CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2025-12008 affects the Yaay social media app, allowing authorization bypass through a user-controlled key. This enables access to functionality not properly constrained by access control lists (ACLs).
A vulnerability in plug_project allows denial of service via unbounded buffer accumulation during multipart header parsing. The read_part_headers/2 function does not obey its :length parameter, leading to no upper limit on the buffer size.
The Comarch ERP Optima client uses a hard-coded password for a database user that cannot be changed. A remote attacker can gain access to the database with elevated privileges, including executing system commands on the server.
The Comarch ERP Optima client connects to a database using a high privileged account regardless of the application account the user logs into. A local attacker controlling the client process can dump its memory, extract credentials, and gain privileged access to the database.
The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to and including 5.1.2 via the popup_submit. This allows unauthenticated attackers to make web requests to arbitrary locations, which can be used to query and modify information from internal services.
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 5.1.2. This is due to the missing authorization and capability checks in the infusedwoo_gdpr_upddata() function, allowing authenticated attackers with subscriber-level access and above to update their own wp_capabilities user meta to grant themselves Administrator role privileges.
The Fluent Forms plugin for WordPress is vulnerable to insecure direct object reference due to missing validation on a user-controlled key. Authenticated attackers with manager-level access can bypass form-level access restrictions and access data they are not authorized to view.
The Motors – Car Dealership & Classified Listings Plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to and including 1.4.107. This is due to insufficient file path validation in the become-dealer logo upload flow.
The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'MWP-Key-Name' HTTP request header in all versions up to and including 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values.
GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. In customizable analytics dashboards, an authenticated user could have executed arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.
The Fluent Forms plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 6.1.21. The SubmissionPolicy class authorizes submission-level actions based on a user-supplied `form_id` query parameter.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an unauthenticated user to cause denial of service by sending specially crafted payloads on certain API endpoints.
SOGo before 5.12.7, when using PostgreSQL or MariaDB and storing cleartext passwords, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
Yubico webauthn-server-core version 2.8.0 and earlier incorrectly checks a function's return value in the second factor flow, leading to impersonation.
Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.