CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability has been identified in the Linux kernel within the dpaa2-switch driver, which involves a lack of validation for the num_ifs value against the maximum allowed number of interfaces. This can lead to out-of-bounds writes.
In the Linux kernel, a vulnerability related to a 'scheduling while atomic' bug in the mlx5e_ipsec_init_macs() function has been fixed. This was resolved by replacing mlx5_query_mac_address() with ether_addr_copy() to directly obtain the local MAC address.
In the Linux kernel, a vulnerability related to error handling in the probe function of the mtk-mdp module has been fixed. The mtk_mdp_unregister_m2m_device() function was added in the error handling path and a check for the return value of vpu_get_plat_device() was implemented to prevent null pointer dereference.
A vulnerability related to error handling after finding a match in an async connection has been fixed in the Linux kernel. Once a match with an fwnode is found, a sub-device may be registered, and its bound operation is called.
A race condition in the Go database/sql package can overwrite expected results when a query is cancelled during the Scan method call while other queries run in parallel.
The RedirectSlashes function in middleware/strip.go is vulnerable to host header injection leading to an open redirect. This is considered lower-severity as it cannot be exploited from browsers or email clients.
A vulnerability in cross-origin redirect handling causes Proxy-Authorization and Proxy-Authenticate headers to persist, potentially leaking sensitive authentication data.
A vulnerability in the assembly implementation of an internal cryptographic function on the ppc64le architecture leaks a few bits of secret scalars due to the use of a variable-time instruction. Based on how this function is used, the leakage is not sufficient to recover the private key.
A vulnerability in the os package of the Go standard library allows improper access to the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") opens the parent directory, bypassing access restrictions.
In the Linux kernel, a fake timeout has been removed to avoid request leaks. This change requires drivers to be responsible for calling blk_should_fake_timeout() at appropriate code paths.
A vulnerability related to a memory leak in the error path in the radio-keene module has been fixed in the Linux kernel. The issue occurred in the usb_keene_probe() function, where a failure in device registration could lead to a memory leak.
A vulnerability in the Linux kernel has been resolved related to the lack of SRCU protection when reading PDPTR registers in the __get_sregs2() function. Reading these registers may lead to unauthorized access to guest memory.
A vulnerability has been identified and resolved in the Linux kernel. It concerns the deletion of empty attribute leaf freemap entries.
A vulnerability has been identified in the Linux kernel related to calculating the maximum value M for scaler configuration. The issue was the lack of a check to ensure that the MIN_X_OUTPUT_SIZE register value is non-zero, which could lead to division by zero.
A vulnerability has been identified in the Linux kernel related to use-after-free in tasklets during device removal. The issue occurs when the PCA-200E or SBA-200E adapter is being detached, potentially leading to unexpected system behavior.
A vulnerability has been identified in the Linux kernel related to the fchmodat2() function, which is not included in the audit attribute class. This function, introduced in version 6.6, allows changing file attributes similarly to chmod().
A vulnerability has been identified in the Linux kernel that has been resolved. It concerns the scsi: qla2xxx module, which could cause system crashes during load/unload tests in a loop.
A vulnerability has been identified in the Linux kernel related to the asynchronous creation of sub-groups in the PCI context. This could lead to a NULL pointer dereference if the driver directory is removed before the work completes.
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
A vulnerability has been identified in the Linux kernel that could lead to a map leak in the fastrpc_put_args function. A failure in the copy_to_user() function could cause an early return without cleaning up the file descriptor list, which has been fixed.