CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to unexpected absence of document data structures.
Use-after-free vulnerability in the matroska_read_seek function in FFmpeg before 2.5.1, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Matroska file that triggers improper maintenance of tracks data.
Use-after-free vulnerability in the Element::detach function in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving pending updates of detached elements.
The factory.cc file in Google V8, used in Google Chrome before version 40.0.2214.91, contains a vulnerability that allows remote attackers to cause a denial of service (memory corruption) or potentially unspecified other impact via crafted JavaScript code that triggers improper maintenance of backing-store pointers.
A use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of TreeScope data.
A use-after-free vulnerability in the HTMLScriptElement::didMoveToNewDocument function in the DOM implementation in Blink, as used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving movement of a SCRIPT element across documents.
The hydrogen.cc file in Google V8, used in Google Chrome before version 40.0.2214.91, has an issue with handling arrays with holes. This can lead to denial of service (memory corruption) or other unspecified impacts via crafted JavaScript code that triggers an array copy.
The SimplifiedLowering::DoLoadBuffer function in Google V8, used in Google Chrome before version 40.0.2214.91, does not properly choose an integer data type, which may lead to denial of service (memory corruption) or other unspecified impacts via crafted JavaScript code.
The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a zero-length quantifier.
A use-after-free vulnerability in the WebAudio implementation in Blink, as used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an audio-rendering thread in which AudioNode data is improperly maintained.
The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a look-behind expression.
The Dealer Portal in SAP ERP does not properly restrict access, allowing remote attackers to obtain sensitive information and gain privileges.
The Extended Application Services (XS) in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors.
SQL injection vulnerability in SAP Adaptive Server Enterprise (Sybase ASE) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
The client in iPass Open Mobile before version 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe.
Unspecified vulnerability in Oracle Java SE 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Unspecified vulnerability in the Integrated Lights Out Manager (ILOM) component in Oracle Sun Systems Products Suite ILOM prior to 3.2.4 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to IPMI.
Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS.
Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption.
The ADB P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, allowing remote attackers to obtain sensitive information or cause a denial of service (device restart).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS