CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.26)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, unsafe use of simple_strtoul in nf_conntrack_sip was replaced with a new port validation function. The fix prevents out-of-bounds memory access and rejects malformed or overly long port numbers.
A use-after-free vulnerability was discovered in the Linux kernel's rtl8150 driver for USB Ethernet devices. The issue occurs when rtl8150_start_xmit() reads skb->len after usb_submit_urb() is called, while the skb buffer has already been freed by the USB completion handler. This can lead to memory corruption and potential privilege escalation.
In the Linux kernel, a potential out-of-bounds access vulnerability was found in the osdmap_decode() function of the libceph library. The ceph_decode_need() check did not account for the correct number of elements, which could lead to reading beyond the allocated buffer when processing a crafted OSD map message.
In the Linux kernel, the crush_decode() function in libceph is vulnerable to an out-of-bounds access when two fields specifying the bucket algorithm in a CRUSH map differ. This can lead to memory corruption and potential exploitation.
Feast before version 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to embed a malicious serialized Python object with an arbitrary __reduce__ method to execute OS commands as the feast service account.
Marlin Firmware up to version 2.1.2.7 (fixed in commit 1f255d1) has an out-of-bounds write vulnerability in the M421 G-code handler when MESH_BED_LEVELING is enabled. Attackers can send a crafted G-code command via USB serial, network interface, or malicious gcode file to write a controlled 32-bit float value past the z_values array bounds, corrupting firmware memory.
Capgo before version 12.128.2 contains a vulnerability in its API key generation mechanism that allows for broken authentication. API keys are exposed in frontend requests, and the backend fails to validate that keys are securely generated and bound to the authenticated user.
In the Linux kernel, the batman-adv tp_meter module has a vulnerability where uninitialized sender-specific variables are used in batadv_tp_recv_ack() and batadv_tp_stop() when called on a receiver role. A malicious ACK packet can trigger undefined behavior.
A use-after-free vulnerability was found in the Linux kernel's SCTP implementation. When handling a Stale Cookie error (transition from COOKIE_ECHOED to COOKIE_WAIT), the outqueue is not purged, leaving stale scheduler pointers. An attacker can trigger a kernel crash by sending a crafted SCTP packet.
In the Linux kernel, the batman-adv module has a vulnerability due to incorrect payload length accounting during fragment reassembly. This flaw allows malformed fragment chains to bypass validation, potentially causing a local denial of service.
The SignUp & SignIn plugin for WordPress up to version 1.0.0 contains a vulnerability allowing authentication bypass and account takeover. The issue is due to missing nonce verification, missing capability checks, and a loose equality check on the password reset code in the `pravel_change_password()` AJAX handler, enabling unauthenticated attackers to change any user's password, including administrators.
The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to and including 1.0.0. The issue arises from the lack of nonce verification and authorization checks in the `pravel_invoice_change_password()` function, allowing for easy bypass of security measures.
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution.
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution.
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution.
The GV-I/O Box 4E is a smart embedded device that supports communication over Ethernet and RS-485. The DVRSearch service, running by default on port 10001, is vulnerable to a stack overflow that can be exploited by an attacker to execute malicious code.
The GV-I/O Box 4E is a smart embedded device that is vulnerable to stack overflow due to improper handling of UDP messages. An attacker can send a specially crafted message, leading to potential buffer overflow.
The GV-I/O Box 4E is an embedded smart device that is vulnerable to stack overflow due to improper handling of UDP messages. An attacker can send a specially crafted message, potentially leading to unauthorized access or device failure.
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution.
GV-I/O Box 4E is a smart embedded device that supports communication over Ethernet and RS-485. The DVRSearch service, running by default on this device, is vulnerable to a stack overflow that can be exploited by an attacker to execute malicious code.