CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Mattermost fails to verify channel membership when linking a board to a channel, allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to.
Mattermost fails to properly validate the origin of a websocket connection, allowing a MITM attacker to access the websocket APIs.
The FiveStarPlugins Restaurant Menu and Food Ordering plugin versions <= 2.4.6 contains a Cross-Site Request Forgery (CSRF) vulnerability. This allows attackers to send unauthorized requests on behalf of users.
The WP Social AutoConnect plugin by Justin Klein versions <= 4.6.1 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
Cross Site Scripting (XSS) vulnerability in Jaegertracing Jaeger UI before v.1.31.0 allows a remote attacker to execute arbitrary code via the KeyValuesTable component.
An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices related to an EMFI attack on ECO3, allowing an attacker to influence the PC value at the CPU context level, regardless of Secure Boot and Flash Encryption status.
The Faboba Falang plugin for WordPress versions up to 1.3.39 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.
The WooCommerce Shipping Multiple Addresses plugin versions up to 3.8.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
The WooCommerce AutomateWoo plugin versions up to 5.7.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
CSRF vulnerability in WooCommerce Order Barcodes plugin versions <= 1.6.4 allows attackers to perform unauthorized actions on behalf of users.
The Etoile Web Design Front End Users plugin versions <= 3.2.24 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
The Membership plugin for WordPress before version 3.2.3 does not sanitize and escape a parameter before outputting it back on the page, leading to a Reflected Cross-Site Scripting vulnerability. This could be exploited against high privilege users such as administrators.
The Autochat Automatic Conversation plugin for WordPress versions up to 1.1.7 does not sanitize and escape user input before outputting it back on the page, leading to a cross-site scripting attack.
CSRF vulnerability in WooCommerce Brands plugin versions <= 1.6.49 allows attackers to perform unauthorized actions on behalf of users.
The myCred plugin versions up to 2.5 contain a Cross-Site Request Forgery (CSRF) vulnerability. This may allow attackers to perform unauthorized actions on behalf of users.
The Zip Recipes plugin versions <= 8.0.7 contains a Cross-Site Request Forgery (CSRF) vulnerability that can be exploited to perform unauthorized actions on behalf of the user.
The WP PDF Generator plugin by wpexperts.Io versions up to 1.2.2 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
Reactive web applications using Spring HATEOAS to produce hypermedia-based responses may be exposed to malicious forwarded headers if not behind a trusted proxy or lacking mechanisms to handle such headers.
CVE-2023-3700 vulnerability involves authorization bypass through a user-controlled key in the GitHub repository alextselegidis/easyappointments prior to version 1.5.0.