CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In jhead 2.87, used in libjhead in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01, a vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via crafted EXIF data.
libmedia in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 has certain incorrect declarations, which allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
The ih264d decoder in mediaserver in Android 6.x before 2016-08-01 mishandles slice numbers, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Integer overflow in h264bsd_dpb.c in libstagefright in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The Qualcomm GPU driver in Android before 2016-08-05 on Nexus 5, 5X, 6, 6P, and 7 (2013) devices allows attackers to gain privileges via a crafted application.
In Android 4.x before version 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before August 1, 2016, there is a vulnerability that allows attackers to increase intent-filter priority via a crafted application.
Buffer overflow in the Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices allows remote attackers to execute arbitrary code via a crafted Information Element in an 802.11 management frame.
The Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices makes incorrect snprintf calls, allowing remote attackers to cause a denial of service (device hang or reboot) via crafted frames.
CVE-2016-4999 is a SQL injection vulnerability in the getStringParameterSQL method in Dashbuilder before version 0.6.0.Beta1. It allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the Data Set Authoring or Displayer editor UI.
Junos OS versions before 12.1X46-D50 on SRX Series devices revert to 'safe mode' after a failed upgrade to 12.1X46, allowing root CLI logins without a password. This may allow local users to gain privileges by leveraging the 'request system software' command with the 'partition' option.
The multi-tenant database container feature in SAP HANA does not properly encrypt communications, allowing remote attackers to bypass intended access restrictions.
SAP HANA DB version 1.00.73.00.389160 allows remote attackers to cause a denial of service (process termination) or execute arbitrary code via vectors related to an IMPORT statement.
An unspecified interface in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands with SIDadm privileges via unspecified vectors.
The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as 'False'. This makes it easier for remote attackers to bypass authentication via a brute force attack.
SAP TREX version 7.10 Revision 63 allows remote attackers to write to arbitrary files via vectors related to RFC-Gateway, posing a serious security threat.
SAP TREX version 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, posing a serious security risk.
Directory traversal vulnerability in SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors.
The Impress tool in Apache OpenOffice 4.1.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read or write) or execute arbitrary code via crafted MetaActions in an ODP or OTP file.
Mozilla Firefox before 48.0 does not properly restrict drag-and-drop (dataTransfer) actions for file: URIs, allowing user-assisted remote attackers to access local files via a crafted web site.
A use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application.