CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
AAP Controller's HashiCorp Vault credential plugin contains a vulnerability that sends the Kubernetes service account token to an attacker-controlled URL when testing Vault credentials with kubernetes_role authentication.
TRENDnet TEW-WLC100 version 1v2.07b01 contains a stack-based buffer overflow vulnerability in the function FUN_0040da4c in /usr/nginx/sbin/nginx, in the HTTP Header Handler component. Manipulation of the Server argument can lead to remote attacks.
Unauthenticated SQL Injection vulnerability in Readabler plugin versions before 2.0.18. An attacker without authentication can inject SQL queries.
Unauthenticated Arbitrary File Upload vulnerability in Masteriyo - LMS plugin versions up to 2.3.2. An attacker without authentication can upload arbitrary files to the server.
Unauthenticated Deserialization of untrusted data vulnerability in Youzify plugin versions up to 1.3.7. An attacker without authentication can deserialize data, potentially leading to remote code execution.
Unauthenticated Broken Authentication vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can bypass authentication mechanisms.
Unauthenticated PHP Object Injection vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.
Unauthenticated PHP Object Injection vulnerability in Ultimate Maps by Supsystic plugin versions before 1.5.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.
Unauthenticated PHP Object Injection vulnerability in Easy Google Maps plugin versions up to 1.13.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.
Unauthenticated SQL Injection vulnerability in JetAppointment plugin versions up to 2.5.2. An attacker without authentication can inject SQL queries.
Unauthenticated SQL Injection vulnerability in Affiliates Manager plugin versions up to 2.9.53. An attacker without authentication can inject SQL queries.
An unauthenticated attacker can remotely execute arbitrary code (RCE) in WP Compress versions prior to 7.20.01.
An unauthenticated attacker can perform PHP Object Injection in RegistrationMagic versions up to 6.0.9.7.
An unauthenticated attacker can exploit SQL Injection in Modern Events Calendar versions prior to 7.35.0.
An unauthenticated attacker can exploit SQL Injection in Sticky Chat Widget versions up to 1.4.2.
The GP Premium plugin by EDGE22 Studios Ltd. contains an unrestricted upload of dangerous file type vulnerability, allowing remote code inclusion. The issue affects versions from n/a through 2.5.5.
Seroval prior to 1.5.3 allows attacker-controlled JSON deserialization that can lead to unintended side effects, and when combined with frameworks registering callable wrappers, potentially unintended server-side invocation or remote code execution.
A user with the Contributor role can upload arbitrary files in Templatiq versions up to 0.2.5.
An unauthenticated attacker can perform PHP Object Injection in FundEngine versions up to 1.7.9.
A user with the Contributor role can upload arbitrary files in Sync Post With Other Site versions up to 1.9.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS