CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated CSRF vulnerability in GeoDirectory plugin versions up to 2.8.176. An attacker can exploit CSRF to perform unwanted actions in the context of a logged-in administrator.
Subscriber sensitive data exposure vulnerability in SureFeedback Client Site versions up to 1.2.12. A user with subscriber role can access data they should not have permission to.
Unauthenticated XSS vulnerability in WP w3all phpBB versions up to 3.0.6. An attacker can inject malicious script that executes in the victim's browser.
The Hash Form plugin versions up to 1.4.1 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.
Unauthenticated XSS vulnerability in CozyStay versions up to 1.10.0. An attacker can inject malicious script that executes in the victim's browser.
The Beautiful Taxonomy Filters plugin versions up to 2.4.6 contain an unauthenticated SQL Injection vulnerability. An attacker can manipulate database queries, potentially leading to unauthorized data access.
The Geo Controller plugin versions up to 8.9.8 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.
Subscriber SQL Injection vulnerability in Like Button Rating versions up to 2.6.61. A user with subscriber role can inject malicious SQL queries.
Unauthenticated XSS vulnerability in Music Player for WooCommerce versions up to 1.8.9. An attacker can inject malicious script that executes in the victim's browser.
Unauthenticated XSS vulnerability in CP Media Player versions up to 1.3.0. An attacker can inject malicious script that executes in the victim's browser.
Editor PHP Object Injection vulnerability in Fluent Boards Pro versions up to 2.0.11. A user with editor role can inject malicious PHP objects, potentially leading to remote code execution.
The Fluent Boards Pro plugin version 2.0.11 and earlier has an Editor Arbitrary File Deletion vulnerability. An editor can delete arbitrary files on the server, which can lead to serious damage.
The Fluent Boards Pro plugin versions up to 2.0.11 contain an arbitrary file upload vulnerability exploitable by users with the editor role. This can lead to execution of malicious code on the server.
The Fluent Boards Pro plugin version 2.0.11 and earlier has a Subscriber Cross Site Scripting (XSS) vulnerability. A user with the subscriber role can inject a malicious script that executes in other users' browsers.
Editor Privilege Escalation vulnerability in FluentCRM Pro versions up to 3.1.12. A user with editor role can escalate their privileges to administrator level.
Unauthenticated XSS vulnerability in Realtyna Organic IDX plugin versions up to 5.4.1. An attacker can inject malicious script that executes in the victim's browser.
The Epayco plugin versions up to 8.4.6 contain an unauthenticated SQL Injection vulnerability. An attacker can manipulate database queries, potentially leading to unauthorized data access.
The Booking and Rental Manager plugin for WordPress versions up to 2.7.5 contains a PHP Object Injection vulnerability exploitable by users with the Contributor role.
Apache APISIX versions 2.11.0 through 3.17.0 are vulnerable to LDAP Injection. A caller with valid credentials for one LDAP entry can authenticate as a different consumer, bypassing the plugin's configured scope.
Apache APISIX version 3.17.0 is vulnerable to inefficient algorithmic complexity in graphql-limit-count routes. A single small request can pin a gateway worker at 100% CPU for an extended period.