CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An XXE vulnerability in the SqlXmlUtil code in Apache Derby before version 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service via vectors involving XmlVTI and the XML datatype.
The qstr method in the PDO driver in the ADOdb Library for PHP before version 5.20.7 may allow remote attackers to conduct SQL injection attacks due to incorrect quoting.
CoreResponseStateManager in Apache MyFaces Trinidad versions 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 may allow attackers to conduct deserialization attacks via a crafted serialized view state string.
A stack-based buffer overflow in the extractTree function in unADF allows remote attackers to execute arbitrary code via a long pathname.
Virtual servers in F5 BIG-IP systems in versions 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2, when configured with HTTP Explicit Proxy functionality or SOCKS profile, allow remote attackers to modify system configuration, read system files, and possibly execute arbitrary code via unspecified vectors.
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a hostname with an escaped trailing dot.
Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.
Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before version 242 and in UAA, Elastic Runtime, and Ops Manager allow remote attackers to hijack the authentication of unspecified victims for requests that approve or deny a scope.
The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, allowing remote attackers to execute arbitrary Java code by registering MBeans.
Integer overflow in the gdImageWebpCtx function in the GD Graphics Library (libgd) through version 2.2.3, used in PHP through version 7.0.11, can lead to denial of service (heap-based buffer overflow) or other unspecified impacts via crafted imagewebp and imagedestroy calls.
The server in Red Hat JBoss Operations Network (JON) allows remote attackers to execute arbitrary code via a crafted HTTP request when SSL authentication is not configured for server/agent communication. This vulnerability exists due to an incomplete fix for CVE-2016-3737.
An unspecified function in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands via unknown vectors.
The statem/statem.c file in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, allowing remote attackers to cause a denial of service (use-after-free) or possibly execute arbitrary code via a crafted TLS session.
Use-after-free vulnerability in Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code via unspecified vectors. This is a different vulnerability than CVE-2016-4263.
OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), as well as Murano-dashboard and python-muranoclient, improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files. This allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions.
The parse_string function in the cJSON library mishandles UTF8/16 strings, allowing remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, triggering a heap-based buffer overflow.
WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
In Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, a vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 does not protect applications from untrusted CGI client data in the HTTP_PROXY environment variable. This may allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request.
The xpointer.c file in libxml2 before version 2.9.5 does not forbid namespace nodes in XPointer ranges, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted XML document.