CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The LabtechCO WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
The Mikado Core WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
The FOX woocommerce-currency-switcher plugin by RealMag777 up to version 1.4.5 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.
The YayMail plugin by YayCommerce up to version 4.3.3 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.
The Simply Schedule Appointments plugin for WordPress up to version 1.6.9.27 contains a blind SQL injection vulnerability. Improper neutralization of special elements in SQL commands allows an attacker to perform blind SQL injection.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ameliabooking Amelia ameliabooking allows Blind SQL Injection. This issue affects Amelia: from n/a through <= 2.1.1.
The Download Monitor plugin for WordPress up to version 5.1.8 has a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.
The OttoKit suretriggers plugin by Brainstorm Force up to version 1.1.20 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.
The User Feedback plugin for WordPress up to version 1.10.1 has a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.
The Broken Link Checker plugin by WPMU DEV up to version 2.4.7 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.
Vulnerability in the MxGeneralIo utility for Moxa industrial x86 computers. An exposed IOCTL with insufficient access control allows a local attacker with high privileges to directly read/write MSR and system memory. This could lead to privilege escalation on Windows 7 or system crash (BSoD) on Windows 10/11.
The Gerador de Certificados – DevApps plugin for WordPress up to version 1.3.6 inclusive contains a vulnerability allowing arbitrary file uploads due to missing file type validation in the moveUploadedFile() function. Authenticated attackers with Administrator-level access or higher can upload malicious files to the server, potentially leading to remote code execution.
The ActivityPub WordPress plugin before version 8.0.2 does not properly filter displayed posts, allowing unauthenticated users to access drafts, scheduled, and pending posts.
MATCHA INVOICE version 2.6.6 and earlier allows an administrator to upload files with dangerous types, potentially creating arbitrary files on the server and executing arbitrary code.
W wersjach MATCHA INVOICE 2.6.6 i wcześniejszych występuje podatność na atak typu SQL Injection. W przypadku jej wykorzystania, użytkownik zalogowany do produktu może uzyskać dostęp do informacji przechowywanych w bazie danych lub je zmienić.
A stack-based buffer overflow vulnerability exists in ASDA-Soft.
A CSRF vulnerability in the Product Feed PRO for WooCommerce plugin (versions 13.4.6 to 13.5.2.1) allows unauthenticated attackers to trigger feed migration, clear cache, rewrite URLs, toggle filter settings, and delete feed posts by tricking an administrator into clicking a link.
When verifying a certificate chain with excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs with different case. This affects only otherwise trusted chains issued by a root CA.
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled resource consumption. This leads to denial of service. This only affects TLS 1.3.
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS