CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
IBM Security Verify Information Queue versions 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against the system.
CVE-2023-41741 describes a vulnerability that exposes sensitive information to unauthorized actors in the cgi component of Synology Router Manager (SRM) before version 1.3.1-9346-6. Remote attackers can obtain sensitive information via unspecified vectors.
CVE-2023-41740 describes an improper limitation of a pathname to a restricted directory in the cgi component of Synology Router Manager (SRM) before version 1.3.1-9346-6. This allows remote attackers to read specific files via unspecified vectors.
CVE-2023-41739 in Synology Router Manager (SRM) before version 1.3.1-9346-6 has an uncontrolled resource consumption vulnerability that can be exploited by remote authenticated users to conduct denial-of-service attacks.
The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the order status parameter in versions up to and including 3.3.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers (admin or higher) to inject arbitrary web scripts on pages.
The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the start_date and end_date parameters in versions up to and including 3.3.6 due to insufficient input sanitization and output escaping.
The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcemails_edit' parameter in versions up to and including 2.2 due to insufficient input sanitization and output escaping.
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to and including 1.2.89. This allows subscribers to view arbitrary invoices if they can guess the order id and invoice id.
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to and including 1.2.90. This allows unauthenticated attackers to create invoice fields if they can trick an admin into performing an action such as clicking on a link.
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via admin settings in versions up to and including 1.2.90 due to insufficient input sanitization and output escaping.
The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 0.6.2. This is due to missing or incorrect nonce validation on its AJAX actions, allowing unauthenticated attackers to create and delete countdowns.
The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up to and including 0.6.2. This allows authenticated attackers with subscriber-level permissions and above to create and delete countdowns as well as manipulate other plugin settings.
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.90. This is due to missing or incorrect nonce validation on the Save function, allowing unauthenticated attackers to make changes to invoices via a forged request.
The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to and including 5.5.0. This is due to the passphrase and iv being hardcoded in the 'pm_encrypt_decrypt_pass' function, allowing authenticated attackers with administrator-level permissions to decrypt and view users' passwords.
The GitHub repository instantsoft/icms2 prior to version 2.16.1 has a reflected Cross-site Scripting (XSS) vulnerability.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, allowing for the storage of malicious code.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, allowing for the storage of malicious code.
There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1. This may lead to unauthorized access to internal server resources.
Improper access control exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
Session Fixation vulnerability in GitHub repository instantsoft/icms2 prior to version 2.16.1.