CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
PDF Smart Viewer for Elementor versions up to 1.0.4 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can send requests from the server to internal resources.
The Online Contact Widget plugin versions up to 1.3.0 contain an unauthenticated Broken Access Control vulnerability. This means an attacker without logging in can gain unauthorized access to functions that should be protected.
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.
BetterDesk, a remote desktop management solution, versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.
The Duitku Payment Gateway plugin versions up to 2.11.14 contain an unauthenticated Sensitive Data Exposure vulnerability. An attacker without logging in can access confidential information.
The Gravity Forms Bookings premium plugin versions up to 2.1 contain a Subscriber SQL Injection vulnerability. An attacker with subscriber privileges can execute unauthorized database queries.
The Essential Real Estate plugin versions up to 5.3.3 contain a Customer PHP Object Injection vulnerability. An attacker can inject malicious PHP objects, which could lead to remote code execution.
The Theme Test Drive plugin versions up to 2.9.1 contain an unauthenticated Local File Inclusion vulnerability. An attacker without logging in can include local files from the server.
The Mayosis Core plugin versions up to 5.4.7 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker without logging in can inject malicious scripts into pages.
The FormyChat plugin versions up to 2.15.7 contain an unauthenticated Broken Access Control vulnerability. An attacker without logging in can gain unauthorized access to functions.
The Vavo Core plugin versions up to 2.3.0 contain an unauthenticated Local File Inclusion vulnerability. An attacker without logging in can include local files from the server.
Unauthenticated Cross Site Scripting (XSS) in SSL Zen versions up to 4.7.43.
Unauthenticated Cross Site Scripting (XSS) in Quill Forms versions up to 5.7.1.
Unauthenticated Broken Access Control in WP Sort Order versions up to 1.3.5.
Subscriber Privilege Escalation in The Grid versions up to 2.7.9.1.
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
SQL injection vulnerability in Task Management System 1.0, in the function Operation::select_with_multiple_condition in /index.php, in the Login Form component, via the email argument. The attack can be launched remotely, and the exploit is publicly available.
Mitigation bypass in the Data Loss Prevention component. Fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Denial-of-service vulnerability in the Widget component. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Site isolation issue in the Audio/Video: Web Codecs component. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.