CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.
Unauthenticated Privilege Escalation in TranslatePress versions up to 3.3.2.
AutomatorWP versions up to 5.8.3 have a Subscriber Broken Access Control vulnerability, allowing subscribers to access unauthorized functionality.
Unauthenticated PHP Object Injection in The Events Calendar versions up to 6.17.2.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Toolset Blocks versions up to and including 1.6.26.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Event Tickets versions up to and including 5.29.2.1.
Unauthenticated PHP Object Injection in WP Project Manager versions up to 4.0.6.
Unauthenticated Broken Authentication vulnerability in WPLegalPages versions up to and including 3.7.0.
Vulnerability in libp2p (JavaScript) before version 4.2.9: the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. A remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service.
A vulnerability in CakePHP Authentication plugin (versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0) allows authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. Fixed in versions 2.11.2, 3.3.7, and 4.2.1.
OpenEXR versions 3.4.0 through 3.4.13 are vulnerable to a crash when decoding crafted HTJ2K-compressed EXR files, due to invalid tile geometry in the OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. Fixed in 3.4.14.
OpenTelemetry-Go versions 0.11.0 through 1.44.0 have a panic vulnerability in the OpenTracing bridge due to an unsynchronized extraBaggageItems map, causing concurrent access issues and denial of service. Fixed in 1.45.0.
Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress versions up to 2.0.63.
Subscriber Privilege Escalation vulnerability in Booking Hub versions up to and including 1.3.0.
Subscriber Local File Inclusion vulnerability in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator versions up to and including 1.4.
A vulnerability in UltimateAI versions up to 3.1.0 allows a subscriber to upload arbitrary files to the server.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Boost versions up to and including 2.0.4.
A vulnerability in Boost versions up to 2.0.4 allows unauthenticated SQL injection.
A vulnerability in WooBeWoo Product Filter Pro versions up to 3.1.8 allows unauthenticated SQL injection.