CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability has been identified and resolved in the Linux kernel. The issue concerns the fbcon_open() function, which, if it fails, does not set the info->fbcon_par pointer, leading to later dereferencing of a NULL pointer.
A vulnerability has been identified and resolved in the Linux kernel. It concerns the HID Magic Mouse, which can cause system crashes when the input pointer is missing.
A vulnerability in the Linux kernel related to swapped parameters in the pci_{primary/secondary}_epc_epf_unlink() functions has been resolved.
A vulnerability in the Linux kernel related to the lack of error checking for the kcalloc() function in parse_thread_groups() has been resolved. The absence of this check could lead to a NULL pointer dereference.
A vulnerability has been identified in the Linux kernel within the dpaa2-switch driver, which involves a lack of validation for the num_ifs value against the maximum allowed number of interfaces. This can lead to out-of-bounds writes.
In the Linux kernel, a vulnerability related to a 'scheduling while atomic' bug in the mlx5e_ipsec_init_macs() function has been fixed. This was resolved by replacing mlx5_query_mac_address() with ether_addr_copy() to directly obtain the local MAC address.
A vulnerability has been identified in the Linux kernel's implementation of the minix filesystem, which does not support any value for s_log_zone_size other than 0. Fixes have been introduced to add required sanity checking.
A vulnerability has been identified in the Linux kernel related to the btree repair functions for free space and inode. The issue involves a lack of checking for deleted cursors when revalidating two btrees, which may lead to filesystem malfunctions.
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function.
A vulnerability has been identified and resolved in the Linux kernel. It concerns the scsi: qla2xxx component, where freeing memory in the error path could lead to system crashes during load/unload tests.
A vulnerability in the Linux kernel has been fixed in the nilfs2 filesystem that could lead to block overflow and system hang. The issue occurred when executing the FITRIM command if the end_block value was too small.
A vulnerability has been identified in the Linux kernel related to improper resource release in the most_register_interface() function. In cases of early failure before device registration, resources were not correctly released.
A vulnerability has been identified in the Linux kernel that leads to a memory leak in the atomic_destroy_state function. After several commits, slab memory increases as some drm_crtc_commit objects are not freed.
A vulnerability in the Linux kernel related to vhost has been resolved by moving the vdpa group bound check to vhost_vdpa. This reduces duplication and lowers the risk of a parent driver missing them.
A vulnerability has been identified in the Linux kernel within the wifi: libertas module, which has been resolved. The usb_tx_block() function submits cardp->tx_urb without ensuring that any previous transmission on this URB has completed.
A vulnerability in the Linux kernel has been resolved that allowed special inodes to be treated as regular files. The change introduced in commit af153bb63a33 requires any inode to be one of the specified types.
A vulnerability related to the tile info buffer size in the AV1 module for Verisilicon has been fixed in the Linux kernel. The issue involved incorrect memory allocation for tile information, which could lead to operational errors.
A vulnerability has been identified in the Classmate laptop driver in the Linux kernel, related to missing NULL pointer checks. In several places, code using the accel object may run before the address of that object is stored in the input device driver data.
A vulnerability in the Linux kernel related to validating rounded allocations in DRM_BUDDY_CONTIGUOUS_ALLOCATION has been resolved. The issue involved the requested size being rounded up to the next power of two, which could lead to errors.
A vulnerability has been identified in the Linux kernel within the USB pegasus module, which involves filling URBs with hardcoded endpoint pipes without verifying their descriptors. This may lead to improper functioning of USB devices.