CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable.
Versions up to 1.1.1 of the Integration for ActiveCampaign and contact forms (Contact Form 7, WPForms, Elementor, Ninja Forms) are vulnerable to unauthenticated PHP object injection.
There is an unauthenticated Path Traversal vulnerability in FastDup versions <= 2.7.2.
Versions of the eCommerce Product Catalog up to 3.5.5 are vulnerable to unauthenticated SQL injection.
There is an unauthenticated PHP Object Injection vulnerability in OttoKit versions <= 1.1.27.
The GPTranslate plugin in versions up to 2.32.6 has a vulnerability to unauthenticated SQL Injection, allowing malicious queries to be executed against the database.
There is an unauthenticated PHP Object Injection vulnerability in WP Travel Engine versions up to 6.7.12.
There is an unauthenticated PHP Object Injection vulnerability in wpForo Forum versions <= 3.1.0.
Happyforms versions up to 1.26.13 are vulnerable to unauthenticated PHP object injection.
The WP User Manager plugin versions up to 2.9.16 contain a vulnerability that allows subscribers to delete arbitrary files.
In versions up to 1.1.8 of the Integration for Mailchimp and contact forms (Contact Form 7, WPForms, Elementor, Ninja Forms), there is a vulnerability to unauthenticated PHP object injection.
Versions of RegistrationMagic up to 6.0.8.6 have a vulnerability in unauthenticated authentication, which may allow attackers to take over user accounts.
The Integration for Contact Form 7 HubSpot plugin version 1.3.7 and earlier contains an unauthenticated PHP Object Injection vulnerability. An attacker can remotely inject a malicious PHP object, potentially leading to arbitrary code execution or other dangerous operations.
Versions up to 1.4.3 of the Integration for Salesforce, Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms plugins are vulnerable to unauthenticated PHP object injection.
In versions of Integration for Contact Form 7 and Constant Contact up to 1.1.6, there is a vulnerability to unauthenticated PHP object injection.
The WP Zendesk plugin for contact forms such as Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms in versions up to 1.1.4 is vulnerable to unauthenticated PHP object injection.
Versions up to 1.2.1 of the Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugins are vulnerable to unauthenticated PHP object injection.
There is an unauthenticated PHP Object Injection vulnerability in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms versions <= 1.1.4.
Versions of Advanced 301 and 302 Redirect up to 1.6.9 are vulnerable to unauthenticated SQL injection.
JS Help Desk versions up to 3.0.9 are vulnerable to unauthenticated SQL injection, potentially allowing attackers to access database data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS