CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Google Chrome prior to version 147.0.7727.101, an out of bounds write in the GPU allowed a remote attacker who compromised the GPU process to potentially perform a sandbox escape via a crafted HTML page.
In Google Chrome on Windows prior to version 147.0.7727.101, there was a vulnerability related to uninitialized use in accessibility features. A remote attacker who compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
Use after free in Dawn in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
A use after free vulnerability in Viz in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
In Google Chrome prior to version 147.0.7727.101, an out of bounds read in the Media module allowed a remote attacker to execute arbitrary code by convincing a user to perform specific UI gestures on a crafted HTML page.
W Turbofan w Google Chrome przed wersją 147.0.7727.101 wystąpiła podatność typu 'Type Confusion', która umożliwiała zdalnemu atakującemu wykonanie dowolnego kodu wewnątrz piaskownicy za pomocą spreparowanej strony HTML.
Heap buffer overflow in PDFium in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
Heap buffer overflow in PDFium in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
Use after free in Graphite in Google Chrome prior to version 147.0.7727.101 allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Use after free in Codecs in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
A use after free vulnerability in Video in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Type Confusion in Turbofan in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
A use after free vulnerability in CSS in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Use after free in Prerender in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Use after free in Proxy in Google Chrome prior to version 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape via a crafted HTML page.
ApostropheCMS to otwartoźródłowy system zarządzania treścią oparty na Node.js. W wersjach 4.28.0 i wcześniejszych występuje podatność na przechowywane ataki XSS w polach związanych z SEO, gdzie dane wprowadzone przez użytkownika są renderowane bez odpowiedniego kodowania w kontekście HTML.
W wersjach IdentityIQ 8.5 (wszystkie), 8.5 przed 8.5p2 oraz 8.4 (wszystkie) przed 8.4p4, uwierzytelnieni użytkownicy z przypisaną zdolnością Debug Pages Read Only lub inną niestandardową zdolnością z prawem ViewAccessDebugPage mogą nieprawidłowo tworzyć nowe obiekty IdentityIQ. Wymagana jest aktualizacja lub zastosowanie poprawek zabezpieczeń.
Adobe Photoshop Installer is affected by an Uncontrolled Search Path Element vulnerability that could lead to arbitrary code execution in the context of the current user. An attacker can exploit this by placing a malicious library in a directory searched by the installer. Exploitation requires user interaction as the victim must run the installer.
Weblate to narzędzie do lokalizacji oparte na sieci. W wersjach przed 5.17, punkt końcowy API do łatania użytkowników nie ograniczał prawidłowo zakresu edycji. Problem ten został naprawiony w wersji 5.17.
Weblate to narzędzie do lokalizacji oparte na sieci. W wersjach przed 5.17 funkcja pobierania ZIP nie weryfikowała pobranych plików, co mogło prowadzić do śledzenia symlinków poza repozytorium. Problem został naprawiony w wersji 5.17.