CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command.
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
Broken Function Level Authorization allows execution of poller post-restart commands by an authenticated user. The lack of function-level permission checks enables access to restricted operations.
Missing Authorization vulnerability in the myCred (mycred) plugin allows exploitation of incorrectly configured access control security levels. This issue affects myCred from n/a through 4.0.2.
The MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the plugin's absolute filesystem path.
The MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.
Missing Authorization vulnerability in the ShopBuilder – Elementor WooCommerce Builder Addons (shopbuilder) plugin allows exploitation of incorrectly configured access control security levels. This issue affects ShopBuilder from n/a through 3.4.2.
Missing Authorization vulnerability in Cozmoslabs Profile Builder (profile-builder) allows exploitation of incorrectly configured access control security levels. This issue affects Profile Builder from n/a through 4.0.5.
Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) (page-and-post-restriction) allows exploitation of incorrectly configured access control security levels. This issue affects Page Restriction WordPress (WP) from n/a through 1.6.1.
The WP User Frontend plugin (weDevs) up to version 4.3.13 contains a Missing Authorization vulnerability due to insufficient access control checks. This allows exploitation of incorrectly configured access control security levels.
The WP User Frontend plugin (weDevs) up to version 4.3.13 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.
The EventPrime plugin up to version 4.3.6.0 contains an Authorization Bypass Through User-Controlled Key vulnerability that allows bypassing authorization checks. This can lead to privilege abuse.
The Gutenberg Blocks by Kadence Blocks plugin (Liquid Web / StellarWP) up to version 3.8.0.2 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.
The JetElements For Elementor plugin (Crocoblock) up to version 2.9.2.6 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.
The Kit plugin (formerly ConvertKit) up to version 3.4.7 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.
The WPFunnels plugin up to version 3.13.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force a logged-in user to perform unwanted actions.
The User Registration plugin (ThemeGrill) up to version 5.3.0 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.
The WP ERP plugin (weDevs) up to version 1.17.10 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.
The Flash & HTML5 Video plugin (bPlugins) up to version 2.14.0 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS