CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In libxslt before version 1.1.29, used in Google Chrome before version 51.0.2704.63, there is an issue with handling namespace nodes. This can lead to denial of service through out-of-bounds heap memory access or potentially other unspecified impacts via a crafted document.
A heap-based buffer overflow in the opj_j2k_read_SPCod_SPCoc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before version 51.0.2704.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
A use-after-free vulnerability in SkFontHost_FreeType.cpp in Skia, as used in Google Chrome before version 51.0.2704.63, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via unknown vectors.
The ToV8Value function in Google Chrome before version 51.0.2704.63 does not properly restrict the use of getters and setters, which may lead to denial of service (use-after-free) or other unspecified impacts via crafted JavaScript code.
In Google V8 before version 5.0.71.32, used in Google Chrome before version 51.0.2704.63, there is an issue with improper restriction of lazy deoptimization. This may allow remote attackers to cause a denial of service (heap-based buffer overflow) or potentially have unspecified other impact via crafted JavaScript code.
The binding.js file in the extension bindings in Google Chrome before version 51.0.2704.63 has a prototype usage issue, allowing remote attackers to bypass the Same Origin Policy.
Blink, as used in Google Chrome before version 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattachment during destruction, related to FrameLoader.cpp and LocalFrame.cpp.
The extensions subsystem in Google Chrome before version 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Blink, as used in Google Chrome before version 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
The ModuleSystem::RequireForJsInner function in Google Chrome before version 51.0.2704.63 mishandles properties, allowing remote attackers to conduct bindings-interception attacks and bypass the Same Origin Policy.
The TraceStrokePolygon function in ImageMagick before version 6.9.4-0 and 7.x before version 7.0.1-2 mishandles the relationship between the BezierQuantum value and certain strokes data. This may allow remote attackers to cause a denial of service (buffer overflow and application crash) or potentially have unspecified other impact via a crafted file.
The DrawDashPolygon function in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles calculations of certain vertices integer data, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CISCO IP 8800 phones with software 11.0.1 and earlier allow local users to gain privileges for OS command execution via crafted CLI commands.
Cisco Prime Network Analysis Module (NAM) and Virtual Network Analysis Module (vNAM) before version 6.1(1) patch.6.1-2-final and 6.2.x before version 6.2(2) allow remote authenticated users to execute arbitrary OS commands via a crafted HTTP request.
Cisco Prime Network Analysis Module (NAM) and Prime Virtual Network Analysis Module (vNAM) before version 6.1(1) patch.6.1-2-final and 6.2.x before version 6.2(1) have a vulnerability that allows local users to gain root access via crafted CLI input.
UpdateAgent in Lenovo Accelerator Application allows man-in-the-middle attackers to execute arbitrary code by spoofing an update response from susapi.lenovomm.com.
The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on specified files.
The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition before SR16 FP25 improperly deserializes classes in an AccessController doPrivileged block, allowing remote attackers to bypass a sandbox protection mechanism and execute arbitrary code.
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25, 6 R1 before SR8 FP25, 7 before SR9 FP40, 7 R1 before SR3 FP40, and 8 before SR3 uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, allowing remote attackers to call setSecurityManager and bypass a sandbox protection mechanism.
Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.