CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability was detected in TOTOLINK WA300 version 5.2cu.7112_B20190227 affecting the sub_401510 function in cstecgi.cgi. Manipulation of the UPLOAD_FILENAME argument leads to command injection, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.
The Breeze plugin for WordPress (Cloudways) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects Breeze from n/a through version 2.2.21.
The Responsive Addons for Elementor plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.0.8.
The UiChemy plugin for WordPress is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 4.4.2.
The Post Expirator plugin (up to version 4.9.3) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized users to access functions that should be protected.
The TheGem Theme Elements plugin (for WPBakery) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 5.11.0.
The Creator LMS plugin (WPFunnels) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects Creator LMS from n/a through version 1.1.12.
The TheGem Theme Elements plugin (for Elementor) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 5.11.0.
The Tickera plugin (tickera-event-ticketing-system) in versions up to and including 3.5.6.4 contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
In the Better Business Reviews plugin (from BBR Plugins), there is a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions up to and including 0.1.1.
Missing Authorization vulnerability in Proxy & VPN Blocker allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Proxy & VPN Blocker: from n/a through <= 3.5.3.
The Events Calendar (the-events-calendar) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions through 6.15.12.2.
Stored XSS vulnerability in Accordion plugin (Themepoints) up to version 3.0.3. Improper input neutralization during web page generation allows persistent injection of malicious scripts.
RSS Feed Widget (rss-feed-widget) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions through 3.0.2.
In The Events Calendar Countdown Addon (from CoolHappy), there is a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions up to and including 1.4.15.
The AffiliateX plugin for WordPress (versions up to and including 1.3.9.3) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of improperly configured authorization mechanisms.
Missing Authorization vulnerability in BoldGrid Post and Page Builder (up to 1.27.9) allows exploiting incorrectly configured access control security levels.
WeDesignTech Ultimate Booking Addon (wedesigntech-ultimate-booking-addon) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions through 1.0.3.
The Ultimate Store Kit Elementor Addons plugin (up to version 2.9.4) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized users to access functions that should be protected.
The Team Showcase plugin for WordPress is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 2.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS