CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A TSIG packet with name compression can crash DNS. Incorrect size calculations when a TSIG record contains compressed names lead to a large out-of-bounds write, causing a server crash.
A low-privilege authenticated Samba AD user can modify internal LDB special DNs via LDAP access, enabling a domain takeover.
Nodemailer's SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether it is still a partial reply on every line. The partial-response test performs string operations per line, which can lead to inefficient processing.
The iscsi-initiator-utils package version 6.2.1.11-0.git4b3e853.el10 has a stack buffer overflow vulnerability in idbm_recinfo_config. A malicious iSCSI target can inject an extra configuration line into a persisted node record via a crafted SendTargets TargetName, later causing a stack buffer overflow.
Security advisory GHSA-2hw4-c9m4-f2fj concerns the knative/pkg component. Verification on 2026-05-19 confirmed end-to-end amplification of 4.5×, worse than the advisory's conservative 2× claim. A Go proof of concept (cmd/poc-c2/main.go) was built.
Nodemailer's address parser has three published, patched fixes for RFC 5322 comment handling inside an addr-spec. The description covers earlier issues with glued domain atoms and quoted local parts, plus related ReDoS fixes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS