CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The SEO Plugin by Squirrly SEO in versions <= 14.2.5 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Contributor privileges.
Simply Schedule Appointments plugin version 1.6.12.29 and earlier contains a Broken Access Control vulnerability that can be exploited without authentication, allowing unauthorized access to functionality.
The Cost of Goods for WooCommerce plugin in versions <= 3.5.2 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Shop manager privileges.
The WP Statistics plugin in versions <= 14.16.13 is vulnerable to unauthenticated Cross Site Scripting (XSS). An unauthenticated attacker can inject malicious script.
The Minimum and Maximum Quantity for WooCommerce plugin in versions <= 2.1.2 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Author privileges.
The Music Player for WooCommerce plugin versions 1.9.1 and earlier contains a PHP Object Injection vulnerability exploitable by a shop manager. An attacker with shop manager privileges can exploit this to execute arbitrary code.
The WP Data Access plugin versions 5.5.84 and earlier contain an unauthenticated SQL Injection vulnerability. A remote attacker can exploit this to execute unauthorized queries against the database.
The Notification for Telegram plugin versions 3.5.2 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
The JW Player for WordPress plugin versions 2.3.11 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
Apache WSS4J stores the Nonce of each accepted UsernameToken as raw base64 text, but authentication decodes that text and uses the bytes. The same bytes can be written as base64 in several ways. An attacker who captured an authenticated request could re-send it with a space added to the Nonce: the password digest still verified, but the token no longer matched the remembered one, so the replay was accepted. Since a UsernameToken does not cover the message body, the captured token could then be reused on requests of the attacker's choosing until it expired. Affects deployments with a nonce replay cache configured, as Apache CXF has by default, and only tokens using a password digest. The cache is now keyed on the decoded Nonce. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. The DOM code is not affected. Users are recommended to upgrade to versions 4.0.2, 3.0.6, or 2.4.4 which fix this issue.
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass.
Maksisoft Gym versions from 0.5.10 before 0.5.11 contain an observable response discrepancy vulnerability that allows account footprinting, enabling attackers to determine if an account exists.
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access the system with admin privileges. The issue is due to improper handling of URI encoding in HTTP requests, allowing bypass of an authentication rule for a specific API endpoint. An attacker can send a crafted HTTP request to gain admin access.
sogo_yhn configures SOGo with the parameter "SOGoTrustProxyAuthentication=YES", causing the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account. This issue was fixed in version 5.8.0~ynh9.
sogo_yhn configures SOGo with a parameter that forces requests with the HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password. This issue was fixed in version 5.8.0~ynh9.
The WP Activity Log plugin versions 5.6.6 and earlier contain an SQL Injection vulnerability exploitable by an administrator. An administrator can exploit this to execute unauthorized queries against the database.
Creator LMS plugin version 1.2.19 and earlier contains an 'Other Vulnerability Type' vulnerability exploitable by subscribers, allowing unauthorized actions.
Flexible PDF Coupons plugin version 1.14.11 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by contributors, allowing unauthorized access to resources.
Happy Addons for Elementor plugin version 3.23.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS