CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
A use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
A use after free in PDFium in Google Chrome prior to version 55.0.2883.75 for Mac, Windows, and Linux, and prior to version 55.0.2883.84 for Android allows a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Heap buffer overflow during TIFF image parsing in PDFium in Google Chrome prior to version 55.0.2883.75 for Mac, Windows, and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Bad casting in bitmap manipulation in Blink in Google Chrome prior to version 55.0.2883.75 for Mac, Windows, and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
The PDF plugin in Google Chrome prior to version 55.0.2883.75 for Mac, Windows, and Linux, and 55.0.2883.84 for Android incorrectly followed redirects, allowing a remote attacker to bypass the Same Origin Policy via a crafted HTML page.
A use after free in PDFium in Google Chrome prior to version 55.0.2883.75 for Mac, Windows, and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
V8 in Google Chrome prior to version 54.0.2840.98 for Mac, 54.0.2840.99 for Windows, 54.0.2840.100 for Linux, and 55.0.2883.84 for Android incorrectly applied type rules, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
An off by one error in FFmpeg in Google Chrome prior to version 54.0.2840.98 for Mac, 54.0.2840.99 for Windows, 54.0.2840.100 for Linux, and 55.0.2883.84 for Android may lead to an allocation of zero size. This allows a remote attacker to potentially exploit heap corruption via a crafted video file.
V8 w Google Chrome przed wersją 54.0.2840.90 dla systemu Linux, 54.0.2840.85 dla Androida oraz 54.0.2840.87 dla systemów Windows i Mac zawierał błędne założenia dotyczące optymalizacji, co umożliwiało zdalnemu atakującemu wykonywanie dowolnych operacji odczytu/zapisu, prowadząc do wykonania kodu poprzez spreparowaną stronę HTML.
The content view client in Google Chrome prior to version 54.0.2840.85 for Android insufficiently validated intent URLs, allowing a remote attacker who compromised the renderer process to start arbitrary activity on the system via a crafted HTML page.
The content renderer client in Google Chrome prior to version 54.0.2840.85 for Android insufficiently enforced the Same Origin Policy amongst downloaded files, allowing a remote attacker to access any downloaded file and interact with sites, including those the user was logged into, via a crafted HTML page.
Citrix Provisioning Services before version 7.12 allows attackers to obtain sensitive information from kernel memory via unspecified vectors.
The Groovy LDAP API in Apache has a vulnerability that allows attackers to conduct LDAP entry poisoning attacks. The issue arises from setting the returnObjFlag to true for all search methods.
The Bzrtp library (libbzrtp) 1.0.x before 1.0.4 is vulnerable to man-in-the-middle attacks, allowing spoofing attacks due to a missing HVI check on DHPart2 packet reception.
Unspecified vulnerability in Zimbra Collaboration before version 8.7.0 allows remote attackers to affect integrity via unknown vectors.
Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors.
Multiple cross-site request forgery (CSRF) vulnerabilities in Zimbra Collaboration before version 8.7.0 allow remote attackers to hijack the authentication of unspecified victims via vectors involving the Client uploader extension or extension REST handlers.
Multiple unspecified vulnerabilities in Zimbra Collaboration before version 8.7.0 allow remote attackers to affect integrity.
Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors.