CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The ListingPro plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 2.9.8.
The WPFront User Role Editor WordPress plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions up to and including 4.2.3.
The Woostify plugin for WordPress in versions up to and including 2.4.2 is vulnerable to stored XSS due to improper neutralization of input during web page generation.
XSS vulnerability in the XStore theme for WordPress allows injection of HTML/JavaScript code into a web page. Affects versions up to and including 9.6.
The Embed Any Document plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 2.7.7.
Missing Authorization vulnerability in Jeff Farthing Theme My Login allows exploiting incorrectly configured access control security levels. This issue affects Theme My Login from n/a through <= 7.1.12.
The TheGem plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 5.10.5.
The TheGem (Elementor) plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 5.10.5.
The Stackable plugin for WordPress has an insertion of sensitive information into sent data vulnerability that allows retrieval of embedded sensitive data. This issue affects versions from n/a through 3.18.1.
The Stackable (stackable-ultimate-gutenberg-blocks) plugin for WordPress in versions up to and including 3.18.1 contains a Missing Authorization vulnerability. It enables exploitation of incorrectly configured access control security levels.
CSRF vulnerability in the Download Manager plugin. Allows an attacker to perform unauthorized requests on behalf of an administrator.
Vulnerability in the Download Manager plugin for WordPress (versions up to 3.3.25) allows exposure of sensitive system information to unauthorized parties. An attacker can retrieve embedded sensitive data.
The wp-mpdf WordPress plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions up to and including 3.9.1.
The Wide Banner plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.0.4.
The Quantities and Units for WooCommerce plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.0.13.
CSRF vulnerability in the Di Themes Demo Site Importer. An attacker can exploit this to perform unauthorized imports or changes.
The Acclectic Media Organizer plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.4.
The Authorsy plugin up to version 1.0.5 contains a Stored XSS vulnerability. The issue arises from improper neutralization of input during web page generation.
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server.
Apache Airflow 3 introduced a "write-only" model for sensitive connection fields, but in version 3.0.3 this model was unintentionally violated. Users with READ permissions could view sensitive connection information through both the API and the UI, bypassing the AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS option. This issue does not affect Airflow 2.x.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS