CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.28)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
ESET AV Remover (standalone) contains an Improper Privilege Management vulnerability that allows Privilege Escalation via specially crafted RPC.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could exploit this, leading to denial of service.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Validation of Certificate with Host Mismatch vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access.
The PublishPress Capabilities plugin for WordPress up to version 2.50.0 is vulnerable to Privilege Escalation. The addPluginCapabilities() function automatically grants the Editor role all manage_capabilities_* capabilities, allowing attackers with Editor-level access to manage roles and plugin settings, but not full administrator access.
The Quentn WP WordPress plugin before version 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection.
The WPBot – AI ChatBot plugin for WordPress up to version 8.7.3 is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The nonce-based protection is ineffective because the nonce is localized on every public-facing page.
The Next-Cart Store to WooCommerce Migration plugin for WordPress up to version 3.9.8 has an authentication bypass vulnerability in the NCWM_Kitconnect::run() function. The REST route /wp-json/next_cart/v1/migration has permission_callback set to __return_true and relies on a hardcoded fallback token '__token__' when the nextcart_token option is not yet set. This allows unauthenticated attackers to bypass authentication and execute arbitrary SQL and delete files.
The Loops & Logic WordPress plugin before version 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see. This allows unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
The ELEX WooCommerce Request a Quote WordPress plugin before version 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query. This allows unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.
An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service.
Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity.
Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory.
Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege.
Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration.
The Repeater Fields for Gravity Forms plugin for WordPress up to version 3.0.4 is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
The UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS