CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The IPv6 stack in the Linux kernel before version 4.3.3 mishandles options data, allowing local users to gain privileges or cause a denial of service via a crafted sendmsg system call.
The trace_writeback_dirty_page implementation in the Linux kernel before version 4.4 improperly interacts with mm/migrate.c, allowing local users to cause a denial of service through NULL pointer dereference and system crash.
netd in Android before 2016-08-05 mishandles tethering and stdio streams, allowing attackers to cause a denial of service or possibly have unspecified other impact via a crafted application.
In Qualcomm components in Android before 2016-08-05, there is a vulnerability that does not validate a certain count parameter. This allows attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted application.
In Qualcomm components in Android before 2016-08-05, there is a vulnerability in msm_mctl_buf.c that does not validate the image mode. This can lead to denial of service (out-of-bounds array access) or other unspecified impacts via a crafted application.
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, there is no verification of mapping existence before proceeding with an unmap operation. This allows attackers to gain privileges via a crafted application.
In Qualcomm components in Android before 2016-08-05 on Nexus 6 devices, the stream state is not validated in msm_cpp.c, allowing attackers to gain privileges via a crafted application.
The Qualcomm components in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices have an issue with improper validation of array indexes, allowing attackers to gain privileges via a crafted application.
Integer overflow in q6lsm.c in Qualcomm components in Android before 2016-08-05 on Nexus 6 devices allows attackers to gain privileges via a crafted application.
In Qualcomm components in Android before 2016-08-05 on Nexus 7 (2013) devices, r stages, g stages, or b stages data is not validated, allowing attackers to gain privileges via a crafted application.
The MSM camera driver in Qualcomm components in Android before 2016-08-05 on Nexus 6 devices does not validate input parameters, allowing attackers to gain privileges via a crafted application.
In Qualcomm components in Android before 2016-08-05 on Nexus 5, 6, and 7 (2013) devices, a bug in socket process handling allows attackers to gain privileges via a crafted application.
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, certain buffer addresses are not validated, allowing attackers to gain privileges via a crafted application that makes an ioctl call.
Off-by-one error in Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges via a crafted application that sends an I2C command.
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, CPP frame messages are not validated, allowing attackers to gain privileges via a crafted application.
In the Linux kernel before version 3.13 on ARM platforms, used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, executable DMA mappings are not prevented. This may allow local users to gain privileges via a crafted application.
In Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, certain length values are not validated, allowing attackers to gain privileges via a crafted application.
In Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, there is a vulnerability that improperly validates input parameters. This allows attackers to gain privileges via a crafted application.
CVE-2014-9885 describes a format string vulnerability in drivers/thermal/qpnp-adc-tm.c in Qualcomm components in Android before 2016-08-05 on Nexus 5 devices. This allows attackers to gain privileges via a crafted application that provides format string specifiers in a name.
In Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, certain pointers are not validated, allowing attackers to gain privileges via a crafted application.