CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unspecified vulnerability in SAP adminadapter allows remote attackers to read or write to arbitrary files via unknown vectors.
SQL injection vulnerability in SAP BI Universal Data Integration allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to the J2EE schema.
Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via various parameters.
The Pearson eSIS Enterprise Student Information System, version 3.3.0.13 and earlier, has an SQL injection vulnerability in the password reset functionality. This allows remote attackers to execute arbitrary SQL commands via the new password.
The SIP inspection engine in Cisco Adaptive Security Appliance (ASA) Software before versions 8.2(5.48), 8.4(6.5), 9.0(3.1), and 9.1(2.5) allows remote attackers to cause a denial of service via crafted SIP packets.
Cisco Adaptive Security Appliance (ASA) Software versions before 8.2(5.48), 8.3 before 8.3(2.40), 8.4 before 8.4(7.9), 8.6 before 8.6(1.13), 9.0 before 9.0(4.1), and 9.1 before 9.1(4.3) does not properly process management-session information during privilege validation for SSL VPN portal connections. This allows remote authenticated users to gain privileges by establishing a Clientless SSL VPN session and entering crafted URLs.
Cisco Adaptive Security Appliance (ASA) Software versions before 8.2(5.47), 8.4(7.5), 8.7(1.11), 9.0(3.10), and 9.1(3.4) allows remote authenticated users to gain privileges by leveraging level-0 ASDM access.
An unspecified vulnerability in TIBCO Spotfire's authentication modules allows remote attackers to execute arbitrary code. This affects multiple versions of Spotfire Web Player, Desktop, Server, and other components.
Multiple unspecified vulnerabilities in Google V8 before version 3.24.35.22, as used in Google Chrome before version 34.0.1847.116, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google Chrome before version 34.0.1847.116 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Use-after-free vulnerability in renderer_webcolorchooser_impl.h in Google Chrome before version 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms.
A use-after-free vulnerability in Speech Dispatcher 0.7.1, used in Google Chrome before version 34.0.1847.116, allows remote attackers to cause application hang or potentially have unspecified other impact via a text-to-speech request.
The UnescapeURLWithOffsetsImpl function in Google Chrome before version 34.0.1847.116 does not properly handle bidirectional Internationalized Resource Identifiers (IRIs), which makes it easier for remote attackers to spoof URLs via crafted use of right-to-left (RTL) Unicode text.
A use-after-free vulnerability in the RenderBlock::addChildIgnoringAnonymousColumnBlocks function in Blink, as used in Google Chrome before version 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving addition of a child node.
Google V8, used in Google Chrome before version 34.0.1847.116, does not properly implement lazy deoptimization, allowing remote attackers to cause a denial of service (memory corruption) or possibly other unspecified impacts via crafted JavaScript code.
A use-after-free vulnerability in the HTMLBodyElement::insertedInto function in Blink, used in Google Chrome before version 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attributes.
A use-after-free vulnerability in the WebSharedWorkerStub::OnTerminateWorkerContext function in the Web Workers implementation in Google Chrome before version 34.0.1847.116 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger a SharedWorker termination during script loading.
Integer overflow in the SoftwareFrameManager::SwapToNewFrame function in Google Chrome before version 34.0.1847.116 may allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted mapping of a large amount of renderer memory.
Google V8, used in Google Chrome before version 34.0.1847.116, improperly performs numeric casts during typed array handling. This allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JavaScript code.
The XSS vulnerability in the Runtime_SetPrototype function in Google V8, used in Google Chrome before version 34.0.1847.116, allows remote attackers to inject arbitrary web scripts or HTML via unspecified vectors.