CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing excessive CPU consumption. An attacker can send a crafted query to exhaust server CPU resources, potentially slowing down or stopping other requests. The fix limits FIQL expressions to 4 KiB by default.
CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. This was reachable via JWE decryption when zip=DEF (e.g., JoseSessionTokenProvider with RSA-OAEP) and via SAML redirect/POST binding token inflation — in both cases decompression happens before or independent of trust validation. The fix adds a configurable maximum inflated-size cap (default 10 MiB).
Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXF allows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation.
By default, StaxUtils placed no limit on the total number of elements or characters in an XML document. A very large request could use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (e.g., SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: maximum element count is 100 × maxChildElements (5,000,000 by default), and maximum document size is 256M characters.
The multipart/MTOM attachment header parser in Apache CXF did not fully enforce the configured size and count limits. The size limit applied only to individual lines, not to values built from continuation lines or combined repeated headers. A remote, unauthenticated attacker could send a request with very large headers, causing unbounded memory allocation and denial of service.
The JAX-RS XML Security module in Apache CXF did not properly verify XML signatures. The XML signature interceptors did not ensure that the XML passed to the application was covered by the signature. An attacker with a document signed by a trusted key could wrap it in unsigned content, which the application would treat as signed.
A Reflected Cross-Site Scripting (XSS) vulnerability in the Welcart e-Commerce usc-e-shop plugin for WordPress, affecting versions up to 2.12.3, allows an attacker to inject malicious scripts into the page.
A Cross-Site Request Forgery (CSRF) vulnerability in the Featured Image from URL plugin for WordPress, affecting versions up to 6.0.7, allows an attacker to force a logged-in user to perform unauthorized actions.
A Reflected Cross-Site Scripting (XSS) vulnerability in the NEX-Forms plugin for WordPress, affecting versions up to 9.3.1, allows an attacker to inject malicious scripts into the page.
A Reflected Cross-Site Scripting (XSS) vulnerability in the FiboSearch plugin for WordPress, affecting versions up to 1.34.1, allows an attacker to inject malicious scripts into the page.
A Missing Authorization vulnerability in the Amelia plugin for WordPress, affecting versions up to 2.4.10, allows exploitation of incorrectly configured access control security levels.
Authentication bypass by spoofing vulnerability in the Forminator plugin. Affects versions from n/a through 1.57.2.
Authentication bypass by spoofing vulnerability in the GiveWP plugin. Affects versions from n/a through 4.16.8.1.
Reflected XSS vulnerability in the Simple Payment plugin. Affects versions from n/a through 2.5.4.
Blind SQL Injection vulnerability in the tagDiv Opt-In Builder plugin. Affects versions from n/a through 1.7.6.
Blind SQL Injection vulnerability in the UpSolution Core. Affects versions from n/a through 9.3.
Stored XSS vulnerability in the Media Library Assistant plugin. Affects versions from n/a through 3.41.
Reflected XSS vulnerability in the HUSKY plugin. Affects versions from n/a through 1.4.3.2.
Blind SQL Injection vulnerability in the WPLMS plugin. Affects versions from n/a through 4.973.
Blind SQL Injection vulnerability in the Taskbuilder plugin. Affects versions from n/a through 6.0.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS