CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Use after free in the Loader component of Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Insufficient validation of untrusted input in the Network component of Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Use after free in the V8 engine of Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Use-after-free vulnerability in the Navigation component of Google Chrome prior to 151.0.7922.72. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.
Race condition in the Updater component of Google Chrome on Mac prior to 151.0.7922.72. A local attacker could perform OS-level privilege escalation via a malicious file.
Use-after-free vulnerability in the Skia component of Google Chrome prior to 151.0.7922.72. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.
Use-after-free vulnerability in the Compositing component of Google Chrome prior to 151.0.7922.72. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.
A vulnerability in VaahCMS versions 2.0.0-2.3.4 involves a malicious obfuscated JavaScript payload embedded in the Blade template for OTP emails. The payload establishes a WebSocket connection to a C2 server, installs a password keylogger, scrapes WhatsApp Web DOM, and accepts remote commands to redirect or overwrite the page.
The kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the emailid and email parameters.
The kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1.
The kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter.
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in /save_user.php via the status parameter.
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in update_student.php via the fname and student_class parameters.
Sourcecodester Advocate office management system 1.0 is vulnerable to SQL injection in control/activate_case.php via the id parameter, allowing remote code execution.
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in update_password.php via the new_password parameter.
OliveTin up to version 3000.17.0 stores OAuth2 login states in a map without expiration or size limits, allowing an unauthenticated attacker to exhaust memory and cause a denial of service (DoS).
XML External Entity (XXE) vulnerability in Jinher OA C6. An unauthenticated remote attacker can send a crafted XML payload to the GetXmlHttp endpoint to read arbitrary files from the server via an out-of-band attack.
Autel MaxiCharger AC Elite Home EV chargers have an integer underflow vulnerability in WebSocket OCPP message handling, allowing an unauthenticated remote attacker to execute arbitrary code on the device.
GitLab CE/EE versions 10.1.0 through 19.0.5, 19.1 through 19.1.3, and 19.2 through 19.2.1 have insufficient access controls on internal request handling, potentially allowing an authenticated Developer user to access unauthorized information.
The NTIOLib_X64.sys driver in MSI Center fails to properly validate command origins, allowing a local attacker to escalate privileges to SYSTEM and execute arbitrary code.