CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Synaptics touchscreen driver in Android before 2016-09-05 on Nexus 5X and 9 devices allows attackers to gain privileges via a crafted application.
The Qualcomm radio interface layer in Android before 2016-09-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application.
Multiple stack-based buffer overflows in the AVCC reassembly implementation in libstagefright in Android allow remote attackers to execute arbitrary code via a crafted media file.
The media/ExifInterface.java file in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before September 1, 2016, has an issue with the interaction with static variables in libjhead_jni. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
LibUtils in Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, allowing remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file.
The Qualcomm camera driver in Android before 2016-09-05 on Nexus 5, 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application.
Buffer overflow in Qualcomm drivers in Android before 2016-09-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application that provides a long string.
In Skia, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, the return values of ChopMonoAtY calls are not properly validated. This may allow remote attackers to cause a denial of service through uninitialized memory access and application crash.
Multiple unspecified vulnerabilities in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The EditingStyle::mergeStyle function in Blink, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties. This may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted website leveraging 'type confusion' in the StylePropertySerializer class.
Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.
Multiple integer overflows in OpenJPEG, used in PDFium in Google Chrome, can lead to denial of service or unspecified other impacts via crafted JPEG 2000 data.
A heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data.
In Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux, there is an issue in event processing that may lead to a denial of service (use-after-free) or other unspecified impacts.
Multiple heap-based buffer overflows in PDFium, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JBig2 image.
The Web Animations implementation in Blink, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux, improperly relies on list iteration. This may allow remote attackers to cause a denial of service (use-after-destruction) or possibly have unspecified other impact via a crafted website.
Integer overflow in the opj_tcd_get_decoded_tile_size function in OpenJPEG, used in PDFium in Google Chrome, may lead to denial of service or other unspecified impacts via crafted JPEG 2000 data.
PDFium in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux mishandles timers, allowing remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted PDF document.
In Blink, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux, there is an issue with the Indexed Database (IndexedDB) API implementation that does not properly restrict key-path evaluation. This can lead to denial of service (use-after-free) or other unspecified impacts via crafted JavaScript code.
The extensions subsystem in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify an associated extension. This allows remote attackers to conduct extension-bindings injection attacks by leveraging script access to a resource that initially has the about:blank URL.