CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Inappropriate implementation in Google Lens in Google Chrome prior to 149.0.7827.53. A remote attacker can bypass navigation restrictions via a crafted HTML page.
Insufficient validation of untrusted input in Plugins in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Severity: Low)
Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform privilege escalation via a crafted HTML page.
Inappropriate implementation in Extensions of Google Chrome prior to version 149.0.7827.53. A remote attacker who had compromised the renderer process could perform privilege escalation via a crafted HTML page.
SQL injection vulnerability in SourceCodester Ship Ferry Ticket Reservation System (up to 1.0) in /admin/login.php via Username argument. Remote attack, exploit public.
The Gutenberg Essential Blocks plugin for WordPress up to version 6.1.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the `save_ai_generated_image()` function. Authenticated attackers with Author-level access or higher can make requests to arbitrary external and internal locations, potentially reading or modifying data from internal services.
Microsoft Copilot is vulnerable to command injection due to improper neutralization of special elements used in commands. This allows an authorized attacker to execute code over a network.
A vulnerability in the CLI of Cisco Catalyst SD-WAN devices (Controller, Manager, Validator) allows an authenticated local attacker with netadmin privileges to execute arbitrary commands as root by uploading a crafted file. The issue is due to insufficient input validation. Cisco has observed limited exploitation resulting in configuration changes on edge devices.
Insufficient validation of untrusted input in the Media component of Google Chrome prior to 149.0.7827.53 allows a remote attacker who has compromised the renderer process to perform UI spoofing via a crafted HTML page. Severity is low.
Insufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149.0.7827.53. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.
Insufficient policy enforcement in Compositing component of Google Chrome prior to 149.0.7827.53. A remote attacker who compromised the renderer process can execute arbitrary code inside a sandbox via a crafted HTML page.
Inappropriate implementation in Safe Browsing of Google Chrome on Mac prior to version 149.0.7827.53. A remote attacker could execute arbitrary code via a malicious file.
Use-after-free vulnerability in Extensions component of Google Chrome prior to 149.0.7827.53. A remote attacker can execute arbitrary code inside a sandbox via a crafted HTML page.
Use-after-free vulnerability in Chromoting component in Google Chrome on Linux prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code via malicious network traffic. Chromium security severity is Low.
An integer overflow vulnerability was found in Google Chrome prior to 149.0.7827.53 in the V8 engine. A remote attacker can exploit a crafted HTML page to execute arbitrary code inside a sandbox. (Severity: Medium)
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53. A remote attacker can potentially perform a sandbox escape via a crafted HTML page.
Use-after-free vulnerability in ServiceWorker in Google Chrome prior to 149.0.7827.53. An attacker who convinced a user to install a malicious extension could execute arbitrary code via a crafted Chrome Extension.
Out of bounds memory access in ANGLE in Google Chrome prior to 149.0.7827.53 allows a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
Use-after-free in USB in Google Chrome on Android prior to 149.0.7827.53. A remote attacker can potentially perform a sandbox escape via a crafted HTML page.
Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension.