CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before version 1.60 IR 04 stores rde.jar under the web root with insufficient access control, allowing remote attackers to obtain sensitive configuration information.
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, allowing remote attackers to obtain database credentials via the install parameter with the value 4.
An off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, leading to a heap-based buffer overflow.
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus, potentially executing arbitrary code with root privileges.
Adobe Flash Player w wersjach przed 13.0.0.262 oraz 14.x do 16.x przed 16.0.0.287 na systemach Windows i OS X oraz przed 11.2.202.438 na Linuksie nie ogranicza prawidłowo odkrywania adresów pamięci. To umożliwia atakującym obejście mechanizmu ochrony ASLR na Windows oraz może mieć nieokreślony wpływ na inne platformy.
Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google Chrome before version 40.0.2214.91 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The Fonts implementation in Google Chrome before version 40.0.2214.91 does not initialize memory for a data structure, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
The collator implementation in International Components for Unicode (ICU) version 52 through SVN revision 293126, used in Google Chrome before version 40.0.2214.91, does not initialize memory for a data structure. This may allow remote attackers to cause a denial of service or potentially have unspecified other impact via a crafted character sequence.
The Fonts implementation in Google Chrome before version 40.0.2214.91 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Multiple off-by-one errors in libavcodec/vorbisdec.c in FFmpeg before 2.4.2 allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Vorbis I data.
A use-after-free vulnerability in the Speech implementation in Google Chrome before version 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving utterances from a closed tab.
Use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to unexpected absence of document data structures.
Use-after-free vulnerability in the matroska_read_seek function in FFmpeg before 2.5.1, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Matroska file that triggers improper maintenance of tracks data.
Use-after-free vulnerability in the Element::detach function in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving pending updates of detached elements.
The factory.cc file in Google V8, used in Google Chrome before version 40.0.2214.91, contains a vulnerability that allows remote attackers to cause a denial of service (memory corruption) or potentially unspecified other impact via crafted JavaScript code that triggers improper maintenance of backing-store pointers.
A use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of TreeScope data.
A use-after-free vulnerability in the HTMLScriptElement::didMoveToNewDocument function in the DOM implementation in Blink, as used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving movement of a SCRIPT element across documents.
The hydrogen.cc file in Google V8, used in Google Chrome before version 40.0.2214.91, has an issue with handling arrays with holes. This can lead to denial of service (memory corruption) or other unspecified impacts via crafted JavaScript code that triggers an array copy.
The SimplifiedLowering::DoLoadBuffer function in Google V8, used in Google Chrome before version 40.0.2214.91, does not properly choose an integer data type, which may lead to denial of service (memory corruption) or other unspecified impacts via crafted JavaScript code.