CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Arbitrary Code Execution vulnerability in WP BASE Booking versions up to 6.3.0. An attacker can execute arbitrary code without authentication.
The WP Full Stripe Free plugin versions up to 8.5.0 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
Rekor, a software supply chain transparency log, contains a decompression bomb vulnerability in the `Package.Unmarshal()` function for APK files. An attacker can submit a specially crafted APK file that decompresses to a huge amount of memory, causing a server crash. The vulnerability affects versions 0.3.0 through 1.5.1 and is reachable via two unauthenticated endpoints.
The Participants Database plugin versions up to 2.7.8.4 allow unauthenticated users to delete arbitrary files from the server.
Hydra Booking plugin versions up to 1.2.2 contain an unauthenticated Broken Access Control vulnerability. An attacker without authentication can exploit this flaw to perform unauthorized operations.
Knowledge Base for Documentation, FAQs with AI Assistance plugin versions up to 17.211.0 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without authentication.
Travelfic Toolkit plugin versions up to 1.5.1 contain a Broken Access Control vulnerability from subscriber level. A user with subscriber role can gain unauthorized privileges.
Unauthenticated Broken Authentication vulnerability in Log in with Google versions up to 1.4.2. An attacker can bypass authentication mechanisms without logging in.
This CVE has been rejected or withdrawn by its CVE Numbering Authority.
Cross Site Scripting (XSS) vulnerability in AcyMailing SMTP Newsletter versions up to 10.11.1, exploitable by a user with Subscriber role.
Broken Access Control vulnerability in AcyMailing SMTP Newsletter up to version 10.11.1 allows a subscriber to gain unauthorized access to administrative functions.
Booking Activities plugin versions up to 1.18.4 contain an unauthenticated PHP Object Injection vulnerability. An attacker without authentication can inject malicious PHP objects.
Visitors Traffic Real Time Statistics plugin versions up to 8.11 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without authentication.
Sensitive data exposure vulnerability in WP Event Solution up to version 4.1.18 allows unauthorized access to customer data.
WP Event Solution plugin versions up to 4.1.19 contain a Customer Arbitrary Content Deletion vulnerability. A user with customer role can delete arbitrary content.
Blog Floating Button plugin versions up to 1.4.20 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without authentication.
CubeWP plugin versions up to 1.1.30 contain a SQL Injection vulnerability from subscriber level. A user with subscriber role can inject malicious SQL queries.
Service Finder Booking plugin versions up to 6.2 contain a Subscriber Privilege Escalation vulnerability. A user with subscriber role can gain higher privileges.
Broken Access Control vulnerability in Service Finder Booking up to version 6.2 allows a subscriber to gain unauthorized access to administrative functions.
Unauthenticated Cross Site Scripting (XSS) in Do Lasso versions up to 358. An attacker can inject malicious script without authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS