CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Cross Site Scripting (XSS) in Team Section Block versions up to 2.0.4.
The Tailored Tools plugin in versions up to and including 3.0.3 contains an unauthenticated arbitrary file upload vulnerability. The lack of required authorization allows exploitation without an account in the application.
The CodeBard Help Desk plugin in versions up to and including 1.1.2 contains an arbitrary file upload vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required, greatly easing exploitation.
The Tonda Membership plugin in versions up to and including 1.0.1 contains an unauthenticated privilege escalation vulnerability. The lack of required authorization allows exploitation without an account.
Subscriber PHP Object Injection in Angio versions up to 1.1.1.
Unauthenticated Local File Inclusion in TouchUp versions before 1.4.
Reflected Cross-site Scripting vulnerability in ThemeREX Group Kids Planet theme, from n/a through 2.2.14.2.
Unauthenticated Local File Inclusion in DukaMarket versions up to 1.3.0.
Unauthenticated Local File Inclusion in Uminex versions up to 1.0.9.
Administrator SQL Injection in WP Ultimate CSV Importer versions up to 9.2.
Unauthenticated Local File Inclusion in Aalto versions up to 1.8.
Unauthenticated Local File Inclusion in CleanSkin versions up to 1.5.0.
The CleanSkin plugin in versions up to and including 1.5.0 contains a PHP Object Injection vulnerability exploitable by an unauthenticated attacker. The lack of required authorization allows exploitation without an account.
Administrator SQL Injection in Frontend Admin by DynamiApps versions up to 3.29.13.
The Dynamic User Directory plugin in versions up to and including 2.4 contains a PHP Object Injection vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required.
The Booster for WooCommerce plugin in versions up to and including 8.4.0 contains a PHP Object Injection vulnerability exploitable by an unauthenticated attacker. The lack of required authorization allows exploitation without an account.
SQL Injection vulnerability in the administrator panel of the Leyka plugin in versions up to 3.32.3.
The Payever - WooCommerce Gateway plugin in versions up to and including 4.8.2 contains a PHP Object Injection vulnerability exploitable by an unauthenticated attacker. The lack of required authorization allows exploitation without an account.
Unauthenticated Cross Site Scripting (XSS) vulnerability in the Photo Gallery by 10Web plugin in versions up to 1.8.47.
SQL Injection vulnerability in the Qode Tours plugin in versions up to 3.1.3.2, affecting users with the subscriber role.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS