CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The DRMExtractor.cpp file in libstagefright in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016, does not validate a certain offset value. This allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
In libstagefright in mediaserver in Android 6.x before 2016-07-01, a certain section length is not validated, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The Qualcomm GPU driver in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application.
The Qualcomm USB driver in Android before 2016-07-05 on Nexus 5X and 6P devices contains a vulnerability that allows attackers to gain privileges via a large size in a GSER_IOCTL ioctl call.
The Qualcomm camera driver in Android before 2016-07-05 on Nexus 5X, 6, 6P, and 7 (2013) allows attackers to gain privileges via a crafted application.
The MSM QDSP6 audio driver for Linux kernel 3.x allows attackers to gain privileges or cause a denial of service via a crafted application performing AUDIO_EFFECTS_WRITE or AUDIO_EFFECTS_READ operations.
The MSM graphics driver for Linux kernel 3.x has a flaw related to improper handling of the KGSL_MEMFLAGS_GPUREADONLY flag. This allows attackers to gain privileges by leveraging accidental read-write mappings.
In Qualcomm components in Android before July 5, 2016, on Nexus 5X and 6P devices, there is a vulnerability that allows attackers to bypass intended access restrictions via a digest with trailing data.
Multiple integer overflows in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allow attackers to bypass intended access restrictions via a crafted image.
In Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices, certain GUID Partition Table (GPT) data is not validated. This allows attackers to bypass intended access restrictions via a crafted MultiMediaCard (MMC).
The aboot implementation in Qualcomm components in Android before 2016-07-05 on Nexus 6P devices omits the recovery PIN feature, which may lead to unspecified impacts and attack vectors.
Integer overflow in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices allows attackers to bypass intended access restrictions via a crafted block count and block size of a sparse header.
In the Linux kernel before version 3.15-rc5-next-20140519, used in Android before 2016-07-05 on Nexus 5X and 6P devices, there is an issue with mishandling execute-only pages. This allows attackers to gain privileges via a crafted application.
Multiple integer overflows in lib/libfdt/fdt.c in Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allow attackers to gain privileges via a crafted application.
Multiple integer overflows in lib/libfdt/fdt_rw.c in Qualcomm components in Android before 2016-07-05 on Nexus 5 devices allow attackers to gain privileges via a crafted application.
Integer overflow in lib/heap/heap.c in the Qualcomm components in Android before July 5, 2016, on Nexus 5 and 7 (2013) devices allows attackers to gain privileges via a crafted application.
The makefile in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) omits the -fno-strict-overflow option to gcc, which might allow attackers to gain privileges via a crafted application that leverages incorrect compiler optimization of an integer-overflow protection mechanism.
In Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices, the page size in the kernel header is not validated, allowing attackers to bypass intended access restrictions via a crafted boot image.
In Qualcomm components in Android before 2016-07-05 on Nexus 5 devices, there is a flaw in app/aboot/aboot.c that does not properly check for integer overflow, allowing attackers to bypass intended access restrictions via crafted start and size values.
In Qualcomm components in Android before 2016-07-05 on Nexus 7 (2013) devices, there is a bug in handling the power-on write-protect feature, allowing attackers to gain privileges via a crafted application.