CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Fluent Forms plugin for WordPress up to version 6.2.7 has a Stored XSS vulnerability via the Name field nested in `password`. An unauthenticated attacker can inject arbitrary JavaScript that executes when a user views the page.
The GTM4WP plugin for WordPress up to version 1.22.3 has a Stored XSS vulnerability via WooCommerce billing fields. An unauthenticated attacker can inject JavaScript in the billing first name during guest checkout.
SQL injection vulnerability in ERPNext and Frappe due to direct string interpolation in SQL queries. An authenticated low-privilege user can execute arbitrary SQL, bypass access controls, and extract sensitive data including admin password hash.
Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.
Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The header_rewrite plugin in Apache Traffic Server can crash or corrupt memory during cookie operations and CIDR condition matching. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.
The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The regex_remap plugin in Apache Traffic Server overflows the stack and integers from substitution input. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.
The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Cripts framework of Apache Traffic Server has out-of-bounds writes, path traversal, and use-after-free errors. Affected versions: 10.0.0 through 10.1.3.
Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.
Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.
Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.
Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. Affected versions are from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4.
In Apache Atlas, missing authorization in admin endpoints allows any authenticated user, regardless of role, to perform administrative operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS