CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Google Chrome before version 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, allowing attackers to conduct directory traversal attacks via a file: URL.
The Zone::New function in Google V8 before version 5.0.71.47 and in Google Chrome before version 50.0.2661.102 does not properly determine when to expand certain memory allocations. This can lead to denial of service (buffer overflow) or other unspecified impacts via crafted JavaScript code.
The forEachForBinding function in V8 bindings in Blink, used in Google Chrome before version 50.0.2661.102, uses an improper creation context, allowing remote attackers to bypass the Same Origin Policy via a crafted website.
The TreeScope::adoptIfNeeded function in the DOM implementation in Blink, used in Google Chrome before version 50.0.2661.102, does not prevent script execution during node-adoption operations. This allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Multiple unspecified vulnerabilities in Google Chrome before version 50.0.2661.94 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The SerializedScriptValue::transferArrayBuffers function in WebKit in Blink, used in Google Chrome before version 50.0.2661.94, mishandles certain array-buffer data structures. This can lead to denial of service (use-after-free) or other unspecified impacts via a crafted website.
In Google Chrome before version 50.0.2661.94, there is a vulnerability in gc_callback.cc that does not prevent fallback execution once the Garbage Collection callback has started. This allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.
Blink in Google Chrome before version 50.0.2661.94 does not ensure that frames satisfy an additional check for the same renderer process, which can lead to denial of service (memory corruption) or other unspecified impacts via a crafted website.
Blink, as used in Google Chrome before version 50.0.2661.94, mishandles assertions in the WTF::BitArray and WTF::double_conversion::Vector classes. This allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted web site.
Lantronix xPrintServer devices with firmware before version 5.0.1-65 have hardcoded credentials, allowing remote attackers to gain root access via unspecified vectors.
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allow remote attackers to obtain sensitive cleartext information via unspecified vectors.
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to execute arbitrary commands via an 'access command shell-like feature.'
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for 'post-admin' login pages, allowing remote attackers to obtain sensitive information or modify data via unspecified vectors.
HPE System Management Homepage before version 7.5.5 allows local users to obtain sensitive information or modify data via unspecified vectors.
The Ninja Forms plugin before version 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
The server in Apple FileMaker before version 14.0.4 on OS X allows remote attackers to read PHP source code via unspecified vectors.
The packet-processing microcode in Cisco IOS 15.2(2)EA, 15.2(2)EA1, 15.2(2)EA2, and 15.2(4)EA on Industrial Ethernet 4000 devices and 15.2(2)EB and 15.2(2)EB1 on Industrial Ethernet 5000 devices allows remote attackers to cause a denial of service (packet data corruption) via crafted IPv4 ICMP packets.
CVE-2015-8156 describes an unquoted Windows search path vulnerability in the EEDService in Symantec Endpoint Encryption (SEE) 11.x before version 11.1.1. This allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory.
Integer overflow in imlib2 before version 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, leading to an out-of-bounds heap memory write operation.
The GIF loader in imlib2 before version 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive information via a crafted image, which triggers an out-of-bounds read.