CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.25)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Broken Access Control vulnerability in MultiVendorX versions up to 5.0.10.
Subscriber Sensitive Data Exposure vulnerability in WPJAM Basic versions up to 7.0.2.1.
Unauthenticated Broken Access Control vulnerability in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) versions up to 1.0.7.
Subscriber SQL Injection vulnerability in Visitor Traffic Real Time Statistics Pro versions up to 11.10.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Visitor Traffic Real Time Statistics Pro versions up to 11.10.
Unauthenticated Cross Site Scripting (XSS) vulnerability in WP-Stats versions up to 2.56.
The AI Hub plugin versions up to 1.3.10 allow a subscriber-level user to download arbitrary files from the server.
The Agrion plugin versions up to 1.0.0 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
The WPMobile.App plugin versions up to 11.77 have a Broken Access Control vulnerability that can be exploited without authentication.
The OMGF Pro plugin versions up to 5.2.7 allow unauthenticated users to download arbitrary files from the server.
The SAML SP Single Sign On plugin versions up to 5.4.3 have a vulnerability that allows unauthenticated users to escalate privileges.
The Mang Board WP plugin versions up to 2.3.4 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
The GeekyBot plugin versions up to 1.2.6 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
The WP Full Stripe Free plugin versions up to 8.5.0 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
Rekor, a software supply chain transparency log, contains a decompression bomb vulnerability in the `Package.Unmarshal()` function for APK files. An attacker can submit a specially crafted APK file that decompresses to a huge amount of memory, causing a server crash. The vulnerability affects versions 0.3.0 through 1.5.1 and is reachable via two unauthenticated endpoints.
The Participants Database plugin versions up to 2.7.8.4 allow unauthenticated users to delete arbitrary files from the server.
Hydra Booking plugin versions up to 1.2.2 contain an unauthenticated Broken Access Control vulnerability. An attacker without authentication can exploit this flaw to perform unauthorized operations.
Knowledge Base for Documentation, FAQs with AI Assistance plugin versions up to 17.211.0 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without authentication.
Travelfic Toolkit plugin versions up to 1.5.1 contain a Broken Access Control vulnerability from subscriber level. A user with subscriber role can gain unauthorized privileges.
Booking Activities plugin versions up to 1.18.4 contain an unauthenticated PHP Object Injection vulnerability. An attacker without authentication can inject malicious PHP objects.