CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code.
The Manual - Documentation, Knowledge Base & Education WordPress Theme versions up to 7.5.4 contain an unauthenticated Broken Access Control vulnerability. An attacker can gain unauthorized access to functions or data.
The Complianz plugin versions up to 7.5.0 contain a PHP Object Injection vulnerability exploitable by an administrator. An attacker with admin privileges can inject a malicious PHP object.
The Dokan Pro plugin versions up to 5.0.3 contain an unauthenticated Broken Access Control vulnerability. An attacker can gain unauthorized access to functions or data.
The Dokan Pro plugin versions up to 5.0.2 contain an SQL Injection vulnerability exploitable by a subscriber. An attacker with subscriber privileges can manipulate database queries.
The Dokan Pro plugin version 5.0.2 and earlier allows a subscriber-level PHP object injection. An attacker with subscriber role can submit malicious data that gets deserialized, leading to remote code execution.
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the weDevs Dokan Pro plugin allows Reflected XSS. This issue affects Dokan Pro from n/a before 5.0.7.
Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio Element Kit for Elementor (lastudio-element-kit) allows Stored XSS. This issue affects versions from n/a through 1.6.2.
The Vino plugin version 1.9 and earlier allows a contributor-level Local File Inclusion. A user with contributor role can read arbitrary files from the server.
The Tonda Core plugin version 2.1.2 and earlier allows a contributor-level Local File Inclusion. A user with contributor role can read arbitrary files from the server.
The Uncanny Automator plugin version 7.3.2 and earlier allows an administrator-level SQL injection. An administrator can execute arbitrary SQL queries against the database.
The Quiz And Survey Master plugin up to version 11.2.0 contains an SQL injection vulnerability exploitable by a contributor-level user. An attacker can manipulate database queries through specially crafted input.
The MapSVG plugin up to version 8.14.0 contains an SQL injection vulnerability exploitable by a contributor-level user. An attacker can manipulate database queries.
The MapSVG plugin up to version 8.14.0 contains an SQL injection vulnerability exploitable by a contributor-level user. An attacker can manipulate database queries.
Vulnerability in JetBrains IntelliJ IDEA before version 2026.2 allows arbitrary code injection via UI Designer form files.
In IntelliJ IDEA before version 2026.2, there is a vulnerability allowing unauthorized file access during a Remote Development session. An attacker can access files they should not have permission to.
In JetBrains IntelliJ IDEA before version 2026.2, arbitrary code execution was possible before granting project trust via development container configuration.
In JetBrains PhpStorm before 2026.2, arbitrary code execution was possible before granting project trust via the configured interpreter.
In JetBrains PhpStorm before 2026.2, arbitrary code execution was possible before granting project trust via project tooling.
In JetBrains WebStorm before version 2026.2, arbitrary code execution was possible via a project-supplied linter configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS