CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Pulse Connect Secure (PCS) versions 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in an unspecified directory via unknown vectors.
Buffer overflow in the Application Specific Packet Filtering (ASPF) functionality in Huawei devices allows remote attackers to cause a denial of service or execute arbitrary code via a crafted packet.
The exif_process_TIFF_in_JPEG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
The exif_process_IFD_in_JPEG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
The exif_process_IFD_TAG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
The grapheme_strpos function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.
The grapheme_stripos function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.
The xml_parse_into_struct function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service through crafted XML data, leading to parser errors.
The bcpowmod function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the global variables _zero_, _one_, or _two_. This may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.
The bcpowmod function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which may lead to denial of service or other unspecified impacts.
Integer overflow in the str_pad function in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer overflow.
Integer overflow in the php_filter_encode_url function in PHP before version 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer overflow.
Integer overflow in the xml_utf8_encode function in PHP before version 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long argument to the utf8_encode function, leading to a heap-based buffer overflow.
A double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to trigger an error, potentially leading to unspecified impact.
In PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12, certain Exception objects are not validated, allowing remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.
In PHP before 5.5.22 and 5.6.x before 5.6.6, when using PHP-FPM, each thread is not isolated from libxml_disable_entity_loader changes in other threads. This allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document.
Multiple integer overflows in the mbfl_strcut function in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 may allow remote attackers to cause application crashes or potentially execute arbitrary code via a crafted mb_strcut call.
Rozszerzenie Phar w PHP przed wersjami 5.5.34, 5.6.20 oraz 7.0.5 zawiera podatność umożliwiającą zdalne wykonanie dowolnego kodu poprzez spreparowaną nazwę pliku. Problem wynika z nieprawidłowego obsługiwania znaków null (\0) w funkcji phar_analyze_path w pliku ext/phar/phar.c.
A format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via format string specifiers in an SNMP::get call.
The kernel component in Symantec Anti-Virus Engine (AVE) 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cause a denial of service via a malformed PE header file.