CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The IDrm.cpp file in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure, allowing attackers to obtain sensitive information from process memory.
The IOMX.cpp file in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, allowing attackers to obtain sensitive information from process memory.
The IOMX.cpp file in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016, does not initialize a parameter data structure, allowing attackers to obtain sensitive information from process memory.
The BufferQueueConsumer library in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016, does not check for the android.permission.DUMP permission. This allows attackers to obtain sensitive information and bypass an unspecified protection mechanism via a dump request.
dhcpcd versions before 6.10.0, used in Android 4.x to 6.x, mismanage option lengths, allowing remote attackers to execute arbitrary code or cause a denial of service via a malformed DHCP response.
In Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, there is a bug in mediametadataretriever.cpp that mishandles cleared service binders. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
The post_proc/volume_listener.c file in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
In Android 4.x before version 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, the Sonivox component in mediaserver does not check for a negative number of samples, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
A vulnerability in libstagefright in mediaserver in Android allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file. This affects Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016.
The decoder/impeg2d_dec_hdr.c in mediaserver in Android 6.x before April 1, 2016, has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a certain negative value.
An HTTP servlet in vApp Manager in EMC Unisphere for VMAX Virtual Appliance before version 8.2.0 has a vulnerability that allows remote attackers to write to arbitrary files via a crafted pathname.
Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before version 4.0.6 can be exploited by remote attackers.
Cisco Unified Computing System (UCS) Central Software 1.3(1b) and earlier allows remote attackers to execute arbitrary OS commands via a crafted HTTP request.
Integer overflow in the ImagingResampleHorizontal function in Pillow before version 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, leading to a heap-based buffer overflow.
Multiple buffer overflows in xymond/xymond.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a long filename, involving handling a 'config' command.
In Git versions before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, there is a vulnerability that does not properly restrict allowed protocols in remote helper programs. This may allow remote attackers to execute arbitrary code via a URL in a .gitmodules file or other unknown sources in a submodule.
Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with 'illegal options.'
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before version 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.
The Sync Process in the JavaScript API for Creative Cloud Libraries in Adobe Creative Cloud Desktop Application before version 3.6.0.244 allows remote attackers to read or write to arbitrary files via unspecified vectors.
Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to execute arbitrary code on the host OS via a crafted application.