CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The decoder/ih264d_process_intra_mb.c file in mediaserver in Android 6.x before 2016-07-01 mishandles intra mode, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The H.264 decoder in mediaserver in Android 6.x before 2016-07-01 does not initialize certain slice data, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The DRMExtractor.cpp file in libstagefright in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016, does not validate a certain offset value. This allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The REST plugin in Apache Struts 2 versions 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
The usbip_recv_xbuff function in the Linux kernel before version 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet.
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets.
phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 do not properly choose delimiters, which may allow remote attackers to execute arbitrary PHP code via a crafted string.
In phpMyAdmin versions 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3, there is an SQL injection vulnerability in libraries/central_columns.lib.php. Remote attackers can execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.
A stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11997 and 9.4.x before 9.4 HF 12815 allows remote attackers to execute arbitrary code via a long MacroName argument.
Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrary code. The attack can be carried out through various properties and arguments in specific DLLs.
Apple AirPort Base Station firmware before 7.6.7 and 7.7.x before 7.7.7 misparses DNS data, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Cisco Prime Collaboration Provisioning 10.6 SP2 mishandles LDAP authentication, allowing remote attackers to obtain administrator privileges via a crafted login attempt.
The API in Cisco Prime Infrastructure versions 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information via a crafted HTTP request.
The IBM Watson Developer Cloud services on Bluemix platforms do not properly generate random numbers for service-instance credentials, making it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec products that may lead to unauthorized access or execution of malicious code.
It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. This allowed an attacker to bypass security restrictions and send and receive messages within the cluster.
SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before 9.1.2.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The handle_regservice_request function in mDNSResponder before version 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.
Multiple buffer overflows in mDNSResponder before version 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations. The issues involve the GetValueForIPv4Addr, GetValueForMACAddr, rfc3110_import, and CopyNSEC3ResourceRecord functions.
A stack-based buffer overflow in Unitronics VisiLogic OPLC IDE before version 9.8.30 allows remote attackers to execute arbitrary code via a crafted filename field in a ZIP archive in a vlp file.