CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
ThumbPress versions prior to 6.5 contain an unauthenticated Broken Access Control vulnerability. Unauthenticated users can perform operations they are not authorized to do.
BP Better Messages versions up to 2.15.22 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
Ezoic versions up to 2.22.11 contain an unauthenticated Broken Authentication vulnerability. An attacker can bypass authentication mechanisms and gain unauthorized access.
PDF Smart Viewer for Elementor versions up to 1.0.4 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can send requests from the server to internal resources.
The Online Contact Widget plugin versions up to 1.3.0 contain an unauthenticated Broken Access Control vulnerability. This means an attacker without logging in can gain unauthorized access to functions that should be protected.
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.
BetterDesk, a remote desktop management solution, versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.
The Duitku Payment Gateway plugin versions up to 2.11.14 contain an unauthenticated Sensitive Data Exposure vulnerability. An attacker without logging in can access confidential information.
The Gravity Forms Bookings premium plugin versions up to 2.1 contain a Subscriber SQL Injection vulnerability. An attacker with subscriber privileges can execute unauthorized database queries.
The Essential Real Estate plugin versions up to 5.3.3 contain a Customer PHP Object Injection vulnerability. An attacker can inject malicious PHP objects, which could lead to remote code execution.
The Theme Test Drive plugin versions up to 2.9.1 contain an unauthenticated Local File Inclusion vulnerability. An attacker without logging in can include local files from the server.
The Mayosis Core plugin versions up to 5.4.7 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker without logging in can inject malicious scripts into pages.
The FormyChat plugin versions up to 2.15.7 contain an unauthenticated Broken Access Control vulnerability. An attacker without logging in can gain unauthorized access to functions.
The Vavo Core plugin versions up to 2.3.0 contain an unauthenticated Local File Inclusion vulnerability. An attacker without logging in can include local files from the server.
Unauthenticated Cross Site Scripting (XSS) in SSL Zen versions up to 4.7.43.
Unauthenticated Cross Site Scripting (XSS) in Quill Forms versions up to 5.7.1.
Unauthenticated Broken Access Control in WP Sort Order versions up to 1.3.5.
Subscriber Privilege Escalation in The Grid versions up to 2.7.9.1.
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
SQL injection vulnerability in Task Management System 1.0, in the function Operation::select_with_multiple_condition in /index.php, in the Login Form component, via the email argument. The attack can be launched remotely, and the exploit is publicly available.