CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the archive/zip package of Go causes its handling of certain invalid zip files to differ from most zip implementations. This discrepancy can be exploited to create a zip file whose content varies depending on the reading implementation. The archive/zip package now rejects such files.
A vulnerability in systemd causes systemd-coredump to ignore the kernel's fs.suid_dumpable setting, potentially leading to a local information leak.
Improper input validation in Intel PROSet/Wireless WiFi software before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Nodemailer's process-global DNS cache is keyed only by `host`, but each cache entry also stores the caller-specific TLS `servername`. When two direct SMTPS transports use the same DNS host with different `tls.servername` values, the first transport's server name is returned to the second.
VideoLAN dav1d before 1.2.0 has a race condition in thread_task.c related to dav1d_decode_frame_exit that can lead to an application crash.
Out-of-bounds write in Intel PROSet/Wireless WiFi software before version 22.140 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
A vulnerability was found in the WebRTC component of the Chromium browser. Technical details are not provided beyond a reference to the upstream bug.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS