CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Filter & Grids plugin for WordPress is vulnerable to SQL Injection via the 'phrase' parameter in all versions up to and including 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only works on MariaDB as the query results in a syntax error on MySQL.
The Brizy – Page Builder plugin for WordPress up to version 2.7.16 is vulnerable to Sensitive Information Exposure via the get_users() function. This allows authenticated attackers with Contributor-level access or above to extract sensitive data including email addresses and hashed passwords of administrators.
A vulnerability was detected in campcodes Online Student Enrollment System 1.0 allowing unrestricted file upload. Manipulating the userphoto argument in /admin/index.php?page=user-profile enables remote attacks. The exploit is public and may be used.
The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If a user imports a specially crafted JSON file, the tool would load JavaScript from the file into the page, executing in the user's browser context upon submission.
A logic issue in file handling was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, and macOS Tahoe 26.2. An app may be able to access protected user data.
An inconsistent user interface issue was addressed with improved state management. An attacker may be able to spoof their FaceTime caller ID. Fixed in iOS 18.7.3, iPadOS 18.7.3, iOS 26.2, iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2.
An information disclosure issue was addressed with improved privacy controls. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An app may be able to access sensitive user data.
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An app may be able to access sensitive user data.
A vulnerability in Apple systems (iOS, iPadOS, macOS) has been addressed with improved checks. The issue involves an app potentially accessing sensitive user data. Fixes are available in iOS 18.7.3, iPadOS 18.7.3, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, and macOS Tahoe 26.2.
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3 and macOS Tahoe 26.2. An app may be able to access sensitive user data.
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.3 and macOS Tahoe 26.2. An app may be able to access sensitive user data.
A memory corruption issue was addressed with improved memory handling. The vulnerability affected iOS, iPadOS, macOS, tvOS, visionOS, and watchOS and was fixed in the listed versions.
A permissions issue in macOS was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, and macOS Tahoe 26.2. An app may be able to access sensitive user data.
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, and macOS Tahoe 26.2. An app may be able to read sensitive location information.
A use-after-free vulnerability in WebKit was fixed with improved memory management. The issue affects Safari and Apple systems before the specified updates.
This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to access sensitive user data.
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox.
The issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, and macOS Tahoe 26.2. An app may be able to cause a denial-of-service.
This issue was addressed with improved state management. Fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and macOS Tahoe 26.1. An app may be able to access sensitive user data.
The issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS