CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer overflow in the str_pad function in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer overflow.
Integer overflow in the php_filter_encode_url function in PHP before version 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer overflow.
Integer overflow in the xml_utf8_encode function in PHP before version 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long argument to the utf8_encode function, leading to a heap-based buffer overflow.
A double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to trigger an error, potentially leading to unspecified impact.
In PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12, certain Exception objects are not validated, allowing remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.
In PHP before 5.5.22 and 5.6.x before 5.6.6, when using PHP-FPM, each thread is not isolated from libxml_disable_entity_loader changes in other threads. This allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document.
Multiple integer overflows in the mbfl_strcut function in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 may allow remote attackers to cause application crashes or potentially execute arbitrary code via a crafted mb_strcut call.
Rozszerzenie Phar w PHP przed wersjami 5.5.34, 5.6.20 oraz 7.0.5 zawiera podatność umożliwiającą zdalne wykonanie dowolnego kodu poprzez spreparowaną nazwę pliku. Problem wynika z nieprawidłowego obsługiwania znaków null (\0) w funkcji phar_analyze_path w pliku ext/phar/phar.c.
A format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via format string specifiers in an SNMP::get call.
The kernel component in Symantec Anti-Virus Engine (AVE) 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cause a denial of service via a malformed PE header file.
VMware Workstation 11.x before 11.1.3 and VMware Player 7.x before 7.1.3 on Windows incorrectly access an executable file, allowing host OS users to gain host OS privileges.
A stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TAR archive.
The make_http_soap_request function in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not properly retrieve keys, which may lead to denial of service or potentially arbitrary code execution.
The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, allowing remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code. These issues are related to the Serializable interface, the SplObjectStorage class, and the SplDoublyLinkedList class, which are mishandled during unserialization.
The phar_convert_to_other function in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 does not validate a file pointer before a close operation, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted TAR archive mishandled in a Phar::convertToData call.
Heap-based buffer overflow in the ftp_genlist function in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command.
The escapeshellarg function in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS commands via a crafted string to an application that accepts command-line arguments for a call to the PHP system function.
The exception::getTraceAsString function in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.
The __PHP_Incomplete_Class function in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.