CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Local File Inclusion in Aalto versions up to 1.8.
Unauthenticated Local File Inclusion in CleanSkin versions up to 1.5.0.
Administrator SQL Injection in Frontend Admin by DynamiApps versions up to 3.29.13.
SQL Injection vulnerability in the administrator panel of the Leyka plugin in versions up to 3.32.3.
Unauthenticated Cross Site Scripting (XSS) vulnerability in the Photo Gallery by 10Web plugin in versions up to 1.8.47.
SQL Injection vulnerability in the Qode Tours plugin in versions up to 3.1.3.2, affecting users with the subscriber role.
Unauthenticated Cross Site Scripting (XSS) vulnerability in the Slider by 10Web plugin in versions up to 1.2.63.
Unauthenticated Cross Site Scripting (XSS) vulnerability in the Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin in versions up to 6.0.5.
Unauthenticated Broken Access Control vulnerability in the DK plugin in versions up to 3.2.1.
Unauthenticated Broken Access Control vulnerability in Grand News plugin up to version 3.4. Allows unauthorized users to access functions they should not have permissions for.
Unauthenticated Local File Inclusion vulnerability in Kids Care plugin up to version 3.2.4. Allows unauthorized users to read local files on the server.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in FV Player 8 plugin up to version 8.1.8. Allows unauthorized users to inject malicious scripts into pages viewed by other users.
The WordPress plugin "Social Share Icons & Social Share Buttons" (ultimate-social-media-plus) up to version 3.7.5 is vulnerable to Reflected Cross-site Scripting due to improper neutralization of input during web page generation.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Jannah theme up to version 7.6.5. Allows unauthorized users to inject malicious scripts into pages viewed by other users.
SQL Injection vulnerability in Events Manager plugin up to version 7.4.6, requiring subscriber privileges. Allows a user with subscriber role to inject malicious SQL queries into the database.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Qode Real Estate plugin up to version 1.1.7.3. Allows unauthorized users to inject malicious scripts into pages viewed by other users.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Qode Music plugin up to version 2.1.8.2. Allows unauthorized users to inject malicious scripts into pages viewed by other users.
Unauthenticated Sensitive Data Exposure vulnerability in Web Plura Backup & Restore Manager plugin up to version 0.2.25. Allows unauthorized users to access sensitive data.
The PeepSo plugin versions up to 9.0.5.4 allow a subscriber to delete arbitrary files on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS