CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The PendingScript::notifyFinished function in Google Chrome before version 49.0.2623.75 relies on memory-cache information about integrity-check occurrences, allowing remote attackers to bypass the Subresource Integrity (SRI) protection mechanism by triggering two loads of the same resource.
In Google Chrome before version 49.0.2623.75, there is an issue with object lifetimes and re-entrancy in the OnDocumentElementCreated handling. This can lead to denial of service (use-after-free) or other unspecified impacts.
Use-after-free vulnerability in Blink, as used in Google Chrome before version 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
The doapr_outch function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, allowing remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string.
The fmtstr function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which can lead to denial of service (overflow and out-of-bounds read) due to a long string.
A double free vulnerability in the dsa_priv_decode function in OpenSSL before version 1.0.1s and 1.0.2 before version 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.
Cisco Nexus 3000 and 3500 devices running NX-OS versions 6.0(2)U6(1) to 6.0(2)U6(5) and 6.0(2)A6(1) to 6.0(2)A6(5) and 6.0(2)A7(1) contain hardcoded credentials. This allows remote attackers to gain root privileges via a TELNET or SSH session.
A stack-based buffer overflow in IBM Tivoli Storage Manager FastBack versions 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a daemon crash.
A stack-based buffer overflow in IBM Tivoli Storage Manager FastBack versions 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a daemon crash.
A stack-based buffer overflow in IBM Tivoli Storage Manager FastBack versions 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a daemon crash.
The FTP service in QNAP iArtist Lite before version 1.4.54, as distributed with QNAP Signage Station before version 2.0.1, has hardcoded credentials, making it easier for remote attackers to gain access via a session on TCP port 21.
Cisco Nexus 2000 Fabric Extender devices running NX-OS versions 7.0(1)N1(1), 7.0(1)N1(3), and 7.0(4)N1(1) have a blank root password, allowing local users to gain privileges via unspecified vectors.
Multiple buffer overflows in lmgrd and Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote attackers to execute arbitrary code via a crafted packet with opcode 0x107 or 0x10a.
The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation, leading to incorrect output in its implementation of the P-256 NIST elliptic curve.
In Nettle versions before 3.2, the x86_64/ecc-384-modp.asm file does not properly handle carry propagation, leading to incorrect output in its implementation of the P-384 NIST elliptic curve.
The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation, leading to incorrect output in its implementation of the P-256 NIST elliptic curve.
Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors.
The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments before version 6.3.2.5, 6.4.3.1, and 7.1.4, as well as Tivoli Storage FlashCopy Manager for VMware before version 3.1.1.3, 3.2.0.6, and 4.1.4, allows remote attackers to obtain administrative privileges via a crafted URL that triggers back-end function execution.
The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, allowing remote attackers to perform administrative actions via modified JavaScript code.
SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.