CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an information disclosure vulnerability in Comply.
Tanium addressed a SQL injection vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an information disclosure vulnerability in Tanium Server.
Tanium addressed a path traversal vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed a path traversal vulnerability in Comply.
Tanium addressed an unauthorized code execution vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
The FireBox plugin for WordPress (up to version 3.1.10) is vulnerable to Remote Code Execution due to a bypassable regex blacklist in Executer::allowedToRun() and lack of sanitization of PHP condition rule values stored via the firebox_meta REST endpoint. Authenticated attackers with author-level access or above can execute code on the server. On sites upgraded from a version prior to 3.1.10, the Migrator::preserveCampaignRoleAccess() function automatically grants the Author role the edit_fireboxes and publish_fireboxes capabilities, lowering the effective entry point to Author-level access.
The Eventin plugin for WordPress (up to version 4.1.22) is vulnerable to Local File Inclusion via the 'event_layout' parameter. Authenticated attackers with contributor-level access or above can include and execute arbitrary .php files on the server. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration.
The Eventin plugin for WordPress (up to version 4.1.22) is vulnerable to Local File Inclusion via the 'event_layout' parameter. Authenticated attackers with custom-level access or above can include and execute arbitrary .php files on the server, potentially leading to bypassing access controls, obtaining sensitive data, or code execution if .php files can be uploaded and included.
Tanium addressed an improper access controls vulnerability in Tanium Server.
Tanium addressed a path traversal vulnerability in Tanium Data Service.
The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting in all versions up to, and including, 3.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Contact Form to DB by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cntctfrm_contact_dropdown parameter in all versions up to and including 1.7.5 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. The payload executes in the context of an administrator's browser session when they visit the message manager page, potentially compromising administrator-level sessions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS