CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Mattermost allows an authenticated user with team access to modify metric settings in another user's playbook via a crafted import or update request with a foreign metric ID. Affected versions are 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, and 10.11.x <= 10.11.19.
The Car Rental Manager WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.3.7.
The Church Admin WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.0.30.
The JetSearch WordPress plugin (versions up to 3.6.1.2) contains a vulnerability that allows unauthorized users to access sensitive system information. This flaw enables reading embedded sensitive data, potentially leading to information disclosure.
The JetBlocks For Elementor WordPress plugin version 1.5.0 and earlier exposes sensitive system information to unauthorized parties. The vulnerability allows reading embedded confidential data.
The JetReviews WordPress plugin (versions up to 3.0.1) contains a vulnerability that exposes sensitive system information to unauthorized parties. An attacker can exploit this flaw to retrieve embedded confidential data.
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress up to version 5.0.4 contains a Server-Side Request Forgery (SSRF) vulnerability. It allows an attacker to send requests from the server to internal network resources.
The myCred WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 3.1.2.
The License Manager for WooCommerce WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.0.17.
The WooCommerce Bulk Edit Products – WP Sheet Editor plugin (versions up to 1.8.21) has a missing authorization vulnerability, allowing an attacker to exploit incorrectly configured access control security levels. This flaw enables unauthorized operations on products in the WooCommerce store.
Missing authorization vulnerability in the Simply Schedule Appointments WordPress plugin, allowing exploitation of incorrectly configured access control security levels.
The Simply Schedule Appointments WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 1.6.12.4.
The EduMall WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 4.5.1.
The Speaker WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 4.1.13.
The Universal Clocks WordPress plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.2.0.
The MeetingHub plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 1.25.10.
The Envision Page Builder plugin for WordPress contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. The flaw affects all versions up to and including 0.22.
The Fascinate WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 1.1.5.
The Booking calendar, Appointment Booking System plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.2.36.
The VW Wedding WordPress plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.3.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS