CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity for specially crafted HTML inputs, which can lead to denial of service (DoS).
In the cryptography package for Python before version 3.3.2, sequences of update calls for symmetric encryption of multi-GB data can cause integer overflow and buffer overflow, as demonstrated with the Fernet class.
An issue was discovered in py-lmdb 0.97 where for certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. This occurs when accessing a data.mdb file supplied by an attacker.
A flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer.
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function.
A vulnerability related to sync handling in amdgpu has been resolved in the Linux kernel. Invalidating a dmabuf can impact other users of the shared buffer object (BO).
A vulnerability has been identified in the Linux kernel related to a potential memory leak in the tw9903_probe() function. Memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed in one of the error paths.
A vulnerability has been identified in the Linux kernel's netfilter module related to the TCP option parser. The issue arises from the lack of validation of the remaining option length before reading, which could lead to unexpected behavior.
A vulnerability has been identified in the Linux kernel that has been resolved. The issue concerns the cper_print_fw_err() function, which does not check if the error record length is sufficient to handle the offset, potentially leading to malfunction in case of faulty firmware.
A vulnerability in the Linux kernel has been resolved that allowed special inodes to be treated as regular files. The change introduced in commit af153bb63a33 requires any inode to be one of the specified types.
A vulnerability in the Linux kernel related to the IOMMU mechanism has been resolved, concerning flushing dev-IOTLB only when the PCIe device is accessible in scalable mode.
A vulnerability related to TX queue manipulation in the kaweth_set_rx_mode() function has been resolved in the Linux kernel. This function incorrectly invokes TX queue flow control operations that are unrelated to RX.
A vulnerability has been identified in the Linux kernel related to bitmap leaks in the octeontx2-af module. RX/TX flow-control bitmaps are allocated but never freed, leading to memory issues.
A vulnerability in the Linux kernel related to error handling in the pci_slot_trylock() function has been resolved. The fix adds missing bridge locks to the pci_bus_lock() function, improving PCI device lock management.
A vulnerability in the Linux kernel has been fixed related to the imx_rproc_elf_find_loaded_rsc_table() function, which could incorrectly report a loaded resource table even when the current firmware does not provide one.
A vulnerability has been identified in the Linux kernel related to the registration of the omap_mpuio_driver in the omap_gpio_probe() function. This issue has been resolved in commit 11a78b794496.
A vulnerability has been identified in the Linux kernel related to the xfs_attr_leaf_hasname function, which may return a NULL buffer on attribute read errors. This issue has been resolved.
A vulnerability has been identified in the Linux kernel related to the btree repair functions for free space and inode. The issue involves a lack of checking for deleted cursors when revalidating two btrees, which may lead to filesystem malfunctions.
A vulnerability related to the tile info buffer size in the AV1 module for Verisilicon has been fixed in the Linux kernel. The issue involved incorrect memory allocation for tile information, which could lead to operational errors.
In the Linux kernel, a vulnerability related to a reference leak in mtk_mdp_remove() has been fixed. The issue was resolved by adding platform_device_put() to prevent the reference leak.