CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, allowing remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive.
A use-after-free vulnerability in the wddx_stack_destroy function in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field element, leading to mishandling in a wddx_deserialize call.
In PHP before version 5.6.26 and 7.x before 7.0.11, there is a vulnerability that does not verify that a BIT field has the UNSIGNED_FLAG flag. This can lead to remote denial of service (heap-based buffer overflow) or possibly other unspecified impacts via crafted field metadata.
In PHP before version 5.6.26, there is an issue with handling object-deserialization failures, which can lead to denial of service due to memory corruption or other unspecified impacts.
Cisco WebEx Meetings Server version 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script.
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.17, and in Acrobat and Acrobat Reader DC Classic before 15.006.30198, as well as in Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.17, and Acrobat and Acrobat Reader DC Classic before version 15.006.30198, as well as Acrobat and Acrobat Reader DC Continuous before version 15.017.20050 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Cisco AsyncOS through version 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturation) by making many HTTP requests for overlapping byte ranges simultaneously.
Multiple SQL injection vulnerabilities in the FAQ package in versions 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.
Adobe AIR SDK and Compiler before version 23.0.0.257 on Windows does not support Android runtime-analytics transport security, which might allow remote attackers to obtain sensitive information.
Integer overflow in the MDC2_Update function in OpenSSL before version 1.1.0 may allow remote attackers to cause a denial of service through out-of-bounds write, leading to application crash.
The tls_decrypt_ticket function in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, allowing remote attackers to cause a denial of service via a ticket that is too short.
Use-after-free vulnerability in Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code via unspecified vectors.
Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. This is a different vulnerability than CVE-2016-4256, CVE-2016-4257, CVE-2016-4258, CVE-2016-4259, CVE-2016-4260, and CVE-2016-4262.
Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. This is a different vulnerability than CVE-2016-4256, CVE-2016-4257, CVE-2016-4258, CVE-2016-4259, CVE-2016-4261, and CVE-2016-4262.
Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. This is a different vulnerability than CVE-2016-4256, CVE-2016-4258, CVE-2016-4259, CVE-2016-4260, CVE-2016-4261, and CVE-2016-4262.
Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.