CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.15)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Kit (formerly ConvertKit) plugin version 3.3.5 and earlier contains a broken access control vulnerability that can be exploited without authentication. An attacker can gain unauthorized access to functions or data.
The Fluent Support plugin version 2.3.0 and earlier is vulnerable to XSS attacks from a contributor role. A user with contributor privileges can inject a malicious script.
The AWP Classifieds plugin version 4.4.7 and earlier contains a broken access control vulnerability that can be exploited without authentication. An attacker can gain unauthorized access to functions or data.
The JetBooking plugin version 4.1.2 and earlier contains a broken access control vulnerability that can be exploited without authentication. An attacker can gain unauthorized access to functions or data.
The JetEngine plugin version 3.8.11 and earlier is vulnerable to SSRF attacks from a contributor role. A user with contributor privileges can send requests to internal network resources.
The JetBooking plugin version 4.1.2 and earlier is vulnerable to SSRF attacks from a custom role. A user with a custom role can send requests to internal network resources.
The JetElements for Elementor plugin version 2.9.1.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. An attacker with contributor role can inject malicious JavaScript.
The GiveWP plugin version 4.16.3 and earlier is vulnerable to unauthenticated Cross Site Request Forgery (CSRF). An attacker can trick an administrator into performing unwanted actions.
The Masteriyo - LMS plugin version 2.3.1 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by a subscriber. A subscriber can access other users' resources.
The Zarinpal Gateway plugin version 5.1.0 and earlier is vulnerable to unauthenticated Cross Site Request Forgery (CSRF). An attacker can trick an administrator into performing unwanted actions.
A vulnerability in Polylang and Polylang Pro (up to version 3.8.5) allows exposure of sensitive system information to unauthorized control spheres, enabling retrieval of embedded sensitive data.
The ЮKassa for WooCommerce plugin version 2.16.1 and earlier contains a Broken Access Control vulnerability exploitable by a subscriber. A subscriber can gain unauthorized access to administrative functions.
The Product Slider for WooCommerce plugin version 1.13.62 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by a contributor. A contributor can access other users' sliders.
The Ebook Store plugin version 6.19 and earlier is vulnerable to unauthenticated Broken Access Control. An unauthenticated attacker can access administrative functions.
The Ebook Store plugin version 6.19 and earlier is vulnerable to unauthenticated Broken Access Control. An unauthenticated attacker can access administrative functions.
The MapSVG plugin version 8.14.0 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. An attacker with contributor role can inject malicious JavaScript.
In JetBrains IntelliJ IDEA before version 2026.2, HTML injection was possible in IDE notifications, allowing silent user activity tracking.
The Simple Link Directory Pro plugin versions 15.0.8 and earlier are vulnerable to unauthenticated Cross-Site Request Forgery (CSRF).
The ShopLentor Pro plugin versions 2.8.5 and earlier have a broken access control vulnerability exploitable by Subscriber-level users.
The ShopLentor Pro plugin versions 2.8.5 and earlier have an unauthenticated broken access control vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS