CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The MPEG4Extractor::parseChunk function in libstagefright in Android before version 5.1.1 LMY48I does not properly restrict size addition, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted MPEG-4 tx3g atom.
Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before version 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms.
Integer overflow in the SampleTable::setSampleToChunkParams function in libstagefright in Android before version 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication.
Integer overflow in the Bitmap_createFromParcel function in Android before version 5.1.1 LMY48I can lead to system_server crashes or disclosure of sensitive system_server memory content via a crafted application.
Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before version 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service via a crafted application.
Integer overflow in SampleTable.cpp in libstagefright in Android before version 5.0.0 may lead to unspecified impact and attack vectors.
Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors.
Integer overflow in SampleTable.cpp in libstagefright in Android before version 5.0.0 may lead to unspecified impacts and attack vectors.
Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in a RETR command.
Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a RETR command.
CVE-2015-7601 is a directory traversal vulnerability in PCMan's FTP Server 2.0.7 that allows remote attackers to read arbitrary files via a ..// (dot dot double slash) in a RETR command.
The Appointment Booking Calendar plugin for WordPress before version 1.1.8 contains an SQL injection vulnerability in the cpabc_appointments_admin_int_calendar_list.inc.php file. This allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.
CVE-2015-5074 describes an incomplete blacklist vulnerability in the FileUploadsFilter class in X2Engine X2CRM before version 5.0.9, allowing remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension.
Buffer overflow in the DumpSysVar function in var.c in Remind before version 3.1.15 allows attackers to have unspecified impact via a long name.
Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before version 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
The h5ai before version 0.25.0 has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
ZOHO ManageEngine EventLog Analyzer version 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do.
Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the NEW_PASSWORD_1 or NEW_PASSWORD_2 parameter to cgi-bin/chpasswd.cgi.
SQL injection vulnerability in install.php in Web Reference Database (refbase) version 0.9.6 allows remote attackers to execute arbitrary SQL commands via the defaultCharacterSet parameter.
Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (refbase) version 0.9.6 allow remote attackers to execute arbitrary PHP code via the pathToMYSQL or databaseStructureFile parameters.