CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A heap-based buffer overflow in Adobe Reader and Acrobat before version 11.0.18, and in Acrobat and Acrobat Reader DC Classic before version 15.006.30243, as well as in Acrobat and Acrobat Reader DC Continuous before version 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, and Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code.
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, and Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code.
Siemens Automation License Manager (ALM) before 5.3 SP3 allows remote attackers to modify files, rename files, create directories, or delete directories via crafted packets.
A use-after-free vulnerability in the __sys_recvmmsg function in the Linux kernel before version 4.5.2 allows remote attackers to execute arbitrary code via mishandled error processing during a recvmmsg system call.
A vulnerability in the Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via a large negative value for the data length.
A vulnerability in the Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted visualizer data length.
A vulnerability in the Qualcomm QDSP6v2 driver in Android before October 5, 2016, allows attackers to cause a denial of service or possibly have unspecified other impact via crafted parameter data.
The Qualcomm QDSP6v2 driver in Android before 2016-10-05 has a vulnerability that allows attackers to cause a denial of service or possibly have unspecified other impact via an invalid data length.
The Qualcomm MDSS driver in Android before 2016-10-05 has a vulnerability that allows attackers to cause a denial of service through invalid pointer access. It may also lead to unspecified other impacts.
The gbk2utf module in Qualcomm Wi-Fi in Android before 2016-10-05 allows remote attackers to cause a framework crash or possibly have unspecified other impact via an access point with a malformed SSID with GBK encoding.
The QDSP6v2 Voice Service driver for Linux kernel 3.x has a vulnerability that allows attackers to cause a denial of service through memory corruption or potentially other unspecified impacts. This issue is demonstrated by a buffer overflow in the voice_svc_send_req function.
Unspecified vulnerability in a Qualcomm component in Android before 2016-10-05 on Nexus 5X and 6P devices. The impact and attack vectors are unknown.
Unspecified vulnerability in a Qualcomm component in Android before 2016-10-05 on Nexus 5X and 6P devices. The impact and attack vectors are unknown.
Unspecified vulnerability in a Qualcomm component in Android before 2016-10-05 on Nexus 5, 5X, 6, and 6P devices. Impact and attack vectors are unknown.
Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.
Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before version 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.
The Zotpress plugin for WordPress contains an SQL Injection vulnerability in the zp_get_account() function. An attacker can exploit this flaw to execute unauthorized queries against the database.
Huge-IT Catalog v1.0.7 for Joomla is vulnerable to unauthenticated SQL injection, which can be exploited by an attacker to gain access to the database.
The Huge-IT Portfolio Gallery plugin version 1.0.6 contains a vulnerability to unauthenticated SQL Injection, allowing attackers to manipulate database queries.