CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Falcon – WordPress Optimizations & Tweaks plugin in version 2.10.0 and earlier has an unknown vulnerability exploitable by an unauthenticated user. No detailed information is available.
The Stripe For WooCommerce plugin in version 4.0.7 and earlier allows unauthenticated users Broken Access Control. Users without login can access payment functions.
The Ebook Store plugin version 6.19 and earlier does not require authentication to expose sensitive data. An attacker can remotely read confidential information without having an account.
The ShipTime: Discounted Shipping Rates plugin version 1.1.1 and earlier allows a user with the Subscriber role to access sensitive data without proper permissions.
Ericsson Packet Core Controller (PCC) before version 1.38 contains a command injection vulnerability that allows an attacker to execute arbitrary code as root.
The SP Page Builder extension for Joomla (from joomshaper.com) below version 6.7.1 allows an authenticated user to delete arbitrary files due to improper path validation and ACL checks in the media manager.
The SP Page Builder extension for Joomla (from joomshaper.com) below version 6.7.1 contains an SQL injection vulnerability in the search and date filters of the media manager, allowing an authenticated user to manipulate database queries.
Missing authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API, potentially leading to system compromise.
Incorrect authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate to root on the vulnerable appliance, potentially leading to full system compromise.
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the backup restore functionality, potentially leading to full system compromise.
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the Geo Location management interface, potentially leading to full system compromise.
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the management interface, potentially leading to full system compromise.
Lack of cryptographic mechanisms in Ghost Robotics Vision 60 robot (APK v5.5.0) enables man-in-the-middle attacks. An attacker on the local network can intercept and manipulate communications between the operator and the robot.
An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics Vision 60 robot allows multiple simultaneous sessions without client validation. An attacker with a modified app can connect during an active session.
Lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics Vision 60 robot allows an unauthenticated attacker on the Wi-Fi network full access to the web admin interface and HTTP API.
Allocation of resources without limits or throttling vulnerability in Apache Thrift Rust bindings. Affects versions before 0.24.0.
Integer overflow or wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi, and Haxe bindings. Affects versions before 0.24.0.
Inefficient algorithmic complexity and allocation of resources without limits or throttling vulnerability in Apache Thrift Node.js bindings. Affects versions before 0.24.0.
Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Ruby bindings. Affects versions before 0.24.0.
Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. Affects versions before 0.24.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS