CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In PHP 7.x before version 7.0.10, there is an integer overflow issue in libcurl that can lead to allocation errors and heap-based buffer overflows. Remote attackers can exploit this vulnerability by sending a long string to the curl_escape function.
The php_wddx_process_data function in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value.
The imagegammacorrect function in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which can lead to denial of service (out-of-bounds write) or other unspecified impacts.
The imagetruecolortopalette function in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which may lead to denial of service or other unspecified impacts.
In PHP before 5.6.25 and 7.x before 7.0.10, there is an issue with mishandling certain invalid objects, which may lead to denial of service or other unspecified impacts. Attackers can exploit crafted serialized data, leading to a __destruct call or magic method call.
Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.
Fortinet FortiSwitch models in FortiLink managed mode, when upgraded to version 3.4.1, may allow remote attackers to bypass authentication and gain administrative access via an empty password for the rest_admin account.
J-Web in Juniper Junos OS before versions 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D25, 13.3 before 13.3R10, 13.3R9 before 13.3R9-S1, 14.1 before 14.1R7, 14.1X53 before 14.1X53-D35, 14.2 before 14.2R6, 15.1 before 15.1A2 or 15.1F4, 15.1X49 before 15.1X49-D30, and 15.1R before 15.1R3 might allow remote attackers to obtain sensitive information and consequently gain administrative privileges.
Multiple unspecified vulnerabilities in HPE Integrated Lights-Out 3 (iLO 3) firmware before 1.88, Integrated Lights-Out 4 (iLO 4) firmware before 2.44, and Integrated Lights-Out 4 (iLO 4) mRCA firmware before 2.32 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service.
Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via 'special characters'. This is a different vulnerability than CVE-2016-7109.
Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via 'special characters'. This is a different vulnerability than CVE-2016-7110.
Huawei XH620 V3, XH622 V3, XH628 V3, RH1288 V3, RH2288 V3, and RH2288H V3 servers with software before V100R003C00SPC610, V100R003C00SPC613, V100R003C00SPC617, and V100R003C00SPC515 are vulnerable to brute-force attacks, allowing remote attackers to obtain passwords due to a lack of authentication protection mechanisms.
A vulnerability in F5 BIG-IP that affects various software versions allows remote attackers to cause a denial of service by restarting the traffic management microkernel when packet filtering is enabled on virtual servers.
A vulnerability has been identified in the EN100 Ethernet module for various firmware variants that are older than specified versions. Attackers with access to the device's web interface may bypass authentication and perform certain administrative operations.
Malware Information Sharing Platform (MISP) before 2.3.90 is vulnerable to PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate_event_from_template_attributes.ctp.
In MISP versions before 2.3.92, the file app/Controller/TemplatesController.php does not properly restrict filenames under the tmp/files/ directory, which may lead to unspecified impacts and attack vectors.
Integer overflow in the get_data function in zipimport.c in CPython before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.
Cisco Small Business 220 devices with firmware before 1.0.1.1 have a hardcoded SNMP community, allowing remote attackers to read or modify SNMP objects by leveraging knowledge of this community.
NUUO NVRmini 2 versions 1.0.0 through 3.0.0 and NUUO NVRsolo versions 1.0.0 through 3.0.0 have hardcoded root credentials, allowing remote attackers to gain administrative access via unspecified vectors.
In NUUO NVRmini 2, NUUO NVRsolo, NUUO Crystal, and NETGEAR ReadyNAS Surveillance, a vulnerability allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.