CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Canon EOS Network Setting Tool version 1.5.0 and earlier uses hard-coded cryptographic keys, which may lead to unauthorized access to data.
The Canon EOS Network Setting Tool version 1.5.0 or earlier has improper validation of server certificates. This can lead to man-in-the-middle attacks.
The Canon EOS Network Setting Tool version 1.5.0 or earlier has improper validation of SSH host keys.
Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpException::setTitle() and/or setDescription() to include untrusted/request-derived data, an attacker could inject arbitrary HTML/JavaScript that executes in the victim's browser.
Welcart e-Commerce versions up to 2.11.28 have an issue with unauthenticated access that can lead to broken access control.
There is a Cross Site Scripting (XSS) vulnerability in FV Flowplayer Video Player versions below 7.5.51.7212 for subscribers.
There is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in WP Migrate Lite versions <= 2.7.8. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
There is a vulnerability in XCloner versions up to 4.8.6 that allows for the exposure of subscriber sensitive data.
JS Help Desk versions up to 3.0.9 contain a vulnerability in access control that allows unauthorized access to resources.
The WP Job Portal plugin versions up to 2.5.2 contain a Cross Site Scripting (XSS) vulnerability that can be exploited by subscribers.
There is a vulnerability in versions of Visual Link Preview up to 2.4.1 that exposes sensitive subscriber data.
The King Addons plugin for Elementor versions up to 51.1.62 contains a Subscriber Cross Site Scripting (XSS) vulnerability.
MultiJuicer versions 8.0.0 through 10.0.0 have a vulnerability in the team join endpoint that accepts requests with any Content-Type, including text/plain. This allows attackers to embed an HTML form that auto-submits to the endpoint, enabling identity takeover of the victim.
Versions of Stripe Payments up to 2.0.98 contain a vulnerability that allows for unauthenticated bypass.
Masteriyo - LMS versions up to 2.1.8 contain a vulnerability in authentication that allows unauthorized access.
There is a Subscriber Cross Site Scripting (XSS) vulnerability in Modula Image Gallery versions up to 2.14.23.
There is an unauthenticated Cross Site Scripting (XSS) vulnerability in Simple Membership versions <= 4.7.2. An attacker can exploit this flaw to inject malicious scripts.
Event Tickets versions up to 5.27.5 contain a vulnerability that allows unauthenticated bypass of security measures.
Contest Gallery versions up to 28.1.7 have a vulnerability that allows for the exposure of subscriber sensitive data.
Versions of Advanced Form Integration up to 1.126.12 have a vulnerability in access control that may allow subscribers unauthorized access to resources.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS