CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Android for MSM, Firefox OS for MSM, and QRD Android, a vulnerability related to double free can occur when kmalloc fails to allocate memory for pointers resp/req in the service-locator driver function service_locator_send_msg().
The camera application in Android for MSM has a user-memory-access issue as the Camera CPP module Linux driver directly accesses the application provided buffer. An unchecked userspace value can lead to kernel buffer overflow.
In the ISP Camera driver for Android on MSM, there is a vulnerability that allows the contents of an arbitrary kernel address to be leaked to userspace via the function msm_isp_get_stream_common_data().
In Android for MSM, Firefox OS for MSM, and QRD Android, while flashing UBI image, the size is not validated, leading to an uninitialized data access vulnerability.
In Android for MSM, Firefox OS for MSM, and QRD Android, while flashing FRP partition using reference FRP unlock, the authentication method can be compromised for static keys.
In Android for MSM, Firefox OS for MSM, and QRD Android, a race condition in the function audio_effects_shared_ioctl() can lead to memory corruption.
In Android for MSM, Firefox OS for MSM, and QRD Android, a race condition in the rmnet USB control driver can potentially lead to a Use After Free condition.
In Android for MSM, Firefox OS for MSM, and QRD Android, there is a possibility of out-of-bound buffer accesses due to no synchronization in accessing global variables by multiple threads.
In Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability related to out-of-bounds array access in the camera driver in the kernel.
In Android for MSM, Firefox OS for MSM, and QRD Android, flashing a specially crafted UBI image can lead to memory corruption or access to uninitialized memory.
In Android for MSM, Firefox OS for MSM, and QRD Android, the value of SIR_MAC_AUTH_CHALLENGE_LENGTH is set to 128, which may lead to a buffer overflow. The frame parser allows challenge text of length up to 253 bytes, while the driver cannot handle challenge text larger than 128 bytes.
In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability occurs while parsing a Measurement Request IE in a Roam Neighbor Action Report. This affects all Android releases from CAF using the Linux kernel.
In Android for MSM, Firefox OS for MSM, and QRD Android, with all Android releases using the Linux kernel, the UnpackCore function increases the countOffset variable in each loop iteration without checking the boundary 'pIe->arraybound'.
In Android for MSM, Firefox OS for MSM, and QRD Android, a stack-based buffer overflow vulnerability exists when processing a specially crafted QCA_NL80211_VENDOR_SUBCMD_ENCRYPTION_TEST cfg80211 vendor command.
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
CVE-2017-0866 is a privilege escalation vulnerability in the Direct rendering infrastructure of the NVIDIA Tegra X1, where unchecked input from userspace is passed as a pointer to kfree. This could lead to kernel memory corruption and possible code execution.
VMware AirWatch Launcher for Android prior to 3.2.2 contains a vulnerability that could allow an escalation of privilege from the launcher UI context menu to native UI functionality and privilege. Successful exploitation of this issue could result in an escalation of privilege.
VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add malicious data to an enrolled device's log files. Successful exploitation of this issue could result in an unsuspecting AWC user opening a CSV file which contains malicious content.
An injection issue was discovered in Moxa NPort 5110 (versions 2.2, 2.4, 2.6, 2.7), NPort 5130 (version 3.7 and prior), and NPort 5150 (version 3.7 and prior). An attacker may be able to inject packets that could potentially disrupt the availability of the device.
W urządzeniach Moxa NPort 5110, 5130 i 5150 występuje problem z ujawnieniem informacji związany z obsługą wypełnienia ramek Ethernet. Atakujący może wykorzystać tę lukę do uzyskania dostępu do poufnych informacji.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS