CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
MyBB before version 1.8.40 has a JavaScript code injection vulnerability in the Buddy/Ignore component due to improper username sanitization. Specially crafted usernames can leave unescaped single quotes, which can be exploited to execute scripts.
CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application.
The Entries component in Brainstorm Force SureForms versions less than 2.12.3 does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, allowing a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.
RAGFlow before version 0.26.3 has a server-side request forgery vulnerability in the agent workflow Invoke component. The component builds an outbound request URL from canvas configuration and template variables and passes it to requests.get/post/put without safety validation, allowing access to internal network resources.
A vulnerability in TaxoPress (up to version 3.51.0) involves deserialization of untrusted data, allowing Object Injection.
Starter Templates by Kadence WP versions up to 2.3.3 contain an unauthenticated Denial of Service (DoS) vulnerability. An attacker can cause service unavailability without authentication.
Unauthenticated Broken Access Control vulnerability in Charitable versions up to 1.8.11.3.
Unauthenticated Local File Inclusion vulnerability in Restaurant Menu by MotoPress versions up to 2.4.11.
Subscriber Broken Authentication vulnerability in MWB HubSpot for WooCommerce versions up to 1.6.7.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Subscribe2 versions up to 10.46.
Stored XSS vulnerability in the Site Reviews plugin by Gemini Labs. Improper input neutralization during web page generation allows persistent script injection. Affects versions from n/a through 8.2.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Contact Form by Supsystic versions prior to 1.10.0.
Unauthenticated Broken Access Control vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.
Unauthenticated Remote File Inclusion vulnerability in Easy Google Maps versions prior to 1.14.2.
Unauthenticated Cross Site Scripting (XSS) vulnerability in URL Shortify versions up to 2.5.0.
Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor versions up to 3.4.18.
Unauthenticated Cross Site Scripting (XSS) in Chaty Pro versions up to 3.5.8.
Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager versions up to 2.9.53.
Unauthenticated Arbitrary Content Deletion in Breeze versions up to 2.5.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS