CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page.
Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
Inappropriate implementation in Editing in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Insufficient validation of untrusted input in the Mobile component in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a malicious file.
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page.
Insufficient validation of untrusted input in Clipboard in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page.
Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Insufficient policy enforcement in the Passwords component in Google Chrome prior to 151.0.7922.72. A remote attacker who had compromised the renderer process could leak cross-origin data via a crafted HTML page.
Inappropriate implementation in the Passwords component in Google Chrome prior to 151.0.7922.72. A remote attacker who convinced a user to engage in specific UI gestures could leak cross-origin data via a crafted HTML page.
Inappropriate implementation in Skia allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
GitLab CE/EE has improper authorization checks on merge request collaboration settings, allowing an authenticated user with developer role to commit changes to a project after being removed as a member. Affected versions are 10.6 through 19.0.4, 19.1 through 19.1.2, and 19.2 through 19.2.0.
The Python library joserfc versions 1.7.1 and earlier accept JWTs with trailing padding (==), which is non-conforming to JOSE specifications. This leads to token malleability, potentially allowing bypass of token revocation or anti-replay protection.
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 are vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to execute unauthorized actions on behalf of a trusted user.
In the Zephyr system, the print_coredump_hdr() function uses the 16-bit tgt_code field from a coredump header as an index into a fixed 7-element array without bounds checking. A tgt_code >= 7 causes an out-of-bounds read, potentially disclosing device memory or causing a crash.
fuse-overlayfs before version 1.17 preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777.
A vulnerability in the Apache Traffic Server multiplexer plugin causes a chunk-decode buffer overrun on upstream input, enabling denial of service. Affects versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3; fixed in versions 9.2.15 and 10.1.4.
An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information.
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint.
An unauthenticated attacker can forcibly terminate the session of any Koollab LMS user by knowing their email address via the login kickout endpoint, leading to denial of service.