CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Cisco ACE30 Application Control Engine module and ACE 4700 appliances running A5 3.3 are vulnerable to a remote denial of service (device reload) via crafted SSL or TLS packets.
CVE-2016-6371 describes a vulnerability in the web interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) version 10.6(3) and earlier, allowing remote attackers to write to arbitrary files via a crafted URL.
In PHP 7.x before 7.0.10, when open_basedir is enabled, there is an issue with handling huge realloc operations, which can lead to integer overflow and potentially cause a denial of service.
In PHP before 5.6.25 and 7.x before 7.0.10, a vulnerability allows remote attackers to cause application crashes via an invalid wddxPacket XML document during a wddx_deserialize call. This is demonstrated by a stray element inside a boolean element, leading to NULL pointer dereference.
In PHP before version 5.6.25 and 7.x before 7.0.10, a vulnerability allows remote attackers to cause a denial of service through a malformed wddxPacket XML document. This leads to a NULL pointer dereference and application crash.
The php_wddx_pop_element function in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service via NULL pointer dereference, leading to application crash. This issue occurs with an invalid base64 binary value in a wddxPacket XML document.
In PHP before 5.6.25 and 7.x before 7.0.10, there is a vulnerability that skips invalid session names, leading to incorrect parsing. This allows remote attackers to inject arbitrary session data by controlling a session name.
The HTTP framework on Cisco SPA300, SPA500, and SPA51x devices allows remote attackers to cause a denial of service (device outage) via a series of malformed HTTP requests.
The Java Debug Wire Protocol (JDWP) implementation in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, allowing attackers to gain privileges via a crafted application.
In Android 7.0 before September 1, 2016, the SettingsProvider.java file does not properly enforce the DISALLOW_CONFIG_VPN setting, allowing attackers to bypass an intended always-on VPN state via a crafted application.
Debuggerd in Android versions 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles the interaction between PTRACE_ATTACH operations and thread exits, allowing attackers to gain privileges via a crafted application.
The Qualcomm Wi-Fi driver in Android before 2016-09-05 on Nexus 5X devices has a vulnerability related to improper validation of the arguments array. Attackers can gain privileges via a crafted application that sends a WE_UNIT_TEST_CMD command.
The NVIDIA kernel in Android before 2016-09-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application.
Buffer overflow in SoftVPX.cpp in libstagefright in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, 2016-09-01 for 6.x, and 2016-09-01 for 7.0 allows attackers to gain privileges via a crafted application.
Multiple buffer overflows in SoftMP3.cpp in libstagefright in mediaserver in Android before version 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allow attackers to gain privileges via a crafted application.
The omx/SimpleSoftOMXComponent.cpp file in libstagefright in mediaserver in Android contains a vulnerability that does not prevent input-port changes. This allows attackers to gain privileges via a crafted application.
The Broadcom Wi-Fi driver in Android before 2016-09-05 on Nexus 5, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, and Pixel C devices allows attackers to gain privileges via a crafted application.
The Qualcomm power driver in Android before 2016-09-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application.
The Qualcomm IPA driver in Android before 2016-09-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application.
The Qualcomm sound driver in Android before 2016-09-05 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application.