CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unspecified vulnerability in HP Network Automation 9.10 and 9.20 allows local users to bypass intended access restrictions via unknown vectors.
Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors.
Joomla! CMS versions 2.5.x before 2.5.19 and 3.x before 3.2.3 allow remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.
SQL injection vulnerability in Joomla! CMS versions 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Joomla! versions 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allow remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code.
The vulnerability in visionmedia send before version 0.8.4 for Node.js involves a partial comparison for verifying whether a directory is within the document root, allowing remote attackers to access restricted directories.
Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.php or (2) id parameter to lib/events/eventinfo.php.
Multiple unspecified vulnerabilities in Google V8 before version 3.28.71.15, as used in Google Chrome before version 38.0.2125.101, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google Chrome before version 38.0.2125.101 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
In Google Chrome before version 38.0.2125.101 on Windows, there is an issue with improper implementation of read-only restrictions on shared memory, allowing attackers to bypass a sandbox protection mechanism.
Use-after-free vulnerability in the Web Workers implementation in Google Chrome before version 38.0.2125.101 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
The SessionService::GetLastSession function in Google Chrome before version 38.0.2125.101 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors that leverage 'type confusion' for callback processing.
A use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in the DOM implementation in Blink, used in Google Chrome before version 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
A use-after-free vulnerability in Blink, used in Google Chrome before version 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers a widget-position update improperly interacting with the render tree.
A use-after-free vulnerability in the Event::currentTarget function in Blink, used in Google Chrome before version 38.0.2125.101, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code that accesses the path property of an Event object.
The chrome_pdf::CopyImage function in the PDFium component in Google Chrome before version 38.0.2125.101 does not properly validate image-data dimensions, which may lead to denial of service (out-of-bounds read) or other unspecified impacts.