CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Citrix XenApp versions 6.x before 6.5 HRP07 and 7.x before 7.9, as well as Citrix XenDesktop before 7.9, may allow attackers to weaken an unspecified security mitigation via vectors related to memory permission.
Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.
Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.
A use-after-free vulnerability in DBD::mysql before version 4.029 allows attackers to cause a program crash or potentially execute arbitrary code due to a lost server connection.
A stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before version 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to execute arbitrary code.
The vulnerability in ActiveSyncProvider in Microsoft Windows 10 Gold and 1511 allows attackers to discover credentials by leveraging the failure of Universal Outlook to obtain a secure connection.
SQL injection vulnerability in Moxa SoftCMS before version 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified fields.
The TSC driver for Linux kernel 3.x has a vulnerability that allows attackers to cause a denial of service through an invalid pointer dereference. This can be achieved via a crafted application that makes a TSC_GET_CARD_STATUS ioctl call.
The vfe31_proc_general function in the MSM-VFE31 driver for Linux kernel 3.x does not validate a certain id value, allowing attackers to gain privileges or cause a denial of service (memory corruption) via an application making a crafted ioctl call.
Multiple unspecified vulnerabilities in Google Chrome before version 52.0.2743.116 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before version 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter. This allows remote attackers to bypass intended access restrictions via a crafted URL.
The Developer Tools (DevTools) subsystem in Blink, used in Google Chrome before version 52.0.2743.116, mishandles the script-path hostname, remoteBase, and remoteFrontendUrl parameters. This allows remote attackers to bypass intended access restrictions via a crafted URL.
The Web Cryptography API (WebCrypto) implementation in Blink, used in Google Chrome before version 52.0.2743.116, does not properly copy data buffers. This may allow remote attackers to cause a denial of service (use-after-free) or potentially have unspecified other impact via crafted JavaScript code.
A heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc function in j2k.c in OpenJPEG allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JPEG 2000 data.
The zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data containing a ZipArchive object.
A double free vulnerability in the php_wddx_process_data function in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.
In spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23, there is an improper interaction with the unserialize implementation and garbage collection, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data.
Integer overflow in the SplFileObject::fread function in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer argument.
Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the mcrypt_generic and mdecrypt_generic functions.
A double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.