CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The amazing_print library (commit dc890df) contains a Ruby code injection vulnerability in the AwesomeMethodArray#grep method. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names.
The Gutenverse Companion plugin version 2.5.1 and earlier contains an unauthenticated Server Side Request Forgery (SSRF) vulnerability. This vulnerability allows an attacker without authentication to send requests from the server to internal resources.
The Smart Online Order for Clover plugin version 1.6.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
The SureDash plugin version 1.10.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
The Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin version 2.10.0 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
Subscriber-level Broken Access Control vulnerability in Motors plugin versions up to and including 1.4.113.
The Nokri plugin versions up to 1.6.6 contain an unauthenticated Broken Access Control vulnerability. This means an attacker without logging in can access functions or data that should be protected.
Unauthenticated Broken Access Control vulnerability in Anti Spam and list cleaner – AcyChecker plugin versions up to and including 2.0.0.
Customer-level Cross Site Scripting (XSS) vulnerability in WpBookingly plugin versions up to and including 1.3.2.
The Directories Pro plugin version 2.0.5 and earlier contains a subscriber privilege escalation vulnerability. A user with low privileges can elevate their privileges to a higher level.
Unauthenticated Broken Access Control vulnerability in Contact Form 7 – PayPal & Stripe Add-on plugin versions up to and including 2.5.1.
The Reviewer plugin version 3.14.2 and earlier contains a SQL Injection vulnerability for users with the subscriber role. A user with low privileges can execute malicious SQL queries against the database.
The Biagiotti Core plugin version 2.1.1 and earlier contains an unauthenticated Local File Inclusion (LFI) vulnerability. An attacker without authentication can read arbitrary files from the server, such as configuration files or user data.
The Foton Core plugin version 1.1.1 and earlier contains an unauthenticated Local File Inclusion (LFI) vulnerability. An attacker without authentication can read arbitrary files from the server, such as configuration files or user data.
The MultiParcels Shipping For WooCommerce plugin version 1.30.36 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
Subscriber-level Server Side Request Forgery (SSRF) vulnerability in Vehica Core plugin versions up to and including 1.0.104.
Unauthenticated Local File Inclusion in Barista plugin versions up to 2.5.1. An attacker without authentication can include local files from the server.
The Church Admin plugin versions up to 5.1.1 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.
The Everest Backup plugin versions up to 2.3.12 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.
Subscriber-level Cross Site Scripting (XSS) vulnerability in Accordion plugin versions up to and including 3.0.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS