CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
WpStream versions below 4.11.2 have a vulnerability allowing subscribers to upload arbitrary files.
Booking Activities versions up to 1.16.48.1 have a vulnerability in access control that allows unauthorized access.
Versions of the engine below 1.4.107 have a broken access control issue for subscribers, which may lead to unauthorized access to resources.
There is a Cross Site Scripting (XSS) vulnerability for subscribers in JupiterX Core versions <= 4.14.1.
In Download Monitor versions <= 5.1.9, there is a vulnerability that allows unauthorized users to download arbitrary files.
In Meta Box, a WordPress custom fields framework, there is a vulnerability allowing arbitrary file deletion by a contributor in versions up to 5.11.1.
The WP Google Review Slider plugin versions up to 18.0 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.
The Rank Math SEO plugin for WordPress (up to 1.0.271) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may enable unauthorized users to access functions or data they should not have access to.
Unauthenticated Broken Access Control exists in Essential Addons for Elementor versions below 6.6.0.
There is a broken access control issue in Bookify versions up to 1.1.1 that may allow subscribers unauthorized access to resources.
Versions of bunny.net up to 2.3.6 contain a vulnerability in access control that may allow subscribers unauthorized access to resources.
PopAd versions up to 1.0.4 contain a Server Side Request Forgery (SSRF) vulnerability that can be exploited by an attacker to send unauthorized requests from the server.
Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries during IPv4/TCP header parsing.
A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into opening a specially crafted AV1 media file, triggering an assertion abort and causing the application to crash.
In Nginx Proxy Manager v2.14.0, incorrect access control in the 'Let's Encrypt' certificate download endpoint allows authenticated attackers to obtain TLS private key material via a crafted GET request.
A cross-site scripting (XSS) vulnerability in Deck9 Input v2.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Discuz! X5.0 versions from 20260320 to 20260610 contain a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images.
Version v0.54.0 of Datadog, Inc Vector has an issue in the /util/http/prelude.rs endpoint that allows attackers to cause a Denial of Service (DoS) via a crafted request or payload.
Ruoyi version 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.
An issue in Boyleep K11 with y108 firmware v.2.3.0.11291 allows a physically proximate attacker to execute arbitrary code via the factory test feature.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS