CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded SVG file.
An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint.
A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.
A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the name or namespace parameter.
Cross-site scripting (XSS) vulnerability in the Object module of Liferay Portal 7.4.3.4 through 7.4.3.36. Remote attackers can inject arbitrary web script or HTML via the `Label` text field on the edit object details page.
A cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal and DXP allows remote attackers to inject arbitrary web script or HTML.
A Cross-site scripting (XSS) vulnerability in the Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through 36. Remote attackers can inject arbitrary web script or HTML via the `redirect` parameter.
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8.
An authentication bypass vulnerability in FortiOS, FortiProxy, and FortiSwitchManager allows an unauthenticated attacker to perform operations on the administrative interface via crafted HTTP or HTTPS requests.
Feishu version 3.40.3 contains an untrusted search path vulnerability. The application may load libraries or files from unsafe locations.
A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161. This impacts the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. Such manipulation leads to race condition. A high complexity level is associated with this attack. The exploitability is said to be difficult.
An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page. The lack of rate limiting or account lockout mechanisms enables repeated password guessing.
A broken session control was discovered in devhub version 0.102.0, which could allow an attacker to hijack user sessions.
In the Linux kernel up to versions 5.10.162/5.15.85/6.0.15/6.1.1, a vulnerability was found in the libbpf component, in the btf_dump_name_dups function of tools/lib/bpf/btf_dump.c. Manipulation leads to a use-after-free. The issue is fixed in versions 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2.
A Cross-site scripting (XSS) vulnerability was found in the Blog module of Liferay Digital Experience Platform 7.3.10 SP3. It allows remote attackers to inject arbitrary JS or HTML into the name field of a new topic.
WiJungle NGFW version U250 was found to have no rate limit on login requests, allowing an attacker to brute force the admin password and take over the account.
A cross-site scripting (XSS) vulnerability was discovered in mxGraph version 4.2.2 within the setTooltips() function. It allows injection of malicious JavaScript code due to improper input handling.
W wyniku niewłaściwego zarządzania pamięcią, otwarcie zmanipulowanego pliku Scalable Vector Graphic (.svg, svg.x3d) w SAP 3D Visual Enterprise Viewer - wersja 9, może prowadzić do zdalnego wykonania kodu. Atakujący może wykorzystać przepełnienie stosu lub ponowne użycie wskaźnika, który odnosi się do nadpisanej przestrzeni w pamięci.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS