CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Rclone versions 1.46.0 through 1.74.2 have a vulnerability in server mode (rcd --rc-serve) that allows unauthenticated GET and HEAD requests to execute arbitrary system commands. An attacker can craft a URL containing remote storage configuration that executes local commands during initialization.
Vulnerability in Jellyfin from version 10.9.0 to 10.11.9 allows authenticated non-admin users to write arbitrary files on the server by manipulating the Client field in the Authorization header. An attacker can use ../ sequences in this field to overwrite files in any location accessible to the Jellyfin service user, with a forced .log extension.
Jellyfin prior to version 10.11.10 has a vulnerability that allows a specially crafted MKV file with forged filename tags to exploit missing path sanitization during playback. As a result, a malicious MKV file can redirect attachment extraction to any absolute path on disk.
Jellyfin, an open-source media server, prior to version 10.11.9, had a potential XSS vulnerability that allowed a non-privileged user to execute arbitrary Javascript in the context of a logged-in Administrative user. The attack could occur through the Client header during AuthenticateByName.
A vulnerability in Jellyfin before version 10.11.10 allows FFmpeg argument injection via a specially crafted subtitle filename. An unauthenticated attacker can exploit the lack of path normalization in SubtitleEncoder, leading to arbitrary file write on the server and information disclosure.
Use after free in Autofill in Google Chrome on Windows prior to version 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Use after free in WebView in Google Chrome on Android prior to version 149.0.7827.197 allowed a local attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Use after free in Blink in Google Chrome prior to version 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Use after free in Bluetooth in Google Chrome on Mac prior to version 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a malicious peripheral.
Inappropriate implementation in Passwords in Google Chrome prior to version 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
In Google Chrome prior to version 149.0.7827.197, there was an out of bounds read and write vulnerability in Blink>InterestGroups, allowing a remote attacker to execute arbitrary code via a crafted HTML page.
Use after free in WebGL in Google Chrome on Android prior to version 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Use after free in Blink in Google Chrome prior to version 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Uninitialized use in GPU in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
A use after free vulnerability in Web Authentication in Google Chrome prior to version 149.0.7827.197 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
A use-after-free vulnerability in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Use-After-Free vulnerability in the FileSystem component in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue was rated as High severity in Chromium security.
A Use-After-Free vulnerability in the Digital Credentials component in Google Chrome on Mac prior to version 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is rated as High severity in Chromium.
A race condition in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.