CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Sensitive Data Exposure vulnerability in REST API Log versions up to 1.7.1.
Unauthenticated Broken Access Control vulnerability in MultiVendorX versions up to 5.0.10.
Unauthenticated SQL Injection vulnerability in Active Products Tables for WooCommerce versions up to 1.1.1. An attacker can execute arbitrary SQL queries without authentication.
Subscriber Sensitive Data Exposure vulnerability in WPJAM Basic versions up to 7.0.2.1.
Unauthenticated Broken Access Control vulnerability in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) versions up to 1.0.7.
Subscriber SQL Injection vulnerability in Visitor Traffic Real Time Statistics Pro versions up to 11.10.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Visitor Traffic Real Time Statistics Pro versions up to 11.10.
Unauthenticated Cross Site Scripting (XSS) vulnerability in WP-Stats versions up to 2.56.
Unauthenticated Privilege Escalation vulnerability in SMS Alert Order Notifications versions up to 3.9.7. An attacker can gain higher privileges without authentication.
The AI Hub plugin versions up to 1.3.10 allow a subscriber-level user to download arbitrary files from the server.
The Agrion plugin versions up to 1.0.0 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
The WPMobile.App plugin versions up to 11.77 have a Broken Access Control vulnerability that can be exploited without authentication.
The OMGF Pro plugin versions up to 5.2.7 allow unauthenticated users to download arbitrary files from the server.
The SAML SP Single Sign On plugin versions up to 5.4.3 have a vulnerability that allows unauthenticated users to escalate privileges.
Broken Access Control vulnerability in Secure Card Gateway for ePay Paycenter (Piraeus Bank) versions up to 1.0.32, exploitable without authentication.
The Mang Board WP plugin versions up to 2.3.4 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
Unauthenticated SQL Injection vulnerability in Listdom versions up to 5.6.0. An attacker can execute arbitrary SQL queries without authentication.
Unauthenticated Privilege Escalation vulnerability in miniorange otp verification versions up to 5.5.1. An attacker can gain higher privileges without authentication.
Subscriber SQL Injection vulnerability in WPJAM Basic versions up to 7.0.1. A user with subscriber role can execute arbitrary SQL queries.
The GeekyBot plugin versions up to 1.2.6 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS