CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability has been identified in the Linux kernel related to the registration of the omap_mpuio_driver in the omap_gpio_probe() function. This issue has been resolved in commit 11a78b794496.
A vulnerability has been identified in the Linux kernel related to the xfs_attr_leaf_hasname function, which may return a NULL buffer on attribute read errors. This issue has been resolved.
A vulnerability related to the tile info buffer size in the AV1 module for Verisilicon has been fixed in the Linux kernel. The issue involved incorrect memory allocation for tile information, which could lead to operational errors.
A vulnerability in the Linux kernel related to error handling in the pci_slot_trylock() function has been resolved. The fix adds missing bridge locks to the pci_bus_lock() function, improving PCI device lock management.
A vulnerability related to NULL pointer dereference in the ASoC: SOF: Intel: hda module has been fixed in the Linux kernel. The issue occurs when there is a mismatch between the DAI links in the machine driver and the topology, potentially leading to the playback/capture widget not being set, especially in loopback scenarios.
A vulnerability in the Linux kernel related to the lack of error checking for the kcalloc() function in parse_thread_groups() has been resolved. The absence of this check could lead to a NULL pointer dereference.
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function.
A vulnerability has been identified in the Linux kernel related to the handling of fake USB devices that can send their own report descriptors. If the input_mapping() hook is not called, the pm->input_ep82 pointer remains NULL, leading to a system crash.
A vulnerability has been identified in the Linux kernel related to improper reference counting management in the 'xfrm_state' structure. The issue occurs during the NETDEV_UNREGISTER event, leading to reference count leaks.
A vulnerability in the Linux kernel related to vhost has been resolved by moving the vdpa group bound check to vhost_vdpa. This reduces duplication and lowers the risk of a parent driver missing them.
In the Linux kernel, a vulnerability related to a reference leak in mtk_mdp_remove() has been fixed. The issue was resolved by adding platform_device_put() to prevent the reference leak.
A vulnerability has been identified in the Linux kernel within the rockchip module that may lead to ERR_PTR dereference in the rga_buf_init() function. The issue occurs when rga_get_frame() returns ERR_PTR(-EINVAL) due to an unsupported or invalid buffer type.
A vulnerability has been identified in the Linux kernel related to the dwc3_gadget_vbus_draw() function, which can be called from atomic context. This leads to invoking power-supply APIs that may cause synchronization issues as some operations may require sleeping.
A vulnerability related to error handling after finding a match in an async connection has been fixed in the Linux kernel. Once a match with an fwnode is found, a sub-device may be registered, and its bound operation is called.
A vulnerability in the urllib.parse component of Python before version 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
A vulnerability related to TX queue manipulation in the kaweth_set_rx_mode() function has been resolved in the Linux kernel. This function incorrectly invokes TX queue flow control operations that are unrelated to RX.