CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting certain operations.
A TSIG packet with name compression can crash DNS. Incorrect size calculations when a TSIG record contains compressed names lead to a large out-of-bounds write, causing a server crash.
When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects applications using HSTS and URLs with the insecure HTTP:// scheme.
When curl is told to use the Certificate Status Request TLS extension (OCSP stapling) to verify the server certificate, it might fail to detect some OCSP problems and wrongly consider the response as fine if the returned status reports another error than expected.
An issue in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.
A flaw was found in systemd where uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.
An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsi_rsp_handler_oem() to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure.
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity for specially crafted HTML inputs, which can lead to denial of service (DoS).
No description is available for CVE-2026-6502. The nature of the vulnerability cannot be determined.
A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS