CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The TrueBooker plugin versions up to 1.2.3 contain an unauthenticated privilege escalation vulnerability.
The TrueBooker plugin versions up to 1.2.3 are vulnerable to unauthenticated SQL injection.
The Bookly plugin versions up to 27.7 are vulnerable to unauthenticated SQL injection.
The WPDM – Premium Packages plugin versions up to 6.2.0 are vulnerable to unauthenticated SQL injection.
The Participants Database plugin versions up to 2.7.8.3 allow unauthenticated arbitrary file deletion.
The Thrive Quiz Builder plugin versions up to 10.9.3.0 are vulnerable to unauthenticated PHP object injection.
The Advanced Views plugin versions up to 3.8.11 allow a subscriber to perform remote code execution (RCE).
The SMS Alert Order Notifications plugin versions up to 3.9.6 contain an unauthenticated privilege escalation vulnerability.
The MapSVG plugin versions up to 8.14.0 are vulnerable to unauthenticated SQL injection.
The Participants Database plugin versions up to 2.7.8.3 contain an unauthenticated SQL injection vulnerability. An attacker can send crafted requests to execute arbitrary SQL queries.
Buddyboss Platform versions up to 3.0.5 contain an unauthenticated SQL injection vulnerability. An attacker can remotely execute arbitrary SQL queries.
The Ninja Forms File Uploads Extension versions up to 3.3.26 are vulnerable to unauthenticated Cross-Site Request Forgery (CSRF). An attacker can trick an administrator into performing unwanted actions.
The Mailster plugin versions up to 4.1.17 allow an editor to upload arbitrary files. A user with the editor role can upload a malicious file to the server.
The GeoIP extension for Joomla! extracts database update archives without path validation, leading to a Zipslip vulnerability.
The Cache Cleaner Pro extension for Joomla! exposes CDN credentials in administrator request URLs.
The Cache Cleaner Pro extension for Joomla! (from regularlabs.com) is vulnerable to Server-Side Request Forgery (SSRF). Custom query URLs can access internal or reserved network services.
The MountDev AI MCP Connector plugin for WordPress versions up to 1.6.1 has an authorization bypass vulnerability. An unauthenticated attacker can obtain an administrator-bound OAuth Bearer token by exploiting publicly accessible client registration and authorization endpoints.
The Customer Support Ticket System & Helpdesk plugin for WordPress up to version 6.0.5 is vulnerable to code injection via the 'path' parameter due to dynamic function invocation on an attacker-controlled value with insufficient validation. Unauthenticated attackers can invoke arbitrary parameterless PHP functions, disrupting site functionality or exposing sensitive information. The required nonce is publicly emitted via wp_localize_script when the [emd_form] shortcode is rendered on any public-facing page.
The GoDAM plugin for WordPress up to version 1.12.2 allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution due to insufficient file type validation in the save_video_file() function.
A remote code execution (RCE) vulnerability in fastjson versions 1.2.68 through 1.2.83. The vulnerability is exploitable under default configuration, without requiring AutoType enablement or classpath gadgets.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS