CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
OLE Point of Sale (OPOS) drivers before version 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSPOSKeyboard.ocx for POS keyboards and POS keyboards with MSR.
OLE Point of Sale (OPOS) drivers before version 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSToneIndicator.ocx for POS keyboards and POS keyboards with MSR.
OLE Point of Sale (OPOS) drivers before version 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code. They exploit vulnerabilities involving OPOSLineDisplay.ocx for various types of customer display monitors.
OLE Point of Sale (OPOS) drivers before version 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code. This vulnerability involves OPOSMICR.ocx for various types of receipt printers.
The WebGate Embedded Standard Protocol (WESP) SDK has multiple buffer overflows that may allow remote attackers to execute arbitrary code. The attack can be carried out through various functions such as LoadImage, ChangePassword, or Connect.
A stack-based buffer overflow in WESPPlayback.WESPPlaybackCtrl.1 in WebGate WinRDS allows remote attackers to execute arbitrary code via unspecified vectors in the PrintSiteImage, PlaySiteAllChannel, StopSiteAllChannel, or SaveSiteImage functions.
The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to 'Index Out-Of-Bounds.'
Heap-based buffer overflow in the browser plugin for PTC Creo View allows remote attackers to execute arbitrary code via vectors involving setting a large buffer to an unspecified attribute.
Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in JSTL XML tags <x:parse> or <x:transform>.
The email gateway in RT (Request Tracker) versions 3.0.0 through 4.x before 4.0.23 and 4.2.x before 4.2.10 is vulnerable to an attack that can lead to denial of service via a crafted email.
Smart Proxy in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, allowing remote attackers to bypass intended authentication and execute arbitrary API requests without a certificate.
Multiple unspecified vulnerabilities in Google V8 before version 4.1.0.21, as used in Google Chrome before version 41.0.2272.76, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Array index error in the MidiManagerUsb::DispatchSendMidiData function in Google Chrome before version 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation.
Multiple unspecified vulnerabilities in Google Chrome before version 41.0.2272.76 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The getHiddenProperty function in Blink, used in Google Chrome before version 41.0.2272.76, has a name conflict with the AudioContext class. This allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that adds an AudioContext event listener and triggers 'type confusion.'
The RenderCounter::updateCounter function in Blink, used in Google Chrome before version 41.0.2272.76, does not force a relayout operation, leading to uninitialized memory for a data structure. This allows remote attackers to cause application crashes or potentially other unspecified impacts via a crafted CSS token sequence.
The DragImage::create function in Blink, used in Google Chrome before version 41.0.2272.76, does not initialize memory for image drawing. This may allow remote attackers to trigger an unspecified impact by causing a failed image decoding.
Multiple use-after-free vulnerabilities in the DOM implementation in Blink, used in Google Chrome before version 41.0.2272.76, may allow remote attackers to cause a denial of service or possibly have unspecified other impact via change events triggered by invalid input or input to read-only fields.
Multiple use-after-free vulnerabilities in the ServiceWorkerScriptCacheMap implementation in Google Chrome before version 41.0.2272.76 may allow remote attackers to cause a denial of service or potentially have unspecified other impact via calls to DeleteAndStartOver.
A use-after-free vulnerability in Blink, as used in Google Chrome before version 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect ordering of operations in the Web SQL Database thread relative to Blink's main thread.