CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.13)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
WeDesignTech Ultimate Booking Addon (wedesigntech-ultimate-booking-addon) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions through 1.0.3.
The Ultimate Store Kit Elementor Addons plugin (up to version 2.9.4) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized users to access functions that should be protected.
The Team Showcase plugin for WordPress is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 2.9.
The Wishlist for WooCommerce plugin is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 3.3.0.
The Theater for WordPress plugin (versions up to and including 0.19) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This allows exploitation of improperly configured authorization mechanisms.
Missing Authorization vulnerability in magepeopleteam Car Rental Manager allows exploiting incorrectly configured access control security levels. This issue affects Car Rental Manager from n/a through <= 1.0.9.
W podatności CVE-2025-69086 występuje niewłaściwe zarządzanie nazwą pliku w instrukcji include/require w programie PHP, co prowadzi do lokalnego włączenia pliku PHP w motywie jwsthemes Issabella w wersjach od n/a do 1.1.2.
W podatności CVE-2025-69085 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych, co prowadzi do ataków typu Cross-site Scripting (XSS) w e-plugins JobBank. Problem ten dotyczy wersji JobBank od n/a do 1.2.2 włącznie.
Podatność CVE-2025-69084 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych, co prowadzi do ataków typu Cross-site Scripting (XSS) w wtyczce gt3-photo-video-gallery. Problem ten dotyczy wersji od n/a do 2.7.7.26 włącznie.
W podatności CVE-2025-69083 występuje niewłaściwa kontrola nazw plików w instrukcjach include/require w programie PHP, co prowadzi do lokalnego włączenia pliku PHP w Elated-Themes Frappé w wersjach od n/a do 1.8. Problem ten może umożliwić atakującym dostęp do wrażliwych danych na serwerze.
Lack of output escaping leads to a XSS vector in the pagebreak plugin.
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.
Blue Access Cobalt v02.000.195 suffers from an authentication bypass vulnerability, which allows an attacker to selectively proxy requests in order to operate functionality on the web application without the need to authenticate with legitimate credentials.
Podatność na deserializację niezaufanych danych w DZS Video Gallery umożliwia wstrzyknięcie obiektów. Problem ten dotyczy wersji DZS Video Gallery od n/a do 12.25.
W podatności CVE-2025-39477 występuje brak autoryzacji w Sfwebservice InWave Jobs, co pozwala na wykorzystanie nieprawidłowo skonfigurowanych poziomów kontroli dostępu. Problem dotyczy wersji InWave Jobs od n/a do 3.5.8.
Dell Unisphere for PowerMax, versions 9.2.4.x, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could exploit this, leading to unauthorized access to data and resources outside the intended control sphere.
W podatności CVE-2024-30547 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych w wtyczce Shazdeh Header Image Slider, co prowadzi do ataków typu XSS (Cross-site Scripting). Problem ten dotyczy wersji wtyczki od n/a do 0.3.
A vulnerability has been identified in Tenda AC23 firmware version 16.03.07.52, affecting the sscanf function in the /goform/PowerSaveSet file. Manipulation of the Time argument can lead to a buffer overflow. The attack can be launched remotely, and the exploit is publicly available.
NJHYST HY511 POE core (before 2.1) and plugins (before 0.1) have insufficient cookie verification, allowing an attacker to directly download the core configuration file without logging in. By reading the username and self-decrypted MD5 password, the attacker can log in to the backend.
H3C M102G (HM1A0V200R010) and BA1500L (SWBA1A0V100R006) have a misconfiguration in vsftpd, causing all files uploaded anonymously via FTP to be owned by root. Remote attackers can gain root-level control over the devices.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS