CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SiYuan before version v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a non-existent plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping, allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating XSS to arbitrary OS command execution.
SiYuan before version v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as <img> are skipped by that check, a payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution.
Avada Core versions up to 5.15.6 contain an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An attacker can trick a logged-in administrator into performing unintended actions without their knowledge.
Really Simple CSV Importer versions up to 1.3 contain an Administrator Arbitrary File Upload vulnerability. An administrator can upload a malicious file, potentially leading to remote code execution on the server.
MapSVG versions up to 8.14.0 contain an Administrator Arbitrary File Upload vulnerability. An administrator can upload a malicious file, potentially leading to remote code execution on the server.
In JetBrains IntelliJ IDEA before 2026.2, unauthorized settings modification was possible in a Remote Development session.
In JetBrains IntelliJ IDEA before version 2026.2, unauthorized input injection is possible during a Remote Development session.
The TrueBooker plugin versions up to 1.2.3 contain an unauthenticated privilege escalation vulnerability.
The TrueBooker plugin versions up to 1.2.3 are vulnerable to unauthenticated SQL injection.
The Bookly plugin versions up to 27.7 are vulnerable to unauthenticated SQL injection.
The WPDM – Premium Packages plugin versions up to 6.2.0 are vulnerable to unauthenticated SQL injection.
The Participants Database plugin versions up to 2.7.8.3 allow unauthenticated arbitrary file deletion.
The Thrive Quiz Builder plugin versions up to 10.9.3.0 are vulnerable to unauthenticated PHP object injection.
The Advanced Views plugin versions up to 3.8.11 allow a subscriber to perform remote code execution (RCE).
The SMS Alert Order Notifications plugin versions up to 3.9.6 contain an unauthenticated privilege escalation vulnerability.
The MapSVG plugin versions up to 8.14.0 are vulnerable to unauthenticated SQL injection.
The Participants Database plugin versions up to 2.7.8.3 contain an unauthenticated SQL injection vulnerability. An attacker can send crafted requests to execute arbitrary SQL queries.
Buddyboss Platform versions up to 3.0.5 contain an unauthenticated SQL injection vulnerability. An attacker can remotely execute arbitrary SQL queries.
The Ninja Forms File Uploads Extension versions up to 3.3.26 are vulnerable to unauthenticated Cross-Site Request Forgery (CSRF). An attacker can trick an administrator into performing unwanted actions.
The Mailster plugin versions up to 4.1.17 allow an editor to upload arbitrary files. A user with the editor role can upload a malicious file to the server.