CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An IDOR vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.
The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4 and Liferay DXP 7.4 GA does not properly check permissions, allowing remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.
The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36 and Liferay DXP 7.4 update 1 through 36 does not properly check user permissions, allowing remote attackers to obtain the history of all friendly URLs assigned to a page.
The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, allowing remote authenticated users to view asset libraries via the UI.
A Cross Site Scripting (XSS) vulnerability has been discovered in Liferay products via the Commerce module. This affects Liferay Portal versions 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
Shopwind v3.4.3 was discovered to contain a reflected XSS vulnerability in the /common/library/Page.php component. An attacker can inject a malicious script that executes in the victim's browser.
A vulnerability in multiple management dashboard pages of Cisco Umbrella allows an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the Cisco Umbrella dashboard. This issue is due to unsanitized user input.
The NdkAdvancedCustomizationFields 3.5.0 plugin for ndk design is vulnerable to Cross-Site Scripting (XSS) in the createPdf.php file. This allows an attacker to inject malicious JavaScript code into the page.
ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
ProcessWire v3.0.200 was found to have multiple XSS vulnerabilities in the Search Users and Search Pages functions. These flaws allow attackers to inject arbitrary JavaScript or HTML.
Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page. This allows an attacker to inject malicious scripts through improperly sanitized input fields.
A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Account Full Name field.
Multiple stored cross-site scripting (XSS) vulnerabilities were found in Train Scheduler App v1.0. Attackers can inject malicious JavaScript or HTML into the Train Code, Train Name, and Destination text fields.
In the Linux kernel, a vulnerability was identified in the function __mtk_ppe_check_skb of the file drivers/net/ethernet/mediatek/mtk_ppe.c, in the Ethernet Handler component. Manipulation leads to a use-after-free. A patch is available, but no released kernel version was ever affected by this CVE.
Cross Site Scripting (XSS) vulnerability in the New equipment page of EasyVista Service Manager 2018.1.181.1 allows remote attackers to execute arbitrary code via the notes field.
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded SVG file.
A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.
A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the name or namespace parameter.
Cross-site scripting (XSS) vulnerability in the Object module of Liferay Portal 7.4.3.4 through 7.4.3.36. Remote attackers can inject arbitrary web script or HTML via the `Label` text field on the edit object details page.