CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use after free vulnerability in PrintPreview in Google Chrome prior to version 58.0.3029.81 for Windows allowed a remote attacker to potentially access out of bounds memory via a crafted HTML page.
Type confusion in PDFium in Google Chrome prior to version 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
A use after free vulnerability in Blink in Google Chrome prior to version 57.0.2987.133 for Linux, Windows, and Mac, and prior to version 57.0.2987.132 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
A use after free in printing in Google Chrome prior to version 57.0.2987.133 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
An out-of-bounds read in V8 in Google Chrome prior to version 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to obtain heap memory contents via a crafted HTML page.
An out-of-bounds read in V8 in Google Chrome prior to version 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf.
A flaw in block structure in Blink in Google Chrome prior to version 57.0.2987.133 for Mac, Windows, and Linux, and prior to version 57.0.2987.132 for Android, allows a remote attacker to potentially exploit memory corruption via a crafted HTML page that triggers improper casting.
Before Thornberry NDoc version 8.0, laptop clients and the server have default database (Cache) users set up with a single password. This password is left behind in a cleartext log file during client installation on laptops.
The Tapatalk plugin versions 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin contain multiple SQL injection vulnerabilities. Attackers can remotely execute arbitrary SQL commands via a crafted xmlrpc API request.
Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.
The agent in Bomgar Remote Support versions 15.2.x before 15.2.3, 16.1.x before 16.1.5, and 16.2.x before 16.2.4 allows DLL hijacking due to weak %SYSTEMDRIVE%\ProgramData permissions.
The ultimate-form-builder-lite plugin before version 1.3.7 for WordPress has SQL Injection, leading to PHP Object Injection via wp-admin/admin-ajax.php.
The system boot process in Lenovo E95 and ThinkCentre M710s/M710t is not adequately secured because systems were shipped from the factory without completing the BIOS/UEFI initialization process.
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, allowing indefinite usage in the case of permission revocation.
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
In systemd versions 223 through 235, a remote DNS server can respond with a custom crafted NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service, causing a DoS of the affected service.
In CVE-2017-7341, an authenticated admin user can execute arbitrary system console commands via crafted HTTP requests on the file management AP script download webUI page in Fortinet FortiWLC.
In phpCollab version 2.5.1 and earlier, there is an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the id parameter in newsdesk/newsdesk.php.
The Private Internet Access (PIA) application from London Trust Media before version 1.3.3.1 for Android allows remote attackers to cause application crashes by providing a large VPN server-list file.
D-Link DGS-1500 Ax devices before version 2.51B021 have a hardcoded password, allowing remote attackers to gain shell access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS