CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Traccar Client app, used for GPS tracking, is vulnerable in versions 9.7.19 and below to an attack that allows hijacking GPS tracking parameters via a crafted deep link. Such a link can change the app's configuration without confirmation, redirecting telemetry data to an attacker-controlled server.
Rocket.Chat versions below 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 have an access control vulnerability in Livechat files. The authorization process for downloading protected files does not verify that rc_rid matches the requested file, allowing unauthenticated discovery of all uploaded files.
In Streambert versions 2.4.0 and prior, a Zip Slip vulnerability was identified in the subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing for path traversal attacks and writing arbitrary files to the host filesystem.
AI Lab versions below 5.4.2 are vulnerable to unauthenticated PHP object injection.
Versions of Blocksy Companion Pro up to 2.1.37 have a vulnerability allowing remote code execution (RCE) by unauthorized users.
In Charity Zone versions <= 1.1.1, there is a vulnerability that allows subscribers to upload arbitrary files.
In Kids Gift Shop versions <= 0.5.4, there is a vulnerability allowing arbitrary file uploads by subscribers.
In Ecommerce Zone versions <= 0.9.7, there is a vulnerability that allows subscribers to upload arbitrary files.
In Restaurant Zone versions <= 0.7.8, there is a vulnerability allowing arbitrary file uploads by subscribers.
There is an unauthenticated PHP Object Injection vulnerability in WooCommerce Product Filters versions below 2.0.6.
There is an unauthenticated SQL injection vulnerability in Blocksy Companion Pro versions below 2.1.29.
In Webenvo versions <= 0.0.6, there is a vulnerability that allows subscribers to upload arbitrary files.
There is an unauthenticated PHP Object Injection vulnerability in Elementra versions <= 1.0.9.
Unauthenticated SQL Injection exists in ListingPro versions <= 2.9.10.
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects versions before 3.4.2.
Missing authorization check in DataSource API leads to arbitrary data source metadata disclosure in Apache DolphinScheduler.
Nifty versions up to 1.4.1 are vulnerable to unauthenticated PHP object injection.
In Support Board versions below 3.8.9, there is a vulnerability that allows unauthenticated privilege escalation.
The Elementor (Premium) plugin versions up to 2.0.6 contain a vulnerability that allows unauthorized file uploads by users with appropriate permissions.
The ACPT (Pro) - Custom Post Types plugin for WordPress in versions up to and including 2.0.47 contains an unauthenticated remote code execution (RCE) vulnerability. The description provides no technical details.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS