CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The AI ANN plugin versions up to 1.29.0 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
The Agricola plugin versions up to 1.21.0 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
The Agora plugin versions up to 1.9 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
The Advice plugin versions up to 1.18.0 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
The Adrena plugin versions up to 1.2.14 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
Unauthenticated PHP Object Injection in Accalia versions up to 1.5.3.
Unauthenticated PHP Object Injection in Abogado versions up to 1.18.
Unauthenticated PHP Object Injection in Abelle versions up to 1.22.
Unauthenticated PHP Object Injection in A.Williams versions up to 1.3.1.
Unauthenticated PHP Object Injection in 69 Clothing versions up to 1.2.11.1.
Unauthenticated PHP Object Injection in WPBruiser (no-Captcha anti-Spam) versions up to 3.1.43.
Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 versions up to 2.1.3.
Subscriber PHP Object Injection in Export User Data versions up to 2.2.6.
Contributor Remote Code Execution (RCE) in Betheme versions up to 28.4.2.
Unauthenticated SQL Injection in Qode Tours versions up to 3.1.3.1.
Unauthenticated SQL Injection vulnerability in WP OAuth Server versions up to 6.2.0.
Unauthenticated SQL Injection vulnerability in Simply Schedule Appointments versions up to 1.6.12.10.
Unauthenticated Privilege Escalation vulnerability in AIWU versions up to 1.5.6.
Sensitive Information Disclosure vulnerability in Dell Virtual Storage Integrator for VMware vSphere Client prior to version 10.11.1.0. An unauthenticated remote attacker could exploit this, leading to information disclosure and session hijacking.
Path traversal vulnerability in OpenChamber 1.11.7 in file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw, allowing unauthenticated remote attackers to read arbitrary files by supplying allowOutsideWorkspace=true and an absolute path, bypassing workspace boundary check.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS