CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Pivotal Cloud Foundry (PCF) Ops Manager before version 1.5.14 and 1.6.x before version 1.6.9 uses the same cookie-encryption key across different customers' installations, allowing remote attackers to bypass session authentication.
In PHP before 5.6.26 and 7.x before 7.0.11, there is a vulnerability in ext/spl/spl_array.c that allows SplArray unserialization without validating a return value and data type. This can lead to denial of service or possibly unspecified other impacts via crafted serialized data.
A stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through version 57.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.
The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, allowing remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive.
A use-after-free vulnerability in the wddx_stack_destroy function in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field element, leading to mishandling in a wddx_deserialize call.
In PHP before version 5.6.26, there is an issue with handling object-deserialization failures, which can lead to denial of service due to memory corruption or other unspecified impacts.
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.17, and in Acrobat and Acrobat Reader DC Classic before 15.006.30198, as well as in Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
Adobe Reader and Acrobat before version 11.0.17, and Acrobat and Acrobat Reader DC Classic before version 15.006.30198, as well as Acrobat and Acrobat Reader DC Continuous before version 15.017.20050 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Multiple SQL injection vulnerabilities in the FAQ package in versions 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.
Integer overflow in the MDC2_Update function in OpenSSL before version 1.1.0 may allow remote attackers to cause a denial of service through out-of-bounds write, leading to application crash.
Use-after-free vulnerability in Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code via unspecified vectors.
Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. This is a different vulnerability than CVE-2016-4256, CVE-2016-4257, CVE-2016-4258, CVE-2016-4259, CVE-2016-4260, and CVE-2016-4262.
Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. This is a different vulnerability than CVE-2016-4256, CVE-2016-4257, CVE-2016-4258, CVE-2016-4259, CVE-2016-4261, and CVE-2016-4262.
Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. This is a different vulnerability than CVE-2016-4256, CVE-2016-4258, CVE-2016-4259, CVE-2016-4260, CVE-2016-4261, and CVE-2016-4262.
Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
The BN_bn2dec function in OpenSSL before 1.1.0 does not properly validate division results, which may lead to application crashes or denial of service.
Session fixation vulnerability in Cisco Firepower Management Center and Cisco FireSIGHT System Software through 6.1.0 allows remote attackers to hijack web sessions via a session identifier.