CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, SMB client has a double-free vulnerability in SMB2_ioctl() replay. A response-bearing attempt can free its buffer, and if SMB2_ioctl_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.
In the Linux kernel, SMB client has a double-free vulnerability in change notify replay. A response-bearing attempt can free its buffer, and if SMB2_notify_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.
In the Linux kernel, SMB client has a double-free vulnerability in SMB2_flush() replay. SMB2_flush() keeps response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry fails before storing a new response, flush_exit frees the stale pointer again. The fix reinitializes resp_buftype and rsp_iov at the top of the replay loop.
In the Linux kernel, a problem was found in the devmap broadcast redirect for BPF with fragmented XDP frames. Cloning such frames leaves the XDP_FLAGS_HAS_FRAGS flag set without valid fragment metadata, leading to out-of-bounds access during frame release. The fix rejects fragmented frames in dev_map_enqueue_clone and dev_map_redirect_clone.
A vulnerability in the Linux kernel's nvmet_execute_disc_get_log_page() function allows an unauthenticated attacker to perform an out-of-bounds heap read when processing a Discovery Get Log Page request. Missing validation of offset and data length can lead to kernel memory leak or system panic.
In the Linux kernel, the NVMe over Fabrics (nvmet-auth) subsystem has a vulnerability due to missing bounds validation of hl and dhvlen fields in the DHCHAP_REPLY message. An attacker can send a crafted message with a small transfer length but large hl/dhvlen values, leading to out-of-bounds heap read.
In the Linux kernel's fsl-lpspi SPI driver, a bug was fixed where the RX channel was not terminated when DMA preparation for the TX channel failed. This could lead to memory corruption or a use-after-free bug, as DMA continued writing to buffers that had already been unmapped.
In the Linux kernel RDMA/rtrs-srv component, a vulnerability was found where the RDMA-Write length was not bounded to the chunk size. A malicious client can send a crafted READ request with an inflated descriptor length, causing memory read beyond the mapped chunk region.
In the Linux kernel, the RDMA/siw driver lacks validation of Read Response segment lengths against the sink buffer size. A remote peer can send oversized segments, causing an out-of-bounds write in kernel memory.
In the Linux kernel SMB (CIFS) client, a vulnerability exists where responses with overlapping data areas are rejected. The __smb2_calc_size() function clears data_length, which can make an invalid response appear valid.
In Catalyst::View::Wkhtmltopdf for Perl versions before 0.6.1, shell command injection (RCE) is possible via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization, allowing arbitrary command execution.
In GPU drivers, an integer overflow when calculating physical offsets for sparse PMRs may cause 32-bit truncation for PMRs larger than 4 GB, leading to incorrect GPU MMU mappings and potential access to unintended physical memory.
The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credentials during login. Submitting empty values for both credential fields allows an unauthenticated remote attacker to bypass authentication and establish a valid administrative session.
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys.
A vulnerability was found in the Linux kernel's blk_insert_cloned_request() function, which did not recompute the nr_integrity_segments for cloned requests. This can trigger a BUG_ON() during segment mapping when the bottom queue has stricter segmentation settings than the top queue.
In the Linux kernel's netfs subsystem, a use-after-free vulnerability was found in netfs_unlock_abandoned_read_pages(). The function accesses the folio index after clearing the NETFS_RREQ_IN_PROGRESS flag, potentially leading to dereference of freed memory.
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
Image::WebP for Perl versions before 0.3.0 bundle a vulnerable version of libwebp (0.3.0 from 2013). The module does not link to the system libwebp but uses its own compiled copy, which has known vulnerabilities including CVE-2023-4863. Any caller decoding an untrusted WebP image reaches the vulnerable decoder, and upgrading the system library does not fix the issue.
Server-Side Request Forgery (SSRF) vulnerability in Data Quality allows an unauthorized attacker to elevate privileges over a network.