CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In WishList Member X versions up to 3.29.0, there is a vulnerability that allows subscribers to upload arbitrary files.
Versions of MetForm Pro <= 3.9.1 have an unauthenticated broken access control vulnerability that may allow attackers to access resources they should not have access to.
There is an unauthenticated SQL injection vulnerability in WPJobster versions up to 6.3.5.
There is an unauthenticated SQL injection vulnerability in Tutor LMS Pro versions up to 3.9.6.
In Restaurt versions <= 1.0.4, there is a vulnerability that allows subscribers to upload arbitrary files.
A 'use after free' vulnerability in DigitalCredentials in Google Chrome on Windows prior to version 149.0.7827.155 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024 through SOLIDWORKS Desktop Release 2026 could allow an attacker to write arbitrary files on the server.
In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed.
There is an unauthenticated privilege escalation vulnerability in Support Ticket Management System versions <= 1.9.
The WordPress & WooCommerce Scraper plugin versions <= 1.0.7 allows unauthenticated arbitrary file uploads.
Versions of SeaFood Company up to 1.4 are vulnerable to unauthenticated PHP object injection.
There is a vulnerability in Hot Coffee versions up to 1.7 that allows unauthenticated PHP object injection.
In PT Luxa Addons versions up to 1.2.2, there is a vulnerability that allows subscribers to upload arbitrary files.
The ThemeREX Addons plugin (up to 2.36.1.1) contains a deserialization of untrusted data vulnerability that allows object injection. An attacker could exploit this flaw to execute malicious code within the WordPress application context.
In Grip versions up to 1.0.9, there is a vulnerability that allows subscribers to upload arbitrary files.
Vulnerability in Oracle Solaris (component: Remote Administration Daemon) version 11.4. An unauthenticated attacker with network access via HTTPS can fully compromise the system, leading to unauthorized creation, deletion, or modification of all data and complete access to it. The attack scope may extend beyond Solaris (scope change).
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Attacks may significantly impact additional products.
A vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Attacks may significantly impact additional products, changing the scope of the threat.
Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite allows unauthenticated attackers with network access via HTTP to compromise the system. Versions 12.2.3-12.2.15 are susceptible to easily exploitable attacks.
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to compromise Oracle iSupport. Attacks may significantly impact additional products, increasing the scope of the threat.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS