CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Joomla! CMS versions 2.5.x before 2.5.19 and 3.x before 3.2.3 allow remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.
SQL injection vulnerability in Joomla! CMS versions 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Joomla! versions 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allow remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code.
The vulnerability in visionmedia send before version 0.8.4 for Node.js involves a partial comparison for verifying whether a directory is within the document root, allowing remote attackers to access restricted directories.
Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.php or (2) id parameter to lib/events/eventinfo.php.
Multiple unspecified vulnerabilities in Google V8 before version 3.28.71.15, as used in Google Chrome before version 38.0.2125.101, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google Chrome before version 38.0.2125.101 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
In Google Chrome before version 38.0.2125.101 on Windows, there is an issue with improper implementation of read-only restrictions on shared memory, allowing attackers to bypass a sandbox protection mechanism.
Use-after-free vulnerability in the Web Workers implementation in Google Chrome before version 38.0.2125.101 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
The SessionService::GetLastSession function in Google Chrome before version 38.0.2125.101 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors that leverage 'type confusion' for callback processing.
A use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in the DOM implementation in Blink, used in Google Chrome before version 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
A use-after-free vulnerability in Blink, used in Google Chrome before version 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers a widget-position update improperly interacting with the render tree.
A use-after-free vulnerability in the Event::currentTarget function in Blink, used in Google Chrome before version 38.0.2125.101, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code that accesses the path property of an Event object.
The chrome_pdf::CopyImage function in the PDFium component in Google Chrome before version 38.0.2125.101 does not properly validate image-data dimensions, which may lead to denial of service (out-of-bounds read) or other unspecified impacts.
Google Chrome before 38.0.2125.101 and Chrome OS before 38.0.2125.101 do not properly handle the interaction of IPC and Google V8, allowing remote attackers to execute arbitrary code via vectors involving JSON data, related to improper parsing of an escaped index by ParseJsonObject in json-parser.h.
An unspecified vulnerability in administrative interfaces in ArubaOS 6.3.1.11, 6.3.1.11-FIPS, 6.4.2.1, and 6.4.2.1-FIPS on Aruba controllers allows remote attackers to bypass authentication and obtain potentially sensitive information or add guest accounts via an SSH session.
The ARI Framework module in FreePBX before version 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 has a vulnerability that allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function.
gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary commands via the (1) a1 or (2) a2 parameter in a restart action.
CVE-2014-6433 vulnerability in GoPro HERO 3+ allows remote attackers to execute arbitrary files via the a1 or a2 parameter in a start action.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS