CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A critical vulnerability has been found in the Supplier Management System version 1.0. The issue affects an unknown function in the btn_functions.php file of the Picture Handler component, leading to unrestricted file uploads.
A cross-site scripting (XSS) vulnerability exists in the SEO configuration of the Layout module in Liferay Portal versions 7.4.3.70 to 7.4.3.73 and Liferay DXP 7.4 update 70 to 73. It allows remote attackers to inject arbitrary web scripts or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
An open redirect vulnerability exists in the SEO configuration of the Layout module in Liferay Portal versions 7.4.3.70 through 7.4.3.76 and Liferay DXP update 70 through 76. Attackers can exploit the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter to redirect users to arbitrary external URLs.
Grav is a flat-file content management system. In versions 1.7.42 and prior, the '/forgot_password' page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the 'email' parameter of the request.
Netbox version 3.5.1 is vulnerable to Cross Site Scripting (XSS) in the 'Create Wireless LAN Groups' function.
In versions 4.0.0 to 4.2.1 of the ink! library, there is a bug related to incorrect decoding of the return value when using delegate call mechanics. This issue affects both `CallBuilder::delegate` and `ink_env::invoke_contract_delegate`.
SoftExpert Excellence Suite version 2.1.9 is vulnerable to Cross Site Scripting (XSS) via query screens.
Windows 7 is vulnerable to a full blind TCP/IP hijacking attack. The vulnerability exists in Windows 7 (any Windows until Windows 8) and in any implementation of TCP/IP, which is vulnerable to the Idle scan attack, including many IoT devices.
Jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies.
Versions of fdkaac before 1.0.5 were discovered to contain a heap buffer overflow in the caf_info function in caf_reader.c.
Versions of fdkaac before 1.0.5 were found to contain a stack overflow in the read_callback function in src/main.c.
A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins.
The Jenkins Digital.ai App Management Publisher Plugin version 2.6 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins.
Jenkins AWS CodeCommit Trigger Plugin version 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to access the contents of arbitrary files on the Jenkins controller file system.
Jenkins Template Workflows Plugin version 41.v32d86a_313b_4a and earlier does not escape names of jobs used as building blocks for Template Workflow Jobs, leading to a stored XSS vulnerability.
Jenkins Sonargraph Integration Plugin version 5.0.1 and earlier does not escape the file path and project name for the Log file field form validation, leading to a stored cross-site scripting vulnerability.
Jenkins Maven Repository Server Plugin version 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting (XSS) vulnerability.
Jenkins Maven Repository Server Plugin version 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven Repository page, resulting in a stored XSS vulnerability.
A critical vulnerability has been found in OTCMS up to version 6.62, affecting some unknown processing of the file /admin/read.php?mudi=getSignal. Manipulation of the argument signalUrl leads to server-side request forgery.
A critical vulnerability was found in OTCMS up to version 6.62, affecting unknown code. Manipulating the username/password argument with the input admin leads to the use of a hard-coded password.