CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.
Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.
Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.
The Ultimeter plugin in versions up to and including 3.0.8 contains an SQL Injection vulnerability accessible to users with the Editor role. This allows injection of malicious SQL code into database queries.
The Tainacan plugin in versions up to and including 1.2.0 contains an SQL Injection vulnerability accessible to users with the Subscriber role. This allows injection of SQL code into database queries.
The Calculated Fields Form plugin in versions up to and including 5.5.1.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.
The Core Web Vitals & PageSpeed Booster plugin in versions up to and including 1.0.31 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script into the page.
The Easy Digital Downloads plugin in versions up to and including 3.7.0 contains an SQL Injection vulnerability accessible to users with the Shop manager role. This allows injection of malicious SQL code into database queries.
The Ninja Forms plugin in versions up to and including 3.15.3 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script into the page.
The Online Booking & Scheduling Calendar for WordPress by vcita plugin in versions up to and including 4.6.0 contains an unauthenticated Broken Access Control vulnerability. This allows access to functions or data that should be protected.
The PublishPress Capabilities plugin in versions up to and including 2.50.1 contains an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An attacker can trick a user into performing unwanted actions.
The Arc browser in affected versions contains an address bar spoofing issue. An attacker can use a <select> element that triggers requestFullscreen without displaying the fullscreen notification to spoof the browser address bar.
The Razorpay Payment Button plugin in versions up to and including 2.4.9 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script into the page.
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP versions up to 2.4.1.
Administrator SQL Injection in Email Log versions up to 2.63.
Contributor SQL Injection in WP EasyCart versions up to 5.9.4.
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus versions up to 9.3.02.002.
Contributor SQL Injection in Mollie Forms versions up to 2.11.0.
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login versions up to 1.5.9.3.
Contributor SQL Injection in Live Copy Paste for Elementor versions up to 1.5.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS