CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Cisco ACE30 Application Control Engine module and ACE 4700 appliances running A5 3.3 are vulnerable to a remote denial of service (device reload) via crafted SSL or TLS packets.
Session fixation vulnerability in Cisco Firepower Management Center and Cisco FireSIGHT System Software through 6.1.0 allows remote attackers to hijack web sessions via a session identifier.
CVE-2016-6371 describes a vulnerability in the web interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) version 10.6(3) and earlier, allowing remote attackers to write to arbitrary files via a crafted URL.
In PHP 7.x before version 7.0.10, there is an integer overflow issue in libcurl that can lead to allocation errors and heap-based buffer overflows. Remote attackers can exploit this vulnerability by sending a long string to the curl_escape function.
In PHP 7.x before 7.0.10, when open_basedir is enabled, there is an issue with handling huge realloc operations, which can lead to integer overflow and potentially cause a denial of service.
In PHP before 5.6.25 and 7.x before 7.0.10, a vulnerability allows remote attackers to cause application crashes via an invalid wddxPacket XML document during a wddx_deserialize call. This is demonstrated by a stray element inside a boolean element, leading to NULL pointer dereference.
In PHP before version 5.6.25 and 7.x before 7.0.10, a vulnerability allows remote attackers to cause a denial of service through a malformed wddxPacket XML document. This leads to a NULL pointer dereference and application crash.
The php_wddx_pop_element function in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service via NULL pointer dereference, leading to application crash. This issue occurs with an invalid base64 binary value in a wddxPacket XML document.
The php_wddx_process_data function in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value.
The imagegammacorrect function in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which can lead to denial of service (out-of-bounds write) or other unspecified impacts.
The imagetruecolortopalette function in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which may lead to denial of service or other unspecified impacts.
In PHP before 5.6.25 and 7.x before 7.0.10, there is a vulnerability that skips invalid session names, leading to incorrect parsing. This allows remote attackers to inject arbitrary session data by controlling a session name.
In PHP before 5.6.25 and 7.x before 7.0.10, there is an issue with mishandling certain invalid objects, which may lead to denial of service or other unspecified impacts. Attackers can exploit crafted serialized data, leading to a __destruct call or magic method call.
The HTTP framework on Cisco SPA300, SPA500, and SPA51x devices allows remote attackers to cause a denial of service (device outage) via a series of malformed HTTP requests.
The Java Debug Wire Protocol (JDWP) implementation in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, allowing attackers to gain privileges via a crafted application.
In Android 7.0 before September 1, 2016, the SettingsProvider.java file does not properly enforce the DISALLOW_CONFIG_VPN setting, allowing attackers to bypass an intended always-on VPN state via a crafted application.
Debuggerd in Android versions 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles the interaction between PTRACE_ATTACH operations and thread exits, allowing attackers to gain privileges via a crafted application.
Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.
The Qualcomm Wi-Fi driver in Android before 2016-09-05 on Nexus 5X devices has a vulnerability related to improper validation of the arguments array. Attackers can gain privileges via a crafted application that sends a WE_UNIT_TEST_CMD command.
The NVIDIA kernel in Android before 2016-09-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application.