CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The ViewState add-on for Zed Attack Proxy (ZAP) before version 4 contains an insecure deserialization vulnerability that allows attackers controlling a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter. The JSFViewState.decode() method base64-decodes the ViewState value and passes it directly to ObjectInputStream.readObject() without a deserialization filter, allowlist, or type restriction, causing the malicious object to be deserialized within the ZAP JVM when the Desktop UI renders the ViewState panel.
The Featured Image plugin for WordPress version 2.1 and earlier contains a Cross-Site Scripting (XSS) vulnerability in the author function. This allows an unauthenticated attacker to inject malicious JavaScript code.
The SEOPress PRO plugin version 9.1.1 and earlier contains a vulnerability related to broken access control for contributors. A user with the contributor role can gain unauthorized access to functions that should be restricted.
The vulnerability allows an unauthenticated attacker to inject malicious script (XSS) in NanoMag version 1.8 and earlier. The attack can be performed without authentication, increasing the risk for users.
The vulnerability in the GIFT4U plugin versions up to 1.0.10 allows unauthenticated attackers to bypass access controls. This can lead to unauthorized access to functions or data.
The Flash & HTML5 Video plugin version 2.11.0 and earlier contains an unauthenticated broken access control vulnerability. An attacker can gain unauthorized access to functions or data without required authentication.
Unauthenticated Cross Site Scripting (XSS) vulnerability in weMail versions up to 2.1.2.
The H5P plugin version 1.17.7 and earlier contains a vulnerability allowing a contributor to delete arbitrary files on the server. The flaw is due to insufficient permission validation during file deletion operations.
An unauthenticated Cross Site Scripting (XSS) vulnerability exists in FOX versions 1.4.8 and earlier. It allows a remote attacker to inject malicious script without authentication.
The Site Reviews plugin version 8.0.11 and earlier allows sensitive subscriber data exposure. This vulnerability enables unauthorized users to access information that should be protected.
The vulnerability allows an unauthenticated attacker to execute XSS scripts in the Simply Schedule Appointments plugin versions up to and including 1.6.12.2.
The vulnerability in GetGenie plugin versions up to 4.4.2 allows exposure of sensitive subscriber data. An attacker can access information that should be protected.
The vulnerability allows remote code execution (RCE) in the Blocksy Companion Pro plugin up to version 2.1.45. An attacker can exploit this flaw to take control of the server.
SureCart plugin version 4.3.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
Cross Site Scripting (XSS) vulnerability in SureCart plugin versions up to 4.2.2, allowing a subscriber-level user to inject malicious script.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Everest Forms versions up to 3.4.8.
In Teable v2, the REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables.
Unauthenticated Cross Site Scripting (XSS) vulnerability in WoodMart versions up to 8.5.3 allows an attacker to execute malicious scripts without authentication.
The Advance Product Search plugin version 1.4.4 and earlier contains an unauthenticated SQL injection vulnerability. An attacker can send specially crafted queries to execute arbitrary SQL commands on the database.
An IDOR vulnerability in Toolset Forms versions up to 2.6.24 allows an unauthenticated attacker to access unauthorized data by manipulating object identifiers.