CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
VMware Workstation 11.x before 11.1.3 and VMware Player 7.x before 7.1.3 on Windows incorrectly access an executable file, allowing host OS users to gain host OS privileges.
A stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TAR archive.
The make_http_soap_request function in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not properly retrieve keys, which may lead to denial of service or potentially arbitrary code execution.
The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, allowing remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code. These issues are related to the Serializable interface, the SplObjectStorage class, and the SplDoublyLinkedList class, which are mishandled during unserialization.
The phar_convert_to_other function in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 does not validate a file pointer before a close operation, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted TAR archive mishandled in a Phar::convertToData call.
Heap-based buffer overflow in the ftp_genlist function in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command.
The escapeshellarg function in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS commands via a crafted string to an application that accepts command-line arguments for a call to the PHP system function.
The exception::getTraceAsString function in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.
The __PHP_Incomplete_Class function in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.
PHP versions before 5.6.7 may allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to 'type confusion' issues.
The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to 'type confusion' issues.
The SoapFault::__toString method in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.
CVE-2015-4116 is a use-after-free vulnerability in the spl_ptr_heap_insert function in PHP before 5.5.27 and 5.6.x before 5.6.11. It allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.
Multiple unspecified vulnerabilities in Google Chrome before version 50.0.2661.94 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
In Google Chrome before version 50.0.2661.94, there is a vulnerability in gc_callback.cc that does not prevent fallback execution once the Garbage Collection callback has started. This allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.
Lantronix xPrintServer devices with firmware before version 5.0.1-65 have hardcoded credentials, allowing remote attackers to gain root access via unspecified vectors.
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allow remote attackers to obtain sensitive cleartext information via unspecified vectors.
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to execute arbitrary commands via an 'access command shell-like feature.'
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for 'post-admin' login pages, allowing remote attackers to obtain sensitive information or modify data via unspecified vectors.