CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Cross Site Scripting (XSS) vulnerability in AffiliateWP plugin up to version 2.35.0. An unauthenticated attacker can inject malicious scripts.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Simply Schedule Appointments plugin up to version 1.6.12.10. An unauthenticated attacker can inject malicious scripts.
Unauthenticated Cross Site Scripting (XSS) in wpDataTables versions up to and including 7.5.1.
Unauthenticated Broken Access Control in BOX NOW Delivery Croatia versions up to and including 3.3.0.
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin versions up to and including 1.8.6.
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables versions up to and including 5.2.9.
Unauthenticated Cross Site Scripting (XSS) in Media Library Assistant versions up to and including 3.38.
Unauthenticated Cross Site Scripting (XSS) in EmbedPress versions up to and including 4.5.6.
A heap-based buffer overflow vulnerability exists in the memcached client of Apache Portable Runtime Utility. This issue affects versions from 1.3.0 through 1.6.3.
A heap-based buffer overflow vulnerability exists in the redis client of Apache Portable Runtime Utility. This issue affects versions from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
The PublishPress Capabilities (capability-manager-enhanced) WordPress plugin has an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 2.45.0.
The Popup Maker plugin by Code Atlantic LLC contains an Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that allows DOM-Based XSS. The issue affects versions up to and including 1.23.0.
Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager versions up to and including 2.6.0.
Unauthenticated Cross Site Scripting (XSS) in Forminator versions up to and including 1.56.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in NextGEN Gallery versions up to 4.2.3. An attacker can inject malicious script without authentication.
Unauthenticated Broken Access Control vulnerability in JetFormBuilder versions up to 3.6.4.1. Allows unauthorized users to access functions they should not have permissions for.
Contributor Privilege Escalation vulnerability in Forminator versions up to 1.56.0. A user with Contributor role can escalate their privileges.
Unauthenticated Cross Site Scripting (XSS) vulnerability in JetEngine versions up to 3.8.13.1. An attacker can inject malicious script without authentication.
The apr_password_validate() function in APR-util versions 1.6.3 and earlier did not perform constant-time comparisons of hashes or passwords, potentially leaking their content via a side-channel timing attack, especially on platforms without crypt() such as Windows, BeOS, NetWare, or Android.
Cryptographic timing side-channel vulnerability in the backend authentication mechanism of OMICRON StationScout before version 3.05. Allows an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate clients. An attacker can gain full access to the system configuration, allowing modification, reset, or unauthorized alteration of system parameters or injecting network traffic into the connected network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS