CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2015-8873 describes a stack consumption vulnerability in zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12. This allows remote attackers to cause a segmentation fault via recursive method calls.
The make_http_soap_request function in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not properly retrieve keys, which may lead to denial of service or potentially arbitrary code execution.
The xsl_ext_function_php function in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when using libxml2 before 2.9.2, does not consider the possibility of a NULL return value, which can lead to application crashes.
The xsl_ext_function_php function in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when using libxml2 before 2.9.2, does not consider the possibility of a NULL return value during initial error checking, leading to errors. This allows remote attackers to cause a denial of service via a crafted XML document.
The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, allowing remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code. These issues are related to the Serializable interface, the SplObjectStorage class, and the SplDoublyLinkedList class, which are mishandled during unserialization.
The phar_convert_to_other function in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 does not validate a file pointer before a close operation, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted TAR archive mishandled in a Phar::convertToData call.
The php_pgsql_meta_data function in the PostgreSQL extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not validate token extraction for table names, which might allow remote attackers to cause a denial of service via a crafted name.
Heap-based buffer overflow in the ftp_genlist function in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command.
The escapeshellarg function in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS commands via a crafted string to an application that accepts command-line arguments for a call to the PHP system function.
The mcopy function in softmagic.c in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not properly restrict a certain offset value, allowing remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string.
The mget function in softmagic.c in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not properly maintain a certain pointer relationship, allowing remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string.
The exception::getTraceAsString function in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.
The __PHP_Incomplete_Class function in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.
PHP versions before 5.6.7 may allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to 'type confusion' issues.
The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to 'type confusion' issues.
The SoapFault::__toString method in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.
CVE-2015-4116 is a use-after-free vulnerability in the spl_ptr_heap_insert function in PHP before 5.5.27 and 5.6.x before 5.6.11. It allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.
PHP versions before 5.6.0 contain a vulnerability in the Fileinfo component that allows remote attackers to cause application crashes via a NULL pointer dereference. This issue occurs in CDF files with a zero root_storage value.
IBM Multi-Enterprise Integration Gateway versions 1.0 through 1.0.0.1 and B2B Advanced Communications versions 1.0.0.2 through 1.0.0.4 do not require HTTPS. This may allow remote attackers to obtain sensitive information by sniffing the network.