CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
WP Crowdfunding plugin versions up to 2.2.2 contain an unauthenticated Sensitive Data Exposure vulnerability.
Buddyboss Platform plugin versions up to 3.5.0 contain a Subscriber Privilege Escalation vulnerability.
10Web Social Photo Feed plugin versions up to 1.5.6 contain a Contributor PHP Object Injection vulnerability.
Social Snap plugin versions up to 1.5.4 contain a Contributor PHP Object Injection vulnerability.
The WordPress plugin FV Flowplayer Video Player (fv-wordpress-flowplayer) in versions through 7.5.56.7212 contains a deserialization of untrusted data vulnerability allowing object injection.
Product Catalog Feed by PixelYourSite plugin versions up to 3.1.4 contain a Shop manager PHP Object Injection vulnerability.
The Sastra Essential Addons for Elementor plugin in versions up to and including 1.2.3 contains a PHP Object Injection vulnerability exploitable by a user with Author privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available gadgets in the codebase.
The Frisbii Pay plugin in versions up to and including 1.8.19 contains a PHP Object Injection vulnerability exploitable by a user with Contributor privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available classes in the codebase.
The WP Media folders plugin in versions up to and including 1.1.10 contains a PHP Object Injection vulnerability exploitable by a user with Contributor privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available gadgets.
The Finale Lite plugin in versions up to and including 2.21.0 contains a PHP Object Injection vulnerability exploitable by a user with Shop manager privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available classes.
The News Kit Elementor Addons plugin in versions up to and including 1.5.0 contains a PHP Object Injection vulnerability exploitable by a user with Subscriber privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available gadgets.
The myPOS Checkout plugin in versions up to and including 1.4.5 contains a PHP Object Injection vulnerability exploitable by a user with Shop manager privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available classes.
The BuddyPress Xprofile Custom Field Types plugin in versions up to and including 1.3.1 contains a PHP Object Injection vulnerability exploitable by a user with Subscriber privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available gadgets.
The Dynamic QR Code – generator plugin in versions up to and including 1.0.1 contains a PHP Object Injection vulnerability exploitable by a user with Contributor privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available classes.
The Extra Fees Plugin for WooCommerce in versions up to and including 4.4.0 contains a PHP Object Injection vulnerability exploitable by a user with Contributor privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available gadgets.
The Zippy plugin in versions up to and including 1.7.0 contains a PHP Object Injection vulnerability exploitable by a user with Editor privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available classes.
The WPCargo Track & Trace plugin in versions up to and including 8.0.5 contains a PHP Object Injection vulnerability that allows injection of a malicious PHP object. This may lead to unauthorized actions within the WordPress application context.
The Plus Addons for Elementor Page Builder Lite in versions up to 6.5.3 contains a stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This allows an attacker to store a malicious script that executes in a user's browser.
P-Net before 1.0.3 does not check that a complete block header is present in received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the next block's length is read past the buffer. Additionally, a DCP Set block shorter than the two-byte block qualifier causes a length underflow, processing the block as 65534 bytes. This can cause a crash (denial of service) or disclose a small amount of memory. Requires adjacent network access.
P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length of up to 65507 bytes. An application that copies the reported number of bytes reads past the end of the receive buffer. The attacker must have established an Application Relationship and requires ADJACENT network access. Applications that do not use the alarm data are not affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS