CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The WP Support Plus Responsive Ticket System WordPress plugin up to version 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
The WP Support Plus Responsive Ticket System WordPress plugin through version 9.1.2 fails to properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.
The Kali Forms WordPress plugin before 2.4.13 does not sanitize a form field's caption before outputting it as a column header on the admin form-entries screen. Users with Contributor-level access or above can inject JavaScript that executes in an administrator's session. A missing capability check in the post-duplication action allows the Contributor to publish the malicious form so an administrator renders it.
The Plugin for Google Analytics by IO technologies for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 1.1. This is due to missing or incorrect nonce validation on the Google Analytics settings page (ga.php), allowing unauthenticated attackers to update the plugin's stored Google Analytics tracking ID option (io-ga-id) via a forged request, provided they can trick a site administrator into clicking a link.
The Editorial Rating – Product Review & Rating System plugin for WordPress up to version 4.0.5 is vulnerable to Stored Cross-Site Scripting via the 'Link URL' field due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level access to inject arbitrary web scripts that execute when users access the affected page.
The Premium Addons for KingComposer plugin for WordPress up to version 1.1.1 is vulnerable to unauthorized modification and data loss. Missing authorization and capability checks in the add_custom_sidebar() and remove_custom_sidebar() AJAX handlers allow unauthenticated attackers to create or delete custom widget areas, potentially causing widgets to silently lose registration and stop rendering.
The ProfileGrid plugin for WordPress up to version 5.9.9.5 contains a privilege escalation vulnerability via account takeover. Lack of validation of the `user_login` parameter in registration forms and improper error handling allow unauthenticated attackers to change the email address of the user account with ID=1 (typically an administrator), then reset the password and gain access.
The PixMagix – WordPress Image Editor plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.7.2 via the move_image_on_server function. This allows authenticated attackers with author-level access or above to write files with attacker-controlled content to arbitrary locations on the server.
A Time-of-check time-of-use (TOCTOU) race condition vulnerability has been discovered in Samsung Open Source Escargot. This flaw allows leveraging race conditions to compromise data integrity.
The Team Members – Multi Language Supported Team Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 8.7 inclusive. This is due to insufficient input sanitization and output escaping.
A vulnerability in the rtapi_app component of the linuxcnc-uspace package in LinuxCNC before version 2.9.9 allows privilege escalation. The program is installed SUID root and loads shared library modules via dlopen() using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library, and because the process retains elevated privileges during module loading, this results in local privilege escalation to root.
NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` only checks for literal `../` sequences but fails to account for percent-encoded traversal sequences such as `..%2f`. The `url2pathname()` function decodes these sequences after validation, allowing an attacker to bypass the protection.
The HTTP server in Zephyr (subsys/net/lib/http) is vulnerable to path traversal in the static filesystem resource handler (HTTP_RESOURCE_TYPE_STATIC_FS). An attacker can send a GET request with ../ sequences in the URL path to read arbitrary files outside the configured root directory. Affects versions v4.0.0 through v4.4.0 when file system support (CONFIG_FILE_SYSTEM) is enabled.
A logic operator precedence flaw in the IPv6 Neighbor Discovery handlers of Zephyr RTOS causes critical RFC 4861 validity checks to be bypassed. The incorrect boolean expression combines the Hop Limit == 255 test, source/target address checks, and length validation with the ICMPv6 code check in a way that for legitimate packets (code == 0) the entire predicate evaluates false, so the packet is never dropped and all other checks are silently skipped. This includes the mandatory Hop Limit verification (proving on-link origin) and, for Router Advertisements, the link-local source requirement.
A heap buffer overflow vulnerability has been discovered in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 versions 2.3.3 through 2.3.6. An attacker can exploit this to cause a Denial of Service (DoS) by sending a crafted payload.
A heap buffer overflow was discovered in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3. This vulnerability allows an attacker to cause a Denial of Service (DoS) by sending a crafted packet.
In Zephyr OS, the mcumgr_serial_process_frag() function calls net_buf_reset() on the result of smp_packet_alloc() before checking for NULL. When the MCUmgr packet pool (default 4 buffers) is exhausted, smp_packet_alloc() returns NULL, and writing through the NULL pointer causes a system crash.
The Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
A buffer overflow vulnerability in the Get_Attribute_List function of EIPStackGroup OpENer (commit 76b95c) allows an attacker to cause a Denial of Service (DoS) by sending a crafted Common Packet Format (CPF) packet.
In Coolify prior to version 4.0.0-beta.471, server and project lookups are not scoped to the current team. An authenticated user can access servers and projects belonging to other teams by specifying their IDs directly.