CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in CUPS printing system versions 2.4.8 and earlier. When starting the cupsd server with a Listen configuration pointing to a symbolic link, the process can perform an arbitrary chmod on the target file.
A flaw was found in GnuTLS related to the Minerva attack, a cryptographic vulnerability that exploits deterministic behavior, leading to side-channel leaks. In specific scenarios, such as using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce values.
A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption.
In mmpstrucdata, a stack buffer overflow occurs with oversized RFC5424 structured data.
In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, the HTTP request module incorrectly parses folded headers in HTTP responses, which may lead to misinterpreting the response and using incorrect MIME headers.
Vulnerability in PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12. The HTTP_REDIRECT_STATUS variable used to check if CGI is run by the HTTP server can be controlled by the request submitter via HTTP headers.
In CPython, the email module does not properly quote newlines in email headers during serialization, allowing header injection when an email is serialized. This is a medium severity vulnerability.
Serving WebSocket protocol upgrades over an HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could use this issue to install a different revision on a repository, threatening data integrity. The issue is fixed in version 21.1.
W jądrze Linuxa rozwiązano podatność związaną z NVMe/FC, która występowała podczas inicjalizacji kontrolera. W przypadku niepowodzenia inicjalizacji, tagset administracyjny nie był zwalniany, co mogło prowadzić do problemów z zarządzaniem zasobami.
W jądrze Linuxa zidentyfikowano podatność związaną z wyciekiem pamięci w funkcji verify_header, która ustawia `*ns = NULL` przy każdym wywołaniu. Powoduje to wyciek ciągu nazw przestrzeni, który został przydzielony w poprzednich iteracjach podczas rozpakowywania wielu profili.
W jądrze Linuxa naprawiono podatność związaną z podwójnym zwolnieniem pamięci ns_name w funkcji aa_replace_profiles(). Problem występuje, gdy ns_name jest NULL po próbie rozpakowania danych użytkownika.
In the Linux kernel, in the sc16is7xx serial driver, a TX FIFO corruption was fixed that could occur when a packet was received on channel A at almost the same time as a packet was about to be transmitted on channel B.
In the Linux kernel, a proper folio cleanup was fixed in Btrfs when cow_file_range() fails. The issue involved improper handling of dirty pages.
In the Linux kernel, the JFS filesystem now checks for read-only mode before performing truncation in jfs_truncate_nolock(). This avoids errors related to writing to a read-only filesystem.
In the Linux kernel, the Bluetooth subsystem (hci_core) now disables works during hci_unregister_dev because the hci_dev is about to be freed and new submissions should not be allowed.
In the Linux kernel, in the RDMA/hns driver, a soft lockup issue under heavy CEQE load was fixed by moving CEQE handling to the BH (bottom half) context.
In the Linux kernel, in the NFS server (nfsd), a race between the laundromat thread and the free_stateid operation was fixed, which could lead to incorrect handling of expired delegations.
In the Linux kernel, an overflow in the ring-buffer's __rb_map_vma function was fixed, which occurred when calculating the number of pages (nr_pages). A check was added before the calculation to avoid the issue.
In the Linux kernel's drm/amdgpu/mes driver, a use-after-free issue exists. The fix removes the fence fallback timer to eliminate random errors.