CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver.
shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.
relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result.
In MISP 2.4.118 in app/Controller/TagsController.php, users can bypass intended restrictions on tagging data.
SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
The Quick Tabs module for Drupal has an XSS vulnerability in versions 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3. This allows an attacker to inject client-side scripts.
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption). This affects multiple functions such as dce112_clock_source_create(), dce100_clock_source_create(), dcn10_clock_source_create(), dcn20_clock_source_create(), dce120_clock_source_create(), dce110_clock_source_create(), and dce80_clock_source_create().
Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption).
A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a.
Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a.
A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures.
A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering kfifo_alloc() failures.
Insufficient access control in system firmware for Intel Xeon Scalable Processors, 2nd Generation Intel Xeon Scalable Processors and Intel Xeon Processors D Family may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file. The vulnerability stems from insufficient protection of temporary file operations.
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This can result in an XSS attack.
In the Linux kernel before version 5.3.5, there is a memory leak in the ql_alloc_large_buffers() function in the qla3xxx driver. A local user can trigger pci_dma_mapping_error() failures, leading to excessive memory consumption and denial of service.
A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense, FirePOWER Services for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. This is due to improper handling of HTTP requests, including over HTTPS, with maliciously crafted headers. An attacker could send malicious requests to bypass filtering and deliver malicious content to protected systems.
A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The issue is due to insufficient normalization of a text-based payload. An attacker could exploit this by sending traffic with specifically obfuscated payloads through an affected device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS