CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 are vulnerable to a remote denial of service due to uncontrolled resource consumption.
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
The Forminator plugin (by WPMU DEV) up to version 1.57.3 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in user.
Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HollerBox: from n/a through 2.3.14.
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GiveWP: from n/a through 4.18.0.
Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Visual Composer Website Builder: from n/a through 45.16.3.
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables. This issue affects Event Tickets: from n/a through 5.30.0.1.
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Event Tickets: from n/a through 5.30.0.1.
Stored XSS vulnerability in Gutenberg Blocks by Kadence Blocks (up to 3.7.12) due to improper input neutralization during web page generation.
Missing authorization in Event Tickets (up to 5.30.0.1) allows exploiting incorrectly configured access control security levels.
Stored XSS vulnerability in Robo Gallery (up to 5.1.6) due to improper input neutralization.
Missing authorization in Ultimate Post Kit (up to 4.5.5) allows exploiting incorrectly configured access control security levels.
Missing authorization in YITH WooCommerce Product Bundles (up to 2.29.0) allows exploiting incorrectly configured access control security levels.
Stored XSS vulnerability in MasterStudy LMS (up to 3.7.52) due to improper input neutralization.
Stored XSS vulnerability in WP Store Locator (up to 3.0.3) due to improper input neutralization.
The Vitepos plugin (by Appsbd) up to version 3.6.1 contains a Blind SQL Injection vulnerability that allows an attacker to manipulate database queries.
Missing authorization in VillaTheme Core (up to 1.0.5) allows exploiting incorrectly configured access control security levels.
Stored XSS vulnerability in ShortPixel Image Optimizer (up to 6.5.6) due to improper input neutralization.
The Joomla extension Gridbox (by balbooa.com) below version 2.20.4.0 contains a CSRF vulnerability in the language installation feature because the addLanguage action does not require POST and does not validate the session token.
Path Traversal vulnerability in Joomla extension Gridbox (before 2.20.4.0) in the showImage action allows reading files from sibling directories if image decoding fails, due to insufficient containment checks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS