CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
PHP versions before 5.6.7 may allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to 'type confusion' issues.
The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to 'type confusion' issues.
The SoapFault::__toString method in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.
CVE-2015-4116 is a use-after-free vulnerability in the spl_ptr_heap_insert function in PHP before 5.5.27 and 5.6.x before 5.6.11. It allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.
Multiple unspecified vulnerabilities in Google Chrome before version 50.0.2661.94 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
In Google Chrome before version 50.0.2661.94, there is a vulnerability in gc_callback.cc that does not prevent fallback execution once the Garbage Collection callback has started. This allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.
Lantronix xPrintServer devices with firmware before version 5.0.1-65 have hardcoded credentials, allowing remote attackers to gain root access via unspecified vectors.
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allow remote attackers to obtain sensitive cleartext information via unspecified vectors.
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to execute arbitrary commands via an 'access command shell-like feature.'
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for 'post-admin' login pages, allowing remote attackers to obtain sensitive information or modify data via unspecified vectors.
The Ninja Forms plugin before version 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
Integer overflow in imlib2 before version 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, leading to an out-of-bounds heap memory write operation.
Heap-based buffer overflow in the P-521 reduction function in Botan 1.11.x before 1.11.27 allows remote attackers to cause a denial of service or execute arbitrary code.
Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow.
A use-after-free vulnerability in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.
The setup_snappy_os_mounts function in the ubuntu-core-launcher package before version 1.0.27.1 improperly determines the mount point of bind mounts when using snaps, which might allow remote attackers to obtain sensitive information or gain privileges via a snap with a name starting with 'ubuntu-core.'
Use-after-free vulnerability in Oxide allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors, related to responding synchronously to permission requests.
Serwlet Invoker na platformach SAP NetWeaver Application Server Java, prawdopodobnie przed wersją 7.3, nie wymaga uwierzytelnienia, co pozwala zdalnym atakującym na wykonanie dowolnego kodu za pomocą żądania HTTP lub HTTPS. Atak ten był wykorzystywany w praktyce w latach 2013-2016, znany jako atak 'Detour'.
A use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, and Acrobat and Acrobat Reader DC Classic before 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code.
Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before version 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before version 15.016.20039 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.