CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CoreCapture in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
The CFNetwork Proxies subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, and tvOS before 9.2.1 mishandles URLs in http and https requests, allowing remote attackers to obtain sensitive information via unspecified vectors.
Captive Network Assistant in Apple OS X before 10.11.5 mishandles a custom URL scheme, allowing user-assisted remote attackers to execute arbitrary code.
A vulnerability in the audio component of Apple OS X before version 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Apple Type Services (ATS) in Apple OS X before 10.11.5 allows attackers to bypass intended FontValidator sandbox-policy restrictions and execute arbitrary code in a privileged context.
AppleGraphicsPowerManagement in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
The AppleGraphicsControlClient::checkArguments method in AppleGraphicsControl in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
The AMD subsystem in Apple OS X before version 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-1742 describes an untrusted search path vulnerability in the installer of Apple iTunes before version 12.4, allowing local users to gain privileges via a Trojan horse DLL in the current working directory.
The file_check_mem function in funcs.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 mishandles continuation-level jumps. This can lead to application crashes or potentially allow attackers to execute arbitrary code via a crafted magic file.
The kernel component in Symantec Anti-Virus Engine (AVE) 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cause a denial of service via a malformed PE header file.
The guest_walk_tables function in Xen 4.6.x and earlier improperly handles the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory.
VMware Workstation 11.x before 11.1.3 and VMware Player 7.x before 7.1.3 on Windows incorrectly access an executable file, allowing host OS users to gain host OS privileges.
Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks.
The xmlParserEntityCheck and xmlParseAttValueComplex functions in libxml2 2.9.3 do not properly keep track of the recursion depth, allowing context-dependent attackers to cause a denial of service via a crafted XML document containing a large number of nested entity references.
The xmlStringGetNodeList function in libxml2 version 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service through a crafted XML document, leading to infinite recursion, stack consumption, and application crash.
The make_http_soap_request function in PHP before 5.4.44, 5.5.x before 5.5.28, 5.6.x before 5.6.12, and 7.x before 7.0.4 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (type confusion and application crash) via crafted serialized _cookies data.
A stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TAR archive.
CVE-2015-8874 describes a stack consumption vulnerability in the GD library in PHP versions prior to 5.6.12, allowing remote attackers to cause a denial of service via a crafted imagefilltoborder call.