CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
TwoNav version 2.0.28-20230624 is vulnerable to Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts in the user's browser context.
Cross Site Scripting vulnerability in IP-DOT BuildaGate v.BuildaGate5 allows a remote attacker to execute arbitrary code via a crafted script to the mc parameter of the URL.
A buffer overflow vulnerability in the aswSnx.sys driver of Avast AntiVirus before version 19.7 allows a local attacker to cause a denial of service (DoS) via a crafted request.
The WePupil Quiz Expert plugin versions up to 1.5.0 contain a Cross-Site Request Forgery (CSRF) vulnerability. This allows attackers to send unauthorized requests on behalf of users.
CSRF vulnerability in ChubbyNinjaa Template Debugger plugin versions <= 3.1.2 allows unauthorized actions on behalf of the user.
The StoreApps Stock Manager plugin for WooCommerce versions <= 2.10.0 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The Securimage-WP plugin versions up to 3.6.16 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
CSRF vulnerability in the Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin in versions <= 2.3.3 allows attackers to perform unauthorized actions on behalf of the user.
Cross-Site Request Forgery (CSRF) vulnerability exists in Andy Whalen's Galleria plugin versions <= 1.0.3. This allows attackers to send unauthorized requests on behalf of users.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Recent Posts Slider plugin by Neha Goel in versions <= 1.1. This allows attackers to send unauthorized requests on behalf of users.
The AREOI All Bootstrap Blocks plugin versions up to 1.3.6 contain a Cross-Site Request Forgery (CSRF) vulnerability. This may allow attackers to perform unauthorized actions on behalf of an authenticated user.
The NextGen GalleryView plugin for WordPress versions <= 0.5.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
CSRF vulnerability in Andrea Tarantini's Menubar plugin versions <= 5.8.2 allows attackers to perform unauthorized actions on behalf of users.
CSRF vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps, present in versions <= 3.4.1.
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 in versions below V2.16.0. The affected devices are configured to offer weak ciphers by default, which could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over to and from the affected device.
The WP RSS Images plugin by Alain Gonzalez versions <= 1.1 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The WP Abstracts plugin by Kevon Adonis in versions up to 2.6.2 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
The OOPSpam Anti-Spam plugin versions up to 1.1.44 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The LWS Tools plugin versions up to 2.4.1 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping plugin for WooCommerce has a Cross-Site Request Forgery (CSRF) vulnerability in versions up to 1.6.4.4. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS