CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in ActiveSyncProvider in Microsoft Windows 10 Gold and 1511 allows attackers to discover credentials by leveraging the failure of Universal Outlook to obtain a secure connection.
SQL injection vulnerability in Moxa SoftCMS before version 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified fields.
The TSC driver for Linux kernel 3.x has a vulnerability that allows attackers to cause a denial of service through an invalid pointer dereference. This can be achieved via a crafted application that makes a TSC_GET_CARD_STATUS ioctl call.
The vfe31_proc_general function in the MSM-VFE31 driver for Linux kernel 3.x does not validate a certain id value, allowing attackers to gain privileges or cause a denial of service (memory corruption) via an application making a crafted ioctl call.
Multiple unspecified vulnerabilities in Google Chrome before version 52.0.2743.116 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before version 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter. This allows remote attackers to bypass intended access restrictions via a crafted URL.
The Developer Tools (DevTools) subsystem in Blink, used in Google Chrome before version 52.0.2743.116, mishandles the script-path hostname, remoteBase, and remoteFrontendUrl parameters. This allows remote attackers to bypass intended access restrictions via a crafted URL.
The Web Cryptography API (WebCrypto) implementation in Blink, used in Google Chrome before version 52.0.2743.116, does not properly copy data buffers. This may allow remote attackers to cause a denial of service (use-after-free) or potentially have unspecified other impact via crafted JavaScript code.
A heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc function in j2k.c in OpenJPEG allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JPEG 2000 data.
The zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data containing a ZipArchive object.
A double free vulnerability in the php_wddx_process_data function in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.
In spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23, there is an improper interaction with the unserialize implementation and garbage collection, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data.
Integer overflow in the SplFileObject::fread function in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer argument.
Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the mcrypt_generic and mdecrypt_generic functions.
A double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.
In the GD Graphics Library (libgd) before version 2.2.0, there is a vulnerability that allows attackers to obtain sensitive information from process memory or cause application crashes via a long name.
In PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2, there is a flaw in fpm_log.c that misinterprets the return value of snprintf. This can lead to the disclosure of sensitive information from process memory or denial of service via out-of-bounds read and buffer overflow.
A double free vulnerability in the SplDoublyLinkedList::offsetSet function in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.
Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.
Conscrypt in Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, allowing remote attackers to execute arbitrary code via unspecified vectors.