CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.26)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
There is an unauthenticated PHP Object Injection vulnerability in Reisen versions <= 1.4.1.
Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5.
CVE-2025-60231 describes a deserialization of untrusted data vulnerability in EMV The Hospital, allowing for object injection.
Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop from n/a through 1.9.
CVE-2025-60229 is a vulnerability related to the deserialization of untrusted data in Themeton Lagom, allowing for object injection. This issue affects Lagom versions from n/a through 2.0.
There is an unauthenticated SQL injection vulnerability in Advanced Ads – Tracking versions below 3.0.7.
There is an unauthenticated SQL Injection vulnerability in WP eMember versions below 10.9.4.
There is an unauthenticated privilege escalation vulnerability in the registration form for WooCommerce versions <= 1.0.9.
The WP Activity Log plugin versions up to 5.6.3.1 are vulnerable to unauthenticated PHP object injection.
Versions of SMS Alert Order Notifications up to 3.9.4 contain a vulnerability that allows subscriber privilege escalation.
Fusion Builder versions up to 3.15.4 are vulnerable to PHP Object Injection, which may lead to unauthorized access or data manipulation.
There is an unauthenticated SQL injection vulnerability in JetEngine versions <= 3.8.10.1.
In JobSearch versions up to 3.2.9, there is an unauthenticated SQL Injection vulnerability that can be exploited by an attacker to execute unauthorized queries against the database.
There is an unauthenticated PHP object injection vulnerability in JetEngine versions up to 3.8.10.
SigmaForms Pro – AI Generated Forms versions up to 1.4.5 contain a vulnerability allowing unauthenticated arbitrary file uploads.
A path traversal vulnerability in the SFTP provider allows a malicious or compromised remote SFTP server to write files outside the configured local destination directory. No Airflow account is required, and the attack surface includes any deployment downloading directories from an untrusted SFTP server.
There is a vulnerability in wpForo Forum versions up to 3.1.0 related to unauthenticated broken authentication.
Thrive Apprentice versions below 10.8.10.2 are vulnerable to unauthenticated PHP object injection.
JetEngine versions below 3.8.9.1 are vulnerable to unauthenticated SQL injection.
There is an unauthenticated SQL injection vulnerability in wpDataTables versions up to 7.3.6.