CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, a vulnerability was found in the mechanism preventing timer interrupt starvation. Missing resets of the next_event_forced flag in several places, such as when the clock event state changes, may cause incorrect behavior.
A vulnerability in libfuse versions 3.18.0 through 3.18.1 causes a NULL pointer dereference and memory leak in the fuse_uring_init_queue function. A local user can exploit this to crash the FUSE daemon or exhaust system resources.
A vulnerability was found in the Linux kernel's KVM for AMD SEV. It fails to reject attempts to synchronize vCPU state with an already encrypted VMSA after the VM has been launched.
The ORAS Go library can forward registry credentials configured for one origin to a different HTTP origin during registry redirects. This occurs when fetching manifests or metadata.
In the Linux kernel, a page fault occurs in the vfio/xe driver when resetting VF devices that do not support migration. The fix reorganizes initialization to decouple migration from reset.
Missing checks in certain functions related to RMP initialization allow a local admin privileged attacker to cause misidentification of I/O memory, potentially resulting in a loss of guest memory integrity.
An improper access control vulnerability in Secure Encrypted Virtualization (SEV) allows a privileged attacker to write to the reverse map page (RMP) during Secure Nested Paging (SNP) initialization, potentially leading to loss of guest memory confidentiality and integrity.
The vulnerability in IOMMU stems from improper input validation, allowing a malicious hypervisor to reconfigure IOMMU registers. This results in loss of guest data integrity.
CoreDNS before version 1.14.0 has a vulnerability in gRPC, HTTPS, and HTTP/3 server implementations that lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections.
The email module in Python, specifically the BytesGenerator class, improperly quotes newlines in email headers during serialization, allowing header injection. This only affects usage of LiteralHeader that does not respect email folding.
The KeyTrap vulnerability in the DNSSEC protocol allows a remote attacker to cause a Denial of Service (DoS) by sending DNSSEC responses containing many DNSKEY and RRSIG records. This leads to excessive CPU consumption on the DNS server, potentially causing overload.
SQLite 3.30.1 mishandles parser-tree rewriting in the sqlite3WindowRewrite() function, affecting expr.c, vdbeaux.c, and window.c. The vulnerability is caused by incorrect error handling during window query rewriting.
An issue in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.
A critical vulnerability was found in SQLite3 up to version 3.43.0 in the sessionReadRecord function of ext/session/sqlite3session.c. Manipulation leads to a heap-based buffer overflow, potentially allowing remote code execution.
A flaw was found in systemd where uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.
A vulnerability in SQLite up to version 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. It is recommended to use the maintained package github.com/ProtonMail/go-crypto/openpgp instead.
SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.
The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the __cil_verify_classperms function, called from __cil_verify_classpermission and __cil_pre_verify_helper.
The email module in Python through 3.11.3 incorrectly parses email addresses containing special characters. The wrong portion of an RFC2822 header is identified as the value of the addr-spec.