CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, a vulnerability related to a 'scheduling while atomic' bug in the mlx5e_ipsec_init_macs() function has been fixed. This was resolved by replacing mlx5_query_mac_address() with ether_addr_copy() to directly obtain the local MAC address.
A vulnerability has been identified in the Linux kernel within the dpaa2-switch driver, which involves a lack of validation for the num_ifs value against the maximum allowed number of interfaces. This can lead to out-of-bounds writes.
A vulnerability in the Linux kernel related to the missing encryption key size check upon receiving L2CAP_LE_CONN_REQ has been resolved.
A vulnerability in the Linux kernel has been resolved in rnbd-srv, related to not zeroing the rsp buffer before use. Failure to zero the buffer could lead to unintended data being sent to the client.
A vulnerability in the urllib.parse component of Python before version 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
A vulnerability in the Linux kernel related to swapped parameters in the pci_{primary/secondary}_epc_epf_unlink() functions has been resolved.
A vulnerability in the Linux kernel related to GSO frame transmission errors has been resolved. The udpgro_frglist.sh and udpgro_bench.sh tests are the most unstable tests in NIPA, leading to their failures.
A vulnerability in the Linux kernel related to reserving slots for the clk_hw structure in the 9FGV0841 has been resolved. The issue concerns the lack of sufficient slots for eight outputs, which may lead to out-of-bounds writes.
A vulnerability in the Linux kernel related to double free in the pruss_clk_mux_setup() function has been resolved. The issue occurred during the call to devm_add_action_or_reset(), which triggered pruss_of_free_clk_provider() on error.
In the Linux kernel, a vulnerability related to a resource leak in the cx25821_dev_setup() function has been fixed. The issue occurred when ioremap() failed, leading to the memory region obtained by cx25821_get_resources() not being released.
In the Linux kernel, a vulnerability related to error handling in the probe function of the mtk-mdp module has been fixed. The mtk_mdp_unregister_m2m_device() function was added in the error handling path and a check for the return value of vpu_get_plat_device() was implemented to prevent null pointer dereference.
A vulnerability has been identified in the Linux kernel within the kfd_event_page_set() function, which allows for out-of-bounds writes. This function writes data without checking the buffer size, potentially enabling unauthorized access by unprivileged users.
A vulnerability in the Linux kernel related to the lack of error checking for the kcalloc() function in parse_thread_groups() has been resolved. The absence of this check could lead to a NULL pointer dereference.
A vulnerability in the Linux kernel related to the cpumask_of_node() function has been resolved. This function could not properly handle the NUMA_NO_NODE index, potentially leading to system errors.
A vulnerability has been identified in the Linux kernel related to the dwc3_gadget_vbus_draw() function, which can be called from atomic context. This leads to invoking power-supply APIs that may cause synchronization issues as some operations may require sleeping.
A vulnerability related to error handling after finding a match in an async connection has been fixed in the Linux kernel. Once a match with an fwnode is found, a sub-device may be registered, and its bound operation is called.
A vulnerability has been identified in the Linux kernel's implementation of the minix filesystem, which does not support any value for s_log_zone_size other than 0. Fixes have been introduced to add required sanity checking.
W jądrze Linuxa rozwiązano podatność związaną z niewłaściwym inicjowaniem pakietu transportowego vmci. Funkcja vmci_transport_packet_init nieczyściła poprawnie pakietu, co mogło prowadzić do pozostawienia niezinicjowanych danych w strukturze.
W jądrze Linuxa rozwiązano podatność związaną z zarządzaniem zasobami procesora zdalnego. Problem występował, gdy rproc->state = RPROC_DETACHED był przypisany do procesora zdalnego, a funkcja rproc_handle_resources() zwracała błąd po wywołaniu rproc_attach().
W jądrze Linuxa naprawiono podatność związaną z wyścigiem danych w virtio_ring, oznaczając event_triggered jako podatny na wyścig dla KCSAN. Problem został zgłoszony przez syzbot.