CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Contact Form by Supsystic versions prior to 1.10.0.
Unauthenticated Broken Access Control vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.
Unauthenticated Remote File Inclusion vulnerability in Easy Google Maps versions prior to 1.14.2.
Unauthenticated Cross Site Scripting (XSS) vulnerability in URL Shortify versions up to 2.5.0.
Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor versions up to 3.4.18.
Unauthenticated Cross Site Scripting (XSS) in Chaty Pro versions up to 3.5.8.
Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager versions up to 2.9.53.
Unauthenticated Arbitrary Content Deletion in Breeze versions up to 2.5.12.
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register versions up to 7.8.1.
Unauthenticated Broken Authentication in SupportCandy versions up to 3.5.1.
SQL Injection vulnerability in License Manager for WooCommerce versions up to 3.0.18. An attacker can inject malicious SQL code through the customer field.
Unauthenticated Cross Site Scripting (XSS) vulnerability in WP Multilang versions up to 2.4.31. An attacker can inject a malicious script that executes in the victim's browser.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Autopay versions up to 5.0.0. An attacker can inject a malicious script that executes in the victim's browser.
Unauthenticated Cross Site Scripting (XSS) vulnerability in WPDM – Premium Packages versions up to 7.0.5. An attacker can inject a malicious script that executes in the victim's browser.
Unauthenticated Arbitrary File Download vulnerability in Extra Product Options & Add-Ons for WooCommerce versions before 7.6. An attacker can download arbitrary files from the server.
In n8n, an open source workflow automation platform, prior to versions 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server.
In Hoppscotch, an open source API development ecosystem, prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Convert Pro versions up to 1.0.1. An attacker can inject a malicious script that executes in the victim's browser.
In the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes, a user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.