CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959. The vulnerability may be triggered when processing crafted input in the Vim editor.
A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition.
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.
Academy Learning Management System before version 5.9.1 was found to have a reflected cross-site scripting (XSS) vulnerability via the Search parameter. An attacker can inject a malicious script that executes in the victim's browser.
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).
The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation. This allows attackers to download a web content page's XLIFF translation file via crafted URL.
Multiple cross-site scripting (XSS) vulnerabilities were found in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA. Attackers can execute arbitrary web scripts or HTML via parameters with the "filter_" prefix.
The HtmlUtil.escapeRedirect function in Liferay Portal 7.3.1 through 7.4.2 and Liferay DXP 7.0-7.3 can be bypassed using multiple forward slashes, allowing remote attackers to redirect users to arbitrary external URLs via parameters such as 'redirect' or 'FORWARD_URL'.
The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.
A cross-site scripting (XSS) vulnerability exists in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before Service Pack 3. Attackers can inject arbitrary web scripts or HTML via a crafted payload in the name of a tag.
Liferay Portal versions 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 contain a cross-site scripting (XSS) vulnerability in the Custom Facet widget of the Portal Search module. Attackers can inject arbitrary JavaScript or HTML via the Custom Parameter Name text field.
A stored cross-site scripting (XSS) vulnerability exists in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3. Remote attackers can inject arbitrary web script or HTML via a user's name.
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Simple Task Managing System v1.0 in the newProjectValidation.php component. Attackers can inject arbitrary web scripts or HTML via the shortName parameter.
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Simple Task Managing System v1.0 in the newProjectValidation.php file. Attackers can inject arbitrary web scripts or HTML via the fullName parameter.
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Simple Task Managing System v1.0 via the newTask.php component. Attackers can inject arbitrary web scripts or HTML through the shortName parameter.
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.
In the Linux kernel through 5.19.9, drivers/scsi/stex.c allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.
JasPer 3.0.6 allows denial of service via a reachable assertion in the inttobits function in libjasper/base/jas_image.c.
Craft CMS version 4.2.0.1 is vulnerable to Cross-Site Scripting (XSS) via the Drafts feature. An attacker can inject a malicious script that will be executed in the victim's browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS