CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP. Allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.
In vFairs 3.3, any logged-in user can modify any other user's profile to inject malicious JavaScript (XSS). The database stores HTML tags that are rendered on the page, enabling XSS attacks.
vFairs 3.3 is affected by insecure permissions, allowing any logged-in user to modify other users' profile information or pictures. By knowing a user's unique ID, an attacker can send an HTTP POST request to change profile details or upload a new image.
Centreon version 20.10.2 is affected by a stored XSS vulnerability. The dep_description and dep_name parameters are vulnerable to script injection, requiring login and navigation to Configuration > Notifications > Hosts.
W Arm Trusted Firmware M do wersji 1.2, świat NS może wywołać zatrzymanie systemu, nadpisanie danych zabezpieczonych lub wydrukowanie danych zabezpieczonych podczas wywoływania funkcji zabezpieczonych w trybie obsługi NSPE.
A stored cross-site scripting (XSS) vulnerability was found in the LuCI web interface for OpenWRT version 19.07. It allows an attacker to inject arbitrary JavaScript via the Hostname change operation.
The LuCI web interface for OpenWRT version 19.07 and lower has been found to have a cross-site scripting (XSS) vulnerability.
BMC Remedy Mid Tier 9.1SP3 is affected by a DOM-based cross-site scripting (XSS) vulnerability in a legacy utility. This allows an attacker to inject malicious client-side scripts.
BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing an attacker to hijack system logs. This data can include user names and HTTP data.
A memory leak vulnerability was discovered in GNU LibreDWG version 0.10 in the dwg_decode_eed function at decode.c:3638. Crafted input can cause a memory leak, potentially leading to resource exhaustion.
A null pointer dereference issue exists in GNU LibreDWG version 0.10 in the read_2004_compressed_section function in decode.c. The bug can cause a program crash when processing specially crafted DWG files.
A null pointer dereference issue was discovered in GNU LibreDWG 0.10 in the get_bmp function at dwgbmp.c:164. This flaw can cause a program crash.
InvoicePlane 1.5.11 lacks rate-limiting for password reset and uses a weak, predictable token generation mechanism.
A null pointer dereference issue exists in GNU LibreDWG version 0.10.2641 via htmlescape in escape.c:29. This flaw causes a denial of service (DoS) through application crash.
In GNU LibreDWG version 0.10.2641, a null pointer dereference issue exists in the output_TEXT function at dwg2SVG.c:114, causing a denial of service via application crash.
The Data Engine module in Liferay Portal 7.3.0 through 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, allowing remote authenticated users to view DDMStructures via GET API calls.
Cross-site scripting (XSS) vulnerability in the Asset Publisher app of the Asset module in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10, and 7.3 before fix pack 1. Allows remote attackers to inject arbitrary web script or HTML via the assetEntryId parameter.
Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1. Allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter.
Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1. Remote attackers can inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.
Cross-site scripting (XSS) vulnerability in the Redirect module's administration page in Liferay Portal 7.3.2 through 7.3.5 and Liferay DXP 7.3 before fix pack 1. Attackers can inject arbitrary web script or HTML via the destinationURL parameter.