CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer overflow in the QUIC component of Google Chrome prior to 151.0.7922.72. A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
Insufficient validation of untrusted input in the Chromecast component of Google Chrome prior to 151.0.7922.72. A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
Insufficient validation of untrusted input in the ANGLE component of Google Chrome prior to 151.0.7922.72. A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
Use after free in the Views component of Google Chrome prior to 151.0.7922.72. A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
Inappropriate implementation in the Chrome for iOS component of Google Chrome on iOS prior to 151.0.7922.72. A remote attacker could potentially perform a sandbox escape via a crafted HTML page.
Cryptographic flaw in the Enterprise component of Google Chrome prior to 151.0.7922.72. An attacker in a privileged network position could bypass discretionary access control via malicious network traffic.
Use-after-free vulnerability in the Ozone component of Google Chrome prior to 151.0.7922.72. A remote attacker could potentially escape the sandbox via a crafted HTML page.
Insufficient validation of untrusted input in the ANGLE component of Google Chrome prior to 151.0.7922.72. A remote attacker could potentially escape the sandbox via a crafted HTML page.
Use-after-free vulnerability in the Views component of Google Chrome prior to 151.0.7922.72. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.
Insufficient validation of untrusted input in the Dawn component of Google Chrome on Android prior to 151.0.7922.72. A remote attacker could potentially escape the sandbox via a crafted HTML page.
The kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in get_doctor.php via the doctor and specilizationid parameters.
kishan0725 Hospital Management System 4.0 contains a SQL injection vulnerability in /hms/doctor/view-patient.php via the viewid parameter.
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in save_stud.php via the fname, lname, and student_class parameters.
SQL Injection vulnerability in CASAP Automated Enrollment System 1.0. An attacker can inject malicious SQL via the class_name parameter in update_class.php.
SQL Injection vulnerability in Hospital Management System 4.0. An attacker can inject malicious SQL via the /betweendates-detailsreports.php file.
A vulnerability in Flyto2 Core before version 2.26.6 allows an attacker to write files to arbitrary filesystem paths by controlling the output_dir parameter in the image.download module. The lack of path validation against the FLYTO_SANDBOX_DIR configuration enables writing response bytes anywhere.
A vulnerability in Flyto2 Core before version 2.26.7 in the flyto-verification service allows unauthenticated attackers to perform SSRF and steal the runner secret. The server listens on 0.0.0.0:8344 and uses a client-supplied callback_url to send a POST request with the X-Internal-Key header, bypassing target_allowed validation.
A vulnerability in consul-mcp-server versions 0.1.0 through 0.1.3 causes a Consul authentication token from one client to be reused for subsequent requests from other clients in stateless mode. Lack of session state isolation allows unauthorized access to Consul resources.
An SSRF vulnerability in IBM WebSphere Application Server 9.0, 8.5, and Liberty 17.0.0.3-26.0.0.8 occurs when the SIP container feature (sipServlet-1.1) is enabled. An attacker can use the server to send requests to internal resources.
Care Everywhere Gateway 14.3.10 contains hard-coded default credentials in the WildFly 8.2.0.Final management interface, allowing unauthenticated remote attackers to gain administrative access. Attackers can deploy a malicious WAR file via the console on port 20990 and achieve remote code execution.