CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsoft .NET Framework versions 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandle signature validation for unspecified elements of XML documents, allowing remote attackers to spoof signatures via a modified document.
Multiple unspecified vulnerabilities in Google V8 before version 4.9.385.26, as used in Google Chrome before version 49.0.2623.75, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google Chrome before version 49.0.2623.75 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
A use-after-free vulnerability in the WebRTC Audio Private API implementation in Google Chrome before version 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect reliance on the resource context pointer.
The PendingScript::notifyFinished function in Google Chrome before version 49.0.2623.75 relies on memory-cache information about integrity-check occurrences, allowing remote attackers to bypass the Subresource Integrity (SRI) protection mechanism by triggering two loads of the same resource.
In Google Chrome before version 49.0.2623.75, there is an issue with object lifetimes and re-entrancy in the OnDocumentElementCreated handling. This can lead to denial of service (use-after-free) or other unspecified impacts.
Use-after-free vulnerability in Blink, as used in Google Chrome before version 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
The doapr_outch function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, allowing remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string.
The fmtstr function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which can lead to denial of service (overflow and out-of-bounds read) due to a long string.
A double free vulnerability in the dsa_priv_decode function in OpenSSL before version 1.0.1s and 1.0.2 before version 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.
Cisco Nexus 3000 and 3500 devices running NX-OS versions 6.0(2)U6(1) to 6.0(2)U6(5) and 6.0(2)A6(1) to 6.0(2)A6(5) and 6.0(2)A7(1) contain hardcoded credentials. This allows remote attackers to gain root privileges via a TELNET or SSH session.
A stack-based buffer overflow in IBM Tivoli Storage Manager FastBack versions 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a daemon crash.
A stack-based buffer overflow in IBM Tivoli Storage Manager FastBack versions 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a daemon crash.
A stack-based buffer overflow in IBM Tivoli Storage Manager FastBack versions 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a daemon crash.
The FTP service in QNAP iArtist Lite before version 1.4.54, as distributed with QNAP Signage Station before version 2.0.1, has hardcoded credentials, making it easier for remote attackers to gain access via a session on TCP port 21.
Cisco Nexus 2000 Fabric Extender devices running NX-OS versions 7.0(1)N1(1), 7.0(1)N1(3), and 7.0(4)N1(1) have a blank root password, allowing local users to gain privileges via unspecified vectors.
Multiple buffer overflows in lmgrd and Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode 0x107 or 0x10a.
The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation, leading to incorrect output in its implementation of the P-256 NIST elliptic curve.
In Nettle versions before 3.2, the x86_64/ecc-384-modp.asm file does not properly handle carry propagation, leading to incorrect output in its implementation of the P-384 NIST elliptic curve.
The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation, leading to incorrect output in its implementation of the P-256 NIST elliptic curve.