CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In version 2.5.4 of the ZipArchive component, an unhandled edge case allows attackers to trigger a Denial of Service (DoS) attack via a crafted zip file.
Badaso versions from 0.0.1 to 2.9.7 contain a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload in the 'Name of member' parameter in the add new member function.
In borgbackup, an open-source deduplicating archiver, a flaw in the cryptographic authentication scheme allowed an attacker to fake archives, potentially leading to backup data loss. The attack required access to the repository and the ability to insert files into backups.
The controller responsible for setting the logging level does not include any authorization checks, allowing unauthorized users to access it. This issue affects YugabyteDB Anywhere from versions 2.0.0 to 2.17.3.
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance.
In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed SAML request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.
The MPEmbed WP Matterport Shortcode plugin versions up to 2.1.4 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor permissions and above.
The Breadcrumb simple plugin in versions <= 1.3 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
The SpamReferrerBlock plugin versions up to 2.22 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
The POEditor WordPress plugin before 0.9.8 lacks CSRF checks in various places, which could allow attackers to make logged in admins perform unwanted actions, such as resetting the plugin's settings and updating its API key.
The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks.
The Ninja Forms plugin for WordPress before version 3.6.26 was affected by an HTML Injection security vulnerability.
The Simple Blog Card WordPress plugin before version 1.32 does not ensure that posts displayed via a shortcode are public, allowing authenticated users, such as subscribers, to access arbitrary post titles and their content, including drafts, private posts, and password-protected ones.
The Simple Blog Card WordPress plugin before 1.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
The All Users Messenger WordPress plugin through version 1.24 does not prevent non-administrator users from deleting messages.
The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 lacks proper CSRF checks when managing its license, which could allow attackers to force logged in admins to update and deactivate the plugin's license via CSRF attacks.
The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting vulnerability.
The Upload Media By URL WordPress plugin before version 1.0.8 lacks CSRF checks when uploading files. This could allow attackers to force logged-in admins to upload files, including HTML containing JS code, on their behalf.
The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
The Subscribers Text Counter plugin for WordPress before version 1.7.1 lacks CSRF checks when updating its settings, allowing attackers to change them via a logged-in admin. The absence of sanitization and escaping also leads to the potential for Stored Cross-Site Scripting.