CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An integer overflow vulnerability has been found in the "builtin.c" file of gawk versions 5.4.0 and below. This issue may lead to memory exhaustion on the hosting operating system and could allow an attacker to overwrite gawk heap metadata and objects with controlled bytes.
Mura CMS versions prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitized before being processed by the ColdFusion engine. A remote attacker can exploit this to inject and execute arbitrary CFML expressions and instantiate malicious Java objects, compromising system security.
A missing authorization vulnerability in the repository creation functionality of Google Cloud BigQuery, Dataform, and Colab Enterprise allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. The vulnerability affects versions between October 2025 and May 10, 2026.
The Directorist plugin for WordPress contains a deserialization of untrusted data vulnerability allowing object injection. The issue affects versions up to and including 8.8.2.
The AIWU content generator plugin contains a blind SQL injection vulnerability in versions up to and including 1.5.4. An attacker can exploit improper neutralization of special elements in SQL commands.
The MailOptin WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 1.2.77.3 inclusive.
The Realtyna Organic IDX plugin (real-estate-listing-realtyna-wpl) for WordPress contains a code injection vulnerability that allows remote code inclusion. The issue affects versions up to and including 5.2.0.
The Grand Photography WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This issue affects all versions up to and including 5.7.8.
The RT-Theme 18 | Extensions (rt18-extensions) plugin up to version 2.5 contains a deserialization of untrusted data vulnerability allowing object injection. An attacker can remotely exploit this flaw to execute arbitrary code or manipulate data.
The AcyMailing SMTP Newsletter plugin for WordPress contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. The issue affects versions up to and including 10.11.0.
The 777 triple-seven WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. The issue affects versions up to and including 1.13.0.
The Kirki plugin for WordPress contains a Blind SQL Injection vulnerability in versions up to and including 6.0.12. The issue is due to improper neutralization of special elements used in SQL commands.
The Kirki WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This affects versions up to and including 6.0.12.
The Aimogen Pro WordPress plugin contains an unrestricted file upload vulnerability with dangerous file types. This allows an attacker to upload malicious files, potentially leading to remote code execution.
The LatePoint plugin for WordPress contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects versions up to and including 5.6.3.
The WoowBot Pro Max WordPress plugin contains an unrestricted file upload vulnerability allowing dangerous file types. This enables an attacker to upload malicious files, potentially leading to remote code execution.
The Simple Business Directory Pro WordPress plugin contains an SQL injection vulnerability in versions up to and including 15.9.4. An attacker can exploit improper neutralization of special elements in SQL commands.
The Amelia WordPress plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This affects versions up to and including 2.4.2.
The SureDash WordPress plugin contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 1.8.0.
A URL path injection vulnerability via unencoded user-supplied identifiers has been found in Apache Gravitino. The issue affects versions from 1.0.0 before 1.2.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS