CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer overflow in the GNU C Library (glibc or libc6) before version 2.23 allows context-dependent attackers to cause application crashes or potentially execute arbitrary code via the size argument to the __hcreate_r function, leading to out-of-bounds heap-memory access.
The strftime function in the GNU C Library (glibc) before version 2.23 allows context-dependent attackers to cause application crashes or possibly obtain sensitive information via an out-of-range time value.
Multiple stack-based buffer overflows in the GNU C Library (glibc) before version 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the nan, nanf, or nanl function.
Multiple unspecified vulnerabilities in Google Chrome before version 50.0.2661.75 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The IDrm.cpp file in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure, allowing attackers to obtain sensitive information from process memory.
The IOMX.cpp file in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, allowing attackers to obtain sensitive information from process memory.
The IOMX.cpp file in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016, does not initialize a parameter data structure, allowing attackers to obtain sensitive information from process memory.
The BufferQueueConsumer library in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016, does not check for the android.permission.DUMP permission. This allows attackers to obtain sensitive information and bypass an unspecified protection mechanism via a dump request.
dhcpcd versions before 6.10.0, used in Android 4.x to 6.x, mismanage option lengths, allowing remote attackers to execute arbitrary code or cause a denial of service via a malformed DHCP response.
In Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, there is a bug in mediametadataretriever.cpp that mishandles cleared service binders. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
The post_proc/volume_listener.c file in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
In Android 4.x before version 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, the Sonivox component in mediaserver does not check for a negative number of samples, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
A vulnerability in libstagefright in mediaserver in Android allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file. This affects Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016.
The decoder/impeg2d_dec_hdr.c in mediaserver in Android 6.x before April 1, 2016, has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a certain negative value.
An HTTP servlet in vApp Manager in EMC Unisphere for VMAX Virtual Appliance before version 8.2.0 has a vulnerability that allows remote attackers to write to arbitrary files via a crafted pathname.
Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before version 4.0.6 can be exploited by remote attackers.
Cisco Unified Computing System (UCS) Central Software 1.3(1b) and earlier allows remote attackers to execute arbitrary OS commands via a crafted HTTP request.
Integer overflow in the ImagingResampleHorizontal function in Pillow before version 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, leading to a heap-based buffer overflow.
Multiple buffer overflows in xymond/xymond.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a long filename, involving handling a 'config' command.
In Git versions before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, there is a vulnerability that does not properly restrict allowed protocols in remote helper programs. This may allow remote attackers to execute arbitrary code via a URL in a .gitmodules file or other unknown sources in a submodule.