CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unauthenticated attacker can perform PHP Object Injection in FundEngine versions up to 1.7.9.
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
BetterDesk, a remote desktop management solution, versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.
The Duitku Payment Gateway plugin versions up to 2.11.14 contain an unauthenticated Sensitive Data Exposure vulnerability. An attacker without logging in can access confidential information.
The [Aotuman] Grab WeChat Articles plugin version 2.0.1 and earlier contains a Server Side Request Forgery (SSRF) vulnerability in the subscriber. This allows an attacker to send requests from the server to internal resources.
The Gravity Forms Bookings premium plugin versions up to 2.1 contain a Subscriber SQL Injection vulnerability. An attacker with subscriber privileges can execute unauthorized database queries.
The Essential Real Estate plugin versions up to 5.3.3 contain a Customer PHP Object Injection vulnerability. An attacker can inject malicious PHP objects, which could lead to remote code execution.
The Theme Test Drive plugin versions up to 2.9.1 contain an unauthenticated Local File Inclusion vulnerability. An attacker without logging in can include local files from the server.
A user with the Contributor role can upload arbitrary files in Sync Post With Other Site versions up to 1.9.3.
A user with the Contributor role can remotely execute code (RCE) in Cwicly versions up to 1.4.4.
The Mayosis Core plugin versions up to 5.4.7 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker without logging in can inject malicious scripts into pages.
The FormyChat plugin versions up to 2.15.7 contain an unauthenticated Broken Access Control vulnerability. An attacker without logging in can gain unauthorized access to functions.
The Vavo Core plugin versions up to 2.3.0 contain an unauthenticated Local File Inclusion vulnerability. An attacker without logging in can include local files from the server.
Unauthenticated Cross Site Scripting (XSS) in SSL Zen versions up to 4.7.43.
Unauthenticated Cross Site Scripting (XSS) in Quill Forms versions up to 5.7.1.
Unauthenticated Broken Access Control in WP Sort Order versions up to 1.3.5.
The Piotnet Addons For Elementor Pro plugin versions up to 7.1.67 contains a vulnerability allowing unauthenticated arbitrary file upload.
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. Affects versions from n/a through 2.8.0.
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS