CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary ai/eps/pdf/ps files on the server, which can contain sensitive information.
The Cargo extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects the master version of the extension.
The FlexDiagrams extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects the master version of the extension.
The CentralAuth extension for MediaWiki exposes sensitive information to unauthorized actors, leading to resource leak exposure. This affects versions from master before 1.39.
The GrowthExperiments extension for MediaWiki has an incorrect default permissions vulnerability, leading to resource leak exposure. This affects versions from master before 1.39.
The GrowthExperiments extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects versions from master before 1.39.
The CirrusSearch extension for MediaWiki has an allocation of resources without limits or throttling vulnerability, enabling HTTP DoS. This affects versions from master before 1.43.
The ImageRating extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects versions from master before 1.39.
The UploadWizard extension for MediaWiki is vulnerable to Stored XSS due to improper input neutralization during web page generation. This affects versions from master before 1.39.
The AdvancedSearch extension for MediaWiki contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This affects versions from master before 1.39.
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 5.7.1 via the eb_save_ai_generated_image function. This allows authenticated attackers with Author-level access or above to make web requests to arbitrary locations.
The BlueSky skin for MediaWiki contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This affects versions from master before 1.39.
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'shortpixel_ajaxRequest' AJAX action in all versions up to, and including, 6.3.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to export and import site options.
Wtyczka 10WebMapBuilder dla WordPressa jest podatna na przechowywane ataki Cross-Site Scripting (XSS) poprzez zmianę ustawień wtyczki w wersjach do 1.0.63 włącznie, z powodu niewystarczającej sanitizacji danych wejściowych oraz braku odpowiednich kontroli uprawnień. Umożliwia to nieautoryzowanym atakującym wstrzykiwanie dowolnych skryptów webowych na stronach, które będą wykonywane przy każdym dostępie użytkownika do zainfekowanej strony.
The Cargo extension for MediaWiki (versions 1.39, 1.43, 1.44) is vulnerable to SQL Injection due to improper neutralization of special elements in SQL commands. This flaw can lead to arbitrary SQL query execution.
The MediaWiki QuizGame extension is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This affects versions 1.39, 1.43, and 1.44.
The MediaWiki PollNY extension is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This affects versions 1.39, 1.43, and 1.44.
The MediaWiki WebAuthn extension contains a stored XSS vulnerability due to improper input neutralization during web page generation. The vulnerability affects versions 1.39, 1.43, and 1.44 of the extension.
The Restaurant Brands International (RBI) assistant platform as of 2025-09-06 does not implement access control for the bathroom rating interface. This means any user can access this interface without authorization.
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS