CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The convolution implementation in Skia, used in Google Chrome before version 47.0.2526.73, does not properly constrain row lengths, allowing remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted graphics data.
The DOM implementation in Blink, used in Google Chrome before version 47.0.2526.73, does not prevent javascript: URL navigation while a document is being detached. This allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that improperly interacts with a plugin.
In Google V8, used in Google Chrome before version 47.0.2526.73, there is an improper implementation of certain map and filter operations for arrays, which may lead to denial of service (out-of-bounds memory access) or possibly other unspecified impacts via crafted JavaScript code.
The DOM implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, which is a different vulnerability than CVE-2015-6768.
The provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in Google Chrome before version 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy by leveraging a delay in window proxy clearing.
The DOM implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
A use-after-free vulnerability in the AppCache implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect pointer maintenance associated with certain callbacks.
A use-after-free vulnerability in the AppCache implementation in Google Chrome before version 47.0.2526.73 allows remote attackers with renderer access to cause a denial of service or possibly have unspecified other impact by leveraging incorrect AppCacheUpdateJob behavior associated with duplicate cache selection.
A use-after-free vulnerability in Google Chrome before version 47.0.2526.73 allows remote attackers to execute arbitrary code or cause a denial of service by mishandling AppCache update jobs.
EMC NetWorker versions before 8.0.4.5, 8.1.x before 8.1.3.6, 8.2.x before 8.2.2.2, and 9.0 before build 407 are vulnerable to denial of service attacks. Remote attackers can cause process outages by sending malformed RPC authentication messages.
Cisco Unified SIP 3905 phones allow remote attackers to cause a denial of service through a large amount of network traffic, leading to resource consumption and functionality loss.
Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offset variable.
Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable.
The index_urlfetch function in Cyrus IMAP versions 2.3.x before 2.3.19, 2.4.x before 2.4.18, and 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.
Off-by-one error in the extracthalf function in the dpkg-deb component in Debian allows remote attackers to execute arbitrary code via the archive magic version number in an 'old-style' Debian binary package, triggering a stack-based buffer overflow.
The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokeping_cgi, allowing remote attackers to execute arbitrary code via crafted CGI arguments.
Cisco IOS XE 15.4(3)S on ASR 1000 devices improperly loads software packages, allowing local users to bypass license restrictions and obtain certain root privileges by entering crafted filenames in the CLI.
Versions of McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) before 9.3.2MR19, 9.4.2MR9, and 9.5.0MR8, when configured to use Active Directory or LDAP authentication sources, allow remote attackers to bypass authentication by logging in with the username 'NGCP|NGCP|NGCP;' and any password.
PCRE before 8.38 mishandles certain references, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression.
pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file.