CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal and DXP allows remote attackers to inject arbitrary web script or HTML.
A Cross-site scripting (XSS) vulnerability in the Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through 36. Remote attackers can inject arbitrary web script or HTML via the `redirect` parameter.
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161. This impacts the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. Such manipulation leads to race condition. A high complexity level is associated with this attack. The exploitability is said to be difficult.
A broken session control was discovered in devhub version 0.102.0, which could allow an attacker to hijack user sessions.
In the Linux kernel up to versions 5.10.162/5.15.85/6.0.15/6.1.1, a vulnerability was found in the libbpf component, in the btf_dump_name_dups function of tools/lib/bpf/btf_dump.c. Manipulation leads to a use-after-free. The issue is fixed in versions 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2.
A Cross-site scripting (XSS) vulnerability was found in the Blog module of Liferay Digital Experience Platform 7.3.10 SP3. It allows remote attackers to inject arbitrary JS or HTML into the name field of a new topic.
A cross-site scripting (XSS) vulnerability was discovered in mxGraph version 4.2.2 within the setTooltips() function. It allows injection of malicious JavaScript code due to improper input handling.
Flatpress v1.2.1 was discovered to contain a reflected XSS vulnerability via the 'page' parameter in admin.php. An attacker can inject malicious JavaScript code that executes in the victim's browser.
In app/Controller/UsersController.php in MISP before version 2.4.164, there is a vulnerability that allows attackers to discover role names, which should only be accessible to the site administrator.
mojoPortal v2.7 was discovered to contain a path traversal vulnerability via the 'f' parameter at /DesignTools/CssEditor.aspx. This allows authenticated attackers to read arbitrary files on the system.
An SSRF vulnerability in the Data Import module of Heartex Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Additionally, self-registration is enabled by default, enabling a remote attacker to create an account and exploit the SSRF.
Bus Pass Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via the searchdata parameter. An attacker can inject malicious script that executes in the victim's browser.
Academy Learning Management System before version 5.9.1 was found to have a reflected cross-site scripting (XSS) vulnerability via the Search parameter. An attacker can inject a malicious script that executes in the victim's browser.
The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation. This allows attackers to download a web content page's XLIFF translation file via crafted URL.
Multiple cross-site scripting (XSS) vulnerabilities were found in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA. Attackers can execute arbitrary web scripts or HTML via parameters with the "filter_" prefix.
The HtmlUtil.escapeRedirect function in Liferay Portal 7.3.1 through 7.4.2 and Liferay DXP 7.0-7.3 can be bypassed using multiple forward slashes, allowing remote attackers to redirect users to arbitrary external URLs via parameters such as 'redirect' or 'FORWARD_URL'.
The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.
A cross-site scripting (XSS) vulnerability exists in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before Service Pack 3. Attackers can inject arbitrary web scripts or HTML via a crafted payload in the name of a tag.
Liferay Portal versions 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 contain a cross-site scripting (XSS) vulnerability in the Custom Facet widget of the Portal Search module. Attackers can inject arbitrary JavaScript or HTML via the Custom Parameter Name text field.