CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.13)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W podatności CVE-2025-32304 występuje niewłaściwe zarządzanie nazwą pliku w instrukcji Include/Require w programie PHP, co prowadzi do lokalnego włączenia pliku PHP. Problem ten dotyczy wtyczki WPCHURCH w wersjach od n/a do 2.7.0.
A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted SCP path input containing '/./' sequences, resulting in a heap over read by 1 byte.
wolfSSH's key exchange state machine can be manipulated to leak the client's password in the clear, trick the client to send a bogus signature, or skip user authentication. This affects client applications with wolfSSH version 1.4.21 and earlier.
The Breeze plugin for WordPress (Cloudways) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects Breeze from n/a through version 2.2.21.
The Responsive Addons for Elementor plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.0.8.
The UiChemy plugin for WordPress is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 4.4.2.
The Post Expirator plugin (up to version 4.9.3) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized users to access functions that should be protected.
The TheGem Theme Elements plugin (for WPBakery) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 5.11.0.
The Creator LMS plugin (WPFunnels) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects Creator LMS from n/a through version 1.1.12.
The TheGem Theme Elements plugin (for Elementor) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 5.11.0.
W podatności CVE-2025-69356 występuje niewłaściwa kontrola nazw plików w instrukcjach Include/Require w programie PHP, co prowadzi do lokalnego włączenia pliku PHP. Problem dotyczy elementów motywu TheGem (dla Elementor) w wersjach od n/a do 5.11.0.
In the Better Business Reviews plugin (from BBR Plugins), there is a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions up to and including 0.1.1.
The Events Calendar (the-events-calendar) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions through 6.15.12.2.
W podatności CVE-2025-69351 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach SQL, co prowadzi do możliwości przeprowadzenia ataku typu Blind SQL Injection w wtyczce Ninja Tables w wersjach od n/a do 5.2.4.
Stored XSS vulnerability in Accordion plugin (Themepoints) up to version 3.0.3. Improper input neutralization during web page generation allows persistent injection of malicious scripts.
RSS Feed Widget (rss-feed-widget) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions through 3.0.2.
In The Events Calendar Countdown Addon (from CoolHappy), there is a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions up to and including 1.4.15.
The AffiliateX plugin for WordPress (versions up to and including 1.3.9.3) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of improperly configured authorization mechanisms.
Missing Authorization vulnerability in BoldGrid Post and Page Builder (up to 1.27.9) allows exploiting incorrectly configured access control security levels.
W podatności CVE-2025-69342 występuje niewłaściwe kontrolowanie nazw plików w instrukcjach include/require w programie PHP, co pozwala na lokalne włączenie plików. Problem dotyczy wersji Calafate od n/a do 1.7.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS