CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer overflow in the SkMallocPixelRef::NewAllocate function in the Skia library, used in Google Chrome before version 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted allocation of a large amount of memory during WebGL rendering.
Multiple use-after-free vulnerabilities in the DOM implementation in Blink, used in Google Chrome before version 41.0.2272.76, may allow remote attackers to cause a denial of service or potentially other unspecified impacts via moving a SCRIPT element to different documents.
The V8LazyEventListener::prepareListenerObject function in the V8 bindings in Blink, used in Google Chrome before version 41.0.2272.76, does not properly compile listeners. This may allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage 'type confusion.'
A use-after-free vulnerability in the V8Window::namedPropertyGetterCustom function in V8 bindings in Blink, used in Google Chrome before version 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a frame detachment.
The filters implementation in Skia, as used in Google Chrome before version 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.
Integer overflow in the SkAutoSTArray implementation in Skia, used in Google Chrome before version 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a large count value, leading to an out-of-bounds write operation.
The SkBitmap::ReadRawPixels function in Skia, used in Google Chrome before version 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.
Urządzenia CPU Siemens SIMATIC S7-300 umożliwiają zdalnym atakującym wywołanie odmowy usługi (przejście w tryb defektu) poprzez wysyłanie spreparowanych pakietów na (1) port TCP 102 lub (2) Profibus.
Siemens SPC controllers (SPC4000, SPC5000, SPC6000) before version 3.6.0 are vulnerable to remote attacks that can cause denial of service by sending crafted packets.
The NVIDIA Display Driver R304 before 309.08, R340 before 341.44, R343 before 345.20, and R346 before 347.52 does not properly validate local client impersonation levels when performing a 'kernel administrator check,' which allows local users to gain administrator privileges via unspecified API calls.
An unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition allows remote attackers to bypass intended access permissions and obtain sensitive information.
An unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition allows remote attackers to escape the Java sandbox and execute arbitrary code.
Symantec NetBackup OpsCenter versions 7.6.0.2 through 7.6.1 on Linux and UNIX allows remote attackers to execute arbitrary JavaScript code via unspecified vectors.
An unspecified vulnerability in the Ninja Forms plugin before version 2.8.10 for WordPress may have unknown impact and remote attack vectors related to admin users.
SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_id parameter.
SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php.
KENT-WEB Joyful Note before 5.3 allows remote attackers to delete files or write to files, consequently executing arbitrary code.
npppd in the PPP Access Concentrator (PPPAC) on SEIL SEIL/x86 Fuji routers versions 1.00 through 3.30 and SEIL/X1, SEIL/X2, and SEIL/B1 routers versions 3.50 through 4.70 allows remote attackers to cause a denial of service (infinite loop and device hang) via a crafted SSTP packet.
The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.
SQL injection vulnerability in view_item.php in ClipBucket 2.7 RC3 allows remote attackers to execute arbitrary SQL commands via the item parameter.