CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. The issue is related to incomplete cleanup in the SiteIsolation component.
A race condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The severity is Medium.
Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The severity is High.
A use-after-free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The severity is High.
Incorrect authorization in Downloads in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. The severity is Medium.
Missing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. The severity is Low.
Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. The severity is Low.
Information leak vulnerability in the Paint component of Google Chrome prior to 152.0.7977.65. A remote attacker can bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Race condition vulnerability in the Payments component of Google Chrome prior to 152.0.7977.65. A remote attacker who compromised the renderer process could leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Information leak vulnerability in the QUIC component of Google Chrome prior to 152.0.7977.65. A remote attacker could leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Incorrect authorization vulnerability in the Chromoting component of Google Chrome on Windows prior to 152.0.7977.65. A local attacker could bypass system access restrictions via a local program. (Chromium security severity: Medium)
Buffer overflow vulnerability in the WebRTC component of Google Chrome prior to 152.0.7977.65. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Mesop prior to version 1.3.3, when running in debug mode, exposes a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter. An unauthenticated attacker can send requests with high counter values, exhausting the worker pool and making the server unavailable. The attack requires minimal effort and leaves the server unresponsive until manually restarted.
Incorrect Access Control vulnerability in the /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.
Stack-buffer-underflow vulnerability in the IOFile::getLine() function in aria2 <=1.37.0.
GitHub CLI (gh) versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can become reachable through the user's non-loopback local IP addresses. This issue is fixed in version 2.98.0.
NVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote attacker may access the inference service without authentication. A successful exploit of this vulnerability may lead to information disclosure and denial of service.
NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service.
NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.
NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker could cause a download of code without integrity check. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.