CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in PCRE before version 8.43 allows a subject buffer over-read in JIT when UTF is disabled and \X or \R has more than one fixed quantifier, related to CVE-2019-20454.
`NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory entry inside `secrets_dir` that is a symbolic link pointing outside `secrets_dir` is followed, allowing access to files outside the configured directory.
The development server contains a path traversal vulnerability on Windows when serving files from `servedir`. Due to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instead of a Windows-aware path normalization function, it is possible to craft malicious requests.
An issue was discovered in py-lmdb 0.97 where mdb_node_del does not validate a memmove in the case of an unexpected node->mn_hi, leading to an invalid write operation. This occurs when accessing a data.mdb file supplied by an attacker.
The ifconfig command in Linux kernel 2.2 and later does not report when the network interface is in promiscuous mode if it was enabled using PACKET_MR_PROMISC. This could allow attackers to sniff network traffic undetected.
A vulnerability in the Linux kernel related to vhost has been resolved by moving the vdpa group bound check to vhost_vdpa. This reduces duplication and lowers the risk of a parent driver missing them.