CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Forminator plugin in versions up to and including 1.57.3 allows an unauthenticated attacker to delete arbitrary content on a WordPress site. The flaw requires no login or special privileges.
The WooCommerce Multilingual & Multicurrency plugin in versions up to and including 5.5.8 contains a PHP Object Injection flaw exploitable by a shop manager user. This may lead to dangerous code execution or further privilege escalation.
The Barcode Scanner with Inventory & Order Manager plugin in versions up to and including 1.13.1 has a broken access control flaw exploitable by an unauthenticated attacker. This allows access to functions or data that should be protected.
The Barcode Scanner with Inventory & Order Manager plugin in versions up to and including 1.13.1 is vulnerable to SQL injection exploitable by a subscriber-level user. The flaw allows manipulation of database queries.
The Barcode Scanner with Inventory & Order Manager plugin in versions up to and including 1.13.1 contains a Cross Site Scripting (XSS) flaw exploitable by an unauthenticated attacker. This allows injection of malicious script into site pages.
The KuteShop theme in versions up to and including 4.2.9 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.
The KuteShop theme in versions up to and including 4.2.9 contains an unauthenticated Cross Site Scripting (XSS) flaw. It allows injection of malicious script into site pages.
The Boutique theme in versions up to and including 2.3.3 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.
The Biolife theme in versions up to and including 3.2.3 is vulnerable to unauthenticated Local File Inclusion. An attacker can load files from the server.
The Biolife theme in versions up to and including 3.2.3 contains an unauthenticated Cross Site Scripting (XSS) flaw. It allows injection of malicious script into site pages.
Unauthenticated Local File Inclusion (LFI) in TechOne versions up to 3.0.3. Allows an attacker to read files from the server without authentication.
Unauthenticated Cross Site Scripting (XSS) in TechOne versions up to 3.0.3. Allows an attacker to inject malicious scripts into a victim's browser.
Unauthenticated Local File Inclusion (LFI) in Armania versions up to 1.4.8. Allows an attacker to read files from the server without authentication.
Unauthenticated Cross Site Scripting (XSS) in Armania versions up to 1.4.8. Allows an attacker to inject malicious scripts into a victim's browser.
Unauthenticated Cross Site Scripting (XSS) in Pin WP versions up to 7.0. Allows an attacker to inject malicious scripts into a victim's browser.
Unauthenticated Local File Inclusion (LFI) in Backhoe versions up to 2.0. Allows an attacker to read files from the server without authentication.
Unauthenticated Local File Inclusion (LFI) in Ozeum versions up to 1.3.0. Allows an attacker to read files from the server without authentication.
Unauthenticated Local File Inclusion (LFI) in Flipmart versions up to 2.8. Allows an attacker to read files from the server without authentication.
Unauthenticated Local File Inclusion (LFI) in Fabius versions up to 1.0. Allows an attacker to read files from the server without authentication.
Unauthenticated Local File Inclusion (LFI) in Teoro versions up to 1.1. Allows an attacker to read files from the server without authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS