CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Information disclosure vulnerability in Microsoft Edge for Android (Chromium-based). Could allow unauthorized access to data.
The Comments Extra Fields For Post, Pages and CPT plugin for WordPress up to version 5.0 is vulnerable to Cross-Site Request Forgery. Several AJAX actions lack nonce validation, allowing unauthenticated attackers to invoke them via a forged request if they trick a site administrator into clicking a link. This can lead to modification of comment form fields and plugin settings.
The Comments Extra Fields For Post, Pages and CPT plugin for WordPress up to version 5.0 is vulnerable to Missing Authorization. Several AJAX actions lack proper capability checks, allowing authenticated attackers with subscriber access or higher to modify comment form fields and update plugin settings.
In the amdgpu driver in the Linux kernel, a potential NULL pointer dereference in amdgpu_ras_query_error_status_helper() was fixed. The function now returns -EINVAL for invalid block IDs.
In the Linux kernel, the Ceph filesystem has an incorrect lock order between a directory entry and its parent, leading to a deadlock or dead code. The fix removes the unused code.
In the Linux kernel on LoongArch architecture, a vulnerability causes a system panic during initialization when DEFERRED_STRUCT_PAGE_INIT is enabled. The issue stems from incorrect node id assignment to reserved memory blocks, leading to a NULL pointer dereference in reserve_bootmem_region(). The fix assigns all reserved memory blocks to Node#0 during initialization.
In the Linux kernel, the Ceph filesystem fails to drop messages from MDS during unmount, causing inodes to be held with ihold. With encryption enabled, this triggers a warning when removing keys and later a kernel crash when releasing inodes after superblock destruction.
In the Linux kernel, the AMD Display driver (drm/amd/display) did not wake the DMCUB before sending commands, which could cause a system hang. The fix adds waking DMCUB before command submission.
In the Linux kernel, a workaround for ARM Cortex-A520 erratum 2966298 was added. On affected cores, speculatively executed unprivileged loads might leak data from privileged loads via a cache side channel. The workaround executes a TLBI before returning to EL0.
The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress up to version 2.2.0 is vulnerable to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level permissions can inject arbitrary scripts that execute when a page is visited.
Cross-Site Request Forgery (CSRF) vulnerability in Matt Martz & Andy Stratton Page Restrict. This issue affects Page Restrict: from n/a through 2.5.5.
The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts.
Spoofing vulnerability in Microsoft Edge (Chromium-based). Could allow an attacker to impersonate trusted websites.
A vulnerability in Microsoft Edge (Chromium-based) allows information disclosure.
A flaw in the AMD SPI protection feature allows a user with Ring0 (kernel mode) privileges to bypass protections, potentially resulting in loss of integrity and availability.
A vulnerability in Microsoft Azure File Sync allows elevation of privilege. Technical details are not provided in the description.
A Spoofing vulnerability in Microsoft Azure Active Directory B2C allows an attacker to impersonate the service or users.
A vulnerability in Windows DNS allows information disclosure. An attacker could exploit this flaw to access sensitive data.
Information disclosure vulnerability in Microsoft Teams for Android. May allow access to sensitive data.
A vulnerability in the Windows kernel allows security feature bypass. Technical details are not provided in the description.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS