CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Liferay Portal versions 7.4.3.48 through 7.4.3.76 and Liferay DXP updates 48 through 76, there is a vulnerability to ReDoS attacks through the use of regular expressions as patterns. Remote attackers can exploit this flaw to consume excessive server resources via crafted request URLs.
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier, the default configuration does not require users to verify their email address, allowing remote attackers to create accounts using fake email addresses or addresses they do not control.
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67 and Liferay DXP 7.4 update 67 does not limit Document and Media files that can be downloaded from a Form, allowing remote attackers to download any file via a crafted URL.
SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17 and Liferay DXP 7.3 before update 6 and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. Exploitation of this vulnerability requires chaining with other attacks.
A cross-site scripting (XSS) vulnerability exists in the Layout module in Liferay Portal versions 7.3.4 through 7.4.3.68 and Liferay DXP 7.3 before update 24 and 7.4 before update 69. It allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.
The Account module in Liferay Portal from versions 7.4.3.21 to 7.4.3.62 and Liferay DXP 7.4 from update 21 to 62 has a cross-site scripting (XSS) vulnerability. Attackers can inject arbitrary web scripts or HTML via crafted payloads in user text fields such as First Name, Middle Name, Last Name, or Job Title.
CVE-2023-33942 describes a cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Portal 7.4.3.50 and Liferay DXP 7.4 update 50. It allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a web content article's 'Title' field.
Multiple cross-site scripting (XSS) vulnerabilities in the OAuth2ProviderApplicationRedirect class of the Plugin for OAuth 2.0 module in Liferay Portal 7.4.3.41 through 7.4.3.52 and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web scripts or HTML via the (1) code or (2) error parameter.
A Cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.30 and Liferay DXP 7.4 before update 31. This allows remote attackers to inject arbitrary web scripts or HTML via the Remote App's IFrame URL.
XSS vulnerability in the Modified Facet widget in Liferay Portal from versions 7.1.0 to 7.4.3.12 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a facet label.
A cross-site scripting (XSS) vulnerability exists in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14. Remote attackers can inject arbitrary web scripts or HTML via a crafted payload injected into an App Builder custom object's 'Name' field.
A stored cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.1.0 through 7.3.0 and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 5. Attackers can inject arbitrary web scripts or HTML via a crafted payload in a form's `name` field.
EasyImages versions ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.
Piwigo version 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the 'add tags' function.
An issue was discovered in KaiOS 3.0 and 3.1 where the binary /system/kaios/api-daemon exposes a local web server on *.localhost with subdomains for each installed application. An attacker can make fetch requests to api-daemon to determine if a given app is installed and read the manifest.webmanifest contents, including the app version.
An issue was discovered in the Linux kernel before version 6.2.9 related to a use-after-free in the bq24190_remove function in bq24190_charger.c. This could allow a local attacker to crash the system due to a race condition.
An issue was discovered in Qt versions 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1 related to QDnsLookup, allowing for a buffer over-read via a crafted reply from a DNS server.
The remote keyfob system on Nissan Sylphy Classic 2021 sends the same RF signal for each door-open request, allowing for a replay attack.
In Hazelcast versions 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines do not properly mask passwords in member configuration, allowing Hazelcast Management Center users to view some secrets.
There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured credentials may provide a higher privilege level on the Active Directory domain.