CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Object module in Liferay Portal versions 7.4.3.4 to 7.4.3.60 and Liferay DXP 7.4 before update 61 does not segment object definitions by virtual instance in searches. This allows remote authenticated users in one virtual instance to view object definitions from a second virtual instance.
The Object module in Liferay Portal versions 7.4.3.4 to 7.4.3.48 and Liferay DXP 7.4 before update 49 does not properly isolate objects in different virtual instances. This allows remote authenticated users in one virtual instance to view objects in a different virtual instance via the OAuth 2 scope administration page.
Jenkins SAML Single Sign On (SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata.
A vulnerability classified as problematic was found in SourceCodester Best POS Management System 1.0. An unknown function in the file index.php?page=add-category is affected. Manipulation of the argument Name with the input "><img src=x onerror=prompt(document.domain);> leads to cross-site scripting. The attack can be launched remotely.
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: General/Core Client) affects versions 8.0.28 and prior. It allows an unauthenticated attacker with access to the infrastructure where MySQL Shell runs to compromise it, requiring interaction from a person other than the attacker.
W OpenSSH przed wersją 8.9 odkryto problem związany z uwierzytelnianiem kluczem publicznym przy użyciu przekazywania agenta. Jeśli atakujący zmodyfikował serwer, aby wspierał opcję uwierzytelniania None, użytkownik nie może określić, czy uwierzytelnienie FIDO potwierdza chęć połączenia z serwerem, czy też pozwala temu serwerowi na połączenie z innym serwerem w imieniu użytkownika.
Podatność CVE-2020-8562 dotyczy mechanizmu w Kubernetes, który ma na celu zapobieganie dostępowi do sieci lokalnych i localhost przez połączenia proxy. W wyniku błędu w walidacji odpowiedzi DNS, użytkownik może ominąć te ograniczenia i uzyskać dostęp do prywatnych sieci w kontrolerze.
Spoofing vulnerability in Microsoft Edge for iOS. An attacker can spoof trusted content, potentially leading to display of false information to the user.
Spoofing vulnerability in Microsoft Edge (Chromium-based). An attacker can spoof trusted content, potentially leading to display of false information to the user.
Information Disclosure Vulnerability in Azure RTOS. Details are not provided in the description, but the vulnerability may lead to data leakage.
Information Disclosure Vulnerability in Azure RTOS. Details are not provided in the description, but the vulnerability may lead to data leakage.
Information Disclosure Vulnerability in Azure Sphere. Details are not provided in the description, but the vulnerability may lead to data leakage.
Information Disclosure Vulnerability in Azure RTOS. Details are not provided in the description, but the vulnerability may lead to data leakage.
All versions of GitLab CE/EE from 13.9 before 14.2.6, from 14.3 before 14.3.4, and from 14.4 before 14.4.1 have an improper access control flaw that exposes private email addresses of Issue and Merge Requests assignees to Webhook data consumers.
W Kubernetes odkryto problem bezpieczeństwa, który może umożliwić użytkownikom wysyłanie ruchu sieciowego do lokalizacji, do których normalnie nie mieliby dostępu, poprzez atak 'confused deputy'.
A vulnerability in Winner (ToneWinner) desktop speakers up to August 9, 2021 allows remote attackers to recover speech signals from the power-indicator LED using a telescope and an electro-optical sensor, known as a 'Glowworm' attack.
When typing a password under certain conditions, a race may have occurred where the InputContext was not being correctly set for the input field, resulting in the typed password being saved to the keyboard dictionary. This vulnerability affects Firefox for Android < 80.
Elevation of privilege vulnerability in Microsoft Edge (Chromium-based) due to improper input validation in the Feedback extension. An attacker could write files to arbitrary locations and gain elevated privileges. The vulnerability alone does not allow arbitrary code execution but can be chained with other vulnerabilities.
W Apache Log4j SMTP appender występuje niewłaściwa walidacja certyfikatu w przypadku niezgodności hosta. Może to umożliwić przechwycenie połączenia SMTPS przez atak typu man-in-the-middle, co może prowadzić do ujawnienia wszelkich wiadomości logów przesyłanych przez ten appender.
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, the bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying a string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can lead to disclosure of the content of some memory locations.