CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Versions of Stripe up to 1.3.14 have an issue with unauthenticated access in the user registration process.
Versions of Element Pack Pro up to 9.0.6 are vulnerable to local file inclusion, potentially allowing attackers to access sensitive data on the server.
A vulnerability in Kodezen LLC Academy LMS Pro allows unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server.
The WPZOOM Addons for Elementor plugin versions up to 1.3.4 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.
Hitek versions below 1.8.3 are vulnerable to unauthenticated local file inclusion.
Micdrop versions up to 1.3.1 are vulnerable to unauthenticated PHP object injection.
Mildhill versions up to 1.5 are vulnerable to unauthenticated PHP object injection.
Mr. SEO versions up to 2.0 have a vulnerability allowing unauthenticated local file inclusion, which may lead to the exposure of sensitive data.
There is an unauthenticated PHP Object Injection vulnerability in Santé <= 1.5.1 versions.
Malmö versions up to 2.2 have a vulnerability allowing unauthenticated local file inclusion, potentially leading to sensitive data exposure.
There is an unauthenticated PHP object injection vulnerability in NeoBeat versions up to 1.7.
Fidalgo versions up to 1.2.2 are vulnerable to unauthenticated PHP object injection.
Versions of Aperitif up to 1.5 are vulnerable to unauthenticated local file inclusion. An attacker can exploit this vulnerability to gain access to system files.
Versions of MagOne <= 9.0 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
There is an unauthenticated local file inclusion vulnerability in Getaway versions below 1.8.
MultiLoca versions up to 4.2.15 contain a vulnerability that allows subscriber privilege escalation.
Zermatt versions up to 1.6.1 are vulnerable to unauthenticated PHP object injection.
Alloggio - Hotel Booking versions up to 2.1.2 are vulnerable to unauthenticated PHP object injection.
Mikado Core versions up to 1.6 are vulnerable to unauthenticated local file inclusion.
Versions of Solene <= 3.4 have a vulnerability for unauthenticated local file inclusion, which may lead to the disclosure of sensitive information.