CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Out of bounds write in ANGLE in Google Chrome on Mac (before 149.0.7827.53) allows a remote attacker who compromised the renderer to potentially escape the sandbox via a crafted HTML page.
Out-of-bounds write in Codecs in Google Chrome prior to 149.0.7827.53 allows a remote attacker to potentially escape the sandbox via a crafted video file.
Insufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149.0.7827.53. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.
Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 149.0.7827.53. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page. (Severity: Medium)
Use-after-free vulnerability in the USB component of Google Chrome on Windows prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted HTML page.
Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Insufficient validation of untrusted input in the Dawn component of Google Chrome prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted HTML page.
Insufficient validation of untrusted input in the ANGLE component of Google Chrome prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted HTML page.
Use-after-free vulnerability in the Ozone component of Google Chrome on Linux prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted HTML page.
Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 149.0.7827.53. A remote attacker who compromised the renderer process can potentially escape the sandbox.
Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file.
Use-after-free vulnerability in the FileSystem component of Google Chrome prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted HTML page.
Out-of-bounds write vulnerability in the GPU component of Google Chrome on Android prior to 149.0.7827.53. A remote attacker could potentially escape the sandbox via a crafted HTML page.
Use after free vulnerability in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Out-of-bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53. A remote attacker can potentially perform a sandbox escape via a crafted HTML page.
On platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.
Platforms running Arista EOS with OpenConfig configured may accept gNMI Set requests that should have been rejected, leading to unexpected configuration changes on the switch.
SQLite 'sqldiff.exe' does not securely handle Unicode to ANSI codepage conversion on Windows, allowing an attacker to load an arbitrary DLL via the '-L' option and misinterpret command line arguments.
Netty incubator codec.bhttp before version 0.0.22.Final mishandles direct ByteBufs when sun.misc.Unsafe is unavailable. An unauthenticated network attacker can cause memory corruption and data disclosure from other connections via crafted OHTTP requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS