CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function.
A vulnerability in the Linux kernel has been fixed in the nilfs2 filesystem that could lead to block overflow and system hang. The issue occurred when executing the FITRIM command if the end_block value was too small.
A vulnerability related to sync handling in amdgpu has been resolved in the Linux kernel. Invalidating a dmabuf can impact other users of the shared buffer object (BO).
A vulnerability related to NULL pointer dereference in the ASoC: SOF: Intel: hda module has been fixed in the Linux kernel. The issue occurs when there is a mismatch between the DAI links in the machine driver and the topology, potentially leading to the playback/capture widget not being set, especially in loopback scenarios.
A vulnerability has been identified in the Linux kernel related to improper reference counting management in the 'xfrm_state' structure. The issue occurs during the NETDEV_UNREGISTER event, leading to reference count leaks.
A vulnerability has been identified in the Linux kernel related to the handling of fake USB devices that can send their own report descriptors. If the input_mapping() hook is not called, the pm->input_ep82 pointer remains NULL, leading to a system crash.
A vulnerability in the Linux kernel related to the IOMMU mechanism has been resolved, concerning flushing dev-IOTLB only when the PCIe device is accessible in scalable mode.
A vulnerability in the Linux kernel related to the lack of error checking for the kcalloc() function in parse_thread_groups() has been resolved. The absence of this check could lead to a NULL pointer dereference.
A vulnerability has been identified in the Linux kernel within the ALSA usb-audio module, concerning the lack of size verification for URB packets during playback silencing. This issue may lead to uncontrolled writes outside the allocated buffer.
A vulnerability in the Linux kernel has been resolved by moving the wait_on_sem() function out of the spinlock. The issue occurred with iommu.strict=1, potentially leading to system lockups under high load conditions.
A vulnerability has been identified in the Linux kernel related to manipulating the 'mfd_of_node_list'. A mutex has been added to ensure safety during access and modification of this list, preventing potential crashes.
A vulnerability has been identified in the Linux kernel related to the sticky mode in the SQ manager. This issue can lead to stalls when multiple SQs share an SMQ and transmit concurrently.
A vulnerability has been identified in the Linux kernel that leads to a memory leak in the atomic_destroy_state function. After several commits, slab memory increases as some drm_crtc_commit objects are not freed.
A vulnerability has been identified in the Linux kernel affecting the media: solo6x10 component. The issue was a lack of checks to ensure that the chip_id does not exceed the allowed range.
In the Linux kernel, a vulnerability related to a 'scheduling while atomic' bug in the mlx5e_ipsec_init_macs() function has been fixed. This was resolved by replacing mlx5_query_mac_address() with ether_addr_copy() to directly obtain the local MAC address.
Podatność CVE-2025-14819 dotyczy biblioteki libcurl, która podczas transferów związanych z TLS może przypadkowo ponownie wykorzystać pamięć podręczną magazynu CA, gdy opcja `CURLSSLOPT_NO_PARTIALCHAIN` jest zmieniana. Może to prowadzić do niezamierzonego użycia nieprawidłowego łańcucha certyfikatów.
n8n to platforma automatyzacji procesów roboczych typu open source. Przed wersjami 2.10.1, 2.9.3 i 1.123.22, uwierzytelniony użytkownik z uprawnieniami do tworzenia lub modyfikowania procesów roboczych mógł wykorzystać tryb zapytania SQL w węźle Merge do wykonania dowolnego kodu oraz zapisu dowolnych plików na serwerze n8n.
n8n to platforma automatyzacji procesów roboczych typu open source. Przed wersjami 1.118.0 i 2.4.0, podatność w trybie zapytania SQL w węźle Merge pozwalała uwierzytelnionym użytkownikom z uprawnieniami do tworzenia lub modyfikowania procesów roboczych na zapisanie dowolnych plików w systemie plików serwera n8n.
n8n to platforma automatyzacji procesów roboczych typu open source. Przed wersją 2.4.8 istniała podatność w węźle kodu Python, która pozwalała uwierzytelnionym użytkownikom na wydostanie się z piaskownicy Pythona i wykonanie kodu poza zamierzonymi granicami bezpieczeństwa.
Podatność związana z używaniem niewystarczająco losowych wartości w form-data umożliwia atak typu HTTP Parameter Pollution (HPP). Dotyczy to plików programowych lib/form_data.Js oraz wersji form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.