CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Siemens SIMATIC S7-1500 CPU PLC devices with firmware before version 1.5.0 are vulnerable to remote attacks that can lead to denial of service via crafted HTTP packets.
The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, making it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions.
A directory traversal vulnerability in Google Chrome before version 33.0.1750.152 on OS X and Linux and before version 33.0.1750.154 on Windows has unspecified impact and attack vectors.
The ScopedClipboardWriter::WritePickledData function in Google Chrome before version 33.0.1750.152 on OS X and Linux and before version 33.0.1750.154 on Windows does not verify a certain format value, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via clipboard-related vectors.
Use-after-free vulnerability in the AttributeSetter function in bindings/templates/attributes.cpp in the Blink engine, used in Google Chrome before version 33.0.1750.152 on OS X and Linux and before version 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the document.location value.
The GPU driver in the kernel in Google Chrome OS before version 33.0.1750.152 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.
The AsyncPixelTransfersCompletedQuery::End function in Google Chrome before version 33.0.1750.152 does not check whether a certain position is within the bounds of a shared-memory segment. This may allow remote attackers to cause a denial of service through GPU command-buffer memory corruption or potentially other unspecified impacts.
The boot implementation in Google Chrome OS before version 33.0.1750.152 does not properly consider file persistence, allowing remote attackers to execute arbitrary code via unspecified vectors.
Directory traversal vulnerability in CrosDisks in Google Chrome OS before version 33.0.1750.152 may lead to unspecified impact and attack vectors.
Crosh in Google Chrome OS before version 33.0.1750.152 allows attackers to inject commands via unspecified vectors.
Google V8, as used in Google Chrome before version 33.0.1750.152 on OS X and Linux and before version 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google V8 before version 3.23.17.18, as used in Google Chrome before version 33.0.1750.149, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
A use-after-free vulnerability in the WebSocketDispatcherHost::SendOrDrop function in the Web Sockets implementation in Google Chrome before version 33.0.1750.149 may allow remote attackers to bypass the sandbox protection mechanism by leveraging an incorrect deletion in a certain failure case.
A use-after-free vulnerability in the DatabaseThread::cleanupDatabaseThread function in the Blink web database implementation, used in Google Chrome before version 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of scheduled tasks during thread shutdown.
A use-after-free vulnerability in SpeechSynthesis.cpp in Blink, as used in Google Chrome before version 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of a certain utterance data structure.
Buffer overflow in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 3.0.1-IM-S3SAMPC-WIN32-FP001-IF02 allows remote attackers to execute arbitrary code via a crafted ComboList property value.
Unspecified vulnerability in HP Unified Functional Testing before version 12.0 allows remote attackers to execute arbitrary code via unknown vectors.
Unspecified vulnerability in HP Smart Update Manager 5.3.5 before build 70 on Linux allows local users to gain privileges via unknown vectors.
The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, allowing remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role.
An unspecified vulnerability in the Linux Network Connect client in Juniper Junos Pulse Secure Access Service before versions 7.1r18, 7.3r10, 7.4r8, and 8.0r1 allows local users to gain privileges via unspecified vectors.