CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel's hi311x CAN driver, the missing ndo_change_mtu() implementation allows an attacker to set an invalid MTU (e.g., 9999) and send a malicious CAN XL frame via a PF_PACKET socket. This causes a buffer overflow in hi3110_hw_tx() when copying frame data, as the driver misinterprets the CAN XL frame as a regular CAN frame.
The sun4i_can driver in the Linux kernel lacks the ndo_change_mtu() implementation, allowing an attacker to set an arbitrarily large MTU. By using a PF_PACKET socket, a crafted CAN XL frame can bypass checks and trigger a 247-byte buffer overflow in the xmit() function.
The mcba_usb driver in the Linux kernel lacks the ndo_change_mtu() implementation, allowing an attacker to set an invalid MTU (e.g., 9999) and send a malicious CAN XL frame via a PF_PACKET socket. The frame bypasses standard checks and causes a 247-byte buffer overflow because the driver misinterprets the flags field as data length.
A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth stack in the hci_conn_tx_dequeue function. The issue occurs when processing HCI_EV_NUM_COMP_PKTS events due to missing proper locking of the hdev structure, leading to reading freed memory.
A use-after-free (UAF) vulnerability was discovered in the Linux kernel's Bluetooth subsystem in functions hci_acl_create_conn_sync and hci_le_create_conn_sync. The issue occurs when a pending connection (conn->state == BT_OPEN) is freed before the operation completes, leading to a write to freed memory.
A Use-After-Free (UAF) vulnerability was discovered in the Linux kernel's Bluetooth MGMT stack. The issue occurs when the mgmt_pending structure is freed while still being processed, potentially leading to access to freed memory. The fix introduces the mgmt_pending_valid function and additional locking with mgmt_pending_lock.
In the Linux kernel mlx5 network driver, there is a use-after-free (UAF) bug when releasing a flow counter. When deleting an HWS rule, the counter action may already be freed, and its structure lacks initialized refcount and mutex.
In the Linux kernel, a use-after-free vulnerability was found in the octeontx2-pf driver's otx2_tc_add_flow() function. The issue arises from calling kfree_rcu() before dereferencing the new_node pointer, potentially leading to memory corruption.
A use-after-free vulnerability was found in the Linux kernel's futex subsystem during requeue-PI operations. The race condition occurs because futex_q::task is read without proper synchronization before updating the requeue state, allowing access to freed memory.
In the Linux kernel, in futex_hash_allocate_default(), the wrong error exit label is used in copy_process(). On allocation failure, bad_fork_core_free is used, which unlocks locks that were never acquired (tasklist_lock, siglock), instead of the correct bad_fork_cancel_cgroup label.
In the Linux kernel i40e driver, the ring_len parameter from a virtual function (VF) lacks validation and is directly assigned to hardware memory context (HMC), potentially causing incorrect Tx/Rx queue configuration.
W jądrze Linuxa naprawiono podatność związaną z walidacją indeksu w funkcji i40e_validate_queue_map. Problem dotyczył iteracji po vf->ch[idx] bez odpowiedniego sprawdzenia, czy indeks znajduje się w zakresie aktywnych/zinicjalizowanych TC.
W jądrze systemu Linux naprawiono podatność związaną z walidacją indeksu w konfiguracji kolejek wiadomości i40e. Problem dotyczył iteracji po vf->ch[idx], gdzie idx nie był odpowiednio sprawdzany pod kątem zakresu aktywnych/zinicjalizowanych TC.
W jądrze Linuxa naprawiono podatność związaną z logiką walidacji wejścia w module i40e. Zmieniono warunek sprawdzający na 'większy lub równy', aby zapobiec dereferencji poza granicami.
In the Linux kernel i40e driver, VF state validation in get resources incorrectly used I40E_VF_STATE_ACTIVE, which is not the only active state. The fix uses I40E_VF_STATE_RESOURCES_LOADED, set only during resource retrieval and cleared on reset.
W jądrze Linuksa zidentyfikowano podatność związaną z brakiem sprawdzenia maksymalnej liczby filtrów, które mogą być żądane przez wirtualne funkcje (VF). Wprowadzono poprawkę, która dodaje to sprawdzenie.
In the Linux kernel, the fbcon driver has an integer overflow vulnerability in the fbcon_do_set_font function. Font size calculations can overflow with user-controlled parameters, leading to undersized allocations and buffer overflow.
In the Linux kernel iommufd subsystem, a use-after-free (UAF) vulnerability was found during file descriptor allocation abort. The fput() function does not call release() synchronously, causing premature freeing of the iommufd_object before file operations complete.
Wtyczka Dynamically Display Posts dla WordPressa jest podatna na atak SQL Injection poprzez parametr 'tax_query' we wszystkich wersjach do i włącznie z 1.1. Problem wynika z niewystarczającego zabezpieczenia dostarczonego przez użytkownika oraz braku odpowiedniego przygotowania istniejącego zapytania SQL.
Wtyczka Lisfinity Core używana w motywie WordPress Lisfinity jest podatna na eskalację uprawnień we wszystkich wersjach do 1.4.0 włącznie. Problem wynika z domyślnego przypisania roli edytora, co pozwala na nieograniczony dostęp do API.