CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Inappropriate implementation in DevTools of Google Chrome prior to 149.0.7827.53 allows a remote attacker who has compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium severity: Low.
Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.
An authentication bypass by spoofing vulnerability in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network.
Insufficient validation of untrusted input in Reading Mode in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Insufficient validation of untrusted input in Autofill in Google Chrome prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via malicious network traffic.
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted video file.
In Google Chrome on Android prior to 149.0.7827.53, an inappropriate implementation in WebView allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
In Google Chrome on iOS prior to 149.0.7827.53, a use-after-free in WebMIDI allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
In Google Chrome on Android prior to 149.0.7827.53, a use-after-free in Messages allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Google Chrome prior to version 149.0.7827.53 has a side-channel information leakage vulnerability in Forms. A remote attacker can use a crafted HTML page to leak cross-origin data.
In Google Chrome prior to 149.0.7827.53, an object lifecycle issue in Dawn allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
In Google Chrome prior to 149.0.7827.53, insufficient validation of untrusted input in Chromoting allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
In Google Chrome on Android prior to 149.0.7827.53, a use-after-free in Autofill allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Insufficient input validation in Enterprise Reporting in Google Chrome prior to 149.0.7827.53 allows a remote attacker who compromised the renderer to potentially escape the sandbox via a crafted HTML page.
In Google Chrome on Android prior to 149.0.7827.53, an inappropriate implementation in GPU allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
In Google Chrome on Mac prior to 149.0.7827.53, a use-after-free in Device Trust allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Insufficient input validation in ANGLE in Google Chrome prior to 149.0.7827.53 allows a remote attacker who compromised the renderer to potentially escape the sandbox via a crafted HTML page.
Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension.
Google Chrome on Mac prior to version 149.0.7827.53 has a use-after-free vulnerability in File Input. A remote attacker, after convincing a user to perform specific UI gestures, can use a crafted HTML page to potentially perform a sandbox escape.
Insufficient input validation in Codecs in Google Chrome prior to 149.0.7827.53 allows a remote attacker who compromised the renderer to potentially escape the sandbox via a crafted HTML page.