CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated SQL Injection vulnerability in Newsletter Subscription Form – User Subscriptions Form, Capture Email versions up to 1.5.9. An attacker can inject malicious SQL queries.
Unauthenticated PHP Object Injection vulnerability in GDPR Framework By Data443 versions up to 2.5.0. An attacker can inject malicious PHP objects, potentially leading to code execution.
Unauthenticated SQL Injection vulnerability in SendPress Newsletters versions up to 1.26.1.20. An attacker can perform unauthorized database operations.
The Gmedia Photo Gallery (grand-media) plugin by Serhii Pasyuk contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. The vulnerability allows Blind SQL Injection and affects versions from n/a through 1.25.1.
Unauthenticated Privilege Escalation vulnerability in Doctreat Core versions up to 1.7.0. An attacker without authentication can gain elevated privileges.
Unauthenticated Arbitrary File Upload vulnerability in Doctreat versions up to 1.7.0. An attacker can upload malicious files without authentication.
Unauthenticated SQL Injection vulnerability in Radius Booking — Booking Calendar for Appointments & Services versions up to 1.0.19. An attacker can inject SQL queries.
Unauthenticated Privilege Escalation vulnerability in Meta Box AIO versions up to 3.7.1. An attacker without authentication can gain higher privileges.
The vulnerability allows an employer or sales representative to perform arbitrary file upload in Workreap Core up to version 3.4.5.
The vulnerability allows a subscriber to perform arbitrary file upload in Taskbot up to version 6.6.
The vulnerability allows a subscriber to perform arbitrary file upload in WP Duplicate up to version 1.1.11.
The vulnerability allows an unauthenticated attacker to escalate privileges in Taskbot up to version 6.6.
The vulnerability allows an unauthenticated attacker to perform SQL injection in Booknetic up to version 4.8.5.
The vulnerability allows an unauthenticated attacker to perform arbitrary file upload in Kognetiks Chatbot for WordPress up to version 2.4.9.
The vulnerability allows a subscriber to perform remote code execution (RCE) in WooCommerce Designer Pro up to version 1.9.33.
The vulnerability allows an unauthenticated attacker to perform SQL injection in WooCommerce Appointments up to version 5.3.2.
The vulnerability in the Schmooze app is due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this by decompiling the distributed application package and extracting the embedded credentials and keys.
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
A vulnerability in Tenda AC5 router (version 02.03.01.111_multi) affects an unknown function in the file /goform/setWifi of the Wifi Handler component. Manipulation of the wifiPwd argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit is publicly available.
A vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The issue affects the firmware_check function in /cgi-bin/cstecgi.cgi of the UploadFirmwareFile Handler component. Manipulation of the file_name argument leads to OS command injection. The attack can be performed remotely.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS