CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Information Disclosure Vulnerability in Azure RTOS. Details are not provided in the description, but the vulnerability may lead to data leakage.
Information Disclosure Vulnerability in Azure RTOS. Details are not provided in the description, but the vulnerability may lead to data leakage.
Information Disclosure Vulnerability in Azure Sphere. Details are not provided in the description, but the vulnerability may lead to data leakage.
Information Disclosure Vulnerability in Azure RTOS. Details are not provided in the description, but the vulnerability may lead to data leakage.
All versions of GitLab CE/EE from 13.9 before 14.2.6, from 14.3 before 14.3.4, and from 14.4 before 14.4.1 have an improper access control flaw that exposes private email addresses of Issue and Merge Requests assignees to Webhook data consumers.
Assuming radio permission is gained, missing input validation in the modem interface driver prior to SMR Oct-2021 Release 1 results in a format string bug leading to kernel panic.
W Kubernetes odkryto problem bezpieczeństwa, który może umożliwić użytkownikom wysyłanie ruchu sieciowego do lokalizacji, do których normalnie nie mieliby dostępu, poprzez atak 'confused deputy'.
A vulnerability in Winner (ToneWinner) desktop speakers up to August 9, 2021 allows remote attackers to recover speech signals from the power-indicator LED using a telescope and an electro-optical sensor, known as a 'Glowworm' attack.
A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory.
libcurl keeps previously used connections in a pool for reuse if one matches the setup. Due to logic errors, the config matching function ignored 'issuercert' and compared paths case-insensitively, which could lead to libcurl reusing wrong connections.
The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any, called indirectly from cil_check_neverallow. This occurs due to missing validation of invalid statements in an optional block.
The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the cil_reset_classpermission function, called from cil_reset_classperms_set and cil_reset_classperms_list. This could lead to unexpected behavior or potential exploitation by an attacker.
The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the __cil_verify_classperms function, called from __verify_map_perm_classperms and hashtab_map. This could lead to unexpected behavior or potential exploitation by an attacker.
The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the __cil_verify_classperms function, called from __cil_verify_classpermission and __cil_pre_verify_helper.
curl 7.7 through 7.76.1 suffers from information disclosure when the `-t` command line option (CURLOPT_TELNETOPTIONS in libcurl) is used to send variable=content pairs to TELNET servers. A parser flaw caused uninitialized stack data to be sent to the server.
An observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Incorrect default permissions vulnerability in the cups package of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory. Local attackers with control of the lp users can create files as root with 0644 permissions without the ability to set the content.
curl 7.63.0 through 7.75.0 allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. libcurl can confuse session tickets from the HTTPS proxy with those from the remote server and use the wrong ticket for session resumption.
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.
The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS