CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or cause excessive memory usage.
The mongo-go-driver contains a heap out-of-bounds read vulnerability in the CGo implementation for GSSAPI (Kerberos) authentication on Linux and macOS. The issue arises from incorrect assumptions about string termination in the GSSAPI standard, potentially leading to data disclosure.
When parsing input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. Attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption.
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity for specially crafted HTML inputs, which can lead to denial of service (DoS).
The html.Parse function in the golang.org/x/net/html package enters an infinite loop when processing specially crafted HTML input. An attacker can exploit this vulnerability to cause a denial of service (DoS).
A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.
No description is available for CVE-2026-6502. The nature of the vulnerability cannot be determined.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS