CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability was found in h2oai h2o-3 up to version 3.46.08. The impacted element is an unknown function of the /99/ImportSQLTable file related to the IBMDB2 JDBC Driver component. Manipulation of the connection_url argument causes deserialization, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8 due to improper handling of JDBC connection parameters. Attackers can bypass regular expression checks using double URL encoding, allowing them to read arbitrary system files and execute arbitrary code.
Wersje Starch 0.14 i wcześniejsze generują identyfikatory sesji w sposób niebezpieczny. Domyślny generator identyfikatorów sesji zwraca skrót SHA-1, który jest podatny na przewidywanie.
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. Fixes are available for versions 5.0.31, 5.1.20, 5.2.31, 5.4.8, and 5.5.7.
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
The SKTLab Mukbee app version 1.01.196 on Android has a vulnerability in an unknown function of the AndroidManifest.xml file of the com.dw.android.mukbee component, resulting in improper export of Android application components. The attack must be initiated locally, and the exploit is now public and may be used. The vendor was contacted but did not respond.
W AliasVault, menedżerze haseł z funkcją aliasowania e-maili, występuje podatność typu server-side request forgery (SSRF) w funkcji ekstrakcji favicon w wersjach API 0.23.0 i niższych. Ekstraktor pobiera URL dostarczony przez użytkownika, analizuje zwrócony HTML i podąża za linkiem do ikony, co może prowadzić do nieautoryzowanych żądań do wewnętrznych hostów.
A use-after-free vulnerability was found in the Linux kernel's __mark_inode_dirty() function. It occurs when one thread updates an inode's timestamp while another thread concurrently switches the writeback structure, leading to a race condition and access to freed memory.
In the Linux kernel's cfg80211 subsystem, the cmp_bss() function suffered from a use-after-free due to a memory management issue in cfg80211_update_known_bss(). The fix adjusts this function to free the last beacon frame elements only if they are not shared via the 'hidden_beacon_bss' pointer, preventing the bug.
A vulnerability related to use-after-free in the brcmfmac module has been identified in the Linux kernel. The issue arises from race conditions that may lead to improper memory access after it has been freed, potentially resulting in system crashes or unpredictable behavior.
In the Linux kernel, the mt7915 Wi-Fi driver (part of mt76) has list corruption after hardware restart. Stations are recreated, but wcid lists are not cleared, leading to re-adding unready entries.
A use-after-free vulnerability was found in the l2cap_sock_cleanup_listen() function of the Bluetooth stack in the Linux kernel. The issue is caused by a race condition between threads during socket list iteration in bt_accept_dequeue(), potentially leading to use of freed memory.
In the Linux kernel's SMC subsystem, a NULL pointer dereference was found in smc_ib_is_sg_need_sync(). When using a software RoCE device, ibdev->dma_device is NULL, leading to a kernel crash.
A NULL pointer dereference (NPD) vulnerability was found in the Linux kernel's VXLAN implementation when refreshing an FDB entry that points to a nexthop group. The issue occurs when learning is enabled and a packet tries to refresh an FDB entry without a remote destination, leading to a system crash.
W jądrze Linuxa zidentyfikowano podatność związaną z długością SSID w funkcji __cfg80211_connect_result(). Przekroczenie maksymalnej długości SSID (32 bajty) może prowadzić do uszkodzenia pamięci, co zostało naprawione poprzez dodanie odpowiednich kontroli granicznych.
In the Linux kernel, the ax25_kiss_rcv() function lacks a check for shared skbs before modification, potentially causing skb->dev to become NULL and a system crash.
In the Linux kernel, ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() were defined to ensure proper page table synchronization when calling p*d_populate_kernel(). The fix addresses intermittent boot failures on systems with 4-level paging and large persistent memory, as well as a crash in vmemmap_set_pmd() caused by accessing vmemmap before sync_global_pgds().
In the lpfc SCSI driver (Linux kernel), a use-after-free window was found in the deferred receive path. The bug was due to incorrect order of freeing the RQ buffer and clearing the context pointer, which could lead to double-free or UAF.
In the Linux kernel, the batman-adv module has an out-of-bounds read/write vulnerability in the network-coding decode function. The batadv_nc_skb_decode_packet function trusts coded_len and only checks skb->len, allowing out-of-bounds read and small write.
A vulnerability was found in Ooma Office Business Phone App up to 7.2.2 on Android. It affects an unknown part of the component com.ooma.office2. The manipulation results in improper export of android application components. The attack needs to be approached locally. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS