CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Sensitive Data Exposure vulnerability at the contributor level in the Gutenberg Blocks by Kadence Blocks plugin (versions up to 3.7.8) allows a user with the contributor role to access sensitive data that should not be available to them.
Path Traversal vulnerability in W3 Total Cache versions up to 2.10.2 allows an unauthenticated attacker to access files outside the root directory.
IDOR vulnerability in Colissimo Officiel: Méthodes de livraison pour WooCommerce versions up to 2.10.0 allows a customer to access other users' resources.
XSS vulnerability in Ultimate Addons for Elementor versions up to 1.45.2 allows a user with Contributor role to inject malicious script.
CSRF vulnerability in Plugins Garbage Collector (Database Cleanup) versions up to 0.14 allows an unauthenticated attacker to perform unauthorized actions.
Unauthenticated Sensitive Data Exposure vulnerability in Featured Video Plus versions up to 2.3.3 allows access to confidential information.
Unauthenticated Sensitive Data Exposure vulnerability in Export Import Menus versions up to 1.9.2 allows access to confidential information.
Unauthenticated Sensitive Data Exposure vulnerability in Custom CSS and JavaScript versions up to 2.0.16 allows access to confidential information.
CSRF vulnerability in Theme My Login versions up to 7.1.14 allows an unauthenticated attacker to perform unauthorized actions.
Broken Access Control vulnerability in Advanced Custom Fields: Font Awesome Field versions up to 6.1.1 allows a user with Contributor role to access unauthorized functions.
Broken Access Control vulnerability in Legal Text Connector of the IT-Recht Kanzlei versions up to 1.0.13 allows an unauthenticated attacker to access unauthorized functions.
Broken Authentication vulnerability in WP Event Solution versions up to 4.1.9 allows an unauthenticated attacker to bypass authentication mechanisms.
Broken Authentication vulnerability in Gutena Forms versions up to 1.9.0 allows an unauthenticated attacker to bypass authentication mechanisms.
Bypass vulnerability in Element Pack Elementor Addons versions up to 8.7.13 allows an unauthenticated attacker to bypass security controls.
Cross Site Scripting (XSS) vulnerability in Business Directory versions up to 6.4.24 allows a Subscriber user to inject malicious script.
Broken Access Control vulnerability in SureCart versions up to 4.6.2 allows an unauthenticated attacker to bypass access controls.
Bypass vulnerability in CAPTCHA 4WP versions up to 7.6.0 allows an unauthenticated attacker to bypass CAPTCHA protections.
Insecure Direct Object References (IDOR) vulnerability in Mercado Pago payments for WooCommerce versions up to 8.9.0 allows an unauthenticated attacker to access objects without authorization.
Cross Site Scripting (XSS) vulnerability in FiboSearch versions up to 1.33.0 allows a Shop manager user to inject malicious script.
Cross Site Scripting (XSS) vulnerability in Powerkit versions up to 3.1.0 allows a Contributor user to inject malicious script.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS