CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
libmedia in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 has certain incorrect declarations, which allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
The ih264d decoder in mediaserver in Android 6.x before 2016-08-01 mishandles slice numbers, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Integer overflow in h264bsd_dpb.c in libstagefright in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Buffer overflow in the Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices allows remote attackers to execute arbitrary code via a crafted Information Element in an 802.11 management frame.
CVE-2016-4999 is a SQL injection vulnerability in the getStringParameterSQL method in Dashbuilder before version 0.6.0.Beta1. It allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the Data Set Authoring or Displayer editor UI.
The multi-tenant database container feature in SAP HANA does not properly encrypt communications, allowing remote attackers to bypass intended access restrictions.
An unspecified interface in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands with SIDadm privileges via unspecified vectors.
SAP TREX version 7.10 Revision 63 allows remote attackers to write to arbitrary files via vectors related to RFC-Gateway, posing a serious security threat.
SAP TREX version 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, posing a serious security risk.
Directory traversal vulnerability in SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors.
Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service by leveraging keyboard access to use the Alt key during selection of top-level menu items.
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 have a hardcoded password 'admin' for the admin account, making it easier for remote attackers to gain access via the web management interface.
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 use a hardcoded X.509 certificate from OpenSSL Test Certification Authority. This makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions.
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call.
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html.
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 rely on the client for authentication, allowing remote attackers to gain access by setting the value of objresp.authenabled to 1.
Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the ATE_COMMAND parameter.
Huawei NE40E, CX600, PTN 6900-2-M8, NE5000E, and CloudEngine 12800 devices with specific software versions are vulnerable to remote attacks. Attackers with control plane access can cause denial of service or execute arbitrary code via crafted packets.
Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, allowing remote attackers to execute arbitrary code via vectors related to XStream Serialization.
The server in Red Hat JBoss Operations Network (JON) before version 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization.