CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cisco Unified Computing System (UCS) Central Software 1.3(1b) and earlier allows remote attackers to execute arbitrary OS commands via a crafted HTTP request.
Integer overflow in the ImagingResampleHorizontal function in Pillow before version 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, leading to a heap-based buffer overflow.
Multiple buffer overflows in xymond/xymond.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a long filename, involving handling a 'config' command.
In Git versions before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, there is a vulnerability that does not properly restrict allowed protocols in remote helper programs. This may allow remote attackers to execute arbitrary code via a URL in a .gitmodules file or other unknown sources in a submodule.
Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with 'illegal options.'
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before version 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.
The Sync Process in the JavaScript API for Creative Cloud Libraries in Adobe Creative Cloud Desktop Application before version 3.6.0.244 allows remote attackers to read or write to arbitrary files via unspecified vectors.
Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to execute arbitrary code on the host OS via a crafted application.
Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to cause a denial of service (device crash) or possibly execute arbitrary code via an SSL VPN request.
The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.
Apache OFBiz versions 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, allowing remote attackers to bypass authentication by leveraging knowledge of a valid username.
The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowser or (2) api/showSB.
Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to execute arbitrary code via a large number of languages in an EPOC installation file of type SIS_FILE_MULTILANG.
Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via vectors related to the 'Authenticate buddy' menu item.
The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.
The brin_page_type and brin_metapage_info functions in the pageinspect extension in PostgreSQL before version 9.5.2 allow attackers to bypass intended access restrictions. Consequently, they can obtain sensitive server memory information or cause a denial of service (server crash) via a crafted bytea value in a BRIN index page.
A heap-based buffer overflow in the SEAS module in Kamailio before version 4.3.5 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a large SIP packet.
The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.
SPIP versions 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allow remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.