CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy allows authentication bypass and access to an endpoint that executes attacker-supplied script code without sandboxing, leading to arbitrary code execution.
The Bearer token signature is not verified in the last step of SAML2 authentication for Impala's hs2-http interface, allowing alteration of the username and impersonation of another user. This affects Apache Impala versions >= 4.0.0.
Missing Authorization and Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This affects versions from 1.10 through 1.22.
Missing Authorization and Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This affects versions from 1.10 through 1.22.
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.
A use of less trusted source vulnerability in the PayTR Virtual Pos iFrame API WHMCS Module allows exploitation of trusted identifiers. This issue affects versions from v9.0.0 before v9.0.3.
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
Buffer overflow in ANGLE in Google Chrome on Windows prior to 153.0.8010.36. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.
Out-of-bounds read in WebGL in Google Chrome prior to 153.0.8010.36. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.
Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
Integer overflow in GPU in Google Chrome on Android prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
Use-after-free in Extensions in Google Chrome on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Severity is medium.
Use-after-free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Severity is low.
Out of bounds write in ANGLE in Google Chrome on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)
Incorrect reference resolution in Extensions in Google Chrome before 153.0.8010.36. A remote attacker could potentially execute arbitrary code outside the sandbox via crafted network traffic.
Use-after-free in Sharing in Google Chrome on iOS before 153.0.8010.36. A remote attacker could execute arbitrary code outside the sandbox via crafted network traffic.
Use-after-free in the Device component in Google Chrome on Mac prior to 153.0.8010.36. A remote attacker could exploit a crafted HTML page to potentially execute arbitrary code outside the sandbox.
Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Severity: Low.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS