CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability allowing arbitrary file upload by users with Subscriber role in the Warehouse Cargo plugin. Affects versions up to 2.6.9.
Vulnerability allowing arbitrary file upload by users with Subscriber role in the Smart Cleaning plugin. Affects versions up to 4.8.6.
Vulnerability allowing arbitrary file upload by users with Subscriber role in the IT Residence plugin. Affects versions up to 3.2.1.
Unauthenticated broken authentication vulnerability in the User Registration & Membership Pro plugin. Affects versions up to 5.4.5.
Unauthenticated PHP Object Injection vulnerability in the FundEngine plugin. Affects versions up to 1.7.9.
Subscriber Remote Code Execution (RCE) vulnerability in the Query Wrangler plugin. Affects versions up to 1.5.57.
Unauthenticated SQL Injection vulnerability in the BookingPress Appointment Booking Pro plugin. Affects versions up to 6.0.2.
Unauthenticated privilege escalation vulnerability in the Abandoned Cart Pro for WooCommerce plugin. Affects versions up to 10.4.0.
Unauthenticated SQL Injection vulnerability in the Locatoraid Store Locator plugin. Affects versions up to 3.9.72.
Unauthenticated PHP Object Injection vulnerability in Flatastic versions up to 2.0. An attacker can send crafted data to execute arbitrary code.
Unauthenticated SQL Injection vulnerability in Directory Pro versions up to 2.5.8. An attacker can manipulate database queries.
Unauthenticated SQL Injection vulnerability in TheGem (Elementor) versions up to 5.12.3. An attacker can manipulate database queries.
Author Arbitrary File Upload vulnerability in Media Library Assistant versions up to 3.39. A user with author role can upload malicious files.
Unauthenticated SQL Injection vulnerability in Security & Malware scan by CleanTalk versions up to 2.184. An attacker can manipulate database queries.
The rtMedia plugin for WordPress, BuddyPress and bbPress (up to version 4.7.11) contains an SQL Injection vulnerability, specifically blind SQL injection, due to improper neutralization of special elements in SQL commands.
Unauthenticated PHP Object Injection vulnerability in Forminator versions up to 1.57.0. An attacker can send crafted data to execute arbitrary code.
Unauthenticated Privilege Escalation vulnerability in Capella versions up to 2.5.5. An attacker can gain higher privileges without logging in.
Unauthenticated SQL Injection vulnerability in Capella versions up to 2.5.5. An attacker can manipulate database queries.
A flaw was found in FreeIPA. When a trust relationship is configured with Active Directory, AD users can bypass authentication for FreeIPA services by impersonating a client name in the TGS due to missing PAC certificate verification. This could allow an authenticated AD user to escalate privileges within the FreeIPA domain.
An unauthenticated remote attacker with a valid session identifier can continue using the session after expiration. This increases risks associated with stolen or shared sessions and may enable unauthorized continued access to the FDS web interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS