CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.
Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, allowing remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code.
In Google V8 before version 5.2.361.27 and in Google Chrome before version 52.0.2743.82, there is a vulnerability that allows API interceptors to modify a store target without setting a property. This enables remote attackers to bypass the Same Origin Policy via a crafted website.
A use-after-free vulnerability in WebKit/Source/core/editing/VisibleUnits.cpp in Blink, as used in Google Chrome before version 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code involving an @import at-rule in a Cascading Style Sheets (CSS) token sequence in conjunction with a rel=import attribute of a LINK element.
In Blink, used in Google Chrome before version 52.0.2743.82, there is a vulnerability that does not disable frame navigation during a detach operation on a DocumentLoader object. This allows remote attackers to bypass the Same Origin Policy via a crafted website.
The ChromeClientImpl::createWindow method in Blink, used in Google Chrome before version 52.0.2743.82, does not prevent window creation by a deferred frame, allowing remote attackers to bypass the Same Origin Policy via a crafted website.
CVE-2016-1709 involves a heap-based buffer overflow in the ByteArray::Get method in Google sfntly before 2016-06-10, which may lead to denial of service or unspecified other impacts via a crafted SFNT font.
The inline-installation implementation in the Chrome Web Store in the Extensions subsystem in Google Chrome before version 52.0.2743.82 does not properly consider object lifetimes during progress observation, allowing remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site.
The PPAPI implementation in Google Chrome before version 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come from the browser process. This allows remote attackers to bypass a sandbox protection mechanism via an unexpected message type.
Multiple unspecified vulnerabilities in Google Chrome before version 52.0.2743.82 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Siemens SIMATIC NET PC software before version 13 SP2 is vulnerable to an attack that can lead to an OPC UA service outage. Remote attackers can exploit crafted TCP packets to cause service unavailability.
Siemens SIMATIC WinCC versions 7.0 through SP3 and 7.2 allow remote attackers to read arbitrary WinCC station files via crafted packets.
A vulnerability in Siemens SIMATIC WinCC, SIMATIC BATCH, and SIMATIC OpenPCS allows remote attackers to execute arbitrary code via crafted packets. This affects versions before specified updates.
The kernel in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Audio in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted file.
The Login Window in Apple OS X before version 10.11.6 allows attackers to execute arbitrary code in a privileged context or obtain sensitive user information via a crafted app that leverages a 'type confusion.'
The Login Window in Apple OS X before version 10.11.6 allows attackers to execute arbitrary code in a privileged context, obtain sensitive user information, or cause a denial of service (memory corruption) via a crafted app.
The Login Window in Apple OS X before 10.11.6 does not properly initialize memory, allowing local users to cause a denial of service via unspecified vectors.
The Login Window in Apple OS X before version 10.11.6 allows attackers to gain privileges via a crafted app that leverages a 'type confusion.'
CoreGraphics in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted BMP image.