CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.30 and Liferay DXP 7.4 before update 31. This allows remote attackers to inject arbitrary web scripts or HTML via the Remote App's IFrame URL.
XSS vulnerability in the Modified Facet widget in Liferay Portal from versions 7.1.0 to 7.4.3.12 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a facet label.
A cross-site scripting (XSS) vulnerability exists in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14. Remote attackers can inject arbitrary web scripts or HTML via a crafted payload injected into an App Builder custom object's 'Name' field.
CVE-2023-2064 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Minova Technology eTrace. This issue affects eTrace versions before 23.05.20.
CVE-2023-2045 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Ipekyolu Auto Damage Tracking Software versions before 4.
A stored cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.1.0 through 7.3.0 and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 5. Attackers can inject arbitrary web scripts or HTML via a crafted payload in a form's `name` field.
CVE-2023-33010 describes a buffer overflow vulnerability in the ID processing function in the firmware of Zyxel ATP series, USG FLEX, USG20(W)-VPN, VPN series, and ZyWALL/USG. This could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even remote code execution on an affected device.
CVE-2023-33009 describes a buffer overflow vulnerability in the notification function in the firmware of Zyxel ATP series, USG FLEX series, USG20(W)-VPN, VPN series, and ZyWALL/USG series. This could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even remote code execution on an affected device.
A vulnerability in the Armoli Technology Cargo Tracking System allows authorization bypass through a user-controlled key, leading to authentication abuse.
CVE-2023-2750 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Cityboss E-municipality system. This issue affects E-municipality versions before 6.05.
Wtyczka Go Pricing - WordPress Responsive Pricing Tables dla WordPressa jest podatna na nieautoryzowane przesyłanie plików z powodu niewłaściwej weryfikacji uprawnień w funkcji 'validate_upload' w wersjach do 3.3.19 włącznie. Umożliwia to uwierzytelnionym atakującym, którym administrator wcześniej przyznał dostęp do wtyczki, przesyłanie dowolnych plików na serwer dotkniętej witryny.
Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushService. This vulnerability allows attackers to launch processes with elevated privileges.
AList w wersji 3.15.1 jest podatny na błędne zarządzanie dostępem, co może być wykorzystane przez atakujących do uzyskania poufnych informacji.
Podatność CVE-2023-1508 dotyczy oprogramowania Mobilmen Terminal w systemach Adam Retail Automation, które jest podatne na atak typu SQL Injection. Problem występuje w wersjach przed 3.
A memory leak in the CConsole::Chain component of Teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) by opening a crafted file.
A vulnerability in the Finex Media Competition Management System allows unauthorized actors to access private personal information and collect data provided by users.
CVE-2023-2702 vulnerability in Finex Media Competition Management System allows authorization bypass through a user-controlled key, leading to authentication abuse.
An OS Command Injection vulnerability was found in Parks Fiberlink 210 firmware version V2.1.14_X000 via the target_addr parameter in /boaform/admin/formPing.
EasyImages versions ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.
Piwigo version 13.6.0 is vulnerable to SQL Injection in the 'profile' function.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS