CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stored XSS vulnerability in the Create Site Groups function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored XSS vulnerability in the Create Provider Accounts function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored cross-site scripting (XSS) vulnerability in the Create Locations (/dcim/locations/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored cross-site scripting (XSS) vulnerability in the Create Contact Groups (/tenancy/contact-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored cross-site scripting (XSS) vulnerability in the Create Providers (/circuits/providers/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored XSS vulnerability in the Create Tenant Groups (/tenancy/tenant-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored cross-site scripting (XSS) vulnerability in the Create Circuit Types (/circuits/circuit-types/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored XSS vulnerability in the Create Rack Roles (/dcim/rack-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
The Bramble Handshake Protocol (BHP) in Briar before version 1.5.3 is not forward secure, allowing eavesdroppers to decrypt network traffic between two accounts if they later compromise both accounts.
Briar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group. Each spoofed message would need to be an exact duplicate of a legitimate message displayed alongside the spoofed one.
In Liferay Portal versions 7.4.3.48 through 7.4.3.76 and Liferay DXP updates 48 through 76, there is a vulnerability to ReDoS attacks through the use of regular expressions as patterns. Remote attackers can exploit this flaw to consume excessive server resources via crafted request URLs.
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier, the default configuration does not require users to verify their email address, allowing remote attackers to create accounts using fake email addresses or addresses they do not control.
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67 and Liferay DXP 7.4 update 67 does not limit Document and Media files that can be downloaded from a Form, allowing remote attackers to download any file via a crafted URL.
SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17 and Liferay DXP 7.3 before update 6 and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. Exploitation of this vulnerability requires chaining with other attacks.
A cross-site scripting (XSS) vulnerability exists in the Layout module in Liferay Portal versions 7.3.4 through 7.4.3.68 and Liferay DXP 7.3 before update 24 and 7.4 before update 69. It allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.
The Account module in Liferay Portal from versions 7.4.3.21 to 7.4.3.62 and Liferay DXP 7.4 from update 21 to 62 has a cross-site scripting (XSS) vulnerability. Attackers can inject arbitrary web scripts or HTML via crafted payloads in user text fields such as First Name, Middle Name, Last Name, or Job Title.
CVE-2023-33942 describes a cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Portal 7.4.3.50 and Liferay DXP 7.4 update 50. It allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a web content article's 'Title' field.
Multiple cross-site scripting (XSS) vulnerabilities in the OAuth2ProviderApplicationRedirect class of the Plugin for OAuth 2.0 module in Liferay Portal 7.4.3.41 through 7.4.3.52 and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web scripts or HTML via the (1) code or (2) error parameter.
A Cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.30 and Liferay DXP 7.4 before update 31. This allows remote attackers to inject arbitrary web scripts or HTML via the Remote App's IFrame URL.
XSS vulnerability in the Modified Facet widget in Liferay Portal from versions 7.1.0 to 7.4.3.12 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a facet label.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS