CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality.
The Dbit N300 T1 Pro router running firmware V1.0.0 lacks rate limiting on the /api/login endpoint, allowing attackers to brute force passwords.
In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.
The Reformer for Elementor WordPress plugin has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects all versions up to and including 1.0.6.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Stored XSS. This issue affects VK Google Job Posting Manager: from n/a through <= 1.2.22.
The Watu Quiz plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Watu Quiz from n/a through <= 3.4.5.
The Spoter for Elementor plugin (merkulove) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through <= 1.04.
The Yaad Sarig Payment Gateway For WC WordPress plugin versions up to and including 2.2.11 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This could enable unauthorized access to functionality.
Missing Authorization vulnerability in OnPay.io OnPay.io for WooCommerce onpay-io-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnPay.io for WooCommerce: from n/a through <= 1.0.47.
The Google XML Sitemaps plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.1.22.
Missing Authorization vulnerability in Directory Pro plugin up to version 2.5.6, allowing exploitation of incorrectly configured access control security levels.
The Easy Property Listings plugin by Merv Barrett contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 3.5.22.
Missing Authorization vulnerability in WP Coupons and Deals plugin up to version 3.2.4, allowing exploitation of incorrectly configured access control security levels.
The RTL Tester plugin (up to version 1.2) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick an authenticated user into performing unwanted operations.
Missing Authorization vulnerability in WPS Bidouille plugin up to version 1.33.1, allowing exploitation of incorrectly configured access control security levels.
The Quick Interest Slider plugin (versions up to and including 3.1.5) contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this to perform unauthorized operations in the context of a logged-in user.
The Listify plugin (up to version 3.2.5) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can force an authenticated user to perform unwanted actions.
Missing Authorization vulnerability in Salient Core plugin up to version 3.0.8, allowing exploitation of incorrectly configured access control security levels.
The WP Attractive Donations System - Easy Stripe & Paypal donations plugin (versions up to and including 1.25) contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this to perform unauthorized operations in the context of a logged-in user.
Missing Authorization vulnerability in CM On Demand Search And Replace plugin up to version 1.5.5, allowing exploitation of incorrectly configured access control security levels.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS