CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
In Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, there is a bug in mediametadataretriever.cpp that mishandles cleared service binders. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
Multiple stack-based buffer underflows in decoder/ih264d_parse_cavlc.c in mediaserver in Android 6.x before 2016-04-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The post_proc/volume_listener.c file in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
In Android 4.x before version 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, the Sonivox component in mediaserver does not check for a negative number of samples, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
A vulnerability in libstagefright in mediaserver in Android allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file. This affects Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016.
There is a stack-based buffer overflow in decoder/impeg2d_vld.c in mediaserver in Android 6.x before 2016-04-01. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
The decoder/impeg2d_dec_hdr.c in mediaserver in Android 6.x before April 1, 2016, has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a certain negative value.
An unspecified media codec in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
A heap-based buffer overflow in Cisco Unified Computing System (UCS) Platform Emulator allows local users to gain privileges via crafted libclimeta.so filename arguments.
Cisco Unified Computing System (UCS) Platform Emulator versions 2.5(2)TS4, 3.0(2c)A, and 3.0(2c)TS9 allow local users to gain privileges via crafted arguments on a ucspe-copy command line.
The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline, which might allow remote attackers to obtain sensitive information from private containers.
Apache Camel versions 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using camel-jetty or camel-servlet as consumers in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
The am_read_post_data function in mod_auth_mellon before version 0.11.1 does not limit the amount of data read, allowing remote attackers to cause a denial of service via a large amount of POST data.
The am_read_post_data function in mod_auth_mellon before version 0.11.1 does not check if the ap_get_client_block function returns an error, allowing remote attackers to cause a denial of service (segmentation fault and process crash) via crafted POST data.
The Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, allowing remote attackers to hijack sessions via a crafted web site.
Junos OS version 14.1X53 before 14.1X53-D30 on QFX Series switches is vulnerable to an attack that can lead to a denial of service (PFE panic) due to a high rate of unspecified VXLAN packets.
In Juniper Junos OS versions before 12.1X46-D45, 12.1X47-D30, 12.3R11, 12.3X48-D25, 13.2R8, 13.3R7, 14.1R6, 14.2R4, 15.1R1, 15.1F2, and 15.1X49-D15, a vulnerability allows local users to gain privileges via crafted combinations of CLI commands and arguments. This is a different vulnerability than CVE-2015-3003, CVE-2014-3816, and CVE-2014-0615.
The rpd daemon in Juniper Junos OS before versions 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D40, 13.3 before 13.3R6, 14.1 before 14.1R4, and 14.2 before 14.2R2, when configured with BGP-based L2VPN or VPLS, allows remote attackers to cause a denial of service (daemon restart) via a crafted L2VPN family BGP update.
Juniper's Junos OS before versions 12.1X44-D60, 12.1X46-D40, 12.1X47-D30, 12.3R11, 12.3X48-D20, 13.2R9, 13.2X51-D39, 13.3R8, 14.1R6, 14.1X53-D30, 14.2R4-S1, 15.1R2, 15.1X49-D30, and 16.1R1 is vulnerable to a denial of service (DoS) attack caused by crafted TCP timestamps. Attackers can exploit this vulnerability to exhaust socket resources.