CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
OpenSSH w wersjach do 8.7 pozwala zdalnym atakującym na sprawdzenie, czy określona kombinacja nazwy użytkownika i klucza publicznego jest znana serwerowi SSH. Dzieje się tak, ponieważ wyzwanie jest wysyłane tylko wtedy, gdy ta kombinacja może być ważna dla sesji logowania.
In the Linux kernel, a vulnerability related to use-after-free bugs has been fixed, which occurs during the detachment of the FarSync T-series card. These issues may arise in the fst_remove_one() function, where fst_card_info is deallocated, but fst_tx_task or fst_int_task may still be active.
A vulnerability in the Linux kernel related to improper management of the reconnect-pending bit in the net/rds module has been resolved. The issue occurs when canceling the reconnect worker if it has not been scheduled beforehand.
A vulnerability has been identified in the Linux kernel that has been resolved in the TMU driver. The issue was that the TMU device could be used as both a clocksource and a clockevent provider, and the driver improperly managed the device's power.
A vulnerability in the Linux kernel related to RDS connections lacking a proper shortcut in case of connection errors has been resolved.
A vulnerability related to URB leak in the pvr2_send_request_ex function has been fixed in the Linux kernel. The issue occurs when the function successfully submits a write URB but fails to submit the read URB, leading to an immediate return without waiting for the write URB to complete.
A vulnerability in the Linux kernel related to event handler initialization in IPMB has been resolved, which does not use I2C reads but requires a value to be set. Otherwise, an I2C read will return an uninitialized value from the bus driver.
A vulnerability has been identified in the Linux kernel related to the handling of fake USB devices that can send their own report descriptors. If the input_mapping() hook is not called, the pm->input_ep82 pointer remains NULL, leading to a system crash.
A vulnerability has been identified in the Linux kernel within the ALSA usb-audio module, concerning the lack of size verification for URB packets during playback silencing. This issue may lead to uncontrolled writes outside the allocated buffer.
A vulnerability in the Linux kernel has been resolved by moving the wait_on_sem() function out of the spinlock. The issue occurred with iommu.strict=1, potentially leading to system lockups under high load conditions.
A vulnerability in the Linux kernel has been resolved that allows the rtw8822b_set_antenna() function to be called from userspace when the chip is powered off. In this case, a WARNING is triggered in rtw8822b_config_trx_mode().
A vulnerability in the Linux kernel has been fixed in the nilfs2 filesystem that could lead to block overflow and system hang. The issue occurred when executing the FITRIM command if the end_block value was too small.
A vulnerability has been identified and resolved in the Linux kernel. It concerns the scsi: qla2xxx component, where freeing memory in the error path could lead to system crashes during load/unload tests.
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function.
A vulnerability has been identified in the Linux kernel that has been resolved. The issue concerns the cper_print_fw_err() function, which does not check if the error record length is sufficient to handle the offset, potentially leading to malfunction in case of faulty firmware.
A vulnerability related to TX queue manipulation in the kaweth_set_rx_mode() function has been resolved in the Linux kernel. This function incorrectly invokes TX queue flow control operations that are unrelated to RX.
A vulnerability has been identified in the Linux kernel related to the registration of the omap_mpuio_driver in the omap_gpio_probe() function. This issue has been resolved in commit 11a78b794496.
A vulnerability related to the tile info buffer size in the AV1 module for Verisilicon has been fixed in the Linux kernel. The issue involved incorrect memory allocation for tile information, which could lead to operational errors.
A vulnerability in the Linux kernel related to error handling in the pci_slot_trylock() function has been resolved. The fix adds missing bridge locks to the pci_bus_lock() function, improving PCI device lock management.
A vulnerability in the Linux kernel related to unsound scalar forking in maybe_fork_scalars() for BPF_OR has been fixed. The issue occurred when the source operand was a constant and the dst range was signed in the range [-1, 0].