CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maarten Links shortcode allows Stored XSS. This issue affects Links shortcode: from n/a through <= 1.8.3.
An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brecht WP Recipe Maker allows Code Injection. This issue affects WP Recipe Maker from n/a through < 10.1.0.
The Atarim plugin up to version 4.2.1 inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. The vulnerability affects the Atarim Visual Collaboration plugin.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magicoders ACF Recent Posts Widget allows Stored XSS. This issue affects ACF Recent Posts Widget: from n/a through <= 5.9.3.
The Sunshine Photo Cart plugin up to version 3.5.3 has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This enables unauthorized use of features.
Cross-Site Request Forgery (CSRF) vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) allows Cross Site Request Forgery. This issue affects Off-Canvas Sidebars & Menus (Slidebars) from n/a through <= 0.5.8.5.
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Brands for WooCommerce premmerce-woocommerce-brands allows Cross Site Request Forgery. This issue affects Premmerce Brands for WooCommerce: from n/a through <= 1.2.13.
The King Addons for Elementor plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 51.1.61.
The King Addons for Elementor plugin is vulnerable to DOM-Based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This affects versions up to and including 51.1.61.
The WP VR plugin is vulnerable to DOM-Based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This affects versions up to and including 8.5.48.
The Coupon Affiliates plugin up to version 7.2.0 has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This enables unauthorized use of features.
The WordPress Premmerce User Roles plugin (versions up to 1.0.13) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This enables exploitation of misconfigured security mechanisms.
The Seriously Simple Podcasting (seriously-simple-podcasting) plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.13.0.
The WP-Lister Lite for eBay (wp-lister-for-ebay) plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.8.3.
A cross-site request forgery (CSRF) vulnerability has been discovered in User-Management-PHP-MYSQL (up to commit fedcf58797bf2791591606f7b61fdad99ad8bff1). The vulnerability affects unknown code and can be exploited remotely. The exploit has been publicly released and may be used by attackers.
A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. It affects an unknown part of the file /admin/edit-user.php of the User Management Interface. Manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely and the exploit is publicly available.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints.
GitLab EE versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 contain a flaw allowing an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits.
Lack of input validation in the web UI might lead to potential exploitation. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
Logout functionality is not working. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS