CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Local File Inclusion in Resido <= 1.5 versions.
Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.
Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.
PHP Object Injection vulnerability in Flexible Subscriptions plugin versions up to and including 1.8.1. Allows an attacker to inject malicious PHP objects, potentially leading to unauthorized access or code execution.
Unauthenticated Broken Access Control vulnerability in Taxi Booking Manager for WooCommerce versions prior to 2.0.8. An attacker without authentication can exploit this to perform unauthorized actions.
Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.
Unauthenticated privilege escalation vulnerability in TrueBooker versions up to and including 1.2.6. An attacker without logging in can elevate privileges, e.g., to administrator level.
SQL Injection vulnerability in NGG Smart Image Search plugin versions prior to 4.0.0. An unauthenticated attacker can inject SQL queries, potentially leading to unauthorized database access.
Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.
SQL Injection vulnerability in Maps Marker Pro plugin versions up to and including 4.32. An unauthenticated attacker can inject SQL queries, potentially leading to unauthorized database access.
Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.
Critical vulnerability (CVSS 9.8) in Joomla extension Balbooa Forms versions prior to 2.4.3.2. Allows an unauthenticated attacker to inject and execute arbitrary PHP code on the server via a URL parameter in a shortcode, when the form has a custom PHP handler configured.
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping.
SQL injection vulnerability in Community by PeepSo plugin versions up to 9.0.5.2. An attacker with subscriber role can exploit this flaw to manipulate database queries.
Unauthenticated remote code execution (RCE) vulnerability in JetEngine plugin versions up to and including 3.8.14. An attacker can execute arbitrary code on the server without logging in.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Newsletter plugin versions up to 9.3.3. An attacker can inject malicious script without authentication.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Contest Gallery plugin versions up to 30.0.5. An attacker can inject malicious script without authentication.
SQL injection vulnerability in YITH WooCommerce Membership Premium plugin versions up to 2.33.0. An attacker with subscriber role can exploit this flaw to manipulate database queries.
Vulnerability in NetScaler ADC and NetScaler Gateway products. Affects ADC versions from 14.1 through 73.32 and from 13.1 through 63.21; Gateway versions from 14.1 through 73.32 and from 13.1 through 63.21.