CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65. A remote attacker who had compromised the renderer process could bypass web origin policy via a crafted HTML page.
Incomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Severity: Low)
Incorrect authorization in Select in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Severity: Low)
Incorrect reference resolution in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Severity: Medium)
Improper initialization in the Network component in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. The issue has a medium severity rating.
Uninitialized resource in the Skia component in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. The issue has a low severity rating.
A vulnerability in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. The issue is related to UI misrepresentation in the Browser component.
A vulnerability in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. The issue is related to an information leak in the Canvas component.
A vulnerability in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. The issue is related to incorrect authorization in the WebProtect component.
Incorrect authorization in Downloads in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. The severity is Medium.
Missing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. The severity is Low.
Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. The severity is Low.
Information leak vulnerability in the Paint component of Google Chrome prior to 152.0.7977.65. A remote attacker can bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Information leak vulnerability in the QUIC component of Google Chrome prior to 152.0.7977.65. A remote attacker could leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. The coalescing loop uses O(N²) operations when many identical ranges are supplied, allowing CPU exhaustion. The issue is reachable server-side without authentication and can block the event loop for ~90 ms per request at the wire maximum.
Stack-buffer-underflow vulnerability in the IOFile::getLine() function in aria2 <=1.37.0.
NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of a process using visible sensitive information. Successful exploitation might lead to information disclosure.
NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials. A successful exploit might lead to information disclosure and data tampering.
NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A successful exploit might lead to code execution, information disclosure, and data tampering.
NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit might lead to information disclosure and data tampering.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS