CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path
Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issue. Some workarounds are available. Restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and/or reject oversized requests before JSON parsing.
Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.
Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.
Local File Inclusion (LFI) vulnerability in e2pdf plugin up to version 1.32.40, allowing an unauthenticated attacker to read local files on the server.
Broken Access Control vulnerability in Total Upkeep plugin up to version 1.17.2, allowing an unauthenticated attacker to access administrative functions without authorization.
Cross Site Scripting (XSS) vulnerability in Facebook for WooCommerce plugin up to version 3.7.5, allowing an unauthenticated attacker to inject malicious scripts into pages.
Cross Site Scripting (XSS) vulnerability in Facebook for WordPress plugin up to version 5.2.1, allowing an unauthenticated attacker to inject malicious scripts into pages.
Cross Site Scripting (XSS) vulnerability in Rank Math SEO plugin up to version 1.0.274.1, allowing an unauthenticated attacker to inject malicious scripts into pages.
Cross Site Scripting (XSS) vulnerability in Thrive Architect plugin up to version 10.9.3.1, allowing an unauthenticated attacker to inject malicious scripts into pages.
Cross Site Scripting (XSS) vulnerability in GiveWP plugin up to version 4.16.5, allowing an unauthenticated attacker to inject malicious scripts into pages.
Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO up to version 14.2.0, allowing an unauthenticated attacker to inject malicious scripts into pages.
Cross Site Scripting (XSS) vulnerability in WP Data Access plugin up to version 5.5.79, allowing an unauthenticated attacker to inject malicious scripts into pages.
Broken Access Control vulnerability in Frontend Admin by DynamiApps plugin up to version 3.29.10, allowing a subscriber user to access administrative functions without authorization.
Unauthenticated Cross Site Scripting (XSS) in Events Manager versions up to 7.4.1.
Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor versions up to 3.5.7.
Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters versions up to 3.2.0.3.
Unauthenticated Bypass Vulnerability in Login with phone number versions up to 1.8.70.
Subscriber SQL Injection in WP Job Portal versions up to 2.5.6.