CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Gravity Forms Bookings premium plugin versions up to 2.1 contain a Subscriber SQL Injection vulnerability. An attacker with subscriber privileges can execute unauthorized database queries.
The Essential Real Estate plugin versions up to 5.3.3 contain a Customer PHP Object Injection vulnerability. An attacker can inject malicious PHP objects, which could lead to remote code execution.
The Theme Test Drive plugin versions up to 2.9.1 contain an unauthenticated Local File Inclusion vulnerability. An attacker without logging in can include local files from the server.
The Mayosis Core plugin versions up to 5.4.7 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker without logging in can inject malicious scripts into pages.
The FormyChat plugin versions up to 2.15.7 contain an unauthenticated Broken Access Control vulnerability. An attacker without logging in can gain unauthorized access to functions.
The Vavo Core plugin versions up to 2.3.0 contain an unauthenticated Local File Inclusion vulnerability. An attacker without logging in can include local files from the server.
Unauthenticated Cross Site Scripting (XSS) in SSL Zen versions up to 4.7.43.
Unauthenticated Cross Site Scripting (XSS) in Quill Forms versions up to 5.7.1.
Unauthenticated Broken Access Control in WP Sort Order versions up to 1.3.5.
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. Affects versions from n/a through 2.8.0.
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
SQL injection vulnerability in Task Management System 1.0, in the function Operation::select_with_multiple_condition in /index.php, in the Login Form component, via the email argument. The attack can be launched remotely, and the exploit is publicly available.
Mitigation bypass in the Data Loss Prevention component. Fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Denial-of-service vulnerability in the Widget component. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Site isolation issue in the Audio/Video: Web Codecs component. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Clickjacking vulnerability in the Widget component in Firefox and Thunderbird. The issue was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Integer overflow in the Graphics component in Firefox and Thunderbird. The issue was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Race condition, use-after-free in the Layout: Text and Fonts component. The vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Information disclosure in the Form Autofill component. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Privilege escalation in the Shell Integration component in Firefox and Thunderbird. The issue was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS