CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Local File Inclusion in TouchUp versions before 1.4.
Reflected Cross-site Scripting vulnerability in ThemeREX Group Kids Planet theme, from n/a through 2.2.14.2.
Unauthenticated Local File Inclusion in DukaMarket versions up to 1.3.0.
Unauthenticated Local File Inclusion in Uminex versions up to 1.0.9.
Administrator SQL Injection in WP Ultimate CSV Importer versions up to 9.2.
Unauthenticated Local File Inclusion in Aalto versions up to 1.8.
Unauthenticated Local File Inclusion in CleanSkin versions up to 1.5.0.
Administrator SQL Injection in Frontend Admin by DynamiApps versions up to 3.29.13.
SQL Injection vulnerability in the administrator panel of the Leyka plugin in versions up to 3.32.3.
Unauthenticated Cross Site Scripting (XSS) vulnerability in the Photo Gallery by 10Web plugin in versions up to 1.8.47.
SQL Injection vulnerability in the Qode Tours plugin in versions up to 3.1.3.2, affecting users with the subscriber role.
Unauthenticated Cross Site Scripting (XSS) vulnerability in the Slider by 10Web plugin in versions up to 1.2.63.
Unauthenticated Cross Site Scripting (XSS) vulnerability in the Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin in versions up to 6.0.5.
Unauthenticated Broken Access Control vulnerability in the DK plugin in versions up to 3.2.1.
Unauthenticated Broken Access Control vulnerability in Grand News plugin up to version 3.4. Allows unauthorized users to access functions they should not have permissions for.
Unauthenticated Local File Inclusion vulnerability in Kids Care plugin up to version 3.2.4. Allows unauthorized users to read local files on the server.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in FV Player 8 plugin up to version 8.1.8. Allows unauthorized users to inject malicious scripts into pages viewed by other users.
The WordPress plugin "Social Share Icons & Social Share Buttons" (ultimate-social-media-plus) up to version 3.7.5 is vulnerable to Reflected Cross-site Scripting due to improper neutralization of input during web page generation.
The Jannah plugin for WordPress by TieLabs contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 7.6.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS