CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The WPMobile.App plugin versions up to 11.77 have a Broken Access Control vulnerability that can be exploited without authentication.
The OMGF Pro plugin versions up to 5.2.7 allow unauthenticated users to download arbitrary files from the server.
The SAML SP Single Sign On plugin versions up to 5.4.3 have a vulnerability that allows unauthenticated users to escalate privileges.
The Mang Board WP plugin versions up to 2.3.4 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
The GeekyBot plugin versions up to 1.2.6 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
The WP Full Stripe Free plugin versions up to 8.5.0 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
Rekor, a software supply chain transparency log, contains a decompression bomb vulnerability in the `Package.Unmarshal()` function for APK files. An attacker can submit a specially crafted APK file that decompresses to a huge amount of memory, causing a server crash. The vulnerability affects versions 0.3.0 through 1.5.1 and is reachable via two unauthenticated endpoints.
The Participants Database plugin versions up to 2.7.8.4 allow unauthenticated users to delete arbitrary files from the server.
Hydra Booking plugin versions up to 1.2.2 contain an unauthenticated Broken Access Control vulnerability. An attacker without authentication can exploit this flaw to perform unauthorized operations.
Knowledge Base for Documentation, FAQs with AI Assistance plugin versions up to 17.211.0 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without authentication.
Travelfic Toolkit plugin versions up to 1.5.1 contain a Broken Access Control vulnerability from subscriber level. A user with subscriber role can gain unauthorized privileges.
Booking Activities plugin versions up to 1.18.4 contain an unauthenticated PHP Object Injection vulnerability. An attacker without authentication can inject malicious PHP objects.
Visitors Traffic Real Time Statistics plugin versions up to 8.11 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without authentication.
WP Event Solution plugin versions up to 4.1.19 contain a Customer Arbitrary Content Deletion vulnerability. A user with customer role can delete arbitrary content.
Blog Floating Button plugin versions up to 1.4.20 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without authentication.
CubeWP plugin versions up to 1.1.30 contain a SQL Injection vulnerability from subscriber level. A user with subscriber role can inject malicious SQL queries.
Service Finder Booking plugin versions up to 6.2 contain a Subscriber Privilege Escalation vulnerability. A user with subscriber role can gain higher privileges.
Unauthenticated Cross Site Scripting (XSS) in Do Lasso versions up to 358. An attacker can inject malicious script without authentication.
Path Traversal vulnerability in Do Lasso versions up to 358, exploitable by Subscriber role. Allows access to files outside the root directory.
SQL Injection vulnerability in Do Lasso versions up to 358, exploitable by Subscriber role. Allows manipulation of database queries.