CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Qualcomm GPU driver in Android before 2016-06-01 on Nexus 5, 5X, 6, 6P, and 7 devices allows attackers to gain privileges via a crafted application.
The Qualcomm sound driver in Android before 2016-06-01 on Nexus 5 devices allows attackers to gain privileges via a crafted application.
The Qualcomm sound driver in Android before 2016-06-01 on Nexus 6 devices allows attackers to gain privileges via a crafted application.
The Qualcomm video driver in Android before 2016-06-01 on Nexus 5, 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application.
libvpx in libwebm in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before June 1, 2016, has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file.
Multiple integer overflows in the h264dec component in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation.
An integer signedness error in the MSM QDSP6 audio driver for Linux kernel 3.x allows attackers to gain privileges or cause a denial of service via a crafted application making an ioctl call.
An integer signedness error in the MSM V4L2 video driver for Linux kernel 3.x allows attackers to gain privileges or cause a denial of service via a crafted application that triggers an msm_isp_axi_create_stream call.
The OpenBlob function in GraphicsMagick before version 1.3.24 and in ImageMagick allows remote attackers to execute arbitrary code by placing a | (pipe) character at the start of a filename.
The XXE (XML External Entity) vulnerability in XmlMapper in the Data format extension for Jackson (jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.
A stack-based buffer overflow in the getaddrinfo function in the GNU C Library (glibc) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion.
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.
CSRF vulnerability in KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allows remote attackers to hijack the authentication of unspecified victims for requests that disclose the contents of a configuration file.
MEDHOST Perioperative Information Management System (PIMS or VPIMS) before version 2015R1 has hardcoded credentials, making it easier for remote attackers to obtain sensitive information via direct requests to the application database server.
The Chef Manage add-on before version 1.12.0 allows remote attackers to execute arbitrary code via crafted serialized data in a cookie.
A vulnerability in the web application for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software fails to check the bounds of input data.
The installation component on Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.3(2f) mishandles binary files, allowing local users to obtain root access via unspecified vectors.
Cisco Access Point devices with software 8.2(102.43) are vulnerable to remote attacks that can lead to denial of service via crafted ARP packets.
EMC NetWorker versions 8.2.1.x and 8.2.2.x before 8.2.2.6 and 9.x before 9.0.0.6 mishandle authentication, allowing remote attackers to execute arbitrary commands by leveraging access to a different NetWorker instance.