CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In FreeType versions before 2.5.4, functions responsible for parsing font matrices do not check return values, which can lead to uninitialized memory access and application crashes.
The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
The DrawImage function in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 contains an incorrect function call, which may lead to buffer overflow and application crash. Remote attackers can exploit this vulnerability by sending a crafted file.
Cisco Prime Network Analysis Module (NAM) and Prime Virtual Network Analysis Module (vNAM) before version 6.1(1) patch.6.1-2-final and 6.2.x before version 6.2(1) have a vulnerability that allows remote attackers to execute arbitrary OS commands via a crafted HTTP request.
AMQP connection handling in Apache Qpid Java before version 6.0.3 may allow remote attackers to bypass authentication, enabling actions related to connection state logging.
Aplikacja webowa Fileserver w Apache ActiveMQ w wersjach 5.x przed 5.14.0 umożliwia zdalnym atakującym przesyłanie i wykonywanie dowolnych plików za pomocą żądania HTTP PUT, a następnie żądania HTTP MOVE.
Sixnet BT-5xxx and BT-6xxx M2M devices before 3.8.21 and 3.9.x before 3.9.8 have hardcoded credentials, allowing remote attackers to gain access via unspecified vectors.
Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier mishandles sessions, allowing remote attackers to bypass authentication and make arbitrary configuration changes.
The server in HP Release Control versions 9.13, 9.20, and 9.21 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
Pulse Connect Secure (PCS) versions 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in an unspecified directory via unknown vectors.
Buffer overflow in the Application Specific Packet Filtering (ASPF) functionality in Huawei devices allows remote attackers to cause a denial of service or execute arbitrary code via a crafted packet.
The exif_process_TIFF_in_JPEG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
The exif_process_IFD_in_JPEG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
The exif_process_IFD_TAG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
The grapheme_strpos function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.
The grapheme_stripos function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.
The xml_parse_into_struct function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service through crafted XML data, leading to parser errors.
The bcpowmod function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the global variables _zero_, _one_, or _two_. This may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.
The bcpowmod function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which may lead to denial of service or other unspecified impacts.