CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Server-Side Request Forgery (SSRF) vulnerability exists in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses.
The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.
The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day.
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could exploit this to execute arbitrary OS commands with root privileges on the underlying operating system. Exploitation may lead to a complete system takeover.
The CTX Feed plugin versions up to 6.6.42 contain a Remote Code Execution (RCE) vulnerability exploitable by a shop manager. An attacker with shop manager privileges can execute arbitrary code on the server.
The Type Hub plugin versions up to 2.0.6 contain an Unauthenticated Arbitrary File Upload vulnerability. A remote unauthenticated attacker can upload malicious files to the server.
The Frontend Admin by DynamiApps plugin versions up to 3.29.10 contain an Unauthenticated Privilege Escalation vulnerability. A remote unauthenticated attacker can escalate privileges in the system.
The WordPress File Upload plugin versions up to 5.1.7 contain an Unauthenticated SQL Injection vulnerability. A remote unauthenticated attacker can execute malicious SQL queries against the database.
The AI ANN plugin versions up to 1.29.0 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
The Agricola plugin versions up to 1.21.0 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
The Agora plugin versions up to 1.9 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
The Advice plugin versions up to 1.18.0 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
The Adrena plugin versions up to 1.2.14 contain an Unauthenticated PHP Object Injection vulnerability. A remote unauthenticated attacker can inject malicious PHP objects, potentially leading to code execution.
Unauthenticated PHP Object Injection in Accalia versions up to 1.5.3.
Unauthenticated PHP Object Injection in Abogado versions up to 1.18.
Unauthenticated PHP Object Injection in Abelle versions up to 1.22.
Unauthenticated PHP Object Injection in A.Williams versions up to 1.3.1.
Unauthenticated PHP Object Injection in 69 Clothing versions up to 1.2.11.1.
Unauthenticated PHP Object Injection in WPBruiser (no-Captcha anti-Spam) versions up to 3.1.43.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS