CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Easy Property Listings WordPress plugin in versions up to 3.5.25 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script that executes in the user's browser.
The Auction Nudge – Your eBay on Your Site WordPress plugin in versions up to 8.4.0 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript that executes in the victim's browser.
The Razorpay Payment Button Elementor WordPress plugin in versions up to 1.2.8 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. Malicious script injected by an attacker executes in the user's browser.
The Post Video Players WordPress plugin in versions up to 1.165 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script that executes in the victim's browser.
The YayMail WordPress plugin in versions up to 4.4.6 contains a PHP Object Injection vulnerability exploitable by a shop manager user. This can lead to injection of a malicious PHP object and further exploitation.
The WP Crowdfunding WordPress plugin in versions up to 2.2.2 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script that executes in the user's browser.
The Eventer WordPress plugin in versions up to 0.1.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. Malicious script injected by an attacker executes in the victim's browser.
Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a Server-Side Template Injection (SSTI) vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker with a common operational role can inject template expressions that the server evaluates in an unrestricted context.
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the victim's tokens, and can bypass project access settings via the OIDC device authorization API.
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.
ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI. Unauthenticated attackers can poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers.
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies. An authenticated client can choose which HuggingFace model the server loads by referencing a malicious repository with a pickle weight file.
Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream.
GlobalPayments WooCommerce plugin versions up to 1.23.3 contain an unauthenticated Cross Site Scripting (XSS) vulnerability.
WP Crowdfunding plugin versions up to 2.2.2 contain an unauthenticated Sensitive Data Exposure vulnerability.
Buddyboss Platform plugin versions up to 3.5.0 contain a Subscriber Privilege Escalation vulnerability.
10Web Social Photo Feed plugin versions up to 1.5.6 contain a Contributor PHP Object Injection vulnerability.
Social Snap plugin versions up to 1.5.4 contain a Contributor PHP Object Injection vulnerability.
FV Flowplayer Video Player plugin versions up to 8.3.4 contain a Shop manager PHP Object Injection vulnerability.
Product Catalog Feed by PixelYourSite plugin versions up to 3.1.4 contain a Shop manager PHP Object Injection vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS