CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for various requests, such as adding new repositories or editing existing ones.
Rockwell Automation FactoryTalk EnergyMetrix versions before 2.20.00 do not invalidate credentials upon a logout action, making it easier for remote attackers to gain access by leveraging an unattended workstation.
SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before version 2.20.00 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Cisco FireSIGHT System Software versions 5.3.0, 5.3.1, 5.4.0, 6.0, and 6.0.1 allows remote attackers to bypass Snort rules via crafted parameters in the header of an HTTP packet.
The web framework in Cisco Unified Computing System (UCS) Performance Manager 2.0.0 and earlier allows remote authenticated users to execute arbitrary commands via crafted parameters in a GET request.
The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x on OCTEON II CN6xxx hardware on Linux, supporting TLS with Perfect Forward Secrecy (PFS), is vulnerable to a Lenstra side-channel attack, making it easier for remote attackers to obtain private RSA keys.
CA eHealth versions 6.2.x and 6.3.x before 6.3.2.13 allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
CA eHealth 6.2.x allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
Integer overflow in the php_stream_zip_opener function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted zip:// URL.
An integer signedness error in the simplestring_addn function in xmlrpc-epi through version 0.54.2, used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.
In PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, there is an improper interaction between the unserialize implementation and garbage collection, which may allow remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data.
The locale_accept_from_http function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function. This allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.
The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.
The exif_process_IFD_in_MAKERNOTE function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service via out-of-bounds array access and memory corruption. Attackers may also obtain sensitive information from process memory or possibly have unspecified other impact via a crafted JPEG image.
In PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, there is an issue with improper maintenance of a certain hash data structure, which can lead to denial of service (use-after-free) or possibly unspecified other impacts related to session deserialization.
Integer overflow in the virtual_file_ex function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted extract operation on a ZIP archive.
The php_url_parse_ex function in PHP before 5.5.38 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via vectors involving the smart_str data type.
Use-after-free vulnerability in user_script_injector.cc in the Extensions subsystem in Google Chrome before version 52.0.2743.82 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to script deletion.
The Proxy Auto-Config (PAC) feature in Google Chrome before version 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port. This allows remote attackers to discover credentials by operating a server with a PAC script.
The Service Workers subsystem in Google Chrome before version 52.0.2743.82 does not properly implement the Secure Contexts specification, allowing remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME element.