CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT /sys/tenant/passApply to gain tenant administrator pack permissions in any tenant.
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant arbitrary menu or button permissions, escalating privileges or revoking other users' permissions.
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table, erasing all users' audit trails.
Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
The Forminator plugin in versions up to and including 1.57.3 allows an unauthenticated attacker to delete arbitrary content on a WordPress site. The flaw requires no login or special privileges.
The WooCommerce Multilingual & Multicurrency plugin in versions up to and including 5.5.8 contains a PHP Object Injection flaw exploitable by a shop manager user. This may lead to dangerous code execution or further privilege escalation.
The Barcode Scanner with Inventory & Order Manager plugin in versions up to and including 1.13.1 has a broken access control flaw exploitable by an unauthenticated attacker. This allows access to functions or data that should be protected.
The Barcode Scanner with Inventory & Order Manager plugin in versions up to and including 1.13.1 is vulnerable to SQL injection exploitable by a subscriber-level user. The flaw allows manipulation of database queries.
The Barcode Scanner with Inventory & Order Manager plugin in versions up to and including 1.13.1 contains a Cross Site Scripting (XSS) flaw exploitable by an unauthenticated attacker. This allows injection of malicious script into site pages.
The KuteShop theme in versions up to and including 4.2.9 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.
The KuteShop theme in versions up to and including 4.2.9 contains an unauthenticated Cross Site Scripting (XSS) flaw. It allows injection of malicious script into site pages.
The Boutique theme in versions up to and including 2.3.3 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.
The Biolife theme in versions up to and including 3.2.3 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.
The Biolife theme in versions up to and including 3.2.3 contains an unauthenticated Cross Site Scripting (XSS) flaw. It allows injection of malicious script into site pages.
Unauthenticated Local File Inclusion (LFI) in TechOne versions up to 3.0.3. Allows an attacker to read files from the server without authentication.
Unauthenticated Cross Site Scripting (XSS) in TechOne versions up to 3.0.3. Allows an attacker to inject malicious scripts into a victim's browser.
Unauthenticated Local File Inclusion (LFI) in Armania versions up to 1.4.8. Allows an attacker to read files from the server without authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS