CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Use after free in Vulkan in Google Chrome prior to version 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Use after free in Loader in Google Chrome prior to version 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
In Google Chrome prior to version 116.0.5845.110, an out of bounds memory access in CSS allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Out of bounds memory access in V8 in Google Chrome prior to version 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
IBM Robotic Process Automation versions 21.0.0 through 21.0.7.1 is vulnerable to information disclosure of script content if the remote REST request policy is enabled.
Directory Traversal vulnerability in FileMage Gateway for Windows deployments v.1.10.8 and earlier allows a remote attacker to obtain sensitive information via a crafted request to the /mgmt/ component.
IBM Robotic Process Automation versions 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory.
IBM Robotic Process Automation versions 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 may allow an authenticated user to view sensitive information from installation logs.
IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. An attacker could exploit this vulnerability by sending an overly large number of trial messages for decryption.
An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) that allows an attacker to exploit the file renaming feature to move files to unintended directories.
A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.
CVE-2023-3699 identifies an Improper Privilege Management vulnerability in ASUSTOR Data Master (ADM) that allows unprivileged local users to modify the storage devices configuration. Affected versions include ADM 4.0.6.RIS1, 4.1.0 and below, as well as ADM 4.2.2.RI61 and below.
The Cross-Site Scripting (XSS) vulnerability in CSZ CMS version 1.3.0 allows attackers to execute arbitrary code via a crafted payload in the Social Settings parameter.
Version 4fe2e of webui-aria2 was found to contain a path traversal vulnerability.
All versions of Douran DSGate have an issue that allows a local authenticated privileged attacker to execute arbitrary code via the debug command.
IBM Robotic Process Automation server versions 21.0.0 through 21.0.7 could allow an authenticated user to view sensitive information from application logs.
A stack-based buffer over-read vulnerability in nasm version 2.16 allows attackers to cause a denial of service (crash).
A stack-based buffer over-read in the disasm function in nasm 2.16 allows attackers to cause a denial of service.
Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt.
In version 2.16rc0 of nasm, there is a null pointer dereference issue in the ieee_write_file function, which can lead to a program crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS