CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier.
A heap-based buffer overflow in the enchant_broker_request_dict function in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.
In readelf.c in PHP versions before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, there is a vulnerability that does not consider that pread calls may read only a subset of available data. This allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.
An unspecified vulnerability in MyBB (MyBulletinBoard) before version 1.8.4 is related to group join request notifications being sent to the wrong group leaders.
The GIF encoder in Byzanz allows remote attackers to cause a denial of service (out-of-bounds heap write and crash) or possibly execute arbitrary code via a crafted Byzanz debug data recording (ByzanzRecording file) to the byzanz-playback command.
Multiple buffer overflows in pbm212030 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted PBM image. These issues are related to stream line data and vectors associated with an internal intermediate heap-based buffer.
The RPC daemon in EMC Isilon OneFS versions 6.5.x and 7.0.x before 7.0.2.13, 7.1.0 before 7.1.0.6, 7.1.1 before 7.1.1.2, and 7.2.0 before 7.2.0.1 allows local users to gain privileges by modifying system files.
A stack-based buffer overflow in the PmBase64Decode function in an unspecified demonstration application in MICROSYS PROMOTIC before version 8.2.19 and PROMOTIC development before version 8.3.2 allows remote attackers to execute arbitrary code by providing a large amount of data.
CVE-2014-5428 describes an unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys versions 4.1 through 6.5. This allows remote attackers to execute arbitrary code by uploading a shell script.
The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, allowing remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network.
SVM in Websense TRITON V-Series appliances before version 8.0.0 allows attackers to upload arbitrary files via unspecified vectors.
Unspecified vulnerability in Websense TRITON AP-EMAIL before version 8.0.0, related to 'Autocomplete Enabled', may lead to unknown impact and attack vectors.
Unspecified vulnerability in Websense TRITON AP-EMAIL before version 8.0.0, related to port 17703, has unknown impact and attack vectors.
Movable Type before 5.2.6 does not properly use the Storable::thaw function, allowing remote attackers to execute arbitrary code via the comment_state parameter.
Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX) Servlet, allowing remote attackers to execute arbitrary code.
The Service Discovery Gateway (mDNS Gateway) in Cisco IOS and IOS XE allows remote attackers to cause a denial of service by sending malformed mDNS UDP packets, leading to device reload.
Cisco IOS versions 12.2, 12.4, 15.0, 15.2, and 15.3 allow remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) TCP packets.
A memory leak in Cisco IOS versions 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service through crafted Common Industrial Protocol (CIP) TCP packets.
Cisco IOS versions 12.2, 12.4, 15.0, 15.2, and 15.3 allow remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) UDP packets.
A memory leak in the TCP input module in Cisco IOS allows remote attackers to cause a denial of service by sending crafted TCP packets. This can lead to memory consumption or device reload.