CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Cross Site Scripting (XSS) vulnerability in WP Mailster up to version 1.9.0.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
Subscriber Privilege Escalation vulnerability in WP User Profiles up to version 2.7.3 allows a subscriber to escalate privileges.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Form Block up to version 1.8.1 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
Editor Privilege Escalation vulnerability in Import and export users and customers up to version 2.5.5 allows a user with the editor role to escalate privileges.
Unauthenticated PHP Object Injection vulnerability in Haaken up to version 1.5 allows an unauthenticated attacker to inject malicious PHP objects, potentially leading to remote code execution.
Unauthenticated Cross Site Scripting (XSS) vulnerability in GiveWP up to version 4.17.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
LearnPress plugin in versions up to and including 4.4.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
picu plugin in versions up to and including 3.10.1 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker.
GiveWP plugin in versions up to and including 4.17.0 contains a Privilege Escalation vulnerability exploitable by an unauthenticated attacker.
picu plugin in versions up to and including 3.10.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
Charitable plugin in versions up to and including 1.8.12.3 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
PowerPress Podcasting plugin in versions up to and including 11.17.9 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker.
Groundhogg plugin in versions up to and including 4.8.3 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.
Payflex Payment Gateway plugin in versions up to and including 2.7.1 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
WPO365 plugin in versions up to and including 44.1 contains a Broken Access Control vulnerability exploitable by a subscriber-level attacker.
Xserver Migrator plugin in versions up to and including 1.6.6 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.
A vulnerability was found in SourceCodester Simple Student Information System 1.0 in the file searchquery.php. Manipulation leads to SQL injection. The attack can be initiated remotely.
A vulnerability in Cloud Foundry UAA's OAuth token endpoint allows an authenticated attacker with a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as a Bearer credential on a client_credentials grant request. UAA fails to verify that the Bearer credential is actually a client credential, accepting any valid access token with a matching client_id.
Memory corruption occurs while processing service requests.
Memory corruption occurs when executing system service routines due to improper handling of user input buffers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS