CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W jądrze systemu Linux rozwiązano podatność związaną z pstore, gdzie niewłaściwe użycie funkcji d_drop() i dput() prowadziło do problemów z liczeniem referencji. Zamiast tego, powinno się używać d_invalidate().
In the Linux kernel, the iwlwifi (mvm subsystem) driver has a vulnerability where the TX queue for the offloading TID is not guaranteed to exist during resume. In the rare case that no packets were sent on TID 0, the queue is not allocated, causing a system crash.
In the Linux kernel, a vulnerability in the netfilter nf_tables subsystem causes memory leaks when a set deletion operation fails, due to incorrect element iteration logic in the abort path that skips active instead of inactive elements.
Incorrect access control in ASUS RT-N12+ B1 and RT-N12 D1 routers allows local attackers to obtain root terminal access via the UART interface.
The Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings.
A CSV Injection vulnerability in the Asus RT-N12+ router allows an administrator to inject arbitrary commands or formulas into the client name parameter. When exported to CSV format, the injected code can be executed in another user's session upon opening the file.
A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.
A Cross Site Scripting (XSS) vulnerability in Innovaphone myPBX versions v.14r1, v.13r3, and v.12r2 allows a remote attacker to execute arbitrary code via the query parameter to the /CMD0/xml_modes.xml endpoint.
In WUZHICMS v4.1.0, a stored XSS vulnerability exists in the /affiche/admin/index.php component. Attackers can inject arbitrary scripts or HTML via the $formdata parameter.
CMSeasy version 7.7.7.9 is vulnerable to arbitrary file deletion. An attacker can exploit this vulnerability to delete critical system files.
W jądrze systemu Linux zidentyfikowano i naprawiono podatność, która mogła prowadzić do zakleszczenia (deadlock) podczas próby użycia sock_lock w funkcji .recvmsg. Zamiast tego zastosowano sk_receive_queue.lock w bt_sock_ioctl, aby uniknąć problemu z użyciem po zwolnieniu (UAF).
The WooCommerce WordPress plugin before version 8.6 fails to prevent users with at least the contributor role from leaking products they should not have access to, such as private, draft, and trashed products.
A vulnerability in ZKTeko BioTime version 8.5.4 and earlier allows a remote attacker to obtain sensitive information through the Authentication & Authorization component.
A vulnerability has been identified in the Linux kernel related to null pointer dereference in the ALSA usb-audio module. This issue has been resolved by adding a null check before dereferencing the cs_desc pointer.
W jądrze Linuxa zidentyfikowano podatność związaną z obsługą przerwań SCSI w module UFS. Problem ten został rozwiązany poprzez poprawę obsługi komendy abort w kodzie źródłowym.
A user enumeration vulnerability was found in Portainer CE 2.19.4. During the authentication process, a difference in response time allows a remote unauthenticated attacker to determine if a username is valid.
A NullPointerException was discovered in Time4J Base v5.9.3 in the FormatUtils::useDefaultWeekmodel(Locale) method. Note: multiple third parties dispute the existence of this vulnerability, citing insufficient evidence.
A NullPointerException was discovered in JGraphT Core version 1.5.2 within the compare method of the ToleranceDoubleComparator class. However, multiple third parties dispute the existence of this vulnerability, suggesting the report may be based on an insufficiently robust tool.
W jądrze systemu Linux rozwiązano podatność związaną z błędnym mapowaniem pamięci w systemie Sparse-Memory/vmemmap. Poprawka zapewnia, że pierwsza strona vmemmap będzie mapowana do pierwszej strony pamięci fizycznej, co pozwala na prawidłowe operacje związane z konwersją adresów.
In the Linux kernel, a bug was found in wakeup_kswapd() called with an invalid zone index (-1) on NUMA systems without local memory on a node, causing a page fault and system crash.