CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free vulnerability in the V8Window::namedPropertyGetterCustom function in V8 bindings in Blink, used in Google Chrome before version 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a frame detachment.
The filters implementation in Skia, as used in Google Chrome before version 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.
Integer overflow in the SkAutoSTArray implementation in Skia, used in Google Chrome before version 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a large count value, leading to an out-of-bounds write operation.
The SkBitmap::ReadRawPixels function in Skia, used in Google Chrome before version 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.
Urządzenia CPU Siemens SIMATIC S7-300 umożliwiają zdalnym atakującym wywołanie odmowy usługi (przejście w tryb defektu) poprzez wysyłanie spreparowanych pakietów na (1) port TCP 102 lub (2) Profibus.
Siemens SPC controllers (SPC4000, SPC5000, SPC6000) before version 3.6.0 are vulnerable to remote attacks that can cause denial of service by sending crafted packets.
The NVIDIA Display Driver R304 before 309.08, R340 before 341.44, R343 before 345.20, and R346 before 347.52 does not properly validate local client impersonation levels when performing a 'kernel administrator check,' which allows local users to gain administrator privileges via unspecified API calls.
An unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition allows remote attackers to bypass intended access permissions and obtain sensitive information.
An unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition allows remote attackers to escape the Java sandbox and execute arbitrary code.
Symantec NetBackup OpsCenter versions 7.6.0.2 through 7.6.1 on Linux and UNIX allows remote attackers to execute arbitrary JavaScript code via unspecified vectors.
An unspecified vulnerability in the Ninja Forms plugin before version 2.8.10 for WordPress may have unknown impact and remote attack vectors related to admin users.
SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_id parameter.
SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php.
KENT-WEB Joyful Note before 5.3 allows remote attackers to delete files or write to files, consequently executing arbitrary code.
npppd in the PPP Access Concentrator (PPPAC) on SEIL SEIL/x86 Fuji routers versions 1.00 through 3.30 and SEIL/X1, SEIL/X2, and SEIL/B1 routers versions 3.50 through 4.70 allows remote attackers to cause a denial of service (infinite loop and device hang) via a crafted SSTP packet.
The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.
SQL injection vulnerability in view_item.php in ClipBucket 2.7 RC3 allows remote attackers to execute arbitrary SQL commands via the item parameter.
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10, 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.
Network Vision IntraVue before 2.3.0a14 on Windows allows remote attackers to execute arbitrary OS commands via unspecified vectors.
The WordPress Survey and Poll plugin version 1.1.7 contains an SQL injection vulnerability in the ajax_survey function in settings.php. Remote attackers can execute arbitrary SQL commands via the survey_id parameter in an ajax_survey action.