CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM before version 11.5.3 HF2 and 11.6.0 HF6, as well as in other components, allows remote authenticated users with the 'Resource Administrator' role to gain elevated privileges via iCall scripts or handlers in a SOAP request.
The do_write_pids function in lxcfs.c in LXCFS before version 0.12 does not properly check permissions, allowing local users to gain privileges by writing a pid to the tasks file.
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name.
In OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e, a vulnerability allows remote attackers to cause a denial of service via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.
The Montgomery squaring implementation in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform mishandles carry propagation, leading to incorrect output. This makes it easier for remote attackers to obtain sensitive private-key information via an attack against the use of (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.
The VideoFramePool::PoolImpl::CreateFrame function in Google Chrome before version 47.0.2526.73 does not initialize memory for a video-frame data structure, which might allow remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact.
CVE-2015-8479 is a use-after-free vulnerability in the AudioOutputDevice::OnDeviceAuthorized function in Google Chrome before version 47.0.2526.73. It allows attackers to trigger a denial of service by accessing an unauthorized audio output device, potentially leading to heap memory corruption.
Multiple unspecified vulnerabilities in Google V8 before version 4.7.80.23, as used in Google Chrome before version 47.0.2526.73, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google Chrome before version 47.0.2526.73 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Integer overflow in the FontData::Bound function in Google sfntly, used in Google Chrome before version 47.0.2526.73, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted offset or length value within font data in an SFNT container.
The CJBig2_SymbolDict class in PDFium, used in Google Chrome before version 47.0.2526.73, allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a PDF document containing crafted data with JBIG2 compression.
A use-after-free vulnerability in the ContainerNode::notifyNodeInsertedInternal function in the DOM implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOMCharacterDataModified events for certain detached-subtree insertions.
In PDFium, used in Google Chrome before version 47.0.2526.73, the fxjs_v8.cpp file does not use signatures, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage 'type confusion.'
A use-after-free vulnerability in the GetLoadTimes function in the Extensions implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that modifies a pointer used for reporting loadTimes data.
The convolution implementation in Skia, used in Google Chrome before version 47.0.2526.73, does not properly constrain row lengths, allowing remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted graphics data.
The DOM implementation in Blink, used in Google Chrome before version 47.0.2526.73, does not prevent javascript: URL navigation while a document is being detached. This allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that improperly interacts with a plugin.
In Google V8, used in Google Chrome before version 47.0.2526.73, there is an improper implementation of certain map and filter operations for arrays, which may lead to denial of service (out-of-bounds memory access) or possibly other unspecified impacts via crafted JavaScript code.
The DOM implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, which is a different vulnerability than CVE-2015-6768.
The provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in Google Chrome before version 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy by leveraging a delay in window proxy clearing.
The DOM implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.