CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
The MStore API WordPress plugin before version 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
The Export All URLs plugin for WordPress before version 4.6 does not sanitize and escape a parameter before outputting it back on the page, leading to a Reflected Cross-Site Scripting vulnerability.
The WP Dummy Content Generator plugin by Deepak Anand versions <= 2.3.0 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
KodExplorer version 4.51 contains a Cross-Site Scripting (XSS) vulnerability in the Description box of the Light App creation feature. An attacker can exploit this vulnerability by injecting XSS syntax into the Description field.
Sourcecodester Online Pizza Ordering System v1.0 has a Cross-site scripting (XSS) vulnerability in '/admin/index.php?page=categories' Category item.
The Albert Peschar WebwinkelKeur plugin versions up to 3.24 contains a Cross-Site Request Forgery (CSRF) vulnerability. This may allow attackers to perform unauthorized actions on behalf of users.
The Hostel Management System v.2.1 has a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the add course section.
The WP Zone Potent Donations plugin for WooCommerce versions <= 1.1.9 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.
CVE-2023-35887 vulnerability in Apache MINA exposes sensitive information to unauthorized actors. Logged users on SFTP servers may discover 'exists/does not exist' information about items outside the rooted tree using parent navigation or symlinks.
CVE-2023-35699 concerns cleartext storage on disk in the SICK ICR890-4 device. This allows an unauthenticated attacker with local access to the device to disclose sensitive information by accessing the SD card.
The SICK ICR890-4 has an observable response discrepancy that could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.
Improper restriction of excessive authentication attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials.
The SmartBPM.NET component has a path traversal vulnerability in its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.
In the GitHub repository nilsteampassnet/teampass prior to version 3.0.10, there is improper encoding or escaping of output.
The Online Examination System Project version 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious link that, when clicked by an admin user, will delete a user account from the database without the admin's consent.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the usergroups management section.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the skills wheel.
Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the session category management section.