CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via an email subject in versions up to and including 1.0.0 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The GD Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via email contents in versions up to and including 3.9.3 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to and including 4.6.0. This allows users to control access to objects, bypassing authorization and accessing system resources.
The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via email contents in versions up to and including 2.4.5 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via an email subject in versions up to and including 1.3.46 due to insufficient input sanitization and output escaping when the 'Save Data SendMail' feature is enabled.
The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via email contents in versions up to and including 1.1.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The FluentSMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via an email subject in versions up to and including 2.2.4 due to insufficient input sanitization and output escaping.
The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via email contents in versions up to and including 2.5.7 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages that will execute whenever a user accesses an injected page.
The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via email contents in versions up to and including 1.11.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via an email subject in versions up to and including 2.1.2 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in versions up to and including 5.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.
A vulnerability in Windows Search allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
RestrictedPython is a tool that defines a subset of the Python language, allowing users to provide program input into a trusted environment. In versions prior to 6.1 and 5.3, an attacker could access the current stack frame in a generator, allowing them to break out of the RestrictedPython boundaries and potentially execute arbitrary code in the Python interpreter.
A vulnerability in the Windows Error Reporting Service allows for privilege escalation. An attacker can exploit this flaw to gain elevated privileges on the system.
The GitHub Pull Requests and Issues extension for Visual Studio Code contains a vulnerability that allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.
Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
The installer for Zoom Rooms for Windows before version 5.15.0 has an untrusted search path that may allow an authenticated user to escalate privileges via local access.
A vulnerability in Paint 3D allows for remote code execution, potentially leading to unauthorized access to the system. An attacker could exploit this flaw to execute malicious code on the compromised device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS