CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Local File Inclusion (LFI) in Flipmart versions up to 2.8. Allows an attacker to read files from the server without authentication.
Unauthenticated Local File Inclusion (LFI) in Fabius versions up to 1.0. Allows an attacker to read files from the server without authentication.
Unauthenticated Local File Inclusion (LFI) in Teoro versions up to 1.1. Allows an attacker to read files from the server without authentication.
Unauthenticated Local File Inclusion in the Kaven plugin up to version 1.2. An attacker can exploit this to read arbitrary files on the server.
Unauthenticated Local File Inclusion in the Volos plugin up to version 1.2. Allows an attacker to read files from the server without authentication.
Unauthenticated Local File Inclusion in the Cardea plugin up to version 2.3. An attacker can read arbitrary files on the server without logging in.
Unauthenticated Cross Site Scripting (XSS) in the Ambed plugin up to version 1.0.0. An attacker can inject malicious script into the page that executes in the user's browser.
Unauthenticated Sensitive Data Exposure in the Contact Form 7 – Dynamic Text Extension up to version 5.0.7. An attacker can access sensitive information without logging in.
Unauthenticated Broken Authentication in the eRoom plugin up to version 1.7.1. An attacker can bypass authentication mechanisms and gain unauthorized access.
Unauthenticated Cross Site Scripting (XSS) in the Document Embedder plugin up to version 2.4.0. An attacker can inject malicious script that executes in the user's browser.
Unauthenticated Cross Site Scripting (XSS) in the Before After Image Comparison – Image comparison for WP plugin up to version 1.1.21. An attacker can inject malicious script into the page.
Subscriber Settings Change in the uListing plugin up to version 2.2.0. A user can change subscription settings without proper permissions.
Unauthenticated Server Side Request Forgery (SSRF) in the StreamCast plugin up to version 2.4.5. An attacker can send requests from the server to internal resources.
Unauthenticated Cross Site Scripting (XSS) in Team Section Block versions up to 2.0.4.
Subscriber PHP Object Injection in Angio versions up to 1.1.1.
Unauthenticated Local File Inclusion in TouchUp versions before 1.4.
Reflected Cross-site Scripting vulnerability in ThemeREX Group Kids Planet theme, from n/a through 2.2.14.2.
Unauthenticated Local File Inclusion in DukaMarket versions up to 1.3.0.
Unauthenticated Local File Inclusion in Uminex versions up to 1.0.9.
Administrator SQL Injection in WP Ultimate CSV Importer versions up to 9.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS