CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Qualcomm components in Android before 2016-07-05 on Nexus 5 devices, there is a bug related to the use of an incorrect integer data type in ipc_router.c. This allows attackers to gain privileges via a crafted application.
In Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices, pointers used in read and write operations are not validated. This allows attackers to gain privileges via a crafted application.
The alloc and free APIs in arch/arm/mach-msm/qdsp6v2/msm_audio_ion.c in Qualcomm components in Android before 2016-07-05 on Nexus 5 devices do not validate parameters, allowing attackers to gain privileges via a crafted application.
Multiple buffer overflows in the voice drivers in Qualcomm components in Android before 2016-07-05 on Nexus 5 devices allow attackers to gain privileges via a crafted application.
Integer overflow in drivers/misc/qseecom.c in Qualcomm components in Android before 2016-07-05 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application.
A heap-based buffer overflow in camera drivers in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges via a crafted application.
The Qualcomm components in Android before 2016-07-05 on Nexus 7 (2013) devices do not validate addresses before copying data, allowing attackers to gain privileges via a crafted application.
Multiple buffer overflows in diag_debugfs.c in Qualcomm components in Android before July 5, 2016, on Nexus 5 and 7 (2013) devices allow attackers to gain privileges via a crafted application.
In Qualcomm components in Android before July 5, 2016, on Nexus 7 (2013) devices, there is a vulnerability that does not validate certain values. This allows attackers to gain privileges via a crafted application.
In Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices, the direction and step parameters are not validated in msm_actuator.c. This allows attackers to gain privileges via a crafted application.
Buffer overflow in drivers/video/fbcmap.c in Qualcomm components in Android before 2016-07-05 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application.
In Qualcomm components in Android before July 5, 2016, on Nexus 5, 5X, and 6P devices, the start and length values are not validated in mdp3_ctrl.c, allowing attackers to gain privileges via a crafted application.
The Qualcomm components in Android before 2016-07-05 on Nexus 5 devices have a vulnerability that allows attackers to obtain sensitive information from kernel memory via a crafted offset.
The vid_dec_set_h264_mv_buffers function in Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices does not validate the number of buffers, allowing attackers to gain privileges via a crafted application.
The vid_dec_set_meta_buffers function in Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices does not validate the number of buffers, allowing attackers to gain privileges via a crafted application.
Unspecified vulnerability in the Qualcomm components in Android before 2016-07-05 allows attackers to gain privileges via a crafted application.
A stack-based buffer overflow in Apache Xerces-C++ before version 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.
Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.
The API Discovery implementation in IBM WebSphere Application Server (WAS) versions 8.5.5.8 to 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document.
CSRF vulnerability in Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) allows remote authenticated users to hijack the authentication of arbitrary users. This affects versions 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002.