CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 rely on the client for authentication, allowing remote attackers to gain access by setting the value of objresp.authenabled to 1.
Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the ATE_COMMAND parameter.
Huawei NE40E, CX600, PTN 6900-2-M8, NE5000E, and CloudEngine 12800 devices with specific software versions are vulnerable to remote attacks. Attackers with control plane access can cause denial of service or execute arbitrary code via crafted packets.
Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, allowing remote attackers to execute arbitrary code via vectors related to XStream Serialization.
The server in Red Hat JBoss Operations Network (JON) before version 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization.
SQL injection vulnerability in the Seed Coupon plugin before version 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The AdminUI in HPE Operations Manager (OM) before version 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before version 2.20.00 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
An integer signedness error in the simplestring_addn function in xmlrpc-epi through version 0.54.2, used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.
In PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, there is an improper interaction between the unserialize implementation and garbage collection, which may allow remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data.
The locale_accept_from_http function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function. This allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.
The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.
The exif_process_IFD_in_MAKERNOTE function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service via out-of-bounds array access and memory corruption. Attackers may also obtain sensitive information from process memory or possibly have unspecified other impact via a crafted JPEG image.
In PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, there is an issue with improper maintenance of a certain hash data structure, which can lead to denial of service (use-after-free) or possibly unspecified other impacts related to session deserialization.
The php_url_parse_ex function in PHP before 5.5.38 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via vectors involving the smart_str data type.
The PPAPI implementation in Google Chrome before version 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come from the browser process. This allows remote attackers to bypass a sandbox protection mechanism via an unexpected message type.
A vulnerability in Siemens SIMATIC WinCC, SIMATIC BATCH, and SIMATIC OpenPCS allows remote attackers to execute arbitrary code via crafted packets. This affects versions before specified updates.
ImageIO in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted xStride and yStride values in an EXR image.
libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.