CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
There is an integer underflow in the diag driver in Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices. This allows attackers to gain privileges or obtain sensitive information via a crafted application.
The kernel in Android before 2016-08-05 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application.
The LG Electronics bootloader on Nexus 5X devices before 2016-08-05 contains a vulnerability that allows attackers to gain privileges by leveraging access to a privileged process.
Integer overflow in app/aboot/aboot.c in the Qualcomm bootloader in Android before 2016-08-05 on Nexus 5, 5X, 6P, and 7 (2013) devices allows attackers to gain privileges via a crafted header field in a boot image.
The ION driver in Android before 2016-08-05 on Pixel C devices allows attackers to gain privileges via a crafted application.
The NVIDIA media driver in Android before 2016-08-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application.
The NVIDIA media driver in Android before 2016-08-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application.
The Serial Peripheral Interface driver in Android before 2016-08-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application.
The video driver in the kernel in Android before 2016-08-05 on Nexus 5 devices allows attackers to gain privileges via a crafted application.
A vulnerability in mediaserver in Android before 2016-08-05 on Nexus 9 and Pixel C devices allows attackers to gain privileges via a crafted application.
Android before 2016-08-05 does not properly restrict code execution in a kernel context, allowing attackers to gain privileges via a crafted application.
The Qualcomm GPU driver in Android before 2016-08-05 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application.
Conscrypt in Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, allowing remote attackers to execute arbitrary code via unspecified vectors.
The Shell component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not properly manage the MANAGE_USERS and CREATE_USERS permissions, allowing attackers to bypass intended access restrictions via a crafted application.
The framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 do not ensure that package data originated from the Package Manager, allowing attackers to bypass an unspecified protection mechanism via a crafted application.
The telephony component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows remote attackers to cause a device crash via a mishandled NITZ time value of 2038-01-19 or later.
The Effects.cpp file in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before August 1, 2016, does not validate the reply size for an AudioFlinger effect command. This allows attackers to gain privileges via a crafted application.
In Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before August 1, 2016, a memory allocation error in omx_video_base.cpp in mm-video-v4l2/vidc/venc allows attackers to gain privileges via a crafted application.
The OMXNodeInstance.cpp file in libstagefright in mediaserver in Android versions before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the buffer port, allowing attackers to gain privileges via a crafted application.
The secure-session feature in the mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 mishandles heap pointers, allowing attackers to gain privileges via a crafted application.