CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4 and Liferay DXP 7.4 GA does not properly check permissions, allowing remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.
The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36 and Liferay DXP 7.4 update 1 through 36 does not properly check user permissions, allowing remote attackers to obtain the history of all friendly URLs assigned to a page.
The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, allowing remote authenticated users to view asset libraries via the UI.
A Cross Site Scripting (XSS) vulnerability has been discovered in Liferay products via the Commerce module. This affects Liferay Portal versions 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
A spoofing vulnerability in Microsoft SharePoint Server allows an attacker to impersonate a trusted resource or user. Exploitation could lead to tricking users and disclosing sensitive information.
A vulnerability in Microsoft Excel allows information disclosure. An attacker could exploit this flaw to access data that should be protected.
A vulnerability in Microsoft Excel allows security feature bypass. An attacker could exploit this flaw to bypass protective mechanisms and gain unauthorized access.
Information Disclosure vulnerability in Microsoft Word. Could allow an attacker to read data that should not be accessible.
Vulnerability allowing bypass of BitLocker security features. An attacker could bypass BitLocker protections and gain unauthorized access to encrypted data.
A vulnerability in Windows GDI+ allows information disclosure. An attacker could exploit this flaw to access sensitive data.
An information disclosure vulnerability in the RADIUS protocol in Network Policy Server (NPS) allows an attacker to gain access to sensitive data. The flaw could be exploited to intercept authentication information or other data transmitted over the network.
Security feature bypass vulnerability in Windows Mark of the Web. It allows an attacker to bypass security protections related to files downloaded from the internet.
Denial of Service vulnerability in Windows Point-to-Point Tunneling Protocol (PPTP). Can cause failure of network services.
Windows Group Policy Elevation of Privilege Vulnerability.
Information disclosure vulnerability in Microsoft Dynamics Business Central. Could allow an attacker to read sensitive business data.
A vulnerability in .NET Framework allows information disclosure. An attacker could exploit this flaw to access data that should be protected.
A vulnerability in Microsoft Word allows information disclosure. An attacker could exploit this flaw to access data that should be protected.
A vulnerability in the Windows Human Interface Device driver allows information disclosure.
Security feature bypass vulnerability in Windows Mark of the Web. It allows an attacker to bypass security protections related to files downloaded from the internet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS