CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL injection vulnerabilities in the FAQ package in versions 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.
Integer overflow in the MDC2_Update function in OpenSSL before version 1.1.0 may allow remote attackers to cause a denial of service through out-of-bounds write, leading to application crash.
Use-after-free vulnerability in Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code via unspecified vectors.
Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. This is a different vulnerability than CVE-2016-4256, CVE-2016-4257, CVE-2016-4258, CVE-2016-4259, CVE-2016-4260, and CVE-2016-4262.
Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. This is a different vulnerability than CVE-2016-4256, CVE-2016-4257, CVE-2016-4258, CVE-2016-4259, CVE-2016-4261, and CVE-2016-4262.
Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. This is a different vulnerability than CVE-2016-4256, CVE-2016-4258, CVE-2016-4259, CVE-2016-4260, CVE-2016-4261, and CVE-2016-4262.
Adobe Digital Editions before version 4.5.2 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
The BN_bn2dec function in OpenSSL before 1.1.0 does not properly validate division results, which may lead to application crashes or denial of service.
Session fixation vulnerability in Cisco Firepower Management Center and Cisco FireSIGHT System Software through 6.1.0 allows remote attackers to hijack web sessions via a session identifier.
In PHP 7.x before version 7.0.10, there is an integer overflow issue in libcurl that can lead to allocation errors and heap-based buffer overflows. Remote attackers can exploit this vulnerability by sending a long string to the curl_escape function.
The php_wddx_process_data function in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value.
The imagegammacorrect function in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which can lead to denial of service (out-of-bounds write) or other unspecified impacts.
The imagetruecolortopalette function in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which may lead to denial of service or other unspecified impacts.
In PHP before 5.6.25 and 7.x before 7.0.10, there is an issue with mishandling certain invalid objects, which may lead to denial of service or other unspecified impacts. Attackers can exploit crafted serialized data, leading to a __destruct call or magic method call.
Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.
Fortinet FortiSwitch models in FortiLink managed mode, when upgraded to version 3.4.1, may allow remote attackers to bypass authentication and gain administrative access via an empty password for the rest_admin account.
J-Web in Juniper Junos OS before versions 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D25, 13.3 before 13.3R10, 13.3R9 before 13.3R9-S1, 14.1 before 14.1R7, 14.1X53 before 14.1X53-D35, 14.2 before 14.2R6, 15.1 before 15.1A2 or 15.1F4, 15.1X49 before 15.1X49-D30, and 15.1R before 15.1R3 might allow remote attackers to obtain sensitive information and consequently gain administrative privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS