CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the GD Graphics Library (libgd) before version 2.2.0, there is a vulnerability that allows attackers to obtain sensitive information from process memory or cause application crashes via a long name.
In PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2, there is a flaw in fpm_log.c that misinterprets the return value of snprintf. This can lead to the disclosure of sensitive information from process memory or denial of service via out-of-bounds read and buffer overflow.
A double free vulnerability in the SplDoublyLinkedList::offsetSet function in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.
Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.
Conscrypt in Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, allowing remote attackers to execute arbitrary code via unspecified vectors.
libmedia in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 has certain incorrect declarations, which allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
The ih264d decoder in mediaserver in Android 6.x before 2016-08-01 mishandles slice numbers, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Integer overflow in h264bsd_dpb.c in libstagefright in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Buffer overflow in the Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices allows remote attackers to execute arbitrary code via a crafted Information Element in an 802.11 management frame.
CVE-2016-4999 is a SQL injection vulnerability in the getStringParameterSQL method in Dashbuilder before version 0.6.0.Beta1. It allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the Data Set Authoring or Displayer editor UI.
The multi-tenant database container feature in SAP HANA does not properly encrypt communications, allowing remote attackers to bypass intended access restrictions.
An unspecified interface in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands with SIDadm privileges via unspecified vectors.
SAP TREX version 7.10 Revision 63 allows remote attackers to write to arbitrary files via vectors related to RFC-Gateway, posing a serious security threat.
SAP TREX version 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, posing a serious security risk.
Directory traversal vulnerability in SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors.
Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service by leveraging keyboard access to use the Alt key during selection of top-level menu items.
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 have a hardcoded password 'admin' for the admin account, making it easier for remote attackers to gain access via the web management interface.
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 use a hardcoded X.509 certificate from OpenSSL Test Certification Authority. This makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions.
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call.
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html.