CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The MapSVG plugin up to version 8.14.0 contains an SQL injection vulnerability exploitable by a contributor-level user. An attacker can manipulate database queries.
Vulnerability in JetBrains IntelliJ IDEA before version 2026.2 allows arbitrary code injection via UI Designer form files.
In IntelliJ IDEA before version 2026.2, there is a vulnerability allowing unauthorized file access during a Remote Development session. An attacker can access files they should not have permission to.
In JetBrains IntelliJ IDEA before version 2026.2, arbitrary code execution was possible before granting project trust via development container configuration.
In JetBrains PhpStorm before 2026.2, arbitrary code execution was possible before granting project trust via the configured interpreter.
In JetBrains PhpStorm before 2026.2, arbitrary code execution was possible before granting project trust via project tooling.
In JetBrains WebStorm before version 2026.2, arbitrary code execution was possible via a project-supplied linter configuration.
In JetBrains WebStorm before 2026.2, arbitrary code execution was possible before granting project trust via the configured Node.js interpreter.
In JetBrains WebStorm before 2026.2, arbitrary code execution was possible before granting project trust via project-local package-manager tooling.
In JetBrains WebStorm before 2026.2, arbitrary code execution was possible before granting project trust via project-local linter tooling.
In JetBrains GoLand before 2026.2, arbitrary code execution was possible before granting project trust via the configured Go SDK.
In JetBrains GoLand before 2026.2, arbitrary code execution was possible before granting project trust in the Go Modules integration.
The PayU India plugin up to version 3.8.9 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.
The Form Vibes – Database Manager for Forms plugin up to version 1.5.2 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script that executes in the victim's browser.
The Bookly plugin up to version 27.7 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script that executes in the victim's browser.
The WPDM – Premium Packages plugin up to version 6.2.0 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.
The Ziina plugin up to version 1.2.21 contains an unauthenticated Broken Authentication vulnerability. An unauthenticated attacker can bypass authentication mechanisms and gain unauthorized access to accounts or functions.
The Payment Gateway for PayPal on WooCommerce plugin up to version 9.1.4 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.
The miniOrange Discord Integration plugin version 2.2.4 and earlier contains an authentication bypass vulnerability without requiring login. An attacker can bypass authorization mechanisms and gain unauthorized access to plugin features.
The Kali Forms plugin version 2.4.18 and earlier allows a user with the Subscriber role to delete arbitrary files on the server. The vulnerability does not require special privileges beyond a standard subscriber account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS