CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność CVE-2025-11025 dotyczy platformy Vimesoft Corporate Messaging, która pozwala na wyciąganie wbudowanych danych wrażliwych z wysyłanych wiadomości. Problem ten występuje w wersjach od V1.3.0 do przed V2.0.0.
A security flaw has been discovered in OGRECave Ogre up to 14.4.1 affecting the STBIImageCodec::encode function in /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp of the Image Handler component. The manipulation results in a heap-based buffer overflow. The attack is only possible with local access, and the exploit has been released to the public.
A vulnerability has been found in libucl up to version 0.9.2 in the ucl_include_common function of /src/ucl_util.c. Manipulation leads to a heap-based buffer overflow. Local access is required and the exploit has been publicly disclosed.
Podatność CVE-2025-60219 w HaruTheme WooCommerce Designer Pro umożliwia nieograniczone przesyłanie plików o niebezpiecznych typach, co pozwala na przesłanie powłoki sieciowej na serwer WWW. Problem ten dotyczy wersji WooCommerce Designer Pro od n/a do 1.9.24.
The Google+ Comments plugin for WordPress is vulnerable to Stored Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.0.
The kontur Admin Style plugin for WordPress is vulnerable to Stored Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.0.4.
The SEO Search Permalink plugin for WordPress is vulnerable to Stored Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.0.3.
The Silencesoft RSS Reader plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) due to improper URL validation. This issue affects versions up to and including 0.6.
The Click & Tweet plugin for WordPress is vulnerable to Stored Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 0.8.9.
The Recaptcha – wp plugin for WordPress is vulnerable to Stored Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions up to and including 0.2.6.
W podatności CVE-2025-60173 występuje problem Cross-Site Request Forgery (CSRF) w wtyczce Ashwani kumar GST dla WooCommerce, który umożliwia przechowywanie ataków XSS. Dotyczy to wersji GST dla WooCommerce od n/a do 2.0 włącznie.
Podatność typu Cross-Site Request Forgery (CSRF) w Flytedesk Digital umożliwia przeprowadzenie ataku typu Stored XSS. Problem ten dotyczy wersji Flytedesk Digital od n/a do 20181101 włącznie.
Podatność typu Cross-Site Request Forgery (CSRF) w wtyczce Conditional Cart Messages dla WooCommerce od YourPlugins.com umożliwia przeprowadzenie ataku typu Stored XSS. Problem dotyczy wersji wtyczki od n/a do 1.2.10 włącznie.
Podatność typu Cross-Site Request Forgery (CSRF) w HTACCESS IP Blocker pozwala na przeprowadzenie ataku typu Stored XSS. Problem ten dotyczy wersji HTACCESS IP Blocker od n/a do 1.0 włącznie.
Podatność typu Cross-Site Request Forgery (CSRF) w W3SCloud Contact Form 7 do Zoho CRM umożliwia przechowywanie ataków XSS. Problem ten dotyczy wersji W3SCloud Contact Form 7 do Zoho CRM od n/a do 3.2 włącznie.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in honzat Page Manager for Elementor allows Retrieve Embedded Sensitive Data. This issue affects Page Manager for Elementor from n/a through <= 2.0.5.
Missing Authorization vulnerability in WP Subscription Forms PRO allows exploiting incorrectly configured access control security levels. This issue affects WP Subscription Forms PRO from n/a through <= 2.0.5.
The Frames plugin by HaruTheme has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Frames versions from n/a through 1.5.7.
W aplikacji NewsMAN NewsmanApp występuje podatność typu Cross-Site Request Forgery (CSRF), która umożliwia przeprowadzenie ataku typu Stored XSS. Problem ten dotyczy wersji aplikacji od n/a do 2.7.7 włącznie.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robin W bbp topic count allows DOM-Based XSS. This issue affects bbp topic count from n/a through <= 3.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS