CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated SQL Injection vulnerability in Active Products Tables for WooCommerce versions up to 1.1.1. An attacker can execute arbitrary SQL queries without authentication.
Unauthenticated Privilege Escalation vulnerability in SMS Alert Order Notifications versions up to 3.9.7. An attacker can gain higher privileges without authentication.
Unauthenticated SQL Injection vulnerability in Listdom versions up to 5.6.0. An attacker can execute arbitrary SQL queries without authentication.
Unauthenticated Privilege Escalation vulnerability in miniorange otp verification versions up to 5.5.1. An attacker can gain higher privileges without authentication.
Subscriber SQL Injection vulnerability in WPJAM Basic versions up to 7.0.1. A user with subscriber role can execute arbitrary SQL queries.
Unauthenticated Arbitrary Code Execution vulnerability in WP BASE Booking versions up to 6.3.0. An attacker can execute arbitrary code without authentication.
Unauthenticated Broken Authentication vulnerability in Log in with Google versions up to 1.4.2. An attacker can bypass authentication mechanisms without logging in.
Unauthenticated PHP Object Injection vulnerability in Headless Single Sign On versions up to 1.6. An attacker can inject malicious PHP objects without authentication.
Unauthenticated Bypass Vulnerability in Headless Single Sign On versions up to 1.6. An attacker can bypass security mechanisms without authentication.
Unauthenticated SQL Injection vulnerability in Web Directory Free versions up to 1.7.13. An attacker can execute arbitrary SQL queries without authentication.
Broken Authentication vulnerability in OAuth Single Sign On (SSO) (OAuth Client) versions up to 7.0.0 allows an unauthenticated attacker to bypass authentication mechanisms.
SQL Injection vulnerability in WP Directory Kit versions up to 1.5.4 allows an unauthenticated attacker to inject malicious SQL code.
Remote Code Execution (RCE) vulnerability in QA Analytics versions up to 5.2.0.0 allows an unauthenticated attacker to execute arbitrary code on the server.
WebErpMesv2 versions up to 1.19 allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration and broken role middleware, this chain is effectively unauthenticated RCE against any default installation.
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass.
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection.
A vulnerability in the Portal Generator addon to Priority ERP (Soft Solutions) involves use of hard-coded credentials, exposure of sensitive information, and improper access control. All versions without Priwall v3 are affected.
A vulnerability in the Portal Generator addon to Priority ERP (Soft Solutions) involves missing authentication for critical functions. All versions without Priwall v3 are affected.
A vulnerability in the Portal Generator addon to Priority ERP (Soft Solutions) involves client-side enforcement of server-side security. All versions without Priwall v3 are affected.
A vulnerability in the Portal Generator addon to Priority ERP (Soft Solutions) exposes sensitive personal information to unauthorized actors. All versions without Priwall v3 are affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS