CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The Runtime subsystem in Android before version 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, enabling access to Signature or SignatureOrSystem permissions.
Libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
CVE-2015-7686 is an algorithmic complexity vulnerability in the Email-Address module for Perl, specifically in Address.pm, allowing remote attackers to cause a denial of service through a crafted string containing a list of email addresses and parenthesis characters associated with nested comments.
CVE-2015-5652 describes an untrusted search path vulnerability in python.exe in Python through version 3.5.0 on Windows, allowing local users to gain privileges via a malicious readline.pyd file in the current working directory.
The HTTP application on Mitsubishi Electric MELSEC FX3G PLC devices before April 2015 allows remote attackers to cause a denial of service (device outage) via a long parameter.
The arkeiad daemon in the Arkeia Backup Agent in version 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via crafted requests involving the ARKFS_EXEC_CMD operation.
In GLPI before version 0.85.3, there is an unrestricted file upload vulnerability that allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an attachment to a new ticket.
Heap-based buffer overflow in the parse_string function in libs/esl/src/esl_json.c in FreeSWITCH before 1.4.23 and 1.6.x before 1.6.2. A remote attacker can exploit a trailing \u in a JSON string passed to cJSON_Parse, leading to arbitrary code execution.
The Anchor CMS version 0.9.x has a vulnerability that allows remote attackers to conduct PHP object injection attacks. Attackers can execute arbitrary PHP code via a crafted serialized object in a cookie.
IBM QRadar SIEM version 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges by leveraging admin access.
Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unknown vectors.
The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.
Buffer overflow in Canary Labs Trend Web Server before version 9.5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet.
libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.
Directory traversal vulnerability in EMC RSA OneStep 6.9 before build 559 allows remote attackers to read arbitrary files via a crafted KCSOSC_ERROR_PAGE parameter.
A vulnerability in libstagefright in Android through version 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.
Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to (1) ValidateFormAction.do or (2) ProfileConfirmEditAddressAction.do.