CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The CTX Feed plugin versions up to 6.6.42 contain a Remote Code Execution (RCE) vulnerability exploitable by a shop manager. An attacker with shop manager privileges can execute arbitrary code on the server.
The Type Hub plugin versions up to 2.0.6 contain an Unauthenticated Arbitrary File Upload vulnerability. A remote unauthenticated attacker can upload malicious files to the server.
The Frontend Admin by DynamiApps plugin versions up to 3.29.10 contain an Unauthenticated Privilege Escalation vulnerability. A remote unauthenticated attacker can escalate privileges in the system.
The WordPress File Upload plugin versions up to 5.1.7 contain an Unauthenticated SQL Injection vulnerability. A remote unauthenticated attacker can execute malicious SQL queries against the database.
The AI ANN plugin versions up to 1.29.0 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
The Agricola plugin versions up to 1.21.0 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
The Agora plugin versions up to 1.9 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
The Advice plugin versions up to 1.18.0 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
The Adrena plugin versions up to 1.2.14 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
Unauthenticated PHP Object Injection in Accalia versions up to 1.5.3.
Unauthenticated PHP Object Injection in Abogado versions up to 1.18.
Unauthenticated PHP Object Injection in Abelle versions up to 1.22.
Unauthenticated PHP Object Injection in A.Williams versions up to 1.3.1.
Unauthenticated PHP Object Injection in 69 Clothing versions up to 1.2.11.1.
Unauthenticated PHP Object Injection in WPBruiser (no-Captcha anti-Spam) versions up to 3.1.43.
Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 versions up to 2.1.3.
Subscriber PHP Object Injection in Export User Data versions up to 2.2.6.
Contributor Remote Code Execution (RCE) in Betheme versions up to 28.4.2.
Unauthenticated SQL Injection in Qode Tours versions up to 3.1.3.1.
Unauthenticated SQL Injection vulnerability in WP OAuth Server versions up to 6.2.0.