CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, a vulnerability was found in the AMDGPU driver for JPEG v3.0 decoder. JPEG rings do not support 64-bit user fence writes, which may cause CS submissions with such fences to be rejected.
A vulnerability was found in the Linux kernel's AMDGPU driver for JPEG v4.0 rings. JPEG rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.
A vulnerability was found in the Linux kernel's AMDGPU driver for JPEG v4.0.3 rings. JPEG rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.
In the Linux kernel, a vulnerability was found in the AMDGPU driver for JPEG v4.0.5 rings. JPEG rings do not support 64-bit user fence writes, which may cause CS submissions with user fences to be rejected.
In the Linux kernel, a vulnerability was found in the AMDGPU driver for JPEG v5.0.0 rings. JPEG rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.
A vulnerability was found in the Linux kernel's AMDGPU driver for JPEG v5.0.1 hardware. JPEG rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.
A vulnerability was found in the Linux kernel's AMDGPU driver for JPEG v5.3.0 rings. JPEG rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.
Vulnerability in fast-uri library (versions 2.3.1-4.1.0, 3.x up to 3.1.3, 2.x up to 2.4.2). Backslash is not treated as an authority delimiter, while Node's parser normalizes it to slash. Parsing discrepancy can bypass host-based policies (allowlists, SSRF filtering).
In the Linux kernel, the NTFS3 filesystem allows unprivileged users to write to reserved $LX* extended attributes (UID, GID, MOD, DEV). An attacker can set root ownership and SUID flag on their file, leading to privilege escalation to euid 0 after inode reload.
In the Linux kernel, the mt76 driver lacks a check whether the WCID (Wireless Client ID) has already been published before reinitializing the poll_list. This causes corruption of the dev->sta_poll_list structure, potentially leading to system crashes.
In the Linux kernel's mac802154 subsystem, a vulnerability was found due to missing skb_cow_data() calls before in-place cryptographic operations. LLSEC encrypt/decrypt functions modify shared skb data buffers, leading to data corruption, use-after-free, and kernel crashes under concurrent 802.15.4 traffic with security enabled.
Vulnerability in the Linux kernel ip_gre driver allows a user with CAP_NET_ADMIN in one network namespace to modify a GRE tunnel in another namespace where they lack privileges. Missing CAP_NET_ADMIN check in the target namespace.
Vulnerability in the Linux kernel AppArmor module allows bypassing connect mediation by using MSG_FASTOPEN flag in sendmsg(). A profile allowing send but blocking connect can be bypassed.
A use-after-free vulnerability was found in the rawdata deduplication loop of the AppArmor module in the Linux kernel. The issue occurs when an entry on the rawdata_list has a zero reference count and aa_get_profile_loaddata() performs an unsafe kref_get(), leading to a reference to freed memory.
In the Linux kernel, a vulnerability in keyctl_pkey_params_get_2() was found where incorrect output buffer length calculation can cause overflow when a too small buffer is provided. The fix allocates internal output with the size of the maximum cryptographic primitive length.
A use-after-free vulnerability was found in the Linux kernel's key management subsystem. A race condition between request_key() and KEYCTL_INSTANTIATE_IOV can cause use of freed request_key_auth payload memory.
In the Linux kernel F2FS filesystem, a vulnerability was found due to missing sanity checks in f2fs_get_node_folio_ra(). This can trigger a kernel BUG_ON during file truncation when a corrupted node has mismatched inode and nid in its footer.
In the Linux kernel's F2FS filesystem, the orphan inode recovery function trusts the entry_count from the checkpoint block. A corrupted value larger than F2FS_ORPHANS_PER_BLOCK causes an out-of-bounds read and interprets subsequent data as inode numbers, leading to a kernel panic.
In the Linux kernel's F2FS filesystem, is_meta_ino() unconditionally treats F2FS_COMPRESS_INO() as a meta inode even when compress_cache is disabled. This allows creating a fake internal inode with an out-of-range number, bypassing normal validation.
Vulnerability in the Linux kernel F2FS filesystem leads to a use-after-free (UAF) of f2fs_inode_info.atomic_inode during garbage collection. Missing reference counting can result in accessing freed memory.