CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in HTML::FormHandler for Perl (up to 0.40068) allows attacker-selected method dispatch and resource exhaustion. Error messages built from request data are used as Locale::Maketext bracket notation templates, enabling code execution or large memory allocation.
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build added a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build added a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
The rsync daemon before version 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.
The Nokri plugin versions up to 1.6.6 contain an unauthenticated Broken Access Control vulnerability. This means an attacker without logging in can access functions or data that should be protected.
The Church Admin plugin versions up to 5.1.1 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.
The Everest Backup plugin versions up to 2.3.12 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.
The Cartify plugin versions up to 1.3.0.1 contain an unauthenticated Broken Authentication vulnerability. An attacker without logging in can bypass authentication mechanisms and gain access to user or administrator accounts.
The RealPress plugin versions up to 1.1.2 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.
The Salon booking system plugin versions up to 10.30.26 contain an unauthenticated Broken Authentication vulnerability. An attacker without logging in can bypass authentication mechanisms and gain access to user or administrator accounts.
The If-So Dynamic Content Personalization plugin versions up to 1.10 contain a Subscriber SQL Injection vulnerability. An attacker with a subscriber account can send specially crafted queries that can manipulate the database.
Unauthenticated SQL Injection vulnerability in Active Products Tables for WooCommerce versions up to 1.1.1. An attacker can execute arbitrary SQL queries without authentication.
Unauthenticated Privilege Escalation vulnerability in SMS Alert Order Notifications versions up to 3.9.7. An attacker can gain higher privileges without authentication.
Unauthenticated SQL Injection vulnerability in Listdom versions up to 5.6.0. An attacker can execute arbitrary SQL queries without authentication.
Unauthenticated Privilege Escalation vulnerability in miniorange otp verification versions up to 5.5.1. An attacker can gain higher privileges without authentication.
Subscriber SQL Injection vulnerability in WPJAM Basic versions up to 7.0.1. A user with subscriber role can execute arbitrary SQL queries.
Unauthenticated Arbitrary Code Execution vulnerability in WP BASE Booking versions up to 6.3.0. An attacker can execute arbitrary code without authentication.
Unauthenticated Broken Authentication vulnerability in Log in with Google versions up to 1.4.2. An attacker can bypass authentication mechanisms without logging in.
Unauthenticated PHP Object Injection vulnerability in Headless Single Sign On versions up to 1.6. An attacker can inject malicious PHP objects without authentication.
Unauthenticated Bypass Vulnerability in Headless Single Sign On versions up to 1.6. An attacker can bypass security mechanisms without authentication.