CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Buffer overflow in SoftVPX.cpp in libstagefright in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, 2016-09-01 for 6.x, and 2016-09-01 for 7.0 allows attackers to gain privileges via a crafted application.
Multiple buffer overflows in SoftMP3.cpp in libstagefright in mediaserver in Android before version 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allow attackers to gain privileges via a crafted application.
The omx/SimpleSoftOMXComponent.cpp file in libstagefright in mediaserver in Android contains a vulnerability that does not prevent input-port changes. This allows attackers to gain privileges via a crafted application.
The Broadcom Wi-Fi driver in Android before 2016-09-05 on Nexus 5, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, and Pixel C devices allows attackers to gain privileges via a crafted application.
The Qualcomm power driver in Android before 2016-09-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application.
The Qualcomm IPA driver in Android before 2016-09-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application.
The Qualcomm sound driver in Android before 2016-09-05 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application.
The Synaptics touchscreen driver in Android before 2016-09-05 on Nexus 5X and 9 devices allows attackers to gain privileges via a crafted application.
The Qualcomm radio interface layer in Android before 2016-09-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application.
Multiple stack-based buffer overflows in the AVCC reassembly implementation in libstagefright in Android allow remote attackers to execute arbitrary code via a crafted media file.
The media/ExifInterface.java file in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before September 1, 2016, has an issue with the interaction with static variables in libjhead_jni. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
LibUtils in Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, allowing remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file.
The Qualcomm camera driver in Android before 2016-09-05 on Nexus 5, 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application.
Buffer overflow in Qualcomm drivers in Android before 2016-09-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application that provides a long string.
In Skia, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, the return values of ChopMonoAtY calls are not properly validated. This may allow remote attackers to cause a denial of service through uninitialized memory access and application crash.
Multiple unspecified vulnerabilities in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The EditingStyle::mergeStyle function in Blink, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties. This may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted website leveraging 'type confusion' in the StylePropertySerializer class.
Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.
Multiple integer overflows in OpenJPEG, used in PDFium in Google Chrome, can lead to denial of service or unspecified other impacts via crafted JPEG 2000 data.
A heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data.