CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
RAGFlow before version 0.26.3 has a server-side request forgery vulnerability in the agent workflow Invoke component. The component builds an outbound request URL from canvas configuration and template variables and passes it to requests.get/post/put without safety validation, allowing access to internal network resources.
A vulnerability in TaxoPress (up to version 3.51.0) involves deserialization of untrusted data, allowing Object Injection.
Starter Templates by Kadence WP versions up to 2.3.3 contain an unauthenticated Denial of Service (DoS) vulnerability. An attacker can cause service unavailability without authentication.
Unauthenticated Broken Access Control vulnerability in Charitable versions up to 1.8.11.3.
Unauthenticated Local File Inclusion vulnerability in Restaurant Menu by MotoPress versions up to 2.4.11.
Subscriber Broken Authentication vulnerability in MWB HubSpot for WooCommerce versions up to 1.6.7.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Subscribe2 versions up to 10.46.
Stored XSS vulnerability in the Site Reviews plugin by Gemini Labs. Improper input neutralization during web page generation allows persistent script injection. Affects versions from n/a through 8.2.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Contact Form by Supsystic versions prior to 1.10.0.
Unauthenticated Broken Access Control vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.
Unauthenticated Remote File Inclusion vulnerability in Easy Google Maps versions prior to 1.14.2.
Unauthenticated Cross Site Scripting (XSS) vulnerability in URL Shortify versions up to 2.5.0.
Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor versions up to 3.4.18.
Unauthenticated Cross Site Scripting (XSS) in Chaty Pro versions up to 3.5.8.
Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager versions up to 2.9.53.
Unauthenticated Arbitrary Content Deletion in Breeze versions up to 2.5.12.
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register versions up to 7.8.1.
Unauthenticated Broken Authentication in SupportCandy versions up to 3.5.1.
SQL Injection vulnerability in License Manager for WooCommerce versions up to 3.0.18. An attacker can inject malicious SQL code through the customer field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS