CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Broken Access Control vulnerability in AllAble Connector versions up to 0.13.4, exploitable by a subscriber.
Arbitrary File Deletion vulnerability in WEBO MCP versions up to 3.0.18, exploitable by an author.
Broken Access Control vulnerability in MCP Content Manager Lite up to version 1.1.0. A subscriber can gain unauthorized access to administrative functions.
Cross Site Scripting (XSS) vulnerability in JetEngine up to version 3.8.14.3. A subscriber can inject malicious scripts.
Cross Site Scripting (XSS) vulnerability in ThemeREX Addons before version 2.45.0. A subscriber can inject malicious scripts.
Insecure Direct Object References (IDOR) vulnerability in Webba Booking up to version 6.5.0. A subscriber can access objects without authorization.
Insecure Direct Object References (IDOR) vulnerability in Client Invoicing by Sprout Invoices up to version 20.8.17. An unauthenticated user can access objects without logging in.
Insecure Direct Object References (IDOR) vulnerability in Newsletters, Email Marketing, SMS and Popups by Omnisend up to version 1.9.0. A subscriber can access objects without authorization.
Cross Site Scripting (XSS) vulnerability in EWWW Image Optimizer up to version 8.7.7. A contributor can inject malicious scripts.
Insecure Direct Object References (IDOR) vulnerability in GiveWP up to version 4.16.9. An unauthenticated user can access objects without logging in.
Cross Site Scripting (XSS) vulnerability in King Addons for Elementor up to version 51.1.85. A contributor can inject malicious scripts.
Sensitive Data Exposure vulnerability in GiveWP up to version 4.16.9. A subscriber can access sensitive data.
Cross Site Scripting (XSS) vulnerability in The Plus Addons for Elementor Page Builder Lite up to version 6.5.1. A user with Contributor role can inject malicious script.
Bypass vulnerability allowing a Subscriber user to bypass security in All In One WP Security & Firewall up to version 5.4.8.
Arbitrary File Deletion vulnerability allowing an Editor user to delete any file in Template Kit – Import up to version 1.0.16.
Privilege Escalation vulnerability allowing a Subscriber user to escalate privileges in FluentBoards up to version 2.0.12.
Cross Site Scripting (XSS) vulnerability in pixfort Core before version 4.3.3. A user with Contributor role can inject malicious script.
Insecure Direct Object References (IDOR) vulnerability in Bookly up to version 28.2. A Subscriber user can access unauthorized resources.
Cross Site Scripting (XSS) vulnerability in Profile Builder up to version 4.0.2. A Subscriber user can inject malicious script.
Unauthenticated Denial of Service (DoS) vulnerability in WP Store Locator before version 3.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS