CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Web Cryptography API (WebCrypto) implementation in Blink, used in Google Chrome before version 52.0.2743.116, does not properly copy data buffers. This may allow remote attackers to cause a denial of service (use-after-free) or potentially have unspecified other impact via crafted JavaScript code.
A heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc function in j2k.c in OpenJPEG allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JPEG 2000 data.
The zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data containing a ZipArchive object.
A double free vulnerability in the php_wddx_process_data function in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.
In spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23, there is an improper interaction with the unserialize implementation and garbage collection, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data.
Integer overflow in the SplFileObject::fread function in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer argument.
Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the mcrypt_generic and mdecrypt_generic functions.
A double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.
In the GD Graphics Library (libgd) before version 2.2.0, there is a vulnerability that allows attackers to obtain sensitive information from process memory or cause application crashes via a long name.
In PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2, there is a flaw in fpm_log.c that misinterprets the return value of snprintf. This can lead to the disclosure of sensitive information from process memory or denial of service via out-of-bounds read and buffer overflow.
A double free vulnerability in the SplDoublyLinkedList::offsetSet function in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.
Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.
Conscrypt in Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, allowing remote attackers to execute arbitrary code via unspecified vectors.
libmedia in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 has certain incorrect declarations, which allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
The ih264d decoder in mediaserver in Android 6.x before 2016-08-01 mishandles slice numbers, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Integer overflow in h264bsd_dpb.c in libstagefright in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Buffer overflow in the Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices allows remote attackers to execute arbitrary code via a crafted Information Element in an 802.11 management frame.
CVE-2016-4999 is a SQL injection vulnerability in the getStringParameterSQL method in Dashbuilder before version 0.6.0.Beta1. It allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the Data Set Authoring or Displayer editor UI.
The multi-tenant database container feature in SAP HANA does not properly encrypt communications, allowing remote attackers to bypass intended access restrictions.
An unspecified interface in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands with SIDadm privileges via unspecified vectors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS