CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL Injection vulnerability with subscriber privileges in the rtMedia for WordPress, BuddyPress and bbPress plugin up to version 4.7.10. Allows a user with subscriber role to execute arbitrary SQL queries.
The Byteflows Travel & Hotel Booking plugin in version 1.0.0 and earlier allows unauthenticated users to access sensitive data. This vulnerability enables information disclosure without requiring authentication.
The Hide My WP Ghost plugin in version 7.0.06 and earlier has a Broken Authentication vulnerability for users with the Subscriber role. These users can bypass authentication mechanisms.
The Paid Member Subscriptions plugin in version 3.0.7 and earlier allows users with the Subscriber role to exploit Insecure Direct Object References (IDOR). This enables access to other users' resources without authorization.
The Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin in version 2.10.22 and earlier has an SQL Injection vulnerability exploitable by an administrator. Attackers can inject malicious SQL queries.
The CoCart – Headless ecommerce plugin in version 4.8.4 and earlier allows unauthenticated users Broken Access Control. Users without login can access functions intended for authenticated users.
The Thrive Product Manager plugin in version 10.9.2 and earlier allows unauthenticated users Broken Access Control. Users without login can access product management functions.
The Post My CF7 Form plugin in version 6.2.0 and earlier allows unauthenticated users Broken Access Control. Users without login can access form-related functions.
The Booking and Rental Manager plugin in version 2.7.2 and earlier has an unspecified vulnerability exploitable by an unauthenticated user. Technical details are unknown.
The Falcon – WordPress Optimizations & Tweaks plugin in version 2.10.0 and earlier has an unknown vulnerability exploitable by an unauthenticated user. No detailed information is available.
The Stripe For WooCommerce plugin in version 4.0.7 and earlier allows unauthenticated users Broken Access Control. Users without login can access payment functions.
The Ebook Store plugin version 6.19 and earlier does not require authentication to expose sensitive data. An attacker can remotely read confidential information without having an account.
The ShipTime: Discounted Shipping Rates plugin version 1.1.1 and earlier allows a user with the Subscriber role to access sensitive data without proper permissions.
Ericsson Packet Core Controller (PCC) before version 1.38 contains a command injection vulnerability that allows an attacker to execute arbitrary code as root.
The SP Page Builder extension for Joomla (from joomshaper.com) below version 6.7.1 allows an authenticated user to delete arbitrary files due to improper path validation and ACL checks in the media manager.
The SP Page Builder extension for Joomla (from joomshaper.com) below version 6.7.1 contains an SQL injection vulnerability in the search and date filters of the media manager, allowing an authenticated user to manipulate database queries.
Missing authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API, potentially leading to system compromise.
Incorrect authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate to root on the vulnerable appliance, potentially leading to full system compromise.
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the backup restore functionality, potentially leading to full system compromise.
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the Geo Location management interface, potentially leading to full system compromise.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS