CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.13)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W podatności CVE-2025-68984 występuje niewłaściwe zarządzanie nazwą pliku w instrukcji Include/Require w programie PHP, co prowadzi do lokalnego włączenia pliku. Problem ten dotyczy wersji Puca od n/a do 2.6.39.
W podatności CVE-2025-68983 występuje niewłaściwa kontrola nazw plików w instrukcji Include/Require w programie PHP, co prowadzi do możliwości lokalnego włączenia pliku. Problem dotyczy wersji Greenmart od n/a do 4.2.11.
The DesignThemes LMS Addon for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.6.
The HomeFix Elementor Portfolio plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.0.1.
The WeDesignTech Portfolio plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.0.2.
Authorization Bypass Through User-Controlled Key vulnerability in SimpleCalendar Google Calendar Events google-calendar-events allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Google Calendar Events: from n/a through <= 3.5.9.
DOM-Based XSS vulnerability in DesignThemes Core (up to version 1.6) allows an attacker to manipulate the DOM in the victim's browser, potentially leading to malicious code execution.
DOM-Based XSS vulnerability in DesignThemes Portfolio Addon (up to 1.5) due to improper input neutralization during web page generation.
The Eagle Booking plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.3.4.3.
The Eagle Booking plugin (eagle-booking) in versions up to and including 1.3.4.3 contains an authorization bypass through user-controlled key vulnerability. This allows exploitation of incorrectly configured access control security levels.
The WordPress plugin 'Social Login and Register' by miniOrange up to version 7.7.0 has a PHP Local File Inclusion vulnerability, which could allow reading sensitive files on the server.
A vulnerability was found in D-Link DCS-850L 1.02.09. The function uploadfirmware of the Firmware Update Service component is affected. Manipulation of the argument DownloadFile results in path traversal. The attack must originate from the local network. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
A vulnerability has been found in PHPEMS up to 11.0. This impacts an unknown function of the component Purchase Request Handler. The manipulation leads to race condition. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used.
DVP-12SE11T - Out-of-bound memory write Vulnerability
W systemie Simple Stock System 1.0 odkryto lukę, która dotyczy nieznanej funkcji w pliku /market/login.php. Manipulacja argumentem Username może prowadzić do wstrzyknięcia SQL.
A vulnerability was detected in PHPEMS up to version 11.0. It affects an unknown function of the Coupon Handler component. Manipulation leads to a race condition. The attack can be initiated remotely, but the attack complexity is rather high and exploitability is considered difficult. The exploit is now public and may be used.
DVP-12SE11T - Denial of Service Vulnerability
A security vulnerability was detected in CloudPanel Community Edition up to version 2.5.1. It affects an unknown function in the /admin/users file of the HTTP Header Handler component. Manipulation of the Referer argument leads to an open redirect. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 2.5.2 fixes the issue.
Zidentyfikowano słabość w urządzeniu Tenda M3 w wersji 1.0.0.13(4903), dotyczącą funkcji formSetRemoteInternetLanInfo w pliku /goform/setInternetLanInfo. Manipulacja argumentami portIp/portMask/portGateWay/portDns/portSecDns prowadzi do przepełnienia bufora na stercie.
DVP-12SE11T vulnerability allows authentication bypass via partial password disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS