CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A null pointer dereference issue was discovered in GNU LibreDWG 0.10 in the get_bmp function at dwgbmp.c:164. This flaw can cause a program crash.
InvoicePlane 1.5.11 lacks rate-limiting for password reset and uses a weak, predictable token generation mechanism.
A null pointer dereference issue exists in GNU LibreDWG version 0.10.2641 via htmlescape in escape.c:29. This flaw causes a denial of service (DoS) through application crash.
In GNU LibreDWG version 0.10.2641, a null pointer dereference issue exists in the output_TEXT function at dwg2SVG.c:114, causing a denial of service via application crash.
The Data Engine module in Liferay Portal 7.3.0 through 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, allowing remote authenticated users to view DDMStructures via GET API calls.
Cross-site scripting (XSS) vulnerability in the Asset Publisher app of the Asset module in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10, and 7.3 before fix pack 1. Allows remote attackers to inject arbitrary web script or HTML via the assetEntryId parameter.
Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1. Allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter.
Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1. Remote attackers can inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.
Cross-site scripting (XSS) vulnerability in the Redirect module's administration page in Liferay Portal 7.3.2 through 7.3.5 and Liferay DXP 7.3 before fix pack 1. Attackers can inject arbitrary web script or HTML via the destinationURL parameter.
Cross-site scripting (XSS) vulnerability in the Site module's membership request pages in Liferay Portal 7.0.0 through 7.3.5 and Liferay DXP 7.0-7.3 allows remote attackers to inject arbitrary web script or HTML via the comments parameter.
The Portal Store module in Liferay Portal 7.0.0 through 7.3.5 and Liferay DXP 7.0 through 7.3 does not obfuscate the S3 store's proxy password, allowing attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing.
A denial-of-service vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by enabling TOTP on behalf of another user or modifying the other user's TOTP shared secret.
JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20, and 7.2 before fix pack 10 may return overly verbose error messages. Remote attackers can use the content of these error messages to launch more focused attacks via crafted inputs.
Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.
W urządzeniach Samsung Galaxy S3 i9305 w wersji 4.4.4 odkryto problem związany z implementacją WPA, WPA2 i WPA3, która ponownie składa fragmenty z niekonsekwentnymi numerami pakietów. Atakujący może wykorzystać tę podatność do wykradania wybranych fragmentów.
Microsoft Exchange Server Security Feature Bypass Vulnerability.
InvoicePlane 1.5.11 discloses the full path of the file upload directory when using the upload feature.
Improper handling of address deregistration on failure can lead to new GPU address allocation failure. The vulnerability affects multiple Qualcomm Snapdragon platforms, including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables.
A vulnerability in the Snort detection engine of multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The issue is due to incorrect handling of specific HTTP header parameters. An attacker could exploit this by sending crafted HTTP packets through an affected device, bypassing the policy and delivering a malicious payload.
A vulnerability in the upgrade process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject commands that could be executed with root privileges on the underlying OS. This is due to insufficient input validation. Exploitation involves uploading a crafted upgrade package file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS