CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Cross Site Scripting (XSS) in wpDataTables versions up to 6.5.1.4. An attacker can inject malicious script without authentication.
Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.
Subscriber SQL Injection in WordPress Persistent Login versions up to 3.1.0. A user with subscriber role can execute unauthorized database queries.
Unauthenticated SQL Injection vulnerability in Security & Malware scan by CleanTalk versions up to 2.184. An attacker can manipulate database queries.
The rtMedia plugin for WordPress, BuddyPress and bbPress (up to version 4.7.11) contains an SQL Injection vulnerability, specifically blind SQL injection, due to improper neutralization of special elements in SQL commands.
Unauthenticated Cross Site Scripting (XSS) in Tagembed versions up to 7.4. An attacker can inject malicious script without authentication.
Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
Unauthenticated PHP Object Injection vulnerability in Forminator versions up to 1.57.0. An attacker can send crafted data to execute arbitrary code.
Unauthenticated Cross Site Scripting (XSS) in TranslatePress versions up to and including 3.3.2.
Unauthenticated Cross Site Scripting (XSS) in JetEngine versions up to and including 3.8.14.1.
Unauthenticated Local File Inclusion in Golo Framework versions prior to 1.7.5.
HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing.
Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.
Unauthenticated Privilege Escalation vulnerability in Capella versions up to 2.5.5. An attacker can gain higher privileges without logging in.
Unauthenticated SQL Injection vulnerability in Capella versions up to 2.5.5. An attacker can manipulate database queries.
Unauthenticated Local File Inclusion in Shuffle versions up to and including 1.8.
The setWebhookResolver in the application (likely n8n) lacks validation of user-supplied URLs. An authenticated user can make the server send repeated requests to internal endpoints, including link-local metadata addresses. The response is not returned via the API, making the attack blind.
The scanFeedsResolver in the application (likely n8n) lacks URL validation, allowing an authenticated user to direct the server to arbitrary internal endpoints. The response is parsed as an RSS/Atom feed or HTML, limiting disclosure to feed metadata and RSS/Atom links, but allows distinguishing reachable ports from unreachable ones.
Convert Forms extension for Joomla (versions 1.0.0-4.4.16 and 5.0.0-5.2.5) contains a client-controlled validation bypass vulnerability. CAPTCHA and field validation can be bypassed.
The ipa-enrollment SLAPI plugin in FreeIPA has a null pointer dereference vulnerability. A remote authenticated client can send a malformed LDAP extended operation, omitting the request value for JOIN_OID, causing a server crash and denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS