CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The amazing_print library (commit dc890df) contains a Ruby code injection vulnerability in the AwesomeMethodArray#grep method. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names.
The Gutenverse Companion plugin version 2.5.1 and earlier contains an unauthenticated Server Side Request Forgery (SSRF) vulnerability. This vulnerability allows an attacker without authentication to send requests from the server to internal resources.
The Smart Online Order for Clover plugin version 1.6.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
The SureDash plugin version 1.10.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
The Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin version 2.10.0 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
The Directories Pro plugin version 2.0.5 and earlier contains a subscriber privilege escalation vulnerability. A user with low privileges can elevate their privileges to a higher level.
The Reviewer plugin version 3.14.2 and earlier contains a SQL Injection vulnerability for users with the subscriber role. A user with low privileges can execute malicious SQL queries against the database.
The Biagiotti Core plugin version 2.1.1 and earlier contains an unauthenticated Local File Inclusion (LFI) vulnerability. An attacker without authentication can read arbitrary files from the server, such as configuration files or user data.
The Foton Core plugin version 1.1.1 and earlier contains an unauthenticated Local File Inclusion (LFI) vulnerability. An attacker without authentication can read arbitrary files from the server, such as configuration files or user data.
The MultiParcels Shipping For WooCommerce plugin version 1.30.36 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
Unauthenticated Local File Inclusion in Barista plugin versions up to 2.5.1. An attacker without authentication can include local files from the server.
Unauthenticated Broken Access Control in Arvow AI SEO Writer plugin versions up to 1.5.3. An attacker without authentication can access functions that should be protected.
Unauthenticated Cross-Site Scripting (XSS) in Local Delivery Drivers for WooCommerce plugin versions up to 3.0.0. An attacker can inject malicious script without authentication.
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce plugin versions up to 2.1.1. An attacker without authentication can access unauthorized functions.
Unauthenticated Sensitive Data Exposure in iCARRY plugin versions up to 2.9. An attacker without authentication can access confidential information.
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments plugin versions up to 5.3.8. An attacker without authentication can access confidential information.
Unauthenticated Broken Access Control vulnerability in SMEPay: UPI Gateway for WooCommerce versions up to 1.0.5.
Unauthenticated Local File Inclusion vulnerability in Geo Mashup versions up to 1.13.18.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Geo Mashup versions up to 1.13.18.
Unauthenticated Sensitive Data Exposure vulnerability in REST API Log versions up to 1.7.1.