CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the order status parameter in versions up to and including 3.3.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers (admin or higher) to inject arbitrary web scripts on pages.
The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the start_date and end_date parameters in versions up to and including 3.3.6 due to insufficient input sanitization and output escaping.
The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcemails_edit' parameter in versions up to and including 2.2 due to insufficient input sanitization and output escaping.
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to and including 1.2.89. This allows subscribers to view arbitrary invoices if they can guess the order id and invoice id.
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to and including 1.2.90. This allows unauthenticated attackers to create invoice fields if they can trick an admin into performing an action such as clicking on a link.
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via admin settings in versions up to and including 1.2.90 due to insufficient input sanitization and output escaping.
The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 0.6.2. This is due to missing or incorrect nonce validation on its AJAX actions, allowing unauthenticated attackers to create and delete countdowns.
The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up to and including 0.6.2. This allows authenticated attackers with subscriber-level permissions and above to create and delete countdowns as well as manipulate other plugin settings.
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.90. This is due to missing or incorrect nonce validation on the Save function, allowing unauthenticated attackers to make changes to invoices via a forged request.
The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to and including 5.5.0. This is due to the passphrase and iv being hardcoded in the 'pm_encrypt_decrypt_pass' function, allowing authenticated attackers with administrator-level permissions to decrypt and view users' passwords.
The GitHub repository instantsoft/icms2 prior to version 2.16.1 has a reflected Cross-site Scripting (XSS) vulnerability.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, allowing for the storage of malicious code.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, allowing for the storage of malicious code.
There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1. This may lead to unauthorized access to internal server resources.
Improper access control exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
Session Fixation vulnerability in GitHub repository instantsoft/icms2 prior to version 2.16.1.
In Brocade Fabric OS before v9.2.0a, a local authenticated privileged user can trigger a buffer overflow condition, leading to a kernel panic with large input to buffers in the portcfgfportbuffers command.
A segmentation fault can occur in Brocade Fabric OS after version 9.0 and before version 9.2.0a through the passwdcfg command. This allows an authenticated privileged local user to crash a Brocade Fabric OS switch.
Usermin 2.000 has a Reflected Cross-site Scripting (XSS) vulnerability in the file manager tab that allows remote attackers to inject arbitrary web scripts or HTML via the 'replace in results' field while replacing results under the tools dropdown.
GitPython is a Python library used to interact with Git repositories. Due to a lack of verification of file locations, GitPython can read any file from the system, creating an attack risk.