CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents versions up to 1.51.0.
Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning versions up to 6.65.
Unauthenticated Broken Authentication in Really Simple SSL versions up to 9.8.0.
Unauthenticated Denial of Service (DoS) attack in MalCare Security versions up to 6.69. An attacker can cause service unavailability without an account.
The WP Statistics plugin version 14.16.11 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability.
Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer versions up to 8.7.6. An attacker can inject malicious script without authentication.
The Business Directory plugin version 6.4.26 and earlier contains an unauthenticated Insecure Direct Object References (IDOR) vulnerability.
Unauthenticated SQL Injection vulnerability in VikAppointments Services Booking Calendar versions up to 1.2.20. An attacker can inject SQL queries, potentially leading to unauthorized database access.
The BookIt plugin version 2.6.0.3 and earlier contains an unauthenticated bypass vulnerability.
The FluentBooking Pro plugin version 2.2.1 and earlier contains an unauthenticated bypass vulnerability.
Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT versions up to 7.5.1. An attacker can inject malicious script without authentication.
Unauthenticated Cross Site Scripting (XSS) in RTMKit versions up to 2.1.5. An attacker can inject malicious script without authentication.
The WP EasyPay plugin version 4.5.3 and earlier contains an unauthenticated bypass vulnerability.
Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache versions up to 7.9. An attacker can send requests from the server to internal resources without authentication.
The Business Directory plugin versions up to 6.4.26 contain an unauthenticated broken access control vulnerability. An attacker can exploit this flaw to gain unauthorized access to protected features.
Unauthenticated Settings Change in WP Compress versions up to 7.21.28. An attacker can change plugin configuration without authentication.
Subscriber Privilege Escalation in WCFM Membership versions up to 2.11.11. A user with subscriber role can gain higher privileges.
The Mail Mint plugin versions up to 1.31.0 contain an unauthenticated broken access control vulnerability. This allows unauthorized access to protected features.
The WPFunnels plugin versions up to 3.12.13 contain an unauthenticated broken access control vulnerability. This allows unauthorized access to protected features.
Unauthenticated PHP Object Injection vulnerability in Mail Mint versions up to 1.31.0. An attacker can inject malicious PHP objects, potentially leading to arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS