CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.13)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Missing Authorization vulnerability in WP Telegram Widget and Join Link (through version 2.2.12) allows exploiting incorrectly configured access control security levels.
The TS Poll plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 2.5.5.
The Watu Quiz plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 3.4.5.
Missing Authorization vulnerability in Cooked (through version 1.11.3) allows exploiting incorrectly configured access control security levels.
The WP Document Revisions plugin for WordPress (versions up to and including 3.7.2) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
The Constantin Boiangiu WordPress Vimeotheque plugin (codeflavors-vimeo-video-post-lite) contains a Cross-Site Request Forgery (CSRF) vulnerability. This issue affects versions from n/a through 2.3.5.2. The vulnerability may allow an attacker to force a logged-in user to perform unwanted actions.
The Tikweb Management WordPress Fast User Switching plugin (fast-user-switching) contains a Cross-Site Request Forgery (CSRF) vulnerability. This issue affects versions from n/a through 1.4.10. The vulnerability may allow an attacker to force a logged-in user to perform unwanted actions.
Missing Authorization vulnerability in Funnelforms Free (through version 3.8) allows exploiting incorrectly configured access control security levels.
Missing Authorization vulnerability in YITH Slider for page builders (up to 1.0.11) allows exploiting incorrectly configured access control security levels.
CSRF vulnerability in Advanced Classifieds & Directory Pro up to version 3.2.9. Allows an attacker to perform unauthorized actions in the context of a logged-in user.
The FV Simpler SEO plugin (up to version 1.9.6) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can leverage this to perform unauthorized actions.
Missing Authorization vulnerability in Addonify addonify-quick-view allows exploiting incorrectly configured access control security levels. This issue affects Addonify through <= 2.0.4.
Missing authorization in Virusdie virusdie allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 1.1.6.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie virusdie allows retrieving embedded sensitive data. This issue affects Virusdie from n/a through <= 1.1.6.
Missing Authorization vulnerability in Wappointment team Wappointment allows exploiting incorrectly configured access control security levels. This issue affects Wappointment through <= 2.7.6.
The WPBakery Visual Composer WHMCS Elements plugin for WordPress has a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.0.4.3.
The Simple Keyword to Link plugin (up to version 1.5) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick an authenticated user into performing unwanted actions within the application.
The BBP Core plugin (up to version 1.4.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain unauthorized access to plugin functionality.
The SALESmanago & Leadoo plugin (up to version 3.9.0) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can leverage this to perform unauthorized actions.
W podatności CVE-2025-68570 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach SQL, co prowadzi do podatności na Blind SQL Injection w aplikacji Captivate Sync w wersjach od n/a do 3.2.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS