CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In WP Event Solution versions up to 4.1.8, there is an issue with unauthenticated access that may lead to broken access control.
There is an unauthenticated access control issue in Royal MCP versions <= 1.4.2.
The Booking package versions <= 1.7.06 have an issue with unauthenticated access that allows for broken access control.
Versions of Coupon Affiliates <= 7.5.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
The Contact Form Extender plugin for Divi versions <= 1.0.6 has a vulnerability that allows unauthenticated arbitrary file deletion.
wpForo Forum versions below 3.0.2 have an issue with unauthenticated access that leads to broken access control.
There is a SQL Injection vulnerability in the subscriber module in MasterStudy LMS versions up to 3.7.25.
WPGraphQL versions below 2.11.1 are vulnerable to unauthenticated SQL Injection.
Redsys for WooCommerce Light versions up to 7.0.0 have a vulnerability in access control that allows unauthorized access.
Versions of Notification for Telegram <= 3.5 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
In Groundhogg versions <= 4.4, there is a vulnerability that allows sales representatives to delete arbitrary files.
There is a vulnerability in WP BASE Booking versions up to 5.9.0 that allows unauthenticated privilege escalation.
B Blocks versions up to 2.0.31 contain a vulnerability that allows contributor privilege escalation.
In WP Directory Kit versions <= 1.5.0, there is an unauthenticated broken access control vulnerability that may allow attackers to access resources they should not have access to.
Unauthenticated Broken Access Control exists in AWP Classifieds <= 4.4.4 versions.
Events Calendar for GeoDirectory versions up to 2.3.25 contain a PHP Object Injection vulnerability, which may lead to unauthorized access or data manipulation.
Masteriyo - LMS versions up to 2.1.5 contain a vulnerability in access control that allows unauthorized access.
Versions of EventPrime <= 4.3.0.0 have a vulnerability related to Insecure Direct Object References (IDOR). This allows subscribers to access data they should not have permission to.
Versions of Paid Member Subscriptions up to 2.17.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Versions of Easy Appointments up to 3.12.21 have an unauthenticated broken access control vulnerability that may allow attackers to access resources they should not have access to.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS