CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in the WordPress plugin 'flickr-picture-backup' version 0.7 is due to the lack of checks to see if the user is authenticated or has permission to upload files in 'flickr-picture-download.php'.
Vulnerability in the WordPress plugin 'image-gallery-with-slideshow' version 1.5.2, involving blind SQL injection in image-gallery-with-slideshow/admin_setting.php via the selectMulGallery parameter.
Vulnerability in the WordPress plugin 'image-gallery-with-slideshow' version 1.5.2, involving blind SQL injection in admin_setting.php via the gallery_name parameter.
The WordPress plugin 'image-gallery-with-slideshow' version 1.5.2 has a vulnerability to blind SQL Injection via the imgid parameter in image-gallery-with-slideshow/admin_setting.php.
Vulnerability in the WordPress plugin 'image-gallery-with-slideshow' version 1.5.2 is due to the lack of input sanitization from the gid variable before it is used in an SQL statement.
The WordPress plugin Membership Simplified version 1.58 has a vulnerability to blind SQL injection. The code in updateDB.php does not sanitize user input via recordId in the delete_media function, allowing attackers to manipulate the database.
The WordPress plugin Membership Simplified version 1.58 has a vulnerability to blind SQL injection. The code in updateDB.php does not sanitize user input via recordId in the delete function, allowing an attacker to manipulate SQL queries.
The WordPress plugin 'membership-simplified-for-oap-members-only' version 1.58 has a vulnerability that allows file downloads without checking if the user is logged in and has download privileges.
Vulnerability in WordPress plugin wp2android-turn-wp-site-into-android-app version 1.1.4, which includes unlicensed vulnerable CMS software from http://www.invedion.com.
Vulnerability in WordPress plugin webapp-builder v2.0, which includes unlicensed vulnerable CMS software from http://www.invedion.com/.
Vulnerability in the WordPress plugin 'mobile-app-builder-by-wappress' version 1.05, which includes unlicensed vulnerable CMS software from http://www.invedion.com.
Vulnerability in the WordPress plugin 'mobile-friendly-app-builder-by-easytouch' version 3.0 allows content upload without authentication.
The IPv6 routing header parser in tcpdump before version 4.9.2 has a buffer over-read in the rt6_print() function.
The IKEv2 parser in tcpdump before version 4.9.2 has a buffer over-read in print-isakmp.c in several functions.
The IKEv1 parser in tcpdump before version 4.9.2 has a buffer over-read in the ikev1_id_print() function.
The OLSR parser in tcpdump before version 4.9.2 has a buffer over-read in the olsr_print() function.
The HDLC parser in tcpdump before version 4.9.2 has a buffer over-read in the chdlc_print() function.
The ISO IS-IS parser in tcpdump before version 4.9.2 has a buffer over-read in the function isis_print_is_reach_subtlv().
The LLDP parser in tcpdump before version 4.9.2 has a buffer over-read in the lldp_private_8023_print() function.
The BGP parser in tcpdump before version 4.9.2 has a buffer over-read in the decode_rt_routing_info() function.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS