CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
All Qualcomm products with Android releases from CAF using the Linux kernel have a missing buffer length validation in a PlayReady DRM routine.
All Qualcomm products with Android releases from CAF using the Linux kernel may experience an issue with disabling asserts, potentially leading to a NULL pointer dereference during an out-of-memory condition.
All Qualcomm products with Android releases from CAF using the Linux kernel have an issue where disabling asserts causes an instruction inside of an assert to not be executed, resulting in incorrect control flow.
All Qualcomm products with Android releases from CAF using the Linux kernel may use an insecure cryptographic algorithm in the GPS client.
All Qualcomm products with Android releases from CAF using the Linux kernel have a buffer overflow vulnerability in the UIMDIAG interface.
In Qualcomm products with Android releases from CAF, there is a potential for an out-of-range pointer offset to be exploited in rollback protection.
SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter.
An unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Although they cannot log in at the front end, they can access Surveillance Station functions using their user SID.
A stack-based buffer overflow in the inet_pton function in musl libc allows attackers to exploit unspecified impacts. This affects versions from 0.9.15 to 1.0.4 and from 1.1.0 to 1.1.7.
D-Link DIR-600 Rev Bx devices with v2.x firmware are vulnerable to a traversal attack that allows remote attackers to read passwords, including the admin password.
Unspecified vulnerability in ASSA ABLOY APTUS Styra Porttelefonkort 4400 before A2 has unknown impact and attack vectors.
The libunrar.a library in versions before 5.5.7 has a buffer overflow in the Unpack::LongLZ function.
The libunrar.a library in UnRAR versions before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function.
The libunrar.a library in versions prior to 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode function, which is called within Archive::ReadHeader15.
A Remote Code Execution vulnerability was identified in all Windows versions of Unity Editor, including before 5.3.8p2, 5.4.x before 5.4.5p5, 5.5.x before 5.5.4p3, 5.6.x before 5.6.3p1, and 2017.x before 2017.1.0p4.
The finish_nested_data function in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can impact the integrity of PHP.
In PHP versions 7.0.x through 7.0.22 and 7.1.x through 7.1.8, there is a vulnerability related to heap use after free when unserializing untrusted data. This issue is related to improper use of the hash API for key deletion in a situation with an invalid array size.
CVE-2017-12910 is an SQL injection vulnerability in massmail.php in NexusPHP 1.5 that allows remote attackers to execute arbitrary SQL commands via the or parameter.
An SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter.
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS