CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.
HPE P9000 Command View Advanced Edition Software (CVAE) versions 7.x and 8.x before 8.4.0-00 and XP7 CVAE versions 7.x and 8.x before 8.4.0-00 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
The validateAdminConfig handler in the Analytics Management Console in HPE Vertica before version 7.0.2.12, 7.1.2-12, and 7.2.2-1 allows remote attackers to execute arbitrary commands via the mcPort parameter.
A stack-based buffer overflow in the catopen function in the GNU C Library (glibc) before version 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.
Integer overflow in the GNU C Library (glibc or libc6) before version 2.23 allows context-dependent attackers to cause application crashes or potentially execute arbitrary code via the size argument to the __hcreate_r function, leading to out-of-bounds heap-memory access.
The strftime function in the GNU C Library (glibc) before version 2.23 allows context-dependent attackers to cause application crashes or possibly obtain sensitive information via an out-of-range time value.
Multiple stack-based buffer overflows in the GNU C Library (glibc) before version 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the nan, nanf, or nanl function.
Multiple unspecified vulnerabilities in Google Chrome before version 50.0.2661.75 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The IDrm.cpp file in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure, allowing attackers to obtain sensitive information from process memory.
The IOMX.cpp file in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, allowing attackers to obtain sensitive information from process memory.
The IOMX.cpp file in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016, does not initialize a parameter data structure, allowing attackers to obtain sensitive information from process memory.
The BufferQueueConsumer library in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016, does not check for the android.permission.DUMP permission. This allows attackers to obtain sensitive information and bypass an unspecified protection mechanism via a dump request.
dhcpcd versions before 6.10.0, used in Android 4.x to 6.x, mismanage option lengths, allowing remote attackers to execute arbitrary code or cause a denial of service via a malformed DHCP response.
In Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, there is a bug in mediametadataretriever.cpp that mishandles cleared service binders. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
The post_proc/volume_listener.c file in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
In Android 4.x before version 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, the Sonivox component in mediaserver does not check for a negative number of samples, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
A vulnerability in libstagefright in mediaserver in Android allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file. This affects Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016.
The decoder/impeg2d_dec_hdr.c in mediaserver in Android 6.x before April 1, 2016, has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a certain negative value.
An HTTP servlet in vApp Manager in EMC Unisphere for VMAX Virtual Appliance before version 8.2.0 has a vulnerability that allows remote attackers to write to arbitrary files via a crafted pathname.
Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before version 4.0.6 can be exploited by remote attackers.