CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Insufficient validation of untrusted input in the Dawn component of Google Chrome prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted HTML page.
Insufficient validation of untrusted input in the ANGLE component of Google Chrome prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted HTML page.
Use-after-free vulnerability in the Ozone component of Google Chrome on Linux prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted HTML page.
Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 149.0.7827.53. A remote attacker who compromised the renderer process can potentially escape the sandbox.
Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file.
Use-after-free vulnerability in the FileSystem component of Google Chrome prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted HTML page.
Out-of-bounds write vulnerability in the GPU component of Google Chrome on Android prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted HTML page.
Use after free vulnerability in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Out-of-bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53. A remote attacker can potentially perform a sandbox escape via a crafted HTML page.
On platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.
Platforms running Arista EOS with OpenConfig configured may accept gNMI Set requests that should have been rejected, leading to unexpected configuration changes on the switch.
SQLite 'sqldiff.exe' does not securely handle Unicode to ANSI codepage conversion on Windows, allowing an attacker to load an arbitrary DLL via the '-L' option and misinterpret command line arguments.
Netty incubator codec.bhttp before version 0.0.22.Final mishandles direct ByteBufs when sun.misc.Unsafe is unavailable. An unauthenticated network attacker can cause memory corruption and data disclosure from other connections via crafted OHTTP requests.
Seagull Software BarTender versions 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service on TCP port 7375 (BtSystem.Service.exe). The service registers an unauthenticated singleton endpoint with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. A remote attacker can exploit .NET Remoting object unmarshalling to read/write arbitrary files or coerce NTLMv2 authentication, leading to credential disclosure and code execution. The service runs as NT AUTHORITY\SYSTEM.
OSNexus QuantaStor SDS Manager has an SQL injection vulnerability in the login endpoint. The username field is not properly sanitized, allowing an unauthenticated attacker to bypass authentication and log in as an administrator.
The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection. The application does not properly sanitize user input in the IP address field before passing it to the system's ping command. An attacker can inject arbitrary OS commands, which will be executed with the privileges of the web server.
In the Apache Fory fory-core Java SDK before version 1.1.0, there is a deserialization of untrusted data vulnerability in the Java replace-resolve path. A remote attacker can bypass class registration, TypeChecker, and DisallowedList checks and invoke readResolve/readExternal hooks via crafted Fory serialized data.
The Neterbit NW-431F router version 20241014-IR03 and earlier contains an authentication bypass vulnerability. The router uses a weak/predictable cookie value for authentication. By modifying the cookie value (e.g., setting it to "admin"), an attacker can bypass authentication and gain unauthorized access to admin functionalities.