CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Broken Access Control vulnerability in Koji versions up to 2.2.1. An attacker without authentication can gain unauthorized access to protected functions.
Unauthenticated Broken Access Control vulnerability in EPROLO Dropshipping plugin versions up to 2.4.2. An attacker without authentication can access administrative or other protected resources.
Vulnerability allowing arbitrary file upload by users with Subscriber role in the Warehouse Cargo plugin. Affects versions up to 2.6.9.
Vulnerability allowing arbitrary file upload by users with Subscriber role in the Smart Cleaning plugin. Affects versions up to 4.8.6.
Vulnerability allowing arbitrary file upload by users with Subscriber role in the IT Residence plugin. Affects versions up to 3.2.1.
SQL Injection vulnerability in eShipper Commerce plugin versions up to 2.16.13, exploitable by a user with Subscriber role. A low-privileged user can inject SQL queries into the database.
Unauthenticated broken authentication vulnerability in the User Registration & Membership Pro plugin. Affects versions up to 5.4.5.
SQL Injection vulnerability in WP w3all phpBB plugin versions up to 3.0.5, exploitable by a user with Subscriber role. A low-privileged user can inject SQL queries into the database.
Unauthenticated PHP Object Injection vulnerability in the FundEngine plugin. Affects versions up to 1.7.9.
Subscriber Remote Code Execution (RCE) vulnerability in the Query Wrangler plugin. Affects versions up to 1.5.57.
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
Unauthenticated SQL Injection vulnerability in the BookingPress Appointment Booking Pro plugin. Affects versions up to 6.0.2.
Unauthenticated Cross Site Scripting (XSS) vulnerability in NotificationX Pro plugin versions up to 3.1.4. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.
Unauthenticated privilege escalation vulnerability in the Abandoned Cart Pro for WooCommerce plugin. Affects versions up to 10.4.0.
Unauthenticated SQL Injection vulnerability in the Locatoraid Store Locator plugin. Affects versions up to 3.9.72.
Broken Authentication vulnerability in Leyka plugin versions up to 3.32.3, exploitable by a user with Subscriber role. A low-privileged user can bypass authentication mechanisms and gain unauthorized access.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Flatastic theme versions up to 2.0. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.
Unauthenticated PHP Object Injection vulnerability in Flatastic versions up to 2.0. An attacker can send crafted data to execute arbitrary code.
Unauthenticated SQL Injection vulnerability in Directory Pro versions up to 2.5.8. An attacker can manipulate database queries.
Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.