CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The PORCHE_PAIRING_CONFLICT feature in Bluetooth in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016 allows remote attackers to bypass intended pairing restrictions via a crafted device.
Multiple integer overflows in minzip/SysUtil.c in the Recovery Procedure in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allow attackers to gain privileges via a crafted application.
A race condition in Download Manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016 allows attackers to bypass private-storage file-access restrictions via a crafted application that changes a symlink target.
The Telecom Component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016 allows attackers to spoof the originating telephone number of a call via a crafted application.
The IMemory Native Interface in Android has a vulnerability that improperly considers heap size, allowing attackers to gain privileges via a crafted application.
The Qualcomm RF driver in Android 6.x before 2016-04-01 does not properly restrict access to socket ioctl calls, allowing attackers to gain privileges via a crafted application.
The Qualcomm ARM processor performance-event manager in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016 allows attackers to gain privileges via a crafted application.
The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Multiple stack-based buffer underflows in decoder/ih264d_parse_cavlc.c in mediaserver in Android 6.x before 2016-04-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
There is a stack-based buffer overflow in decoder/impeg2d_vld.c in mediaserver in Android 6.x before 2016-04-01. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
An unspecified media codec in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
A heap-based buffer overflow in Cisco Unified Computing System (UCS) Platform Emulator allows local users to gain privileges via crafted libclimeta.so filename arguments.
Cisco Unified Computing System (UCS) Platform Emulator versions 2.5(2)TS4, 3.0(2c)A, and 3.0(2c)TS9 allow local users to gain privileges via crafted arguments on a ucspe-copy command line.
The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline, which might allow remote attackers to obtain sensitive information from private containers.
Apache Camel versions 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using camel-jetty or camel-servlet as consumers in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
The am_read_post_data function in mod_auth_mellon before version 0.11.1 does not limit the amount of data read, allowing remote attackers to cause a denial of service via a large amount of POST data.
The am_read_post_data function in mod_auth_mellon before version 0.11.1 does not check if the ap_get_client_block function returns an error, allowing remote attackers to cause a denial of service (segmentation fault and process crash) via crafted POST data.
The Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, allowing remote attackers to hijack sessions via a crafted web site.
Junos OS version 14.1X53 before 14.1X53-D30 on QFX Series switches is vulnerable to an attack that can lead to a denial of service (PFE panic) due to a high rate of unspecified VXLAN packets.
In Juniper Junos OS versions before 12.1X46-D45, 12.1X47-D30, 12.3R11, 12.3X48-D25, 13.2R8, 13.3R7, 14.1R6, 14.2R4, 15.1R1, 15.1F2, and 15.1X49-D15, a vulnerability allows local users to gain privileges via crafted combinations of CLI commands and arguments. This is a different vulnerability than CVE-2015-3003, CVE-2014-3816, and CVE-2014-0615.