CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.26)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
WP Event Solution plugin versions up to 4.1.19 contain a Customer Arbitrary Content Deletion vulnerability. A user with customer role can delete arbitrary content.
Blog Floating Button plugin versions up to 1.4.20 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without authentication.
CubeWP plugin versions up to 1.1.30 contain a SQL Injection vulnerability from subscriber level. A user with subscriber role can inject malicious SQL queries.
Service Finder Booking plugin versions up to 6.2 contain a Subscriber Privilege Escalation vulnerability. A user with subscriber role can gain higher privileges.
Unauthenticated Cross Site Scripting (XSS) in Do Lasso versions up to 358. An attacker can inject malicious script without authentication.
Path Traversal vulnerability in Do Lasso versions up to 358, exploitable by Subscriber role. Allows access to files outside the root directory.
SQL Injection vulnerability in Do Lasso versions up to 358, exploitable by Subscriber role. Allows manipulation of database queries.
Unauthenticated Cross Site Scripting (XSS) in Business Directory versions up to 6.4.25. An attacker can inject malicious script without authentication.
Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist versions up to 2.9.1. An attacker can inject malicious script without authentication.
SQL Injection vulnerability in Booktics (Arraytics) versions up to 1.0.22. Allows blind SQL injection.
Unauthenticated privilege escalation in MStore API versions up to 4.20.0. An attacker can elevate privileges without authentication.
Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce versions up to 2.11.31. An attacker can inject malicious script without authentication.
Unauthenticated SQL Injection in WP Directory Kit versions up to 1.5.4. An attacker can manipulate database queries without authentication.
Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms versions up to 4.3.3. An attacker can inject malicious script without authentication.
The Solace Extra plugin versions up to 1.6.0 have a broken access control vulnerability affecting subscribers. This means a low-privileged user may gain unauthorized access to certain functions or data.
The Car Rental Manager plugin versions up to 1.3.9 have a PHP Object Injection vulnerability exploitable by users with the editor role. An attacker can exploit this to execute malicious code on the server.
The Taxi Booking Manager for WooCommerce plugin versions up to 2.0.3 have an unauthenticated broken access control vulnerability. An unauthenticated user may gain unauthorized access to certain functions or data.
Missing authorization in PostgreSQL logical decoding allows a non-superuser with REPLICATION privilege to dlopen any file visible to the OS account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account.
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands.
Fulcio, a certificate authority for issuing code signing certificates for OIDC identities, versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts.