CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A flaw was found in OpenJPEG where maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.
A flaw was found in the OpenJPEG project where a heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.
In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when user-supplied headers are sent, insufficient validation of end-of-line characters may prevent certain headers from being sent or lead to certain headers being misinterpreted.
In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when receiving headers from an HTTP server, headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.
Vulnerability in CUPS printing system versions 2.4.8 and earlier. When starting the cupsd server with a Listen configuration pointing to a symbolic link, the process can perform an arbitrary chmod on the target file.
In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when requesting an HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect.
Issue in libexpat before version 2.6.4. The XML_ResumeParser function can crash if XML_StopParser stops/suspends an unstarted parser.
Vulnerability in GNU Wget up to version 1.24.5. The url.c function mishandles semicolons in the userinfo component of a URI, potentially leading to misinterpretation of data as part of the host.
Incomplete fix for CVE-2022-31629 in PHP. Network or same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.
Vulnerability in PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5. If a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() incorrectly returns true.
Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows than intended. The attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or equivalent. The problem arises when application queries use partitioning.
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g., PATH). This often suffices for arbitrary code execution, even without a database server OS user account.
Vulnerability in Tar 1.15.1 fails to properly warn users when extracting files with setuid or setgid bits set. This could allow local or remote attackers to escalate privileges.
Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise see.
A flaw was found in Poppler's Pdfinfo utility. Using the -dests parameter with a malformed input file can cause the utility to crash.
In CPython, the email module does not properly quote newlines in email headers during serialization, allowing header injection when an email is serialized. This is a medium severity vulnerability.
The GD Graphics Library (LibGD) through version 2.3.2 has an out-of-bounds read due to the lack of certain gdGetBuf and gdPutBuf return value checks.
Vulnerability in the libppd library used by CUPS. The ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer, potentially leading to buffer overflow or other issues.
An integer overflow vulnerability exists in the Compound Document Binary File format parser of libgsf version v1.14.52. A specially crafted file can cause an integer overflow, leading to a heap-based buffer overflow when processing sector allocation.
A timing side-channel in ECDSA signature computations could potentially allow recovering the private key by an attacker. Measuring timing could lead to private key recovery.