CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Wtyczka 'Follow Me Plugin' dla WordPressa jest podatna na atak typu Cross-Site Request Forgery w wersjach do 3.1.1 włącznie. Brak walidacji nonce w funkcji FollowMeIgniteSocialMedia_options_page() umożliwia nieautoryzowanym atakującym modyfikację ustawień wtyczki oraz wstrzykiwanie złośliwego JavaScriptu poprzez sfałszowane żądanie.
In Liferay Portal and DXP, the Test LDAP Users functionality exposes LDAP credentials in the page URL when paginating through the user list. Man-in-the-middle attackers or those with access to request logs can capture these credentials.
Liferay products are missing SSL certificate validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.
An IDOR vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.
The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4 and Liferay DXP 7.4 GA does not properly check permissions, allowing remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.
The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36 and Liferay DXP 7.4 update 1 through 36 does not properly check user permissions, allowing remote attackers to obtain the history of all friendly URLs assigned to a page.
The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, allowing remote authenticated users to view asset libraries via the UI.
A Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module.
A ReDoS vulnerability in the LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume excessive server resources via a crafted payload injected into the 'name' field of a layout prototype.
A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to create or overwrite existing files on the filesystem via the installation of a malicious Elasticsearch Sidecar plugin.
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7 and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
A Cross Site Scripting (XSS) vulnerability has been discovered in Liferay products via the Commerce module. This affects Liferay Portal versions 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
Netatalk w wersji do 3.1.13 zawiera podatność typu przepełnienie bufora w stercie w funkcji afp_getappl, co może prowadzić do wykonania kodu poprzez spreparowany plik .appl. Umożliwia to zdalny dostęp z uprawnieniami roota na niektórych platformach, takich jak FreeBSD (używane w TrueNAS).
Time-of-check time-of-use race condition in BIOS firmware for some Intel processors. A privileged user may exploit it to escalate privileges via local access.
Podatność w xterm przed wersją 375 umożliwia wykonanie kodu poprzez operacje związane z czcionkami, co może prowadzić do wykonania poleceń w trybie edycji linii vi w Zsh. Problem wynika z możliwości wystąpienia odpowiedzi OSC 50 zawierającej Ctrl-g.
A remote code execution (RCE) vulnerability was discovered in ESPCMS P8.21120101 within the IS_GETCACHE component. Attackers can exploit this flaw to execute arbitrary code on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS