CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Cross Site Scripting (XSS) vulnerability in the Contest Gallery plugin for WordPress versions up to 30.0.6. An unauthenticated attacker can inject a malicious script.
A Cross Site Scripting (XSS) vulnerability in the Kali Forms plugin for WordPress versions up to 2.4.18. An unauthenticated attacker can inject a malicious script.
A Cross Site Scripting (XSS) vulnerability in the BackWPup plugin for WordPress versions up to 5.7.4. An unauthenticated attacker can inject a malicious script.
SSRF vulnerability in FormCraft up to version 3.9.15. An unauthenticated attacker can make the server send requests to internal network resources.
XSS vulnerability in GiveWP up to version 4.16.3. An unauthenticated attacker can inject malicious JavaScript.
XSS vulnerability in GetGenie up to version 4.4.3. An unauthenticated attacker can inject malicious JavaScript.
XSS vulnerability in Ultimate Addons for Contact Form 7 up to version 3.5.45. An unauthenticated attacker can inject malicious JavaScript.
XSS vulnerability in Message Filter for Contact Form 7 up to version 1.6.3.9. An unauthenticated attacker can inject malicious JavaScript.
XSS vulnerability in Spam protection, AntiSpam, FireWall by CleanTalk up to version 6.82. An unauthenticated attacker can inject malicious JavaScript.
XSS vulnerability in miniorange otp verification up to version 5.5.1. An unauthenticated attacker can inject malicious JavaScript.
SSRF vulnerability in Simple Link Directory Pro up to version 15.0.6. An unauthenticated attacker can make the server send requests to internal network resources.
An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.
Vulnerability in React Router versions 7.0.0 through 7.17.0. Unauthenticated requests to the manifest endpoint can overload the server and slow down responses. This does not affect applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
An issue in Dede CMS version 5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the file_manage_control.php component.
SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php component.
Quest KACE SMA 11.0.273 ships with default credentials for the kbftp account (password getbxf), which is publicly known. A remote attacker can gain privileged access to the FTP service containing MySQL backups with sensitive data.
Quest KACE SMA 11.0.273 ships with default credentials for the MySQL accounts report and R1 (password box747), which is publicly known. A remote attacker can gain privileged access to MySQL databases containing sensitive data.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
An out-of-bounds read vulnerability that could allow a remote attacker to cause unexpected app termination. The issue was addressed with improved input validation.
An integer overflow was addressed with improved input validation. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS