CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In mmpstrucdata, a stack buffer overflow occurs with oversized RFC5424 structured data.
An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1, where a GDBus-based client subscribing to signals from a trusted system service on a shared computer can receive spoofed D-Bus signals from other users of the same computer.
A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This may allow an attacker to trigger memory allocation failures, causing a segmentation fault and application crash.
A vulnerability in Perl 5.30.0 through 5.38.0 allows a heap buffer overflow when compiling a crafted regular expression. An attacker can exploit this to cause a controlled buffer overflow.
The Diffie-Hellman Key Agreement Protocol allows long exponents, making certain calculations unnecessarily expensive. The 1996 van Oorschot and Wiener paper showed that appropriately short exponents can be used with adequate subgroup constraints, but these are not utilized.
A heap buffer overflow vulnerability was discovered in Perl. Affected versions include release branches 5.34, 5.36, 5.38, and 5.40, as well as development versions from 5.33.1 through 5.41.10. When non-ASCII bytes are present in the left-hand side of the `tr` operator, `S_do_trans_invmap` can overflow the buffer.
In GNOME GLib before 2.82.1, the file gio/gsocks4aproxy.c has an off-by-one error leading to a buffer overflow because SOCKS4_CONN_MSG_LEN is insufficient for a trailing null character.
In CPython, the venv module and CLI do not properly quote paths when creating a virtual environment, allowing injection of commands into activation scripts (e.g., source venv/bin/activate). This enables arbitrary code execution upon activation.
A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption.
A flaw was found in GnuTLS related to the Minerva attack, a cryptographic vulnerability that exploits deterministic behavior, leading to side-channel leaks. In specific scenarios, such as using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce values.
An integer overflow vulnerability exists in the Compound Document Binary File format parser of libgsf version v1.14.52. A specially crafted file can cause an integer overflow when processing the directory, leading to an out-of-bounds read.
Netplan leaks the private key of WireGuard to local users. Versions after 1.0 are not affected.
The nghttp2 library prior to version 1.61.0 keeps reading an unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep the HPACK context in sync. This causes excessive CPU usage to decode HPACK state.
A high severity vulnerability in the CPython zipfile module affecting zipfile.Path. When iterating over entry names in a zip archive (e.g., namelist(), iterdir()), unexpected behavior may occur. The more common zipfile.ZipFile class is unaffected.
A medium severity vulnerability in CPython where regular expressions allow excessive backtracking during tarfile.TarFile header parsing, leading to ReDoS via specially crafted tar archives.
A flaw was found in OpenJPEG where maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.
The urllib.parse.urlsplit() and urlparse() functions in Python improperly validate bracketed hosts (`[]`), accepting hosts that are not IPv6 or IPvFuture. This violates RFC 3986 and could enable SSRF attacks if a URL is processed by multiple URL parsers.
A flaw was found in the OpenJPEG project where a heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.
The go-ntlmssp package before version 0.1.1 contains a vulnerability that causes a slice out of bounds panic when processing a malicious NTLM challenge message. This can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport.
A buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to cause temporary denial of service on platforms where a 1-byte over-read leads to process termination. This affects the database server and libpq.