CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders.
The LMS by Masteriyo WordPress plugin before version 1.6.8 lacks proper authorization in some of its REST API endpoints, allowing students to access the email addresses of other students.
The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attributes, leading to a vulnerability to Reflected Cross-Site Scripting.
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.
The Short URL WordPress plugin before version 1.6.5 does not sanitize and escape some of its settings, which could allow high privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository thorsten/phpmyfaq prior to version 3.1.16, allowing for the storage of malicious code.
IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing 'dot dot' sequences (/../) to view arbitrary files on the system.
Vulnerability in Tadiran Telecom Aeonix related to observable response discrepancies, which may lead to information disclosure.
CVE-2023-37215 affects the JBL multibeam 5.1 soundbar, which uses hard-coded credentials. This may allow unauthorized access to the device.
An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators.
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, unauthorized users could obtain information about restricted-visibility topic tags.
Discourse is an open source discussion platform that prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches did not impose an upper limit on limit parameters in multiple controller actions. This lack of restriction may allow users to generate database queries that could exhaust server resources.
Discourse is an open source discussion platform, where prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can delay the defer queue processing on sites hosted in the same multisite installation.
Discourse is an open source discussion platform, where prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason.
In the Discourse discussion platform prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered that could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous users. Version 3.1.0.beta7 contains a patch.
A critical vulnerability was found in Cafe Billing System 1.0, affecting an unknown functionality of the file index.php in the Order Handler component. Manipulation of the argument id leads to SQL injection.
A critical vulnerability was found in the Simple Online Mens Salon Management System 1.0. Manipulation of the 'id' argument in the file /admin/?page=user/manage_user&id=3 leads to SQL injection.
Several WordPress plugins by Inisev are vulnerable to Cross-Site Request Forgery, allowing unauthorized installation of plugins due to a missing nonce check in the handle_installation function. Attackers can exploit this vulnerability to install plugins if they can trick a site administrator.
A logic issue was addressed with improved state management. This vulnerability could allow a website to track sensitive user information.
A critical vulnerability was found in phpscriptpoint RecipePoint 1.9, affecting an unknown part of the file /recipe-result. Manipulation of the arguments text/category/type/difficulty/cuisine/cooking_method leads to SQL injection.