CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A heap-based buffer overflow in camera drivers in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges via a crafted application.
The Qualcomm components in Android before 2016-07-05 on Nexus 7 (2013) devices do not validate addresses before copying data, allowing attackers to gain privileges via a crafted application.
Multiple buffer overflows in diag_debugfs.c in Qualcomm components in Android before July 5, 2016, on Nexus 5 and 7 (2013) devices allow attackers to gain privileges via a crafted application.
In Qualcomm components in Android before July 5, 2016, on Nexus 7 (2013) devices, there is a vulnerability that does not validate certain values. This allows attackers to gain privileges via a crafted application.
In Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices, the direction and step parameters are not validated in msm_actuator.c. This allows attackers to gain privileges via a crafted application.
Buffer overflow in drivers/video/fbcmap.c in Qualcomm components in Android before 2016-07-05 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application.
In Qualcomm components in Android before July 5, 2016, on Nexus 5, 5X, and 6P devices, the start and length values are not validated in mdp3_ctrl.c, allowing attackers to gain privileges via a crafted application.
The Qualcomm components in Android before 2016-07-05 on Nexus 5 devices have a vulnerability that allows attackers to obtain sensitive information from kernel memory via a crafted offset.
The vid_dec_set_h264_mv_buffers function in Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices does not validate the number of buffers, allowing attackers to gain privileges via a crafted application.
The vid_dec_set_meta_buffers function in Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices does not validate the number of buffers, allowing attackers to gain privileges via a crafted application.
Unspecified vulnerability in the Qualcomm components in Android before 2016-07-05 allows attackers to gain privileges via a crafted application.
A stack-based buffer overflow in Apache Xerces-C++ before version 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.
Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.
The API Discovery implementation in IBM WebSphere Application Server (WAS) versions 8.5.5.8 to 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document.
CSRF vulnerability in Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) allows remote authenticated users to hijack the authentication of arbitrary users. This affects versions 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002.
The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintains session ID validity after a logout action, allowing remote authenticated users to hijack sessions by leveraging an unattended workstation.
IBM i Access 7.1 on Windows allows local users to discover registry passwords via unspecified vectors.
Agents in IBM UrbanCode Deploy versions 6.x before 6.0.1.14, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 do not verify a server's identity in a JMS or HTTP session, allowing local users to obtain root access to arbitrary agents via unspecified vectors.
In Samba library versions 4.x before 4.2.14, 4.3.x before 4.3.11, and 4.4.x before 4.4.5, a vulnerability allows man-in-the-middle attackers to bypass a client-signing protection mechanism. This enables spoofing of SMB2 and SMB3 servers.
IBM WebSphere Application Server (WAS) versions 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not set the HTTPOnly flag in the Set-Cookie header for an unspecified JAX-RS API cookie. This makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.