CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic.
Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page.
Out of bounds write in GPU in Google Chrome on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page.
Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
Use after free in Aura in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sandbox via UI Interaction.
Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page.
Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
Out-of-bounds write vulnerability in V8 component of Google Chrome prior to 154.0.8037.57. A remote attacker can exploit a crafted HTML page to execute arbitrary code inside the sandbox.
Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Use-after-free vulnerability in Browser component of Google Chrome prior to 154.0.8037.57. A local attacker could potentially execute arbitrary code outside the sandbox via UI interaction.
Type confusion vulnerability in Bindings component of Google Chrome prior to 154.0.8037.57. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.
Missing authorization in WebView in Google Chrome on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page.
Use-after-free vulnerability in Platform component of Google Chrome prior to 154.0.8037.57. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.
Race condition vulnerability in V8 component of Google Chrome prior to 154.0.8037.57. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.
Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page.
Improper input validation vulnerability in Themes component of Google Chrome prior to 154.0.8037.57. A remote attacker who compromised the renderer process could execute arbitrary code inside the sandbox via crafted network traffic.
Improper output encoding vulnerability in DevTools component of Google Chrome prior to 154.0.8037.57. A remote attacker who compromised the renderer process could execute arbitrary code outside the sandbox via a crafted HTML page.
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formFilter (access-control / URL filter configuration handler) and is triggered by the url request parameter when the addFilterUrl (or addFilterUrlFlag) action flag is set.
IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this to delete files, potentially causing denial of service or impacting system integrity.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS