CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Severity: Medium)
Inappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Heap buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Insufficient data validation in Animation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
An out-of-bounds read vulnerability in the Skia component of Google Chrome prior to 149.0.7827.53 allows a remote attacker to leak cross-origin data via a crafted HTML page.
Inappropriate implementation in Accessibility in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page.
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted video file.
Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allows a remote attacker who has compromised the renderer process to bypass same-origin policy via a crafted HTML page.
An out-of-bounds read vulnerability in the ANGLE component of Google Chrome prior to 149.0.7827.53 allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Google Chrome on iOS before version 149.0.7827.53 has a vulnerability in Autofill due to insufficient policy enforcement. A remote attacker can leak cross-origin data via a crafted HTML page.
Google Chrome on iOS before version 149.0.7827.53 has a vulnerability in Autofill due to insufficient policy enforcement. A remote attacker can leak cross-origin data via a crafted HTML page.
Google Chrome prior to version 149.0.7827.53 has an inappropriate implementation in the Input component. A remote attacker who compromised the renderer process can bypass site isolation via a crafted HTML page.
In Google Chrome prior to version 149.0.7827.53, an inappropriate implementation in Passwords allows a remote attacker to bypass same origin policy via a crafted HTML page.
Google Chrome prior to version 149.0.7827.53 had insufficient validation of untrusted input in DevTools, allowing a remote attacker who compromised the renderer process to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.
A SQL injection vulnerability was found in the unknown function of the file /admin/adminHome.ph in Online Art Gallery Shop Project 1.0. The attack can be launched remotely by manipulating the social_twitter argument. The exploit is publicly available.
A SQL injection vulnerability was identified in the unknown function of the file /admin/adminHome.php in Online Art Gallery Shop Project 1.0. The attack can be launched remotely by manipulating the social_insta argument. The exploit is publicly available.
On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS