CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated Broken Authentication vulnerability in Super Socializer plugin up to version 7.14.5. An unauthenticated attacker can bypass authentication mechanisms.
Unauthenticated Broken Access Control vulnerability in Staff Training plugin up to version 1.0.7. An unauthenticated attacker can access functions they should not have permissions for.
Unauthenticated Insecure Direct Object References (IDOR) vulnerability in Formidable Forms Signature Online Contract Automation plugin up to version 2.0.1. An unauthenticated attacker can access objects (e.g., files, data) by manipulating identifiers.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Easy PayPal Buy Now Button plugin up to version 2.0.4. An unauthenticated attacker can inject malicious scripts.
Unauthenticated Cross Site Scripting (XSS) vulnerability in AffiliateWP plugin up to version 2.35.0. An unauthenticated attacker can inject malicious scripts.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Simply Schedule Appointments plugin up to version 1.6.12.10. An unauthenticated attacker can inject malicious scripts.
Unauthenticated Cross Site Scripting (XSS) in wpDataTables versions up to and including 7.5.1.
Unauthenticated Broken Access Control in BOX NOW Delivery Croatia versions up to and including 3.3.0.
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin versions up to and including 1.8.6.
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables versions up to and including 5.2.9.
Unauthenticated Cross Site Scripting (XSS) in Media Library Assistant versions up to and including 3.38.
Unauthenticated Cross Site Scripting (XSS) in EmbedPress versions up to and including 4.5.6.
A heap-based buffer overflow vulnerability exists in the memcached client of Apache Portable Runtime Utility. This issue affects versions from 1.3.0 through 1.6.3.
A heap-based buffer overflow vulnerability exists in the redis client of Apache Portable Runtime Utility. This issue affects versions from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
The PublishPress Capabilities (capability-manager-enhanced) WordPress plugin has an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 2.45.0.
The Popup Maker plugin by Code Atlantic LLC contains an Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that allows DOM-Based XSS. The issue affects versions up to and including 1.23.0.
Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager versions up to and including 2.6.0.
Unauthenticated Cross Site Scripting (XSS) in Forminator versions up to and including 1.56.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in NextGEN Gallery versions up to 4.2.3. An attacker can inject malicious script without authentication.
Unauthenticated Broken Access Control vulnerability in JetFormBuilder versions up to 3.6.4.1. Allows unauthorized users to access functions they should not have permissions for.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS