CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in WordPress plugin rk-responsive-contact-form version 1.0 is due to the lack of sanitization of the $delid variable before it is used in an SQL query.
Vulnerability in WordPress plugin Easy Team Manager v1.3.2 is due to the lack of sanitization of the identifier before it is used in an SQL statement. The issue is present in the file ./easy-team-manager/inc/easy_team_manager_desc_edit.php.
Vulnerability in WordPress plugin Surveys version 1.01.8 is due to the lack of sanitization of the survey variable in questions.php before placing it in an SQL query.
Vulnerability in the WordPress plugin Surveys version 1.01.8 is due to the lack of sanitization of the survey_id variable in individual_responses.php before placing it in an SQL query.
Vulnerability in the WordPress plugin Surveys version 1.01.8 is due to the lack of sanitization of the action variable in survey_form.php before placing it inside an SQL query.
Vulnerability in WordPress plugin eventr version 1.02.2, due to lack of input sanitization in the edit.php form and event_form.php code, allowing for blind SQL injection via the event parameter.
Vulnerability in WordPress plugin eventr version 1.02.2, due to lack of input sanitization in the edit.php form and attendees.php code, allowing for blind SQL injection via the event parameter.
Vulnerability in the WordPress plugin 'flickr-picture-backup' version 0.7 is due to the lack of checks to see if the user is authenticated or has permission to upload files in 'flickr-picture-download.php'.
Vulnerability in the WordPress plugin 'image-gallery-with-slideshow' version 1.5.2, involving blind SQL injection in image-gallery-with-slideshow/admin_setting.php via the selectMulGallery parameter.
Vulnerability in the WordPress plugin 'image-gallery-with-slideshow' version 1.5.2, involving blind SQL injection in admin_setting.php via the gallery_name parameter.
The WordPress plugin 'image-gallery-with-slideshow' version 1.5.2 has a vulnerability to blind SQL Injection via the imgid parameter in image-gallery-with-slideshow/admin_setting.php.
Vulnerability in the WordPress plugin 'image-gallery-with-slideshow' version 1.5.2 is due to the lack of input sanitization from the gid variable before it is used in an SQL statement.
The WordPress plugin Membership Simplified version 1.58 has a vulnerability to blind SQL injection. The code in updateDB.php does not sanitize user input via recordId in the delete_media function, allowing attackers to manipulate the database.
The WordPress plugin Membership Simplified version 1.58 has a vulnerability to blind SQL injection. The code in updateDB.php does not sanitize user input via recordId in the delete function, allowing an attacker to manipulate SQL queries.
The WordPress plugin 'membership-simplified-for-oap-members-only' version 1.58 has a vulnerability that allows file downloads without checking if the user is logged in and has download privileges.
Vulnerability in WordPress plugin wp2android-turn-wp-site-into-android-app version 1.1.4, which includes unlicensed vulnerable CMS software from http://www.invedion.com.
Vulnerability in WordPress plugin webapp-builder v2.0, which includes unlicensed vulnerable CMS software from http://www.invedion.com/.
Vulnerability in the WordPress plugin 'mobile-app-builder-by-wappress' version 1.05, which includes unlicensed vulnerable CMS software from http://www.invedion.com.
Vulnerability in the WordPress plugin 'mobile-friendly-app-builder-by-easytouch' version 3.0 allows content upload without authentication.
The IPv6 routing header parser in tcpdump before version 4.9.2 has a buffer over-read in the rt6_print() function.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS