CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The OrganicFood WordPress plugin (versions up to 3.6.4) has a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements.
The Homeo WordPress plugin (versions up to 1.2.59) has a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements.
The Freeio WordPress plugin (versions up to 1.3.21) has a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements.
The Emphires WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statements. Attackers can exploit this to read arbitrary files on the server.
Cross-Site Request Forgery (CSRF) vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Request Forgery. This issue affects Extra Fees Plugin for WooCommerce: from n/a through <= 4.3.3.
The Biolife WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
A CSRF vulnerability in the SpicePress WordPress theme (spicepress) up to version 2.3.2.5. It allows an attacker to upload a web shell to the web server by exploiting an administrator's session.
The Boutique (kute-boutique) WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
The KuteShop WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
The LabtechCO WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
The Mikado Core WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.
The FOX woocommerce-currency-switcher plugin by RealMag777 up to version 1.4.5 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.
The YayMail plugin by YayCommerce up to version 4.3.3 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.
The Simply Schedule Appointments plugin for WordPress up to version 1.6.9.27 contains a blind SQL injection vulnerability. Improper neutralization of special elements in SQL commands allows an attacker to perform blind SQL injection.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ameliabooking Amelia ameliabooking allows Blind SQL Injection. This issue affects Amelia: from n/a through <= 2.1.1.
The Download Monitor plugin for WordPress up to version 5.1.8 has a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.
The OttoKit suretriggers plugin by Brainstorm Force up to version 1.1.20 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.
The User Feedback plugin for WordPress up to version 1.10.1 has a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.
The Broken Link Checker plugin by WPMU DEV up to version 2.4.7 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.
Vulnerability in the MxGeneralIo utility for Moxa industrial x86 computers. An exposed IOCTL with insufficient access control allows a local attacker with high privileges to directly read/write MSR and system memory. This could lead to privilege escalation on Windows 7 or system crash (BSoD) on Windows 10/11.