CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in MISP before version 2.4.158 that allows password confirmation to be bypassed in UsersController.php via an 'Accept: application/json' header.
An issue was discovered in MISP before version 2.4.158 related to XSS in app/Controller/OrganisationsController.php occurring in a situation with a 'weird single checkbox page.'
An issue was discovered in MISP before version 2.4.158 related to XSS in the cerebrate view. If one administrator inputs a javascript: URL in the URL field and another administrator clicks on it, it may lead to unauthorized script execution.
An issue was discovered in MISP before version 2.4.158 related to stored XSS in the event graph via a tag name.
An issue was discovered in MISP before version 2.4.158 related to stored XSS in galaxy clusters.
An issue was discovered in MISP before version 2.4.158 related to stored XSS in the LinOTP login field.
An issue was discovered in MISP before version 2.4.158 related to PHAR deserialization.
A vulnerability in Oracle Java SE and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker with network access to compromise these products. The attacker can gain unauthorized access to critical data or complete access to all data accessible in Oracle Java SE and Oracle GraalVM Enterprise Edition.
Vulnerability in Oracle Agile PLM (component: Attachments) version 9.3.6. A low-privileged attacker with network access via HTTP can compromise the system, leading to unauthorized access to critical data or all accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impact).
Vulnerability in Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces) in versions 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise ADF, potentially leading to takeover. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
Wtyczka Simple File List dla WordPressa jest podatna na pobieranie dowolnych plików poprzez parametr eeFile w pliku ~/includes/ee-downloader.php. Brak odpowiednich zabezpieczeń umożliwia nieautoryzowanym atakującym podanie ścieżki do pliku, który zostanie pobrany, w wersjach do 3.2.7 włącznie.
Wtyczka SiteGround Security dla WordPressa jest podatna na obejście uwierzytelniania, co pozwala nieautoryzowanym użytkownikom logować się jako użytkownicy administracyjni. Problem wynika z braku weryfikacji tożsamości w implementacji kodu zapasowego 2FA, który loguje użytkowników po pomyślnym wprowadzeniu.
Wtyczka SiteGround Security dla WordPressa jest podatna na obejście uwierzytelniania, co pozwala nieautoryzowanym użytkownikom zalogować się jako użytkownicy administracyjni. Problem wynika z braku weryfikacji tożsamości podczas początkowej konfiguracji 2FA, co umożliwia nieautoryzowanym użytkownikom skonfigurowanie 2FA dla oczekujących kont.
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13 and 7.3 fix pack 2 do not properly check user permission when accessing a list of sites/groups. This allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before Service Pack 3. Remote attackers can inject arbitrary web script or HTML via the name of an asset category.
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as ../../../../repository/deployment/server/webapps. Affects WSO2 API Manager 2.2.0-4.0.0, WSO2 Identity Server 5.2.0-5.11.0, WSO2 Identity Server Analytics 5.4.0-5.6.0, WSO2 Identity Server as Key Manager 5.3.0-5.11.0, WSO2 Enterprise Integrator 6.2.0-6.6.0, WSO2 Open Banking AM 1.4.0-2.0.0, and WSO2 Open Banking KM 1.4.0-2.0.0.
In the ncurses library version 6.3 before patch 20220416, an out-of-bounds read and segmentation violation exist in the convert_strings function in tinfo/read_entry.c of the terminfo library.
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.
A privilege elevation vulnerability in the Windows User Profile Service. It requires authentication as a local user.
A vulnerability in Microsoft Excel allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS