CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with 'illegal options.'
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before version 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.
The Sync Process in the JavaScript API for Creative Cloud Libraries in Adobe Creative Cloud Desktop Application before version 3.6.0.244 allows remote attackers to read or write to arbitrary files via unspecified vectors.
Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to execute arbitrary code on the host OS via a crafted application.
Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to cause a denial of service (device crash) or possibly execute arbitrary code via an SSL VPN request.
The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.
Apache OFBiz versions 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, allowing remote attackers to bypass authentication by leveraging knowledge of a valid username.
The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowser or (2) api/showSB.
Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to execute arbitrary code via a large number of languages in an EPOC installation file of type SIS_FILE_MULTILANG.
Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via vectors related to the 'Authenticate buddy' menu item.
The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.
The brin_page_type and brin_metapage_info functions in the pageinspect extension in PostgreSQL before version 9.5.2 allow attackers to bypass intended access restrictions. Consequently, they can obtain sensitive server memory information or cause a denial of service (server crash) via a crafted bytea value in a BRIN index page.
A heap-based buffer overflow in the SEAS module in Kamailio before version 4.3.5 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a large SIP packet.
The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.
SPIP versions 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allow remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
Integer overflow in Git before version 2.7.4 allows remote attackers to execute arbitrary code via (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
In git versions before 2.7.4, there is a bug in revision.c that uses an incorrect integer data type. This allows remote attackers to execute arbitrary code via (1) long filenames or (2) many nested trees, leading to a heap-based buffer overflow.
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
A stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY before 0.66.6.3 allows remote servers to cause a denial of service or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.