CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Apple Type Services (ATS) in Apple OS X before 10.11.5 allows attackers to bypass intended FontValidator sandbox-policy restrictions and execute arbitrary code in a privileged context.
AppleGraphicsPowerManagement in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
The AppleGraphicsControlClient::checkArguments method in AppleGraphicsControl in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
The AMD subsystem in Apple OS X before version 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-1742 describes an untrusted search path vulnerability in the installer of Apple iTunes before version 12.4, allowing local users to gain privileges via a Trojan horse DLL in the current working directory.
The file_check_mem function in funcs.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 mishandles continuation-level jumps. This can lead to application crashes or potentially allow attackers to execute arbitrary code via a crafted magic file.
The guest_walk_tables function in Xen 4.6.x and earlier improperly handles the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory.
Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks.
The xmlParserEntityCheck and xmlParseAttValueComplex functions in libxml2 2.9.3 do not properly keep track of the recursion depth, allowing context-dependent attackers to cause a denial of service via a crafted XML document containing a large number of nested entity references.
The xmlStringGetNodeList function in libxml2 version 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service through a crafted XML document, leading to infinite recursion, stack consumption, and application crash.
The make_http_soap_request function in PHP before 5.4.44, 5.5.x before 5.5.28, 5.6.x before 5.6.12, and 7.x before 7.0.4 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (type confusion and application crash) via crafted serialized _cookies data.
CVE-2015-8874 describes a stack consumption vulnerability in the GD library in PHP versions prior to 5.6.12, allowing remote attackers to cause a denial of service via a crafted imagefilltoborder call.
CVE-2015-8873 describes a stack consumption vulnerability in zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12. This allows remote attackers to cause a segmentation fault via recursive method calls.
The xsl_ext_function_php function in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when using libxml2 before 2.9.2, does not consider the possibility of a NULL return value, which can lead to application crashes.
The xsl_ext_function_php function in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when using libxml2 before 2.9.2, does not consider the possibility of a NULL return value during initial error checking, leading to errors. This allows remote attackers to cause a denial of service via a crafted XML document.
The php_pgsql_meta_data function in the PostgreSQL extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not validate token extraction for table names, which might allow remote attackers to cause a denial of service via a crafted name.
The mcopy function in softmagic.c in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not properly restrict a certain offset value, allowing remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string.
The mget function in softmagic.c in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not properly maintain a certain pointer relationship, allowing remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string.
PHP versions before 5.6.0 contain a vulnerability in the Fileinfo component that allows remote attackers to cause application crashes via a NULL pointer dereference. This issue occurs in CDF files with a zero root_storage value.