CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103. A remote attacker who compromised the renderer process can exploit a crafted HTML page to escape the sandbox.
A use-after-free vulnerability in Compositing in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium severity: Critical).
Use after free in Views in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTML page. This is a critical severity vulnerability.
Use-after-free vulnerability in the Autofill component of Google Chrome on Windows prior to version 149.0.7827.103. A remote attacker who convinced a user to perform specific UI gestures could potentially exploit heap corruption via a crafted HTML page.
Use-after-free vulnerability in the Bluetooth component of Google Chrome on Mac prior to version 149.0.7827.103. A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
Use-after-free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103. A remote attacker can execute arbitrary code via a malicious peripheral.
Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. This is a critical severity vulnerability.
Use-after-free vulnerability in the Aura component of Google Chrome on Windows prior to version 149.0.7827.103. A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
Fides is an open-source privacy engineering platform. From version 2.33.0 to before 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This has been patched in version 2.84.5.
A race condition in OpenVPN versions 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 leads to a use-after-free vulnerability during TLS session promotion. Remote attackers can exploit this to cause a server crash or leak heap memory.
Authorization bypass vulnerability in the WACRM automation engine prior to commit 73041bf. An authenticated attacker can access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contact_id in a POST request without tenant ownership verification. The attacker can exploit a service-role client that bypasses row-level security to modify victim contact fields (name, email, company) across tenant boundaries using only a known contact UUID.
Headplane is a feature-complete Web UI for Headscale. Prior to versions 0.6.3 and 0.7.0-beta.3, Headplane was vulnerable to a path traversal / authorization bypass in the Headscale API client used by node and user rename operations. This issue has been patched in versions 0.6.3 and 0.7.0-beta.3.
Nginx Proxy Manager versions 2.9.14 through 2.15.1 contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function. Attackers with certificates:manage permission can store a malicious payload in the dns_provider_credentials field, which is directly interpolated into a shell command without sanitization, leading to arbitrary command execution upon backend restart.
A flaw has been found in CodeAstro Student Attendance Management System 1.0. The impacted element is an unknown function of the file /attendance-php/index.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
samlify, a Node.js library for SAML SSO, prior to version 2.13.0 does not escape attribute values inserted into XML element text (e.g., <saml:AttributeValue>). A user can inject XML markup into an attribute value (e.g., email, name) and add new <saml:Attribute> elements inside the signed assertion. The IdP signs the tampered assertion and the SP accepts the injected attributes as trusted, allowing privilege escalation.
Vulnerability in Tenda F451 (versions 1.0.0.7/1.0.0.9) in the fromNatlimit function of the web management interface. Manipulation of the page argument leads to stack-based buffer overflow, enabling remote attack.
Archer MR600 v5 router contains a command injection vulnerability in the WireGuard client configuration via the web management interface. An authenticated attacker with administrative privileges can execute arbitrary commands when applying configuration changes, potentially leading to full compromise of confidentiality, integrity, and availability of the device.