CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the User Spam Remover plugin (Joel) allows exposure of sensitive system information to unauthorized parties. The issue affects versions up to and including 1.1.
CSRF vulnerability in the Media Library Downloader WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in user. Affects versions up to and including 1.4.0.
Cross-Site Request Forgery (CSRF) vulnerability in ProteusThemes Custom Sidebars by ProteusThemes custom-sidebars-by-proteusthemes allows Cross Site Request Forgery. This issue affects Custom Sidebars by ProteusThemes: from n/a through <= 1.0.3.
Quick Interest Slider plugin (versions up to 3.1.7) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions reserved for privileged roles.
The ConveyThis plugin for WordPress, in versions up to and including 269.2, contains a Missing Authorization vulnerability. Incorrectly configured access control security levels can be exploited by an attacker to perform unauthorized actions.
The Virtuaria PagBank / PagSeguro for WooCommerce plugin has a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 3.6.3.
A vulnerability in the Geo Controller plugin (INFINITUM FORM) allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. The issue affects versions up to and including 8.9.4.
CSRF vulnerability in the Media Library File Download WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in user. Affects versions up to and including 1.4.
The WordPress plugin DoFollow Case by Case in versions up to and including 3.5.1 is vulnerable to Cross-Site Request Forgery (CSRF). Missing proper request validation allows an attacker to trick an administrator into performing unauthorized actions on their behalf.
The ThemeRain Core plugin has a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.1.9.
Gutenverse News plugin (versions up to 3.0.2) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions they are not permitted to.
The Яндекс Доставка (Boxberry) plugin has a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 2.34.
Missing Authorization vulnerability in BERTHA AI (WordPress plugin) allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.13.
Stored XSS vulnerability in the Generic Elements plugin allows persistent injection of malicious script into the page. An attacker can exploit this to execute script in the victim's browser.
A stored Cross Site Scripting (XSS) vulnerability in the bulletin board (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows remote authenticated users to execute arbitrary JavaScript code in the web browser of other users via manipulation of the 'Inhalt' parameter of the '/SchwarzeBrett/Nachrichten/CreateNachricht' or '/SchwarzeBrett/Nachrichten/EditNachricht/' requests.
Cross-Site Request Forgery (CSRF) vulnerability in Duplicate Content Cure plugin. Allows an attacker to perform unauthorized actions on behalf of an authenticated user.
An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then sending a query with qtype set to ANY.
The Actionwear products sync plugin (up to version 2.3.3) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized access to product sync functions.
A missing authorization vulnerability in the Hype pico plugin allows exploitation of incorrectly configured access control security levels. The issue affects Hype from n/a through <= 1.0.5.
An Information Disclosure vulnerability in Application Server ABAP allows an authenticated attacker to read unmasked values displayed in ABAP Lists. Successful exploitation could lead to unauthorized disclosure of data, resulting in a high impact on confidentiality without affecting integrity or availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS