CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stored cross-site scripting (XSS) vulnerability in the Create Circuit Types (/circuits/circuit-types/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored XSS vulnerability in the Create Rack Roles (/dcim/rack-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
IC Realtime ICIP-P2012T camera version 2.420 has an incorrect access control vulnerability. It allows unauthenticated users to access device ports.
Remote command injection vulnerability in Barracuda Email Security Gateway (appliance form factor only) affecting versions 5.1.3.001-9.2.0.006. It arises from incomplete input validation of user-supplied .tar file names, allowing a remote attacker to execute a system command with the privileges of the product. Fixed in patch BNSF-36456, automatically applied to all customer appliances.
The Introduction Client in Briar through version 1.5.3 does not implement out-of-band verification for the public keys of introducees. This allows an attacker to launch man-in-the-middle attacks against later private communication between two introduced parties.
The Bramble Handshake Protocol (BHP) in Briar before version 1.5.3 is not forward secure, allowing eavesdroppers to decrypt network traffic between two accounts if they later compromise both accounts.
Briar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group. Each spoofed message would need to be an exact duplicate of a legitimate message displayed alongside the spoofed one.
Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service through a series of long messages to a contact, resulting in repeated application crashes.
In Liferay Portal versions 7.4.3.48 through 7.4.3.76 and Liferay DXP updates 48 through 76, there is a vulnerability to ReDoS attacks through the use of regular expressions as patterns. Remote attackers can exploit this flaw to consume excessive server resources via crafted request URLs.
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier, the default configuration does not require users to verify their email address, allowing remote attackers to create accounts using fake email addresses or addresses they do not control.
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67 and Liferay DXP 7.4 update 67 does not limit Document and Media files that can be downloaded from a Form, allowing remote attackers to download any file via a crafted URL.
The Object module in Liferay Portal versions 7.4.3.4 to 7.4.3.60 and Liferay DXP 7.4 before update 61 does not segment object definitions by virtual instance in searches. This allows remote authenticated users in one virtual instance to view object definitions from a second virtual instance.
The Object module in Liferay Portal versions 7.4.3.4 to 7.4.3.48 and Liferay DXP 7.4 before update 49 does not properly isolate objects in different virtual instances. This allows remote authenticated users in one virtual instance to view objects in a different virtual instance via the OAuth 2 scope administration page.
SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17 and Liferay DXP 7.3 before update 6 and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. Exploitation of this vulnerability requires chaining with other attacks.
A cross-site scripting (XSS) vulnerability exists in the Layout module in Liferay Portal versions 7.3.4 through 7.4.3.68 and Liferay DXP 7.3 before update 24 and 7.4 before update 69. It allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.
The Account module in Liferay Portal from versions 7.4.3.21 to 7.4.3.62 and Liferay DXP 7.4 from update 21 to 62 has a cross-site scripting (XSS) vulnerability. Attackers can inject arbitrary web scripts or HTML via crafted payloads in user text fields such as First Name, Middle Name, Last Name, or Job Title.
CVE-2023-33942 describes a cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Portal 7.4.3.50 and Liferay DXP 7.4 update 50. It allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a web content article's 'Title' field.
Multiple cross-site scripting (XSS) vulnerabilities in the OAuth2ProviderApplicationRedirect class of the Plugin for OAuth 2.0 module in Liferay Portal 7.4.3.41 through 7.4.3.52 and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web scripts or HTML via the (1) code or (2) error parameter.
In RocketMQ versions 5.1.0 and below, there is a risk of remote command execution under certain conditions. Several components of RocketMQ, including NameServer, Broker, and Controller, are exposed on the extranet and lack permission verification.
Insecure permissions in MobileTrans v4.0.11 allow attackers to escalate privileges to local admin by replacing the executable file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS