CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cross-site scripting (XSS) vulnerability in the Site module's membership request pages in Liferay Portal 7.0.0 through 7.3.5 and Liferay DXP 7.0-7.3 allows remote attackers to inject arbitrary web script or HTML via the comments parameter.
The Portal Store module in Liferay Portal 7.0.0 through 7.3.5 and Liferay DXP 7.0 through 7.3 does not obfuscate the S3 store's proxy password, allowing attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing.
A denial-of-service vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by enabling TOTP on behalf of another user or modifying the other user's TOTP shared secret.
JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20, and 7.2 before fix pack 10 may return overly verbose error messages. Remote attackers can use the content of these error messages to launch more focused attacks via crafted inputs.
Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.
W urządzeniach Samsung Galaxy S3 i9305 w wersji 4.4.4 odkryto problem związany z implementacją WPA, WPA2 i WPA3, która ponownie składa fragmenty z niekonsekwentnymi numerami pakietów. Atakujący może wykorzystać tę podatność do wykradania wybranych fragmentów.
InvoicePlane 1.5.11 discloses the full path of the file upload directory when using the upload feature.
A vulnerability in the Snort detection engine of multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The issue is due to incorrect handling of specific HTTP header parameters. An attacker could exploit this by sending crafted HTTP packets through an affected device, bypassing the policy and delivering a malicious payload.
A vulnerability in the upgrade process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject commands that could be executed with root privileges on the underlying OS. This is due to insufficient input validation. Exploitation involves uploading a crafted upgrade package file.
A vulnerability in the CLI of Cisco ASA and FTD could allow an authenticated, local attacker to execute arbitrary commands on the underlying OS with root privileges. This is due to insufficient input validation of user-supplied commands.
A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker to overwrite files on the file system using directory traversal techniques. This is due to insufficient validation of user input for the file path in a specific CLI command. A successful exploit could cause system instability if important system files are overwritten.
A race condition in the Linux kernel SCTP sockets implementation (net/sctp/socket.c) before version 5.12-rc8. If sctp_destroy_sock is called without the addr_wq_lock, an element is removed from the auto_asconf_splist list without proper locking. This can be exploited by an attacker with network service privileges to escalate to root or by an unprivileged user if a BPF_CGROUP_INET_SOCK_CREATE is attached that blocks creation of some SCTP sockets.
AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. This affects at least version 10.8.1 and below, but potentially later versions as well. The affected NetVanta 7060 and NetVanta 7100 appliances are End of Life and will not receive a patch.
AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issue. This affects at least version 10.8.1 and earlier, but potentially later versions as well. The affected NetVanta 7060 and NetVanta 7100 appliances are End of Life and will not receive a patch.
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
The jose library, used for cryptographic operations, has a vulnerability in the AES_CBC_HMAC_SHA2 algorithm that allows the use of a padding oracle to decrypt data without knowing the key. Observable timing differences during padding errors can enable an attacker to exploit this vulnerability.
Froala Editor 3.2.6 is vulnerable to persistent XSS. A crafted base64 string in the hyperlink creation module allows injection of malicious scripts.
In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.
An arbitrary file write vulnerability in vRealize Operations Manager API prior to 8.4 allows an authenticated malicious actor with network access to write files to arbitrary locations on the underlying Photon OS.
SeedDMS 5.1.x is affected by a cross-site request forgery (CSRF) vulnerability in out.EditFolder.php. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.