CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.07)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A null pointer dereference issue exists in GNU LibreDWG version 0.10 in the read_2004_compressed_section function in decode.c. The bug can cause a program crash when processing specially crafted DWG files.
A null pointer dereference issue was discovered in GNU LibreDWG 0.10 in the get_bmp function at dwgbmp.c:164. This flaw can cause a program crash.
InvoicePlane 1.5.11 lacks rate-limiting for password reset and uses a weak, predictable token generation mechanism.
A null pointer dereference issue exists in GNU LibreDWG version 0.10.2641 via htmlescape in escape.c:29. This flaw causes a denial of service (DoS) through application crash.
In GNU LibreDWG version 0.10.2641, a null pointer dereference issue exists in the output_TEXT function at dwg2SVG.c:114, causing a denial of service via application crash.
The Data Engine module in Liferay Portal 7.3.0 through 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, allowing remote authenticated users to view DDMStructures via GET API calls.
Cross-site scripting (XSS) vulnerability in the Asset Publisher app of the Asset module in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10, and 7.3 before fix pack 1. Allows remote attackers to inject arbitrary web script or HTML via the assetEntryId parameter.
Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1. Allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter.
Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1. Remote attackers can inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.
Cross-site scripting (XSS) vulnerability in the Redirect module's administration page in Liferay Portal 7.3.2 through 7.3.5 and Liferay DXP 7.3 before fix pack 1. Attackers can inject arbitrary web script or HTML via the destinationURL parameter.
Cross-site scripting (XSS) vulnerability in the Site module's membership request pages in Liferay Portal 7.0.0 through 7.3.5 and Liferay DXP 7.0-7.3 allows remote attackers to inject arbitrary web script or HTML via the comments parameter.
The Portal Store module in Liferay Portal 7.0.0 through 7.3.5 and Liferay DXP 7.0 through 7.3 does not obfuscate the S3 store's proxy password, allowing attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing.
A denial-of-service vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by enabling TOTP on behalf of another user or modifying the other user's TOTP shared secret.
JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20, and 7.2 before fix pack 10 may return overly verbose error messages. Remote attackers can use the content of these error messages to launch more focused attacks via crafted inputs.
Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.
W urządzeniach Samsung Galaxy S3 i9305 w wersji 4.4.4 odkryto problem związany z implementacją WPA, WPA2 i WPA3, która ponownie składa fragmenty z niekonsekwentnymi numerami pakietów. Atakujący może wykorzystać tę podatność do wykradania wybranych fragmentów.
InvoicePlane 1.5.11 discloses the full path of the file upload directory when using the upload feature.
A race condition in the Linux kernel SCTP sockets implementation (net/sctp/socket.c) before version 5.12-rc8. If sctp_destroy_sock is called without the addr_wq_lock, an element is removed from the auto_asconf_splist list without proper locking. This can be exploited by an attacker with network service privileges to escalate to root or by an unprivileged user if a BPF_CGROUP_INET_SOCK_CREATE is attached that blocks creation of some SCTP sockets.
AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. This affects at least version 10.8.1 and below, but potentially later versions as well. The affected NetVanta 7060 and NetVanta 7100 appliances are End of Life and will not receive a patch.
AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issue. This affects at least version 10.8.1 and earlier, but potentially later versions as well. The affected NetVanta 7060 and NetVanta 7100 appliances are End of Life and will not receive a patch.