CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact: TLS and DTLS connections using raw public keys...
An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.
In the POWER9 backend of GCC before version 10, optimization of multiple calls to the __builtin_darn intrinsic into a single call reduces the entropy of the random number generator. This occurs because a volatile operation was not specified.
A divide-by-zero error was discovered in py-lmdb 0.97 in the mdb_env_open2 function when mdb_env_read_header obtains a zero value for a certain size field. This issue can be triggered by supplying a crafted data.mdb file.
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually...
In GCC 4.1 through 8, the stack_protect_prologue and stack_protect_epilogue functions for ARM targets generate instruction sequences that spill the address of the stack protector guard. This allows an attacker to bypass the stack protector mechanism.
SSH clients that receive SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
A vulnerability in the urllib.parse component of Python before version 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
A vulnerability in gRPC-Go servers configured with `xds.NewGRPCServer()` allows a crafted request missing both `:authority` and `Host` headers to cause a server panic, resulting in a Denial of Service (DoS).