CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: 1.5.0–1.5.6, 2.3.0–2.3.4, 2.4.0–2.4.1, 2.5.0–2.5.2, and 3.0.0–3.0.3.
Spring HATEOAS's PropertyUtils.createObjectFromProperties method, used by Collection+JSON and UBER deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations. Affected versions: 1.5.0-1.5.6, 2.3.0-2.3.4, 2.4.0-2.4.1, 2.5.0-2.5.2, 3.0.0-3.0.3.
A vulnerability in Micrometer allows remote denial of service (DoS) via specially crafted HTTP requests. Affects multiple versions of micrometer-core, micrometer-jetty11, and micrometer-jetty12.
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.
A missing authorization vulnerability in QuMagie allows remote attackers to access unauthorized data or perform unauthorized actions. The issue is fixed in version 2.9.0.
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comment text in all versions up to 7.5.49.7212 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute after an administrator approves the comment.
DTStack Taier up to version 1.4.0 has a vulnerability in the preHandle function in LoginInterceptor.java related to the source connection test endpoint. Remote exploitation can bypass authentication. Exploit publicly disclosed.
Rapid7 Velociraptor before version 0.76.6 contains a YAML injection vulnerability. An attacker can supply a crafted ZIP file that, when applied by an analyst, executes arbitrary VQL code with full privileges.
The ABAP application server does not perform necessary authorization checks for an authenticated user, allowing execution of a report generation command that can overwrite another user's data, leading to privilege escalation. This has high impact on integrity, low on availability, and no impact on confidentiality.
Use-after-free vulnerability in the Tracing component of Google Chrome prior to 149.0.7827.103. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.
Use-after-free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Use-after-free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
In Google Chrome prior to 149.0.7827.103, a use-after-free vulnerability in ServiceWorker allows a remote attacker who compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
Inappropriate implementation in Plugins in Google Chrome prior to 149.0.7827.103. A remote attacker who compromised the renderer process could bypass site isolation via a crafted HTML page.
Use-after-free vulnerability in the Read Anything component of Google Chrome prior to 149.0.7827.103. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.
In Google Chrome on Mac prior to 149.0.7827.103, an out-of-bounds read and write vulnerability in Media allows a remote attacker who compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
Insufficient policy enforcement in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Use-after-free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
A use-after-free vulnerability in WebCodecs in Google Chrome prior to 149.0.7827.103 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS