CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
UAC before version 3.3.0 has a command injection vulnerability in the _command_collector function, where foreach command output lines are substituted into command strings via sed without proper escaping before being evaluated with eval. Attackers can exploit malicious filenames or artifact definitions.
UAC before version 3.3.0 has a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames.
In Johnson Controls Simplex Incident Manager / Autocall Fire Administrator before version 2.01.05, there is a vulnerability of cleartext storage of sensitive information in memory. An attacker may exploit this to retrieve embedded sensitive data.
TP-Link TL-MR6400 v7 router has a stack-based out-of-bounds write vulnerability in the login request handling of the administrative web interface. An unauthenticated adjacent attacker can send a specially crafted malformed HTTP request, causing the web service process to crash.
TP-Link TL-MR6400 v7 router has a NULL pointer dereference vulnerability in the HTTP request parsing functionality. An unauthenticated remote attacker can send a specially crafted HTTP request with a malformed session cookie header, causing the HTTP service process to crash.
TP-Link TL-MR6400 v7 router has a stack-based buffer overflow vulnerability in the firmware update functionality due to unsafe processing of attacker-controlled metadata within a firmware image. An authenticated attacker can exploit this to trigger memory corruption and execute arbitrary code.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
In the Linux kernel, the route4 classifier (net/sched: cls_route) has a use-after-free bug in its fastmap cache. The classifier stores raw filter pointers in a 16-slot cache, and a race between read and write operations can lead to use of freed memory, potentially causing system crashes or privilege escalation.
In the Linux kernel, the packet_snd() function (packet send path) has an inconsistency in reading dev->hard_header_len, which can lead to an out-of-bounds write during skb construction. The issue also affects packet_sendmsg_spkt().
In the Linux kernel, the fib6_rule_suppress() function (IPv6 routing) does not clear the res->rt6 pointer after dropping a route, which can lead to use of a freed rt6_info object and trigger rcuref_put_slowpath() during release.
A vulnerability was found in the Linux kernel's vhost subsystem. The vring metadata cache (vq->meta_iotlb[]) is not reset when the vring is reconfigured via VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM while a device IOTLB is attached. This can lead to stale mappings being used, resulting in memory access outside the actually mapped region.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.