CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The JobSearch WordPress plugin (versions up to 3.2.9) contains a stored XSS vulnerability. Improper input neutralization during web page generation allows an attacker to inject a malicious script.
The Simple File List WordPress plugin contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 6.3.8.
The PropertyHive WordPress plugin contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 2.2.3.
The Extensions for Leaflet Map WordPress plugin is vulnerable to DOM-based XSS. The flaw affects versions up to and including 5.1, allowing an attacker to inject malicious scripts.
The FormyChat WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects all versions up to and including 2.15.3.
The Advanced Forms WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.9.3.7.
The ElementInvader Addons for Elementor WordPress plugin contains a DOM-Based Cross-Site Scripting (XSS) vulnerability. The flaw arises from improper input neutralization during web page generation, allowing an attacker to inject malicious JavaScript code.
SSRF vulnerability in the WPJAM Basic plugin allows an attacker to send requests from the server to internal network resources. The issue affects versions up to and including 7.0.
The WPJAM Basic plugin version 7.0 and earlier contains a deserialization of untrusted data vulnerability allowing object injection. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.
The Themify Builder plugin for WordPress contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 7.7.4.
The Jobmonster plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This issue affects all versions up to and including 4.8.5.
The ChatBot plugin for WordPress up to version 8.3.7 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject a malicious script that executes on every page load.
The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. Manipulating the data value allows arbitrary OS commands to be executed as root.
The charging station does not require authentication for Bluetooth commands, allowing unauthorized devices to perform actions. The vulnerability enables sensitive information leakage, triggering reboots, or pushing a firmware update URL.
A weakness has been identified in waooAI waoowaoo up to version 0.4.1, where improper authentication occurs in the functions getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, and requireProjectAuthLight in src/lib/api-auth.ts. Manipulation of the x-internal-user-id request argument allows remote authentication bypass. The exploit is publicly available and could be used for attacks.
A security vulnerability was found in Shibby Tomato up to version 1.28.0000 in the sub_407220 function of the /usr/sbin/httpd file within the DNS List Rendering component. Manipulation leads to a stack-based buffer overflow, which can be exploited remotely. This project is superseded by FreshTomato.
A Server-Side Request Forgery (SSRF) protection bypass was found in the html_to_markdown expansion module of misp-modules. IPv4-mapped IPv6 addresses were not normalized before blocked-range checks, allowing attacks on loopback, internal, or link-local networks.
A flaw in the vllm-orchestrator-gateway component causes all incoming authorization headers and full chat payloads to be logged persistently, exposing bearer tokens and sensitive conversation content to any user with log access.
In Shibby Tomato up to version 1.28.0000, a vulnerability was found in the main function of the file www/apcupsd/tomatodata.cgi of the apcupsd component. Manipulation leads to an out-of-bounds write. The attack can be launched remotely, and the exploit is publicly available.
In Shibby Tomato up to version 1.28.0000, the apcupsd component's getupsvar function in www/apcupsd/tomatodata.cgi is vulnerable to a stack-based buffer overflow via the Field argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.