CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The LoadBuffer implementation in Google V8, used in Google Chrome before version 50.0.2661.75, mishandles data types, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds write operation.
In PDFium, used in Google Chrome before version 50.0.2661.75, the sycc420_to_rgb and sycc422_to_rgb functions are not properly implemented, allowing remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted JPEG 2000 data in a PDF document.
In Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, Wi-Fi does not prevent the use of a CA certificate in an unrelated CA role. This allows attackers to gain privileges via a crafted application.
In Android 4.x before 4.4.4, the rootdir/init.rc file does not ensure that the /data/tombstones directory exists for the Debuggerd component. This allows attackers to gain privileges via a crafted application.
The IDrm.cpp file in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure, allowing attackers to obtain sensitive information from process memory.
The IOMX.cpp file in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, allowing attackers to obtain sensitive information from process memory.
The IOMX.cpp file in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016, does not initialize a parameter data structure, allowing attackers to obtain sensitive information from process memory.
The BufferQueueConsumer library in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016, does not check for the android.permission.DUMP permission. This allows attackers to obtain sensitive information and bypass an unspecified protection mechanism via a dump request.
The IOMX.cpp file in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, does not initialize a handle pointer, allowing attackers to gain privileges via a crafted application.
The SkPostConfig.h file in Skia, used in System_server on Android, mishandles certain crashes. This allows attackers to gain privileges via a crafted application.
A Qualcomm video kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver.
A Texas Instruments haptic kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver.
dhcpcd versions before 6.10.0, used in Android 4.x to 6.x, mismanage option lengths, allowing remote attackers to execute arbitrary code or cause a denial of service via a malformed DHCP response.
The PORCHE_PAIRING_CONFLICT feature in Bluetooth in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016 allows remote attackers to bypass intended pairing restrictions via a crafted device.
Multiple integer overflows in minzip/SysUtil.c in the Recovery Procedure in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allow attackers to gain privileges via a crafted application.
A race condition in Download Manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016 allows attackers to bypass private-storage file-access restrictions via a crafted application that changes a symlink target.
The Telecom Component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016 allows attackers to spoof the originating telephone number of a call via a crafted application.
The IMemory Native Interface in Android has a vulnerability that improperly considers heap size, allowing attackers to gain privileges via a crafted application.
The Qualcomm RF driver in Android 6.x before 2016-04-01 does not properly restrict access to socket ioctl calls, allowing attackers to gain privileges via a crafted application.
The Qualcomm ARM processor performance-event manager in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016 allows attackers to gain privileges via a crafted application.