CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string.
X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the XRecordStartOfData, XRecordEndOfData, or XRecordClientDied category without a client sequence and with attached data.
Multiple integer overflows in X.org libXtst before version 1.2.3 allow remote X servers to trigger out-of-bounds memory access operations by leveraging the lack of range checks.
The XRenderQueryFilters function in X.org libXrender before version 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths.
Multiple buffer overflows in the XvQueryAdaptors and XvQueryEncodings functions in X.org libXrender before version 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.
The libXrandr library in versions before 1.5.1 allows remote X servers to trigger out-of-bounds write operations by mishandling reply data.
Multiple integer overflows in X.org libXrandr before version 1.5.1 allow remote X servers to trigger out-of-bounds write operations via a crafted response.
LibXi versions before 1.7.7 allow remote X servers to cause a denial of service via an infinite loop involving length fields.
Multiple integer overflows in X.org libXi before version 1.7.7 allow remote X servers to cause a denial of service through out-of-bounds memory access or infinite loops, using length fields.
Integer overflow in X.org libXfixes before version 5.0.3 on 32-bit platforms may allow remote X servers to gain privileges via a length value of INT_MAX, causing the client to stop reading data and get out of sync.
The XListFonts function in X.org libX11 before version 1.6.4 may allow remote X servers to gain privileges via vectors involving length fields, leading to out-of-bounds write operations.
The XGetImage function in X.org libX11 before version 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, leading to out-of-bounds read operations.
The XvQueryAdaptors and XvQueryEncodings functions in libXv before version 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data.
BMC BladeLogic Server Automation (BSA) before 8.7 Patch 3 allows remote attackers to bypass authentication, consequently reading arbitrary files or possibly having unspecified other impact by leveraging a 'logic flaw' in the authentication process.
CVE-2016-6706 is a vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 that allows a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High due to the potential for gaining local access to elevated capabilities not normally accessible to third-party applications.
CVE-2016-6699 is a remote code execution vulnerability in libstagefright in Mediaserver in Android 7.0 before November 1, 2016. An attacker can exploit a specially crafted file to cause memory corruption during media file processing.
The igdkmd64 module in the Intel Graphics Driver through version 15.33.42.435, 15.36.x through 15.36.30.4385, and 15.40.x through 15.40.4404 on Windows allows local users to cause a denial of service (crash) or gain privileges via a crafted D3DKMTEscape request.
A heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 can be exploited by remote attackers. This may lead to denial of service (crash) or disclosure of sensitive information from heap memory.
The ProcPutImage function in X.Org Server before version 1.16.4 allows attackers to cause a denial of service via a zero-height PutImage request, leading to a divide-by-zero error and server crash.
PCRE versions 7.8 through 8.37 and PCRE2 version 10.10 mishandle empty group matches, which may allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression.