CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGINFAILEDTABLE table.
IBM Concert 1.0.0 through 2.1.0 stores sensitive information in cleartext during recursive docker builds which could be obtained by a local user.
An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL. This issue affects the next_url parameter in the login endpoint and could lead to phishing or token theft after successful authentication.
Podatność CVE-2025-2154 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie Specto CM, co prowadzi do możliwości ataku typu Stored XSS. Problem ten dotyczy wersji przed 17032025.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPXPO PostX ultimate-post allows Retrieve Embedded Sensitive Data. This issue affects PostX from n/a through <= 5.0.3.
The Post Grid and Gutenberg Blocks plugin up to version 2.3.23 contains a Stored Cross-site Scripting (XSS) vulnerability that allows an attacker to inject a persistent script into the website.
The Editorial Calendar plugin up to version 3.8.8 contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels.
The WordPress plugin 'Accept Donations with PayPal & Stripe' up to version 1.5.2 has an Open Redirect vulnerability that could be used for phishing.
A Cross-Site Request Forgery (CSRF) vulnerability in the Rustaurius Five Star Restaurant Reservations WordPress plugin (restaurant-reservations). This issue affects Five Star Restaurant Reservations versions from n/a through 2.7.8.
The Yannick Lefebvre WordPress Link Library plugin (link-library) contains a Server-Side Request Forgery (SSRF) vulnerability. This issue affects versions from n/a through 7.8.7. The vulnerability may allow an attacker to force the server to make requests to arbitrary resources.
The YouTube Embed plugin up to version 5.4 contains a Stored Cross-site Scripting (XSS) vulnerability that allows an attacker to inject a persistent script into the website.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer (live-composer-page-builder) allows Stored XSS. This issue affects Page Builder: Live Composer from n/a through 2.1.22.
The Jobs for WordPress plugin is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 2.8.1.
The Bit Assist plugin (versions up to and including 1.5.11) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects Bit Assist from n/a through 1.5.11.
The Widgets for Social Photo Feed plugin (versions up to and including 1.8) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects Widgets for Social Photo Feed from n/a through 1.8.
Missing Authorization vulnerability in WP Adminify (through version 4.0.6.1) allows exploiting incorrectly configured access control security levels.
Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Adminify from n/a through <= 4.0.6.1.
Missing Authorization vulnerability in Simple File List (through version 6.1.18) allows exploiting incorrectly configured access control security levels.
Missing Authorization vulnerability in WP Telegram Widget and Join Link (through version 2.2.12) allows exploiting incorrectly configured access control security levels.
The TS Poll plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 2.5.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS