CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, a race condition exists in the ETS (Enhanced Transmission Selection) network scheduler between `ets_qdisc_dequeue` and `ets_qdisc_change`. This leads to a use-after-free (UAF) on a `struct Qdisc` object, potentially allowing an attacker to hijack the execution flow.
Tenda AX-3 v16.03.12.10_CN contains a stack overflow in the wanMTU2 parameter of the fromAdvSetMacMtuWan function. Attackers can cause a Denial of Service (DoS) via a crafted request.
Tenda AX-3 v16.03.12.10_CN contains a stack overflow in the wanSpeed2 parameter of the fromAdvSetMacMtuWan function. Attackers can cause a Denial of Service (DoS) via a crafted request.
Tenda AX-3 v16.03.12.10_CN contains a stack overflow in the cloneType2 parameter of the fromAdvSetMacMtuWan function. Attackers can cause a Denial of Service (DoS) via a crafted request.
Tenda AX-3 v16.03.12.10_CN contains a stack overflow in the serviceName2 parameter of the fromAdvSetMacMtuWan function. Attackers can cause a Denial of Service (DoS) via a crafted request.
Tenda AX-3 v16.03.12.10_CN contains a stack overflow in the mac2 parameter of the fromAdvSetMacMtuWan function. Attackers can cause a Denial of Service (DoS) via a crafted request.
A stack overflow was discovered in the Tenda AX-1806 router version 1.0.0.1 in the security_5g parameter of the sub_4CA50 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
A use-after-free vulnerability was found in the Linux kernel's ALPS touchpad driver. The issue is caused by a race condition where the delayed work item dev3_register_work can be scheduled after the device is disconnected, leading to use of freed memory.
In the dtv5100 driver (dvb-usb) in the Linux kernel, there is an out-of-bounds read vulnerability in dtv5100_i2c_msg(). The rlen value is user-controlled and not checked, allowing it to be set larger than the st->data buffer size, leading to memory corruption.
A patch for the qla2xxx driver in the Linux kernel that introduced lockless command completion in the abort path has been reverted. Missing command type check (sp->cmd_type) caused a NULL pointer dereference in target mode, leading to a system crash.
In the Linux kernel's ETS (Enhanced Transmission Selection) network scheduler, a bug occurs when changing a DRR (Deficit Round Robin) class to strict mode: the class is not removed from the active list. This causes a double addition to the list when later reverting to DRR, triggering a 'list_add double add' warning and potentially destabilizing the system.
A vulnerability in the Linux kernel's KVM allows disabling the KVM_MEM_GUEST_MEMFD flag on an existing memslot, leading to a use-after-free condition. The issue stems from missing validation when toggling the flag, enabling an attacker to trigger a critical error.
In the vidtv driver in the Linux kernel, there is a use-after-free and double-free vulnerability in vidtv_channel_si_init(). After transferring memory ownership to PAT/SDT/EIT tables, local pointers are not nullified, leading to freeing already freed memory on error paths.
In the Linux kernel, the ksmbd module has a vulnerability in the smb2_set_ea function that incorrectly validates buffers for extended attributes (EA). The omission of the null terminator (+1 byte) in the EA name length can lead to validation errors.
In the Linux kernel, a vulnerability in the FUSE module was found due to list corruption in the io-uring mechanism for requests terminated before being committed. Not removing the request from the queue list leads to use-after-free issues.
In the Linux kernel's NFSD subsystem, when an NFSv4 client creates a file with an ACL containing a named principal, the server fails to apply that ACL. Instead, after file creation, the client retrieves a default ACL based on mode bits, violating RFC 8881 section 6.4.1.3.
A use-after-free vulnerability was found in the Linux kernel's mlxsw (Mellanox Spectrum) driver. The issue occurs because a neighbour pointer is stored without holding a reference, leading to access to freed memory. The fix simplifies the reference counting scheme.
In the Linux kernel, a use-after-free vulnerability was found in the mlxsw (Mellanox Spectrum) driver during multicast route stats update. Missing mutex synchronization when deleting a route entry from the list can lead to accessing freed memory.
In the Linux kernel, the caif module has an integer underflow vulnerability in the cffrml_receive() function. When FCS is disabled, the function subtracts 2 from the packet length without checking if the length is at least 2, leading to underflow.
A vulnerability in the Linux kernel's ethtool mechanism can cause a userspace buffer overflow during stats queries due to a race condition between three ioctl calls when the number of stats changes dynamically (e.g., device reconfiguration). The mitigation prevents overflow by not returning data on size mismatch, but may result in temporary stats unavailability.