CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
WooCommerce versions up to 4.5.1 contain a vulnerability for unauthenticated SQL injection in the order delivery date field.
There is an unauthenticated SQL injection vulnerability in Funnel Builder by FunnelKit versions up to 3.15.0.1.
There is an unauthenticated SQL injection vulnerability in wpForo Forum versions up to 3.0.4.
GeekyBot versions up to 1.2.2 have a vulnerability allowing unauthenticated arbitrary file uploads.
There is an unauthenticated SQL Injection vulnerability in Contest Gallery versions up to 28.1.6.
In WP-BusinessDirectory versions <= 4.0.0, there is a vulnerability that allows subscribers to upload arbitrary files.
Versions of Datalogics Ecommerce Delivery up to 2.6.62 contain a vulnerability that allows unauthenticated privilege escalation.
There is an unauthenticated SQL injection vulnerability in SpeakOut! Email Petitions versions up to 4.6.5.
GeekyBot versions up to 1.2.0 are vulnerable to unauthenticated SQL injection, which may lead to unauthorized access to the database.
GeoDirectory versions up to 2.8.152 are vulnerable to unauthenticated SQL injection.
There is an unauthenticated SQL injection vulnerability in WP Photo Album Plus versions up to 9.1.08.001.
There is an unauthenticated SQL injection vulnerability in Form Maker by 10Web versions up to 1.15.38.
There is an unauthenticated SQL injection vulnerability in Simply Schedule Appointments versions up to 1.6.9.27.
There is an unauthenticated SQL injection vulnerability in WP Maps versions up to 4.9.1.
There is a remote code execution (RCE) vulnerability in Responsive Slider by MetaSlider versions up to 3.106.0. An attacker can exploit this flaw to execute arbitrary code on the server.
In Free <= 5.3 versions of the Feed KuantoKusta plugin for WooCommerce, there is an unauthenticated SQL injection vulnerability.
iControlWP versions up to 5.5.3 contain a vulnerability that allows unauthenticated privilege escalation.
In Broadcast Live Video versions below 7.1.3, there is a vulnerability to unauthenticated PHP object injection.
In version 4.6.0 of the grocy application, a SQL injection vulnerability was discovered in the product-group parameter at /stockreports/spendings. This allows attackers to access sensitive database information via a crafted SQL statement.
In version 5.0.1 of shlink, there is a Server-Side Request Forgery (SSRF) vulnerability in the automatic short URL title resolution component, allowing attackers to scan internal resources by supplying a crafted longUrl.