CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber, to change the stock quantity of arbitrary products.
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.
The Document Embedder WordPress plugin before version 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary documents, including private and draft ones, by enumerating IDs.
The CMP WordPress plugin before version 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP plugin's admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page.
The CMP WordPress plugin before version 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP plugin's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.
The CMP WordPress plugin before version 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.
This CVE has been rejected or withdrawn by its CVE Numbering Authority because it is Unused.
This CVE has been rejected or withdrawn by its CVE Numbering Authority because it is Unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is unused.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS