CVE-2026 list

CVE-2026 records published in August 2026

Page 11 of 13: records 10,001 to 11,000 of the 12,071 published in August 2026, newest first. The first page carries the figures for August 2026.

CVE-2026 records published in August 2026, newest first: records 10,001 to 11,000 of 12,071
CVE Summary CVSS EPSS Published Signals
CVE-2026-18942Red Hat OpenShift AI Feast operator apply cronjob privilege escalation5.5CNA v3.10.4%2026-08-10Fix
CVE-2026-18941Red Hat OpenShift AI Feast feature store missing authentication7.7CNA v3.10.9%2026-08-10Fix
CVE-2026-18934RSS Aggregator by Feedzy WordPress plugin Cross-User import Job manipulation and post deletion5.5CISA ADP v3.10.3%2026-08-10Fix
CVE-2026-18786CheckView WordPress plugin Administrator account creation via REST API authentication bypass8.8CISA ADP v3.10.5%2026-08-10Fix
CVE-2026-18666Library Management System WordPress plugin Subscriber+ SQL injection via Filter Value4.3CISA ADP v3.10.3%2026-08-10Fix
CVE-2026-18621Red Hat OpenShift AI Data Science Pipelines privilege escalation7.6CNA v3.10.5%2026-08-10Fix
CVE-2026-18620Red Hat OpenShift AI Data Science Pipelines insecure direct object reference7.1CNA v3.10.5%2026-08-10Fix
CVE-2026-18618Red Hat OpenShift AI ML Metadata gRPC service denial of service7.5CNA v3.10.8%2026-08-10Fix
CVE-2026-18617Red Hat OpenShift AI data-science-pipelines-operator: Dspo: Mysql dsn parameter injection8.8CNA v3.10.7%2026-08-10Fix
CVE-2026-18611Red Hat OpenShift AI Data Science Pipelines Operator vulnerability7.5CNA v3.10.6%2026-08-10Fix
CVE-2026-18608Red Hat OpenShift AI Data Science Pipelines Operator vulnerability8.7CNA v3.10.7%2026-08-10Fix
CVE-2026-18503Python CPython super-linear CPU usage for unbounded input to csv.Sniffer.sniff2.4CNA v4.00.1%2026-08-10Fix
CVE-2026-18478Stored XSS in Magnolia CMS5.1CNA v4.00.5%2026-08-10Fix
CVE-2026-18470Login and Register Forms password reset information disclosure7.5CISA ADP v3.10.4%2026-08-10Fix
CVE-2026-18469Login and Register Forms WordPress plugin unauthenticated account takeover8.1CISA ADP v3.10.4%2026-08-10Fix
CVE-2026-18468Login and Register Forms WordPress plugin unauthenticated account takeover8.1CISA ADP v3.10.4%2026-08-10Fix
CVE-2026-18412The OpenCart extension installer contains a directory traversal9.1CISA ADP v3.10.5%2026-08-10Fix
CVE-2026-18370Heap-based buffer overflow in entr4.8CNA v4.00.2%2026-08-10Fix
CVE-2026-18200FoodBoxBooker WordPress plugin Subscriber+ arbitrary user Profile update4.3CISA ADP v3.10.3%2026-08-10Fix
CVE-2026-18030Bricksforge WordPress plugin unauthenticated arbitrary password reset via Pro Forms8.1CISA ADP v3.10.4%2026-08-10Fix
CVE-2026-17542Bit File Manager WordPress plugin Subscriber+ sensitive data disclosure via bitapps_fm_connector7.5CISA ADP v3.10.4%2026-08-10Fix
CVE-2026-17541Bit File Manager WordPress plugin unauthenticated file Activity Log disclosure7.5CISA ADP v3.10.4%2026-08-10Fix
CVE-2026-17540Bit File Manager WordPress plugin arbitrary file read and deletion8.8CISA ADP v3.10.4%2026-08-10Fix
CVE-2026-17023Salon Booking System Google Calendar OAuth callback improper access control4.8CISA ADP v3.10.3%2026-08-10Fix
CVE-2026-17022Salon Booking System Free Version WordPress plugin unauthenticated Booking information disclosure7.5CISA ADP v3.10.4%2026-08-10Fix
CVE-2026-17021Salon Booking System Free Version WordPress plugin unauthenticated arbitrary Booking Total tampering5.3CISA ADP v3.10.3%2026-08-10Fix
CVE-2026-17020Salon Booking System Free Version WordPress plugin Subscriber+ arbitrary Booking PII disclosure4.3CISA ADP v3.10.3%2026-08-10Fix
CVE-2026-17019JetEngine WordPress plugin unauthenticated stored XSS via form file upload (SVG)6.1CISA ADP v3.10.3%2026-08-10Fix
CVE-2026-17018CubeWP Framework WordPress plugin Contributor+ arbitrary post and user Meta disclosure via IDOR4.9CISA ADP v3.10.4%2026-08-10
CVE-2026-17016Restore PayPal Standard for WooCommerce WordPress plugin Payment bypass via PDT Underpayment3.7CISA ADP v3.10.2%2026-08-10Fix
CVE-2026-17012Accept PayPal and Stripe with Subscriptions for WooCommerce improper access control5.3CISA ADP v3.10.3%2026-08-10Fix
CVE-2026-17010Saitama Addon Pack WordPress plugin Contributor+ stored XSS via post Meta5.4CISA ADP v3.10.2%2026-08-10Fix
CVE-2026-16985Squeeze WordPress plugin Author+ arbitrary file upload8.8CISA ADP v3.10.7%2026-08-10Fix
CVE-2026-16949Term Pages WordPress plugin unauthenticated SQL injection via tp_lookup5.8CISA ADP v3.10.4%2026-08-10Fix
CVE-2026-16742systemd-homed home record signature verification privilege escalation6.7CNA v3.10.1%2026-08-10Fix
CVE-2026-16626JasperReports Server: XXE injection vulnerability (Unauthenticated)9.3CNA v4.00.5%2026-08-10Fix
CVE-2026-16456Red Hat OpenShift AI odh-model-controller secret loading information disclosure6.5CNA v3.10.4%2026-08-10Fix
CVE-2026-16299Single Sign On For TNG WordPress plugin unauthenticated arbitrary password reset9.8CISA ADP v3.10.5%2026-08-10Fix
CVE-2026-16298FoodBoxBooker WordPress plugin unauthenticated arbitrary password reset9.8CISA ADP v3.10.5%2026-08-10Fix
CVE-2026-16257Arvow AI SEO Writer webhook secret validation improper authentication8.2CISA ADP v3.10.4%2026-08-10Fix
CVE-2026-15581Red Hat OpenShift AI TrustyAI service API missing authentication8.0CNA v3.10.4%2026-08-10Fix
CVE-2026-15467Red Hat OpenShift AI TrustyAI LMEvalJob controller vulnerability8.1CNA v3.10.6%2026-08-10Fix
CVE-2026-15238MotoPress Hotel Booking customer record update endpoint insecure direct object reference5.4CISA ADP v3.10.2%2026-08-10Fix
CVE-2026-15237MotoPress Hotel Booking checkout payments REST endpoint missing authorization5.3CISA ADP v3.10.3%2026-08-10Fix
CVE-2026-15229Pinpoint Booking System WordPress plugin unauthenticated arbitrary Booking Price manipulation5.3CISA ADP v3.10.3%2026-08-10
CVE-2026-15060systemd-machined register-machine polkit action missing authorization4.7CNA v3.10.1%2026-08-10Fix
CVE-2026-15059systemd-oomd IPC API path traversal5.5CNA v3.10.2%2026-08-10Fix
CVE-2026-15047s2Member WordPress plugin Contributor+ stored XSS via shortcode6.8CISA ADP v3.10.4%2026-08-10Fix
CVE-2026-14941Customer Reviews for WooCommerce WordPress plugin missing authorization5.4CISA ADP v3.10.2%2026-08-10Fix
CVE-2026-14886Vault Enterprise vulnerable to cross-namespace entity deletion8.2CNA v3.10.3%2026-08-10Fix
CVE-2026-14860Podcast Player WordPress plugin unauthenticated server-side request forgery5.3CISA ADP v3.10.3%2026-08-10Fix
CVE-2026-14450Red Hat OpenShift AI maas-billing: Maas API: Privilege escalation9.9CNA v3.10.7%2026-08-10Fix
CVE-2026-14293Autopay / Blue Media for WooCommerce WordPress plugin unauthenticated stored XSS via CSS Editor8.8CISA ADP v3.10.5%2026-08-10Fix
CVE-2026-14238Vitepos WordPress plugin Admin+ SQL injection via product-details-report4.1CISA ADP v3.10.3%2026-08-10Fix
CVE-2026-14237Vitepos WordPress plugin Outlet Manager+ privilege escalation7.2CISA ADP v3.10.5%2026-08-10Fix
CVE-2026-14211Booking for Appointments and Events Calendar insecure direct object reference3.8CISA ADP v3.10.3%2026-08-10Fix
CVE-2026-14206HT Contact Form WordPress plugin unauthenticated Saved form Draft data disclosure7.5CISA ADP v3.10.4%2026-08-10Fix
CVE-2026-13717Red Hat OpenShift AI MaaS Gateway improper access control8.8CNA v3.10.5%2026-08-10Fix
CVE-2026-13701Advanced Excerpt WordPress plugin Admin+ stored XSS via Ellipsis setting4.8CISA ADP v3.10.2%2026-08-10Fix
CVE-2026-13600AutoNetTV Relay WordPress plugin unauthenticated privilege escalation via Scheduled Sync Cron8.1CISA ADP v3.10.5%2026-08-10Fix
CVE-2026-13206Multiple vulnerabilities in Zyxel's WAH7601 OS command injection9.8CNA v3.11.8%2026-08-10
CVE-2026-13170Eventin WordPress plugin Editor+ local file inclusion via speaker_template setting7.2CISA ADP v3.10.6%2026-08-10Fix
CVE-2026-13133LY LINE uncontrolled search path8.4CNA v4.00.2%2026-08-10
CVE-2026-12984Exposure of sensitive information to an unauthorized actor in Zyxel's WAH76018.2CNA v3.10.3%2026-08-10
CVE-2026-12971LearnPress WordPress plugin Instructor+ server-side request forgery via openai_apply_image_feature2.2CISA ADP v3.10.2%2026-08-10Fix
CVE-2026-12624Vault vulnerable to LIST authorization bypass via trailing-slash strip4.3CNA v3.10.3%2026-08-10Fix
CVE-2026-12570Denial of service via HDF5 Shape Bomb in keras.models.load_model in keras-team/keras5.5CNA v3.00.1%2026-08-10Fix
CVE-2026-12339TP-Link Systems TL-MR6400 authenticated arbitrary file write vulnerability in multiple devices6.9CNA v4.00.5%2026-08-10Fix
CVE-2026-11812zephyrproject zephyr UpdateHub: Race condition on shared context causes out-of-bounds write and DoS2.5CNA v3.10.1%2026-08-10Fix
CVE-2026-11811Zephyr UpdateHub OTA client vulnerability3.7CNA v3.10.4%2026-08-10Fix
CVE-2026-11810zephyrproject zephyr null-pointer dereference in UpdateHub OTA agent on empty inner metadata array7.5CNA v3.10.5%2026-08-10Fix
CVE-2026-11809Zephyr UpdateHub OTA client probe out-of-bounds read3.7CNA v3.10.4%2026-08-10Fix
CVE-2026-10754Pegasystems Pega Platform improper signature verification8.6CNA v4.00.8%2026-08-10Fix
CVE-2026-8718Out-of-bounds write in DTLS peer Connection ID getsockopt in Zephyr net sockets/TLS8.4CNA v3.10.2%2026-08-10Fix
CVE-2026-6791The GNU C Library glibc potential stack-based buffer clash during tilde expansion in wordexp6.6CNA v4.00.3%2026-08-10Fix
CVE-2026-6426QEMU vhost inflight migration state vulnerability4.4CNA v3.10.4%2026-08-10Fix
CVE-2026-6374Hard-coded credentials in Zyxel WAH7601 Router7.3CNA v3.10.2%2026-08-10
CVE-2026-6373Sensitive data exposure in Zyxel WAH7601 Router6.5CNA v3.10.3%2026-08-10
CVE-2026-6368glibc wordexp with WRDE_APPEND can return or use invalid memory2.1CNA v4.00.1%2026-08-10Fix
CVE-2026-71993MSI Radix AXE6600 v781521 command injection via openvpn function9.3CNA v4.02.5%2026-08-09Fix
CVE-2026-70395Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash2.1CNA v4.00.2%2026-08-09Fix
CVE-2026-69659ash-project ash memory exhaustion5.9CNA v4.00.4%2026-08-09Fix
CVE-2026-19378code-projects Task Management System CommentSave.php cross-site scripting5.3CNA v4.00.5%2026-08-09
CVE-2026-19376Uasoft Badaso File API api.php class permission6.9CNA v4.00.5%2026-08-09
CVE-2026-19375dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery5.3CNA v4.00.4%2026-08-09
CVE-2026-19374adafap api-mcp Proxy API endpoint route.ts customAxios server-side request forgery6.9CNA v4.00.5%2026-08-09
CVE-2026-19373PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema server-side request forgery4.8CNA v4.00.1%2026-08-09
CVE-2026-19372Handwriting-OCR handwriting-ocr-mcp-server upload_document index.ts fs.readFileSync path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19371Nikolaibibo claude-comfyui-mcp comfy_upload_image utils.ts copyFileSync path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19370bartekke8it56w2 new-mcp geminithinking index.ts fs.readFileSync path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19369KS-GEN-AI jira-mcp-server attachment upload from URL function server-side request forgery4.8CNA v4.00.1%2026-08-09
CVE-2026-19368PV-Bhat gemsuite-mcp gemini_search unified-gemini.ts path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19367NocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request forgery5.3CNA v4.00.4%2026-08-09
CVE-2026-19366NocteDefensor LudusMCP insert_creds_range_config insertCredsRangeConfig.ts path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19365Ichigo3766 image-gen-mcp upscale_images index.ts path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19364itsourcecode Hospital Management System viewdoctorconsultancycharge.php SQL injection5.3CNA v4.00.3%2026-08-09
CVE-2026-19363lmammino oidc-authorizer Lambda Authorizer handler.rs log file6.9CNA v4.00.7%2026-08-09
CVE-2026-19362lmammino oidc-authorizer authorization header parser denial of service6.9CNA v4.00.6%2026-08-09
CVE-2026-19361macrozheng mall mall-portal getAuthCode password recovery6.3CNA v4.00.4%2026-08-09
CVE-2026-19360wongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges management5.1CNA v4.00.4%2026-08-09
CVE-2026-19359nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control5.1CNA v4.00.4%2026-08-09Fix
CVE-2026-193583CORESec Trapdoor DefaultFunction access control5.3CNA v4.00.3%2026-08-09
CVE-2026-19357MingSoft MCMS ms-mdiy get information disclosure6.9CNA v4.00.5%2026-08-09
CVE-2026-19356MingSoft MCMS ms-mdiy list information disclosure6.9CNA v4.00.5%2026-08-09
CVE-2026-19355MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData SQL injection6.9CNA v4.00.4%2026-08-09
CVE-2026-19354lock-upme OPMS IN Clause message.go SQL injection5.3CNA v4.00.3%2026-08-09
CVE-2026-19353DedeCMS Installation Wizard index.php _4_Setup file inclusion2.3CNA v4.00.4%2026-08-09
CVE-2026-19352mifi lossless-cut Built-in HTTP API service httpServer.ts server-side request forgery2.3CNA v4.00.3%2026-08-09
CVE-2026-19351dresende node-sql-query request Parameter Select.js SelectQuery.build SQL injection6.9CNA v4.00.5%2026-08-09Fix
CVE-2026-19350Dolibarr ERP TakePOS invoice.php fail authorization5.3CNA v4.00.4%2026-08-09
CVE-2026-19348Shenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injection9.3CNA v4.03.6%2026-08-09
CVE-2026-19347itsourcecode Hospital Management System viewdoctor.php SQL injection5.3CNA v4.00.3%2026-08-09
CVE-2026-19346Tenda CH22 CertListInfo formCertListInfo command injection8.7CNA v4.02.7%2026-08-09
CVE-2026-19345code-projects Task Management System UpdateTaskStatus.php authorization6.9CNA v4.00.5%2026-08-09
CVE-2026-19344code-projects Task Management System comment_count_user.php SQL injection6.9CNA v4.00.4%2026-08-09
CVE-2026-19343code-projects Task Management System AdminLogin.php SQL injection6.9CNA v4.00.4%2026-08-09
CVE-2026-19342code-projects Task Management System Login index.php improper authentication6.9CNA v4.00.7%2026-08-09
CVE-2026-19341UTT HiPER 1200GW pptpSrvGlobalConfig strcpy stack-based overflow8.7CNA v4.00.6%2026-08-09
CVE-2026-19340anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery5.3CNA v4.00.4%2026-08-09
CVE-2026-19339aliyun alibabacloud-dataworks-mcp-server resource read handler server-side request forgery5.3CNA v4.00.4%2026-08-09
CVE-2026-19338automateyournetwork MCPyATS generate_mermaid_markdown index.ts processGenerateRequest path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19337adenot mcp-google-search read_webpage index.ts server-side request forgery4.8CNA v4.00.2%2026-08-09
CVE-2026-19336Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19335Jane-xiaoer skill-vision-control config.ts getSkillVersionsDir path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19334NightTrek Ollama-mcp index.ts command injection4.8CNA v4.01.1%2026-08-09
CVE-2026-19333NightTrek Supabase-MCP generate_types command injection4.8CNA v4.01.1%2026-08-09
CVE-2026-19332NellyW8 MCP4EDA run_openlane/view_waveform command injection4.8CNA v4.01.1%2026-08-09
CVE-2026-19331bazylhorsey obsidian-mcp-server CanvasService.ts writeCanvas path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19330angrysky56 advanced-reasoning-mcp index.ts switch_memory_library path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19329andreahaku codex_mcp ask MCP tool codex-process-simple.ts command injection4.8CNA v4.01.1%2026-08-09
CVE-2026-19328aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal4.8CNA v4.00.2%2026-08-09Fix
CVE-2026-19327abracadabra50 claude-sesh enricher.ts enrichSession path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19326Jevon-Zhong Ai-doctor filemanagement.service.ts deleteImage path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19325IncomeStreamSurfer roo-code-memory-bank-mcp-server path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19324HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-19323azer react-analyzer-mcp analyze-projec index.ts generateProjectDocs path traversal4.8CNA v4.00.2%2026-08-09
CVE-2026-18603PiWeb Cancel order / Refund request for WooCommerce reorder AJAX action missing authorization6.5CISA ADP v3.10.3%2026-08-09Fix
CVE-2026-18473WP Directory Kit WordPress plugin unauthenticated SQL injection via field_search parameter9.1CISA ADP v3.10.5%2026-08-09Fix
CVE-2026-18465WP Maps Pro WordPress plugin unauthenticated local file inclusion6.5CISA ADP v3.10.3%2026-08-09Fix
CVE-2026-18464WP Maps Pro WordPress plugin unauthenticated denial of service7.5CISA ADP v3.10.5%2026-08-09Fix
CVE-2026-18357WPC Order Tip for WooCommerce WordPress plugin unauthenticated order data disclosure7.5CISA ADP v3.10.4%2026-08-09Fix
CVE-2026-18037Create by Mediavine WordPress plugin unauthenticated Unpublished content disclosure and Publication6.5CISA ADP v3.10.3%2026-08-09Fix
CVE-2026-18032WP Data Access WordPress plugin unauthenticated sensitive data disclosure7.5CISA ADP v3.10.4%2026-08-09Fix
CVE-2026-17510Crypt::OpenSSL::PKCS12 versions for Perl allow a null pointer dereference in print_attribute7.5CISA ADP v3.10.6%2026-08-09Fix
CVE-2026-17044WordPress File Upload plugin unauthenticated SQL injection via uniqueuploadid8.6CISA ADP v3.10.4%2026-08-09Fix
CVE-2026-17017CubeWP Framework WordPress plugin Subscriber+ SQL injection via cubewp_remove_relation8.1CISA ADP v3.10.4%2026-08-09Fix
CVE-2026-17014WP Photo Album Plus WordPress plugin unauthenticated export ZIP file deletion via delexportzips5.3CISA ADP v3.10.3%2026-08-09Fix
CVE-2026-17011Nexter Blocks WordPress plugin Contributor+ stored CSS injection3.8CISA ADP v3.10.2%2026-08-09Fix
CVE-2026-16992Create by Mediavine WordPress plugin unauthenticated Unpublished content disclosure and Publication6.5CISA ADP v3.10.3%2026-08-09Fix
CVE-2026-16988GeoDirectory markers REST endpoint information disclosure7.5CISA ADP v3.10.4%2026-08-09Fix
CVE-2026-16965Solace Extra WordPress plugin Subscriber+ post Meta update via solace_update_sitebuilder_status4.3CISA ADP v3.10.1%2026-08-09Fix
CVE-2026-16957Slim SEO WordPress plugin Contributor+ arbitrary post Meta disclosure2.7CISA ADP v3.10.3%2026-08-09Fix
CVE-2026-16032LWS Optimize WordPress plugin unauthenticated stored XSS via Real user Monitoring6.1CISA ADP v3.10.3%2026-08-09Fix
CVE-2026-15534Perl regex engine out-of-bounds write5.7CISA ADP v3.10.3%2026-08-09Fix
CVE-2026-15038InfiniteWP Client WordPress plugin unauthenticated Administrator account takeover on Multisite9.8CISA ADP v3.10.8%2026-08-09Exploit codeFix
CVE-2026-12372Server-side request forgery (SSRF) in nltk/nltk3.7CNA v3.00.3%2026-08-09Fix
CVE-2026-10595Path traversal vulnerability in parisneo/lollms7.5CNA v3.00.7%2026-08-09Fix
CVE-2026-71992MSI Radix AXE6600 v781521 command injection via macfilter9.3CNA v4.02.5%2026-08-08Fix
CVE-2026-71991MSI Radix AXE6600 v781521 command injection via TelnetSSH function9.3CNA v4.02.5%2026-08-08Fix
CVE-2026-71990MSI Radix AXE6600 v781521 command injection via TelnetSSH function9.3CNA v4.02.5%2026-08-08Fix
CVE-2026-71989MSI Radix AXE6600 v781521 command injection via porTrigger function9.3CNA v4.02.5%2026-08-08Fix
CVE-2026-71988MSI Radix AXE6600 v781521 command injection via portFw function9.3CNA v4.02.5%2026-08-08Fix
CVE-2026-71987MSI Radix AXE6600 v781521 command injection via alg function9.3CNA v4.02.5%2026-08-08Fix
CVE-2026-71986MSI Radix AXE6600 v781521 command injection via dmz function9.3CNA v4.02.5%2026-08-08Fix
CVE-2026-71985MSI Radix AXE6600 v781521 command injection via accesscontrol function9.3CNA v4.02.5%2026-08-08Fix
CVE-2026-71984MSI Radix AXE6600 v781521 command injection via urlfilter9.3CNA v4.02.5%2026-08-08Fix
CVE-2026-71983MSI Radix AXE6600 v781521 command injection via wps.cgi9.3CNA v4.02.5%2026-08-08Fix
CVE-2026-71958D-Link DWR-M961 buffer overflow via quicksetup.cgi9.3CNA v4.01.1%2026-08-08Fix
CVE-2026-71957D-Link DWR-M961 buffer overflow via app.cgi9.3CNA v4.01.1%2026-08-08Fix
CVE-2026-71956D-Link DWR-M961 command injection via app.cgi9.3CNA v4.03.2%2026-08-08Fix
CVE-2026-71955D-Link DWR-M961 command injection via /boafrm/formWsc9.3CNA v4.03.2%2026-08-08Fix
CVE-2026-71954D-Link DWR-M961 command injection via /boafrm/formL2tpv3ConfigSetup9.3CNA v4.03.2%2026-08-08Fix
CVE-2026-71953D-Link DWR-M961 command injection via /boafrm/formNtp9.3CNA v4.03.2%2026-08-08Fix
CVE-2026-71952D-Link DWR-M961 command injection via /boafrm/formPinManageSetup9.3CNA v4.03.2%2026-08-08Fix
CVE-2026-71951D-Link DWR-M961 command injection via /boafrm/formIMEISetup9.3CNA v4.03.2%2026-08-08Fix
CVE-2026-71950D-Link DWR-M961 command injection via /boafrm/formSmsManage9.3CNA v4.03.2%2026-08-08Fix
CVE-2026-71949D-Link DWR-M961 command injection via /boafrm/formUSSDSetup9.3CNA v4.03.2%2026-08-08Fix
CVE-2026-71948D-Link DWR-M961 command injection via /boafrm/formDebugDiagnosticRun9.3CNA v4.03.2%2026-08-08Fix
CVE-2026-71947D-Link DWR-M961 command injection via /boafrm/formTracerouteDiagnosticRun9.3CNA v4.03.2%2026-08-08Fix
CVE-2026-71946D-Link DWR-M961 command injection via /boafrm/formPingDiagnosticRun9.3CNA v4.03.2%2026-08-08Fix
CVE-2026-71945D-Link DWR-M961 command injection via /boafrm/formLtefotaUpgradeFibocom9.3CNA v4.03.2%2026-08-08Fix
CVE-2026-71944D-Link DWR-M961 command injection via /boafrm/formLtefotaUpgradeQuectel9.3CNA v4.03.2%2026-08-08Fix
CVE-2026-68082Linux kernel Ceph client lock decoder out-of-bounds read9.8CNA v3.10.4%2026-08-08Fix
CVE-2026-68081Linux kernel KVM nested VMX vulnerability–0.2%2026-08-08Fix
CVE-2026-67620Flowise SSRF via fetch-links Endpoint Incomplete Deny-List6.3CNA v4.00.5%2026-08-08Exploit code
CVE-2026-42170Red Hat Enterprise Linux 6 gimp: Gimp dds plug-in heap-based buffer overflow7.8CNA v3.10.2%2026-08-08Fix
CVE-2026-19288astralisone rive-mcp-server-core importRiveFile Flow importRiveFile.ts path traversal4.8CNA v4.00.2%2026-08-08
CVE-2026-19287abrinsmead mindpilot-mcp HistoryService path traversal4.8CNA v4.00.2%2026-08-08
CVE-2026-19285aaronsb memory-graph memoryTools.ts JsonMemoryStorage.saveMemories path traversal4.8CNA v4.00.2%2026-08-08
CVE-2026-19284MauricioMilano coder-api Projects endpoint projects.ts createProject command injection4.8CNA v4.01.1%2026-08-08
CVE-2026-19282andreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injection4.8CNA v4.01.1%2026-08-08
CVE-2026-19281slidev-builder-mcp generateAssets tool command injection4.8CNA v4.01.1%2026-08-08
CVE-2026-19279MIMICLab mcp-pdf-vision index.ts load_pdf command injection4.8CNA v4.01.1%2026-08-08
CVE-2026-19270Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversal4.8CNA v4.00.2%2026-08-08
CVE-2026-19268MCPGateway Claude usage range endpoint command injection5.3CNA v4.01.8%2026-08-08
CVE-2026-19266Kirachon context-engine review-git-diff endpoint gitUtils.ts execGitCommand command injection5.1CNA v4.03.9%2026-08-08Fix
CVE-2026-19263INQUIRELAB mcp-bridge-api Servers endpoint mcp-bridge.js command injection6.9CNA v4.02.1%2026-08-08
CVE-2026-19259MZ Automation libiec61850 MMS protocol handling heap-based buffer overflow4.8CNA v4.00.2%2026-08-08
CVE-2026-18988Easy Accordion WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-08-08Fix
CVE-2026-16955AI Engine WordPress plugin Subscriber+ arbitrary file read via Audio Transcription5.0CISA ADP v3.10.3%2026-08-08Fix
CVE-2026-16953AI Engine WordPress plugin unauthenticated Cross-Session Chatbot file deletion4.8CISA ADP v3.10.3%2026-08-08Fix
CVE-2026-16948Solace Extra WordPress plugin Multiple missing authorization8.1CISA ADP v3.10.4%2026-08-08Fix
CVE-2026-16608Download Monitor WordPress plugin unauthenticated download log injection5.3CISA ADP v3.10.3%2026-08-08Fix
CVE-2026-16595WP Directory Kit WordPress plugin Subscriber+ user and Unpublished Listing disclosure6.5CISA ADP v3.10.4%2026-08-08Fix
CVE-2026-16594WP Directory Kit WordPress plugin Subscriber+ plugin settings and API key disclosure7.5CISA ADP v3.10.4%2026-08-08Fix
CVE-2026-16590WP Directory Kit WordPress plugin Subscriber+ Contact Message and user data disclosure6.5CISA ADP v3.10.4%2026-08-08Fix
CVE-2026-16589WP Directory Kit WordPress plugin Subscriber+ SQL injection via data_fields_list parameter7.7CISA ADP v3.10.4%2026-08-08Fix
CVE-2026-16578Admin Safety Guard WordPress plugin unauthenticated user data disclosure7.5CISA ADP v3.10.5%2026-08-08Fix
CVE-2026-16574Dokan order downloads REST endpoint insecure direct object reference5.4CISA ADP v3.10.2%2026-08-08Fix
CVE-2026-16562WP Statistics WordPress plugin Subscriber+ sensitive data disclosure via Metabox AJAX Handlers6.5CISA ADP v3.10.4%2026-08-08Fix
CVE-2026-16559YMC Filter WordPress plugin Author+ stored XSS via SVG Icon upload6.8CISA ADP v3.10.4%2026-08-08Fix
CVE-2026-16558YMC Filter WordPress plugin Contributor+ stored XSS via Layout Builder Schema5.4CISA ADP v3.10.2%2026-08-08Fix
CVE-2026-16535Link Library WordPress plugin reflected XSS via Thumbs-Rating likelabel6.1CISA ADP v3.10.3%2026-08-08NucleiFix
CVE-2026-16282Appointment Hour Booking booking price parameter vulnerability5.3CISA ADP v3.10.3%2026-08-08Fix
CVE-2026-16269Newsletters WordPress plugin unauthenticated API authentication bypass via type Juggling4.8CISA ADP v3.10.4%2026-08-08Fix
CVE-2026-16267Newsletters WordPress plugin unauthenticated PHP object injection via Date form field8.1CISA ADP v3.10.5%2026-08-08Fix
CVE-2026-14526AI Copilot Content Generator WordPress plugin unauthenticated privilege escalation9.8CNA v3.10.9%2026-08-08Fix
CVE-2026-13505Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization8.7CNA v4.00.3%2026-08-08Fix
CVE-2026-8798Legion of the Bouncy Castle BC-FJA native entropy source infinite loop8.7CNA v4.00.4%2026-08-08Fix
CVE-2026-71870pypdf ToUnicode CMap parsing resource exhaustion4.8CNA v4.00.1%2026-08-07Fix
CVE-2026-71852pypdf CID font width parsing vulnerability4.8CNA v4.00.1%2026-08-07Fix
CVE-2026-71851crypto-js WordArray random number generator insufficient entropy9.0CNA v3.10.6%2026-08-07Exploit codeFix
CVE-2026-71850Hono: `memo` retains SSR output across requests, leading to cross-user data disclosure4.8CNA v3.10.3%2026-08-07Fix
CVE-2026-71849Hono: Proxy Helper does not remove response headers listed in the `Connection` header3.7CNA v3.10.4%2026-08-07Fix
CVE-2026-71848Hono: Algorithmic complexity DoS in Language Middleware5.3CNA v3.10.5%2026-08-07Fix
CVE-2026-71847JSON resumable JSON parser use-after-free8.7CNA v4.00.4%2026-08-07Fix
CVE-2026-71560Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path9.1CISA ADP v3.10.8%2026-08-07Fix
CVE-2026-71559Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata7.5CISA ADP v3.10.8%2026-08-07Fix
CVE-2026-71558Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization9.8CISA ADP v3.11.0%2026-08-07Fix
CVE-2026-71557go-git reference storage path traversal6.3CNA v3.10.4%2026-08-07Fix
CVE-2026-71556go-git worktree operations symlink following7.1CNA v3.10.4%2026-08-07Fix
CVE-2026-71381Adobe Genuine Software Integrity Service incorrect authorization4.0CNA v3.10.3%2026-08-07
CVE-2026-70561TestLink authenticated IDOR via attachmentdownload.php7.1CNA v4.00.4%2026-08-07
CVE-2026-69207Hono: ReDoS in CORS middleware via Access-Control-Request-Headers5.3CNA v3.10.6%2026-08-07Fix
CVE-2026-69127Kirby: System path exposure from error messages in the REST API6.9CNA v4.00.5%2026-08-07Fix
CVE-2026-68772ZenML remote code execution via CloudpickleMaterializer8.5CNA v4.00.8%2026-08-07
CVE-2026-67585Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation8.7CNA v4.00.7%2026-08-07Fix
CVE-2026-66914Joomla extension seblod.com unauthenticated path traversal in SEBLOD9.2CNA v4.00.5%2026-08-07Nuclei
CVE-2026-66838elixir-ecto postgrex SQL injection via the :comment option in Postgrex.stream/45.9CNA v4.00.4%2026-08-07Fix
CVE-2026-66494Joomla extension joomshaper.com unauthenticated stored XSS in Shapes API endpoint SP Page Builder8.7CNA v4.00.5%2026-08-07
CVE-2026-66493Joomla extension phoca.cz path traversal vulnerability in Phoca Commander6.4CNA v4.00.5%2026-08-07Exploit code
CVE-2026-66492Joomla extension phoca.cz path traversal vulnerability in Phoca Commander6.1CNA v4.00.6%2026-08-07Exploit code
CVE-2026-66491Joomla extension phoca.cz arbitrary file read in Phoca Commander8.2CNA v4.00.5%2026-08-07Exploit code
CVE-2026-66151SonicWall Global VPN Client out-of-bounds read5.5CISA ADP v3.10.2%2026-08-07Fix
CVE-2026-66062sveltejs kit SvelteKit: ReDoS (O) in content negotiation unauthenticated DoS5.3CNA v3.10.5%2026-08-07Fix
CVE-2026-66061Home Assistant iOS Companion app tag link handling missing authorization7.1CNA v3.10.2%2026-08-07Fix
CVE-2026-66060Home Assistant Companion app tag link handling missing authorization7.1CNA v3.10.2%2026-08-07Fix
CVE-2026-66059Frappe: Field-level permission bypass via Document Follow5.3CNA v4.00.5%2026-08-07Fix
CVE-2026-66058Frappe: Unrestricted access to a Document Follow API5.3CNA v4.00.4%2026-08-07Fix
CVE-2026-66000Frappe: Unrestricted access to Document Follow APIs2.3CNA v4.00.5%2026-08-07Fix
CVE-2026-65819gopacket DecodingLayerParser out-of-bounds read7.5CNA v3.10.7%2026-08-07Fix
CVE-2026-64676Kata Containers mem-agent ttRPC interface missing authorization5.7CNA v3.10.2%2026-08-07Fix
CVE-2026-64638WordPress cross-site scripting8.9CNA v4.00.9%2026-08-07NucleiExploit codeFix
CVE-2026-64637WebPros Plesk XML-RPC API improper privilege management9.9CNA v3.00.5%2026-08-07Fix
CVE-2026-64636WebPros Plesk An SQL injection7.7CNA v3.10.4%2026-08-07Fix
CVE-2026-62996Smarty Security stream restriction bypass through stream: Resource6.9CNA v4.00.5%2026-08-07Fix
CVE-2026-62992Smarty: Symlink path traversal out of trusted directories6.9CNA v4.00.5%2026-08-07Fix
CVE-2026-62296HAPI FHIR XHTML narrative parser uncontrolled recursion7.5CNA v3.10.5%2026-08-07Fix
CVE-2026-62295HAPI FHIR JSON utility parser uncontrolled recursion7.5CNA v3.10.5%2026-08-07Fix
CVE-2026-62293hapifhir org.hl7.fhir.core HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles5.0CNA v3.10.2%2026-08-07Fix
CVE-2026-61808LightRAG: Missing authentication for Critical API functions in Default Configuration9.8CNA v3.12.5%2026-08-07NucleiFix
CVE-2026-61477libvirt network XML DNS record parser vulnerability2.3CNA v3.10.2%2026-08-07Fix
CVE-2026-59717home-assistant core Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing4.3CNA v3.10.4%2026-08-07Fix
CVE-2026-58262Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum7.1CNA v4.00.2%2026-08-07Fix
CVE-2026-56818Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state6.5CNA v3.10.5%2026-08-07Fix
CVE-2026-56794Dell OpenManage Server Administrator Managed Node (Patch) relative path traversal6.5CNA v3.10.5%2026-08-07Fix
CVE-2026-56793Dell OpenManage Server Administrator Managed Node (Patch) improper authentication7.7CNA v3.10.5%2026-08-07Fix
CVE-2026-54338JupyterHub: Unauthenticated denial of service via Unbounded Username Logging on Failed Login5.3CNA v3.10.4%2026-08-07Fix
CVE-2026-54218TeamDavid: Weak cryptography and Insecure Password Storage8.8CNA v4.00.5%2026-08-07Fix
CVE-2026-54217TeamDavid: Stored XSS in web application5.3CNA v4.00.4%2026-08-07Fix
CVE-2026-54216TeamDavid: Reflected cross-site scripting (XSS) via the EntryInfo parameter5.3CNA v4.00.5%2026-08-07Fix
CVE-2026-54215TeamDavid: Open redirect via the replyUrl parameter5.3CNA v4.00.5%2026-08-07Fix
CVE-2026-54214TeamDavid: Header injection through the cType URL parameter5.3CNA v4.00.5%2026-08-07Fix
CVE-2026-54213TeamDavid: Denial of service via endpoint internalRestart9.2CNA v4.00.7%2026-08-07Fix
CVE-2026-54212TeamDavid: Buffer overflow in JSON-parsing9.5CNA v4.00.7%2026-08-07Fix
CVE-2026-54211TeamDavid: Buffer overflow in multiple form data parameters9.5CNA v4.00.6%2026-08-07Fix
CVE-2026-54210TeamDavid: Buffer overflow in file names of file upload functionalities9.5CNA v4.00.7%2026-08-07Fix
CVE-2026-54209TeamDavid: Buffer overflow in editini function8.9CNA v4.00.4%2026-08-07Fix
CVE-2026-54208TeamDavid: Arbitrary file write leading to stored XSS8.5CNA v4.00.5%2026-08-07Fix
CVE-2026-54207TeamDavid: Server-side request forgery (SSRF) via pathname parameter in move archive functionality6.3CNA v4.00.5%2026-08-07Fix
CVE-2026-54206TeamDavid: Server-side request forgery (SSRF) via pathname parameter in sending functionality6.3CNA v4.00.5%2026-08-07Fix
CVE-2026-54205TeamDavid: Server-side request forgery (SSRF) via pathname parameter in link storing functionality6.3CNA v4.00.5%2026-08-07Fix
CVE-2026-54204TeamDavid: Server-side request forgery (SSRF) via pathnameroot parameter in search functionality7.7CNA v4.00.6%2026-08-07Fix
CVE-2026-54203TeamDavid: Memory leak leaking sensitive information9.2CNA v4.00.6%2026-08-07Fix
CVE-2026-54202TeamDavid: Path traversal in the archive creation functionality8.5CNA v4.00.5%2026-08-07Fix
CVE-2026-54201TeamDavid: Missing authorization6.9CNA v4.00.6%2026-08-07Fix
CVE-2026-54200TeamDavid: Local file inclusion via the form field scjob8.4CNA v4.00.4%2026-08-07Fix
CVE-2026-54199TeamDavid: Header injection through request body in link storing functionality5.3CNA v4.00.4%2026-08-07Fix
CVE-2026-52880Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run7.5CNA v3.10.5%2026-08-07Fix
CVE-2026-52879Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS7.5CNA v3.10.5%2026-08-07Fix
CVE-2026-52878Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain7.5CNA v3.10.5%2026-08-07Fix
CVE-2026-50540kata-containers Kata Containers: Config Path Annotation arbitrary File Loading9.6CNA v3.10.6%2026-08-07Fix
CVE-2026-49746GPU DDK Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem7.1CISA ADP v3.10.2%2026-08-07Fix
CVE-2026-49343Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS5.9CNA v3.10.4%2026-08-07Fix
CVE-2026-49008Integrity‑check credential leakage vulnerability in an application function of ZTE F689 product6.5CNA v3.10.3%2026-08-07
CVE-2026-49007Information leakage vulnerability in ZTE F689 product7.5CNA v3.10.4%2026-08-07
CVE-2026-49006TLS credential leakage vulnerability in ZTE F689 product5.3CNA v3.10.2%2026-08-07
CVE-2026-49005Root password hash exposure vulnerability in ZTE F689 product2.4CNA v3.10.2%2026-08-07
CVE-2026-48170thomaspoignant scim-patch scimPatch vulnerable to prototype pollution via unfiltered keys in patch9.1CNA v3.10.4%2026-08-07Fix
CVE-2026-48169MervinPraison praisonai-platform PraisonAI has Cross-Workspace IDOR and privilege escalation8.8CNA v3.10.4%2026-08-07Fix
CVE-2026-48122Shopify Ruby LSP VS Code extension workspace settings OS command injection5.4CNA v4.00.2%2026-08-07Fix
CVE-2026-48120Kakoune has a critical RCE via Autorestore Backup Filename injection8.6CNA v3.10.2%2026-08-07Fix
CVE-2026-480980x5t4l1n NexTOR_IP_CHANGER NexTOR IP Changer Unsafely Uses sudo and shell=True7.3CNA v3.10.2%2026-08-07Fix
CVE-2026-48097NexTOR_IP_CHANGER has path injection leading to arbitrary command execution7.8CNA v3.10.2%2026-08-07Fix
CVE-2026-48094ShareOpenly has cross-site scripting (XSS) via Missing esc_url on Shared URL in Content Output5.3CNA v4.00.5%2026-08-07Fix
CVE-2026-48093Code Embed Contributor stored cross-site scripting via Remote URL Embed6.5CNA v3.10.3%2026-08-07Fix
CVE-2026-48047XWiki Platform vulnerable to potential arbitrary file writing using path traversal from admin5.9CNA v4.00.7%2026-08-07Fix
CVE-2026-48039Meta Ads MCP HTTP authentication middleware improper authentication9.1CNA v3.10.6%2026-08-07Fix
CVE-2026-48026lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML8.7CNA v3.10.4%2026-08-07Fix
CVE-2026-48007element-hq element-call element Call reports full URLs of visited pages to analytics server8.6CNA v4.00.3%2026-08-07Fix
CVE-2026-47664aehrc Pathling import-pnp operation server-side request forgery8.6CNA v4.00.2%2026-08-07Fix
CVE-2026-47663aehrc Pathling CRUD, search and batch providers improper authorization8.7CNA v4.00.4%2026-08-07Fix
CVE-2026-47662aehrc Pathling bulk-submit operation server-side request forgery8.7CNA v4.00.4%2026-08-07Fix
CVE-2026-47661Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read8.7CNA v4.00.6%2026-08-07Fix
CVE-2026-47660Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration8.7CNA v4.00.5%2026-08-07Fix
CVE-2026-47659Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF8.7CNA v4.00.6%2026-08-07Fix
CVE-2026-47364DataDog Android App crash6.5CISA ADP v3.10.4%2026-08-07Fix
CVE-2026-47363DataDog Android App improper export of Android application components6.3CISA ADP v3.10.2%2026-08-07Fix
CVE-2026-47362DataDog Android App insecure storage of sensitive information4.6CISA ADP v3.10.2%2026-08-07Fix
CVE-2026-47361DataDog Android App improper export of Android application components6.4CISA ADP v3.10.3%2026-08-07Fix
CVE-2026-47249Klever-Go KVM: Hash-array amplification in P2P resolver request handling7.5CNA v3.10.5%2026-08-07Fix
CVE-2026-47243kata-containers kata guest escape: Runtime-rs guest-root to host-root escape via virtiofs9.2CNA v4.00.2%2026-08-07Fix
CVE-2026-47127Ghostfolio has a Stripe subscription bypass6.5CNA v3.10.3%2026-08-07Fix
CVE-2026-46409OpenYak local API: Unauthenticated CSRF chain leads to remote code execution9.6CNA v3.10.3%2026-08-07Fix
CVE-2026-46405OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens5.3CNA v3.10.6%2026-08-07Fix
CVE-2026-46358OpenBao's Inline Auth incorrectly Redacted headers5.4CNA v4.00.2%2026-08-07Fix
CVE-2026-45808OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL7.1CNA v4.00.4%2026-08-07Fix
CVE-2026-45204Imagination Technologies Graphics DDK DmaTransfer null pointer dereference5.5CISA ADP v3.10.2%2026-08-07
CVE-2026-45198GPU DDK RGXFWIF_SYSINIT::sCorememDataStore is untrusted7.8CISA ADP v3.10.2%2026-08-07Fix
CVE-2026-44965DataDog Android App improper export of Android application components5.5CISA ADP v3.10.2%2026-08-07Fix
CVE-2026-44964DataDog Android App confused deputy6.5CISA ADP v3.10.3%2026-08-07Fix
CVE-2026-37171SuperTokens Core tenant isolation incorrect authorization5.9CNA v3.10.3%2026-08-07
CVE-2026-20348Cisco Secure Endpoint ClamAV XAR File Format Processing memory corruption7.5CNA v3.10.5%2026-08-07Fix
CVE-2026-20347Cisco Secure Endpoint ClamAV Mach-O File Format Processing memory corruption7.5CNA v3.10.5%2026-08-07Fix
CVE-2026-20346Cisco Secure Endpoint ClamAV PDF File Format Processing memory corruption7.5CNA v3.10.4%2026-08-07Fix
CVE-2026-20345Cisco Secure Endpoint ClamAV GPT File Format Processing memory corruption7.5CNA v3.10.5%2026-08-07Fix
CVE-2026-20339Cisco Secure Endpoint ClamAV PESpin File Format Processing integer overflow7.5CNA v3.10.5%2026-08-07Fix
CVE-2026-20338Cisco Secure Endpoint ClamAV ZIP File Format Processing memory corruption7.5CNA v3.10.5%2026-08-07Fix
CVE-2026-20337Cisco Secure Endpoint ClamAV ZIP File Format Processing memory corruption7.5CNA v3.10.5%2026-08-07Fix
CVE-2026-19264gitroomhq postiz-app unauthenticated arbitrary file read9.3CNA v4.01.0%2026-08-07Fix
CVE-2026-19246nanobot image download handler server-side request forgery5.3CNA v4.00.4%2026-08-07
CVE-2026-19245HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure4.8CNA v4.00.2%2026-08-07Fix
CVE-2026-19244HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control5.1CNA v4.00.5%2026-08-07Fix
CVE-2026-19243HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection5.3CNA v4.02.3%2026-08-07Fix
CVE-2026-19231SourceCodester Simple Doctors Appointment System ajax.php delete_appointment SQL injection6.9CNA v4.00.4%2026-08-07
CVE-2026-19230SourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross-site scripting5.1CNA v4.00.3%2026-08-07
CVE-2026-19229SourceCodester Online Clothing Store Dreamweaver Metadata files _notes file information disclosure6.9CNA v4.00.6%2026-08-07
CVE-2026-19213WonderTrader Pending Order TraderAdapter.h _undone_qty behavioral workflow5.3CNA v4.00.4%2026-08-07
CVE-2026-19212WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable5.3CNA v4.00.5%2026-08-07
CVE-2026-19211SourceCodester Photo Share Website ajax.php signup SQL injection6.9CNA v4.00.4%2026-08-07
CVE-2026-19210SourceCodester Photo Share Website ajax.php save_upload unrestricted upload5.3CNA v4.00.4%2026-08-07
CVE-2026-19209SourceCodester Photo Share Website index.php home cross-site scripting5.1CNA v4.00.3%2026-08-07
CVE-2026-19208WonderTrader TraderDD.cpp queryTrades behavioral workflow6.3CNA v4.00.4%2026-08-07
CVE-2026-19207PHPGurukul Company Visitor Management System manage-newvisitors.php cross-site scripting4.8CNA v4.00.4%2026-08-07
CVE-2026-19206MZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflow4.8CNA v4.00.2%2026-08-07Fix
CVE-2026-19196SourceCodester Photo Share Website ajax.php login SQL injection6.9CNA v4.00.4%2026-08-07
CVE-2026-19195V-Secure Jingyun Antivirus Kernel Driver ZyArk.sys access control8.5CNA v4.00.2%2026-08-07Exploit code
CVE-2026-19193JiangMin Antivirus Minifilter Port kvcore.sys MessageNotifyCallback access control8.5CNA v4.00.2%2026-08-07Exploit code
CVE-2026-19192DeepCool DisplayService DeepCoolDisplayService.exe access control8.5CNA v4.00.2%2026-08-07
CVE-2026-19191StableBit DrivePool DrivePoolService DrivePool.Service.exe permission8.5CNA v4.00.2%2026-08-07
CVE-2026-19190StableBit Scanner ScannerService Scanner.Service.exe permission8.5CNA v4.00.2%2026-08-07
CVE-2026-19189Power Sofware PowerISO Kernel driver scdemu.sys privileges management8.5CNA v4.00.2%2026-08-07
CVE-2026-19113HashiCorp Consul unauthenticated denial of service via unbounded request body processing5.3CNA v3.10.4%2026-08-07Fix
CVE-2026-19082TONYC Imager EXIF tag parser out-of-bounds read7.5CISA ADP v3.10.5%2026-08-07Fix
CVE-2026-19079Red Hat Enterprise Linux policycoreutils fixfiles script race condition4.4CNA v3.10.1%2026-08-07Fix
CVE-2026-19017Consul vulnerable to partial arbitrary file read via Vault Connect CA provider6.8CNA v3.10.5%2026-08-07Fix
CVE-2026-19016HashiCorp Consul authorization bypass for session deletion in the transaction API4.2CNA v3.10.3%2026-08-07Fix
CVE-2026-19015Uncontrolled resource consumption in the Consul Connect CA roots endpoint5.3CNA v3.10.4%2026-08-07Fix
CVE-2026-19014Uncontrolled resource consumption in the Consul Connect authorization endpoint4.3CNA v3.10.4%2026-08-07Fix
CVE-2026-19012Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path5.3CNA v3.10.3%2026-08-07Fix
CVE-2026-18938p11-kit RPC attribute-array length calculation integer overflow6.2CNA v3.10.2%2026-08-07Fix
CVE-2026-18497The nothings stb TrueType library contains a heap buffer overflow7.1CISA ADP v3.10.2%2026-08-07Fix
CVE-2026-17603Nexus Repository 3 HikariCP connectionInitSql injection RCE via DataStore Configuration API8.7CNA v4.00.5%2026-08-07Fix
CVE-2026-17601Nexus Repository 3 Wildcard Privilege Update Self-Escalation to Administrator8.9CNA v4.00.3%2026-08-07Fix
CVE-2026-17600Nexus Repository 3 Session not Invalidated on User Account Deletion or Deactivation8.7CNA v4.00.2%2026-08-07Fix
CVE-2026-17599Nexus Repository 3 Unverified Onboarding State on change-admin-password endpoint6.9CNA v4.00.3%2026-08-07Fix
CVE-2026-17598Nexus Repository 3 improper input validation in Scheduled Task Configuration5.3CNA v4.00.2%2026-08-07Fix
CVE-2026-17597Nexus Repository 3 server-side request forgery via Email Configuration Verification5.1CNA v4.00.2%2026-08-07Fix
CVE-2026-17596Nexus Repository 3 stored cross-site scripting (XSS) via Blob Store Name6.3CNA v4.00.2%2026-08-07Fix
CVE-2026-17595Nexus Repository 3 JEXL Content Selector Sandbox Property-Read Bypass5.3CNA v4.00.2%2026-08-07Fix
CVE-2026-17594Nexus Repository 3 authorization bypass in Repository Creation8.2CNA v4.00.7%2026-08-07NucleiFix
CVE-2026-17593Nexus Repository arbitrary Class Instantiation via Unsafe Realm Configuration7.2CNA v4.00.8%2026-08-07Fix
CVE-2026-17435File::Rotate::Simple versions for Perl create the target of dangling symlinks when rotating files2.5CISA ADP v3.10.1%2026-08-07Fix
CVE-2026-16637OPeNDAP Hyrax SSRF and credential disclosure via Unvalidated Redirects6.5CISA ADP v3.10.5%2026-08-07Fix
CVE-2026-16265WP Maps WordPress plugin Subscriber+ denial of service6.5CISA ADP v3.10.4%2026-08-07Fix
CVE-2026-16263WP Maps WordPress plugin Subscriber+ local file inclusion8.8CISA ADP v3.10.5%2026-08-07Reported exploitedFix
CVE-2026-16262Estatik WordPress plugin login CSRF7.5CISA ADP v3.10.2%2026-08-07Fix
CVE-2026-16258Ajax Search Lite WordPress plugin unauthenticated PHP object injection9.8CISA ADP v3.10.8%2026-08-07Fix
CVE-2026-16041MStore API WordPress plugin unauthenticated Product Review creation7.5CISA ADP v3.10.4%2026-08-07Fix
CVE-2026-16039MStore API vendor orders endpoint insecure direct object reference6.5CISA ADP v3.10.3%2026-08-07Fix
CVE-2026-16038MStore API WordPress plugin unauthenticated Payment bypass via Multiple Payment Gateways9.1CISA ADP v3.10.4%2026-08-07Fix
CVE-2026-16030MStore API for WordPress unauthenticated account takeover via Firebase Phone authentication8.1CISA ADP v3.10.4%2026-08-07Fix
CVE-2026-16027Unauthenticated WebSocket-to-XAdES SSRF in Revenue Administration's E-Signature5.4CNA v3.10.2%2026-08-07Fix
CVE-2026-15972HashiCorp Consul unauthenticated denial of service via unbounded external gRPC connection acceptance7.5CNA v3.10.5%2026-08-07Fix
CVE-2026-15970HashiCorp Consul L7 intention authorization bypass via custom public listener4.2CNA v3.10.2%2026-08-07Fix
CVE-2026-15816Red Hat Enterprise Linux 10 dracut: Dracut: Root code execution7.5CNA v3.10.4%2026-08-07Fix
CVE-2026-15570Vestel Telefunken TE24553B45V2DZ Smart TV browserseturl server-side request forgery7.1CNA v4.00.3%2026-08-07Fix
CVE-2026-15386Meow Gallery WordPress plugin Author+ stored XSS via Attachment Alt-Text5.4CISA ADP v3.10.2%2026-08-07Fix
CVE-2026-15361Content Views WordPress plugin Subscriber+ SQL injection via preview_request8.1CISA ADP v3.10.4%2026-08-07Fix
CVE-2026-15359Templately WordPress plugin unauthenticated Administrator Templately Cloud Connection Overwrite6.5CISA ADP v3.10.3%2026-08-07Fix
CVE-2026-15245BNE Testimonials WordPress plugin Contributor+ stored XSS via Slider shortcode5.4CISA ADP v3.10.2%2026-08-07Fix
CVE-2026-15239Simple CAPTCHA with Cloudflare Turnstile insufficient verification of data authenticity5.3CNA v3.10.2%2026-08-07Fix
CVE-2026-15215Subscriptions for WooCommerce WordPress plugin Shop Manager+ arbitrary plugin installation8.8CISA ADP v3.10.6%2026-08-07Fix
CVE-2026-15214Subscriptions for WooCommerce WordPress plugin Subscriber+ Subscription Detail disclosure via IDOR4.3CISA ADP v3.10.3%2026-08-07Fix
CVE-2026-15211Subscriptions for WooCommerce insufficient verification of data authenticity5.9CNA v3.10.2%2026-08-07Fix
CVE-2026-15148WP Events Manager WordPress plugin unauthenticated Payment bypass and Booking Status update via IDOR5.3CNA v3.10.2%2026-08-07Fix
CVE-2026-15032Comments plugin for WordPress image URL field stored cross-site scripting6.1CISA ADP v3.10.3%2026-08-07Fix
CVE-2026-14943Password Protected WordPress plugin unauthenticated sensitive information exposure via REST API7.5CISA ADP v3.10.4%2026-08-07Fix
CVE-2026-14644Nexus Repository 3 privilege escalation8.6CNA v4.00.3%2026-08-07Fix
CVE-2026-14365TrueBooker WordPress plugin missing authorization unauthenticated arbitrary password reset9.8CNA v3.10.6%2026-08-07Fix
CVE-2026-14364TrueBooker WordPress plugin missing authorization unauthenticated arbitrary password reset9.8CNA v3.10.5%2026-08-07Fix
CVE-2026-14331Subscribe2 WordPress plugin reflected XSS via email parameter6.1CISA ADP v3.10.3%2026-08-07Fix
CVE-2026-14205WP Events Manager WordPress plugin Subscriber+ Payment bypass via qty parameter9.8CISA ADP v3.10.5%2026-08-07Fix
CVE-2026-12801Ultra Addons for Contact Form 7 WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-08-07Fix
CVE-2026-12261Improper access control in nltk/nltk6.5v3.10.2%2026-08-07Fix
CVE-2026-12071TeamDavid: Header injection leading to open redirect via URL-encoded characters5.3CNA v4.00.5%2026-08-07Fix
CVE-2026-12070TeamDavid: Arbitrary file deletion via form field scjob8.4CNA v4.00.4%2026-08-07Fix
CVE-2026-11907Stream WordPress plugin missing authorization authenticated sensitive information disclosure6.5CNA v3.10.4%2026-08-07Reported exploitedFix
CVE-2026-11743Zephyr SF32LB QSPI NOR flash driver out-of-bounds read6.6CNA v3.10.2%2026-08-07Fix
CVE-2026-11742zephyrproject zephyr use-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlock3.6CNA v3.10.1%2026-08-07Fix
CVE-2026-11430Grav CMS Scheduler Webhook authentication bypass via Null Short-Circuit6.9CNA v4.01.0%2026-08-07Fix
CVE-2026-11425Domoticz Mobile Dashboard versions stored XSS via Text/Alert Device Rendering2.0CNA v4.00.3%2026-08-07Fix
CVE-2026-9169LUCID Vision Labs: DLL search order hijacking in Arena SDK on Windows8.8CNA v3.10.2%2026-08-07
CVE-2026-9031Authenticated denial of service in HTTPD service in TP-Link Archer A66.8CNA v4.00.3%2026-08-07Fix
CVE-2026-9030Authenticated denial of service in HTTPD service in TP-Link Archer A66.8CNA v4.00.2%2026-08-07Fix
CVE-2026-71555PILOS: Reverse tabnabbing in room description4.1CNA v3.10.3%2026-08-06Fix
CVE-2026-71554python-hyper h2 HTTP request smuggling5.3CNA v3.10.4%2026-08-06Exploit codeFix
CVE-2026-71502Unauthenticated Stored Vue template injection leads to cross-site scripting in CTI-Transmute5.1CNA v4.00.7%2026-08-06
CVE-2026-71498node-re2 buffer decoding out-of-bounds read5.1CNA v3.10.2%2026-08-06Fix
CVE-2026-71497jsoup HTML cleaner cross-site scripting4.7CNA v3.10.3%2026-08-06Fix
CVE-2026-71488League/commonmark: Quadratic-time denial of service when parsing crafted Markdown7.5CNA v3.10.6%2026-08-06Fix
CVE-2026-71478League/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes6.1CNA v3.10.4%2026-08-06Fix
CVE-2026-71476Nx: Zip-Slip in the self-hosted remote cache8.7CNA v4.00.9%2026-08-06Fix
CVE-2026-71447ail framework stored cross-site scripting in Chat and Forum Translation Controls in ail-framework6.9CNA v4.00.4%2026-08-06
CVE-2026-71446Stored cross-site scripting in AIL Framework Domain Screenshot view6.9CNA v4.00.4%2026-08-06
CVE-2026-71445ail framework authenticated reflected cross-site scripting in Tag Error Responses in ail-framework8.2CNA v4.00.4%2026-08-06
CVE-2026-71439Mermaid radar diagrams are vulnerable to DoS5.3CNA v4.00.5%2026-08-06Fix
CVE-2026-71438Mermaid configuration APIs allow prototype pollution2.4CNA v4.00.4%2026-08-06Fix
CVE-2026-71437Mermaid Architecture diagrams are vulnerable to prototype pollution6.5CNA v4.00.5%2026-08-06Fix
CVE-2026-71436Mermaid XY Charts are vulnerable to an infinite loop DoS5.3CNA v4.00.6%2026-08-06Fix
CVE-2026-71435Statamic: Stored cross-site scripting in Automagic Form Notification Email template6.1CNA v3.10.3%2026-08-06Fix
CVE-2026-71434Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types5.3CNA v3.10.4%2026-08-06Fix
CVE-2026-71433LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores5.3CNA v3.10.4%2026-08-06Fix
CVE-2026-71430uhop node-re2 string replace denial of service6.2CNA v3.10.2%2026-08-06Fix
CVE-2026-71327Traefik: Gateway API route identity collision allows cross-namespace backend hijacking7.6CNA v4.00.5%2026-08-06Fix
CVE-2026-71326Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing2.1CNA v4.00.3%2026-08-06Fix
CVE-2026-71325Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef4.8CNA v4.00.2%2026-08-06Fix
CVE-2026-71324Traefik CONNECT proxying HTTP request smuggling7.0CNA v4.01.1%2026-08-06Fix
CVE-2026-70646aiosend webhook handler denial of service7.5CNA v3.10.6%2026-08-06Fix
CVE-2026-70640llama.cpp b1886-b7445 race condition use-after-free via llama-android.cpp7.3CNA v4.00.2%2026-08-06Fix
CVE-2026-70639llama.cpp b1886-b7445 null pointer dereference DoS via llama-android.cpp6.8CNA v4.00.2%2026-08-06Fix
CVE-2026-70638llama.cpp b1886-b7445 integer overflow via new_1batch in llama-android.cpp8.5CNA v4.00.2%2026-08-06Fix
CVE-2026-70637LightFTP data race Condition via ABOR command in ftpserv.c8.2CNA v4.00.4%2026-08-06
CVE-2026-70636Flowise authentication bypass via OAuth2 Credential Refresh endpoint8.7CNA v4.00.7%2026-08-06
CVE-2026-70635TimescaleDB out-of-bounds read DoS via Bulk Dictionary Decompression Negative Index7.1v3.10.4%2026-08-06Fix
CVE-2026-70634TimescaleDB out-of-bounds read information disclosure via Dictionary Compression Reverse Iterator7.2CNA v4.00.5%2026-08-06Fix
CVE-2026-70633TimescaleDB out-of-bounds read DoS via Gorilla Compression Reverse Iterator7.1CNA v4.00.5%2026-08-06Fix
CVE-2026-70632FFmpeg heap out-of-bounds write in CFHD Decoder via AVI Demuxing8.5CNA v4.00.2%2026-08-06Fix
CVE-2026-70631FFmpeg uninitialized heap Memory Read in TIFF Decoder6.8CNA v4.00.2%2026-08-06Fix
CVE-2026-70630FFmpeg uninitialized heap Memory Read in Screenpresso Decoder6.8CNA v4.00.2%2026-08-06Fix
CVE-2026-70629FFmpeg uninitialized heap Memory Read in RSCC Decoder6.8CNA v4.00.2%2026-08-06Fix
CVE-2026-70628FFmpeg DVB Subtitle parser heap buffer overflow via WTV file8.5CNA v4.00.1%2026-08-06Fix
CVE-2026-70559Dinky Unauthenticated System Configuration and credential disclosure via GET /API/sysConfig/getAll8.7CNA v4.00.5%2026-08-06Exploit codeFix
CVE-2026-70558Dinky Unauthenticated arbitrary file write9.3CNA v4.00.8%2026-08-06Fix
CVE-2026-70557diboot-core load-related-data endpoint information disclosure7.1CNA v4.00.4%2026-08-06
CVE-2026-70556Hubzilla version CSRF via OAuth2 /authorize Endpoint App Registration5.1CNA v4.00.2%2026-08-06Fix
CVE-2026-70332Microsoft Office SharePoint spoofing9.6CNA v3.10.9%2026-08-06Fix
CVE-2026-68823Microsoft Azure Confidential Ledger remote code execution9.1CNA v3.10.9%2026-08-06Fix
CVE-2026-68750rrrene html_sanitize_ex traversal engine algorithmic complexity8.2CNA v4.00.8%2026-08-06Fix
CVE-2026-68749rrrene html_sanitize_ex CSS scrubber regular expression denial of service8.2CNA v4.00.8%2026-08-06Fix
CVE-2026-68747CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input2.3CNA v4.00.4%2026-08-06Fix
CVE-2026-68481Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider7.5CISA ADP v3.10.7%2026-08-06Fix
CVE-2026-68480Linux kernel x86 Safe-RET speculative return mitigation information disclosure–0.2%2026-08-06Fix
CVE-2026-68079Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay9.8CISA ADP v3.10.7%2026-08-06Fix
CVE-2026-67689FineAdmin V1.0 SQL injection9.8CISA ADP v3.10.8%2026-08-06
CVE-2026-67688ICS-Park Smart Park Management System file upload module unrestricted file upload9.8CISA ADP v3.10.9%2026-08-06
CVE-2026-67687ics-park v.2.0 insecure permissions8.8CISA ADP v3.10.5%2026-08-06Exploit code
CVE-2026-67622Flowise IDOR in OpenAI Assistants Integration8.5CNA v4.00.5%2026-08-06
CVE-2026-67621Flowise missing authorization on Document Store Mutation endpoints7.2CNA v4.00.4%2026-08-06
CVE-2026-67434PHP_CodeSniffer gitblame report command injection via crafted filename7.3CNA v4.01.1%2026-08-06Fix
CVE-2026-67422pymdown-extensions inline processors regular expression denial of service7.5CNA v3.10.6%2026-08-06Fix
CVE-2026-67261Dell Virtual Storage Integrator for VMware vSphere Client OS command injection9.8CNA v3.12.3%2026-08-06Fix
CVE-2026-66909Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage9.8CISA ADP v3.11.1%2026-08-06Fix
CVE-2026-66843rrrene html_sanitize_ex HTML5 scrubber inclusion of untrusted functionality2.3CNA v4.00.5%2026-08-06Fix
CVE-2026-66829rrrene html_sanitize_ex HTML5 scrubber open redirect2.3CNA v4.00.6%2026-08-06Fix
CVE-2026-66733Eukaryot sonic3air Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCache8.7CNA v4.01.6%2026-08-06
CVE-2026-66732Eukaryot sonic3air Sonic 3 A.I.R. Missing Source Address Validation in ConnectionManager8.3CNA v4.00.2%2026-08-06
CVE-2026-66712Simple Membership WordPress plugin broken access control7.5CNA v3.10.3%2026-08-06Fix
CVE-2026-66711WooCommerce Multilingual and Multicurrency WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-66710e2pdf WordPress plugin local file inclusion8.1CNA v3.10.5%2026-08-06Fix
CVE-2026-66709CTX Feed WordPress plugin remote code execution (RCE)9.1CNA v3.10.8%2026-08-06Fix
CVE-2026-66708Total Upkeep WordPress plugin broken access control8.2CNA v3.10.4%2026-08-06Fix
CVE-2026-66707Facebook for WooCommerce WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-66706Subscribe to Comments WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2026-08-06
CVE-2026-66705Facebook for WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-66703MailOptin WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-08-06Fix
CVE-2026-66702Rank Math SEO WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-66701Profile Builder WordPress plugin broken access control5.3CNA v3.10.3%2026-08-06Fix
CVE-2026-66699Dokan WordPress plugin broken access control5.3CNA v3.10.3%2026-08-06Fix
CVE-2026-66696Gutenberg Blocks by Kadence Blocks WordPress plugin sensitive data exposure4.3CNA v3.10.3%2026-08-06Fix
CVE-2026-66695W3 Total Cache WordPress plugin path traversal6.5CNA v3.10.4%2026-08-06Fix
CVE-2026-66694Thrive Architect WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-66692Colissimo Officiel pour WooCommerce insecure direct object reference4.3CNA v3.10.3%2026-08-06Fix
CVE-2026-66690GiveWP WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-66688Ultimate Addons for Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-08-06Fix
CVE-2026-66686Plugins Garbage Collector (Database Cleanup) WordPress plugin cross-site request forgery (CSRF)6.5CNA v3.10.2%2026-08-06Fix
CVE-2026-66685Featured Video Plus WordPress plugin sensitive data exposure5.3CNA v3.10.3%2026-08-06
CVE-2026-66684Export Import Menus WordPress plugin sensitive data exposure5.3CNA v3.10.3%2026-08-06
CVE-2026-66683Custom CSS and JavaScript WordPress plugin sensitive data exposure5.3CNA v3.10.3%2026-08-06
CVE-2026-66681theme My Login WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2026-08-06Fix
CVE-2026-66678Advanced Custom Fields: Font Awesome Field WordPress plugin broken access control4.3CNA v3.10.3%2026-08-06Fix
CVE-2026-66665Type Hub WordPress plugin arbitrary file upload10.0CNA v3.10.5%2026-08-06Reported exploited
CVE-2026-66664SEO plugin by Squirrly SEO WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-66663WP Data Access WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-66662Frontend Admin by DynamiApps WordPress plugin privilege escalation9.8CNA v3.10.5%2026-08-06Fix
CVE-2026-66470Frontend Admin by DynamiApps WordPress plugin broken access control7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-66457Events Manager WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Reported exploitedFix
CVE-2026-66452Legal Text Connector of the IT-Recht Kanzlei WordPress plugin broken access control6.5CNA v3.10.3%2026-08-06Fix
CVE-2026-66451WP Event SOlution WordPress plugin broken authentication6.5CNA v3.10.3%2026-08-06Fix
CVE-2026-66447WordPress File Upload plugin SQL injection9.3CNA v3.10.4%2026-08-06Fix
CVE-2026-66440WPIDE File Manager and Code Editor WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-66439Advanced AJAX Product Filters WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Reported exploitedFix
CVE-2026-66425Gutena Forms WordPress plugin Unauthenticated improper authentication6.5CNA v3.10.4%2026-08-06Fix
CVE-2026-66370rrrene html_sanitize_ex HTML5 scrubber open redirect4.8CNA v4.00.4%2026-08-06Fix
CVE-2026-65668Microsoft Purview eDiscovery elevation of privilege8.8CNA v3.10.8%2026-08-06Fix
CVE-2026-65667Microsoft Teams elevation of privilege10.0CNA v3.10.8%2026-08-06Fix
CVE-2026-65583Apache CXF: Self-issued ID token claims validation skipped9.1CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-65581AI ANN WordPress theme PHP object injection9.8CNA v3.10.6%2026-08-06
CVE-2026-65579Agricola WordPress theme PHP object injection9.8CNA v3.10.6%2026-08-06
CVE-2026-65578Agora WordPress theme PHP object injection9.8CNA v3.10.6%2026-08-06
CVE-2026-65577Advice WordPress theme PHP object injection9.8CNA v3.10.6%2026-08-06
CVE-2026-65576Adrena WordPress theme PHP object injection9.8CNA v3.10.6%2026-08-06
CVE-2026-65575Accalia WordPress theme PHP object injection9.8CNA v3.10.6%2026-08-06
CVE-2026-65574Abogado WordPress theme PHP object injection9.8CNA v3.10.6%2026-08-06
CVE-2026-65573Abelle WordPress theme PHP object injection9.8CNA v3.10.6%2026-08-06
CVE-2026-65572A.Williams WordPress plugin PHP object injection9.8CNA v3.10.6%2026-08-06
CVE-2026-6557169 Clothing WordPress theme PHP object injection9.8CNA v3.10.6%2026-08-06
CVE-2026-65570Login with phone number WordPress plugin bypass vulnerability vulnerability8.1CNA v3.10.4%2026-08-06Fix
CVE-2026-65569WP Job Portal WordPress plugin SQL injection8.5CNA v3.10.4%2026-08-06Fix
CVE-2026-65565Survey Maker WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-65560Houzez Property Feed WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-65559Order Delivery Date for WooCommerce WordPress plugin privilege escalation7.2CNA v3.10.5%2026-08-06Fix
CVE-2026-65556MihChe WPBruiser PHP object injection9.8CNA v3.10.6%2026-08-06Fix
CVE-2026-65554AnsPress Question and answer WordPress plugin broken access control7.1CNA v3.10.3%2026-08-06
CVE-2026-65553Spider Analyser WordPress搜索引擎蜘蛛分析插件 WordPress plugin remote code execution (RCE)10.0CNA v3.10.9%2026-08-06
CVE-2026-65552Export User Data WordPress plugin PHP object injection9.8CNA v3.10.6%2026-08-06
CVE-2026-65551Breakdance WordPress plugin broken access control7.5CNA v3.10.4%2026-08-06Fix
CVE-2026-65549Jeg Elementor Kit WordPress plugin PHP object injection7.2CNA v3.10.5%2026-08-06Fix
CVE-2026-65548Betheme WordPress theme remote code execution (RCE)9.9CNA v3.10.8%2026-08-06Fix
CVE-2026-65547Creative Mail WordPress plugin SQL injection8.5CNA v3.10.4%2026-08-06
CVE-2026-65546Qode Tours WordPress plugin SQL injection9.3CNA v3.10.4%2026-08-06
CVE-2026-65545AI Engine WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-65544Super Socializer WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06
CVE-2026-65543Vimeo WordPress plugin sensitive data exposure7.5CNA v3.10.4%2026-08-06
CVE-2026-65542Super Socializer WordPress plugin broken authentication8.8CNA v3.10.5%2026-08-06
CVE-2026-65541Staff Training WordPress plugin broken access control7.3CNA v3.10.3%2026-08-06
CVE-2026-65523ApproveMe Formidable Forms Signature Online Contract Automation insecure direct object reference7.5CNA v3.10.4%2026-08-06Fix
CVE-2026-65520WP OAuth Server WordPress plugin SQL injection9.3CNA v3.10.4%2026-08-06Fix
CVE-2026-65517Easy PayPal Buy Now Button WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-65515AffiliateWP WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-65513Simply Schedule Appointments WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-65509wpDataTables WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-65508Simply Schedule Appointments WordPress plugin SQL injection9.3CNA v3.10.4%2026-08-06Fix
CVE-2026-65507AIWU WordPress plugin privilege escalation9.8CNA v3.10.5%2026-08-06Fix
CVE-2026-65504BOX NOW Delivery Croatia WordPress plugin broken access control7.5CNA v3.10.4%2026-08-06Fix
CVE-2026-65502Element Pack Elementor Addons WordPress plugin Captcha bypass vulnerability5.3CNA v3.10.3%2026-08-06Fix
CVE-2026-65432Apache CXF: XXE via WSDL/XSD import parsing7.5CISA ADP v3.10.7%2026-08-06Fix
CVE-2026-65400Apple macOS improper authentication9.8CISA ADP v3.11.7%2026-08-06KEVExploit codeFix
CVE-2026-64993Dell RVTools improper certificate validation6.8CNA v3.10.2%2026-08-06Fix
CVE-2026-64958Apache CXF: Denial of service via message header attachments7.5CISA ADP v3.10.7%2026-08-06Fix
CVE-2026-64677Anki's local HTTP server is vulnerable to directory traversal attacks5.9CNA v4.01.0%2026-08-06
CVE-2026-64665Statamic: Account takeover via OAuth email matching without email-verification check8.1CNA v3.10.5%2026-08-06Fix
CVE-2026-64664Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence4.3CNA v3.10.3%2026-08-06Fix
CVE-2026-64663Statamic: Unsafe method invocation via Antlers template resolution allows data destruction6.5CNA v3.10.4%2026-08-06Fix
CVE-2026-64662Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries6.5CNA v3.10.4%2026-08-06Fix
CVE-2026-64655GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching2.1CNA v4.00.3%2026-08-06Fix
CVE-2026-64654GitHub CLI: Terminal escape sequence injection in multiple `gh` commands5.3CNA v4.00.8%2026-08-06Fix
CVE-2026-64653GitHub CLI: Unescaped variable components in request URLs could allow path traversal5.1CNA v4.00.5%2026-08-06Fix
CVE-2026-64652GitHub CLI: Partial token disclosure in `gh auth status` output3.3CNA v3.10.2%2026-08-06Fix
CVE-2026-64640Apache Polaris table and view registration incorrect authorization5.3CNA v4.00.5%2026-08-06Exploit codeFix
CVE-2026-64604Linux kernel KVM VMX CR8 interception vulnerability–0.2%2026-08-06Fix
CVE-2026-64603Linux kernel intel-hid ACPI notify handler null pointer dereference–0.2%2026-08-06Fix
CVE-2026-64602Linux kernel spear ADC driver vulnerability–0.2%2026-08-06Fix
CVE-2026-64601Linux kernel us144mkii USB audio driver use-after-free7.8CNA v3.10.2%2026-08-06Fix
CVE-2026-64599Linux kernel Amlogic crypto driver double free7.8CNA v3.10.1%2026-08-06Fix
CVE-2026-64598Linux kernel SMB2 AEAD request allocation vulnerability8.8CNA v3.10.3%2026-08-06Fix
CVE-2026-64597Linux kernel SMB2 close replay handling double free9.8CNA v3.10.4%2026-08-06Fix
CVE-2026-64596Linux kernel pseudo filesystem execution restrictions vulnerability–0.2%2026-08-06Fix
CVE-2026-64595Linux kernel hid-lenovo-go driver vulnerability–0.2%2026-08-06Fix
CVE-2026-64594Linux kernel f_fs USB gadget driver improper initialization–0.2%2026-08-06Fix
CVE-2026-64593Linux kernel Btrfs device trim null pointer dereference–0.2%2026-08-06Fix
CVE-2026-64592Linux kernel RISC-V Svvptc fault handling denial of service–0.2%2026-08-06Fix
CVE-2026-64591Linux kernel Intel IOMMU driver vulnerability–0.2%2026-08-06Fix
CVE-2026-64590Linux kernel udmabuf vulnerability–0.2%2026-08-06Fix
CVE-2026-64589Linux kernel I2C core adapter registration null pointer dereference–0.2%2026-08-06Fix
CVE-2026-64588Linux kernel FUSE io_uring interface race condition7.8CNA v3.10.2%2026-08-06Fix
CVE-2026-64587Linux kernel ARC EMAC Ethernet driver race condition7.0CNA v3.10.2%2026-08-06Fix
CVE-2026-64586Linux kernel brcmfmac Wi-Fi driver vulnerability8.8CNA v3.10.2%2026-08-06Fix
CVE-2026-64585Linux kernel esd_usb CAN driver vulnerability7.8CNA v3.10.2%2026-08-06Fix
CVE-2026-64584Linux kernel f_midi USB gadget driver vulnerability7.8CNA v3.10.2%2026-08-06Fix
CVE-2026-64583Linux kernel Broadcom BDC USB gadget driver vulnerability7.8CNA v3.10.2%2026-08-06Fix
CVE-2026-63725sysPass FileBackupService authenticated OS command injection via Backup Path8.6CNA v4.00.4%2026-08-06
CVE-2026-63687Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters9.1CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-63637Dgraph: DQL injection via unvalidated regexp filter argument in GraphQL query rewriter8.6CNA v3.10.4%2026-08-06Fix
CVE-2026-63508Microsoft Planetary Computer Pro elevation of privilege10.0CNA v3.10.8%2026-08-06Fix
CVE-2026-62918Microsoft Teams spoofing7.5CNA v3.10.5%2026-08-06Fix
CVE-2026-62896Microsoft Teams elevation of privilege9.6CNA v3.10.7%2026-08-06Fix
CVE-2026-62873Microsoft 365 Admin Center elevation of privilege9.8CNA v3.10.6%2026-08-06Fix
CVE-2026-62857Fedify: Server-side request forgery in getNodeInfo allows Access to Internal Network Resources8.8CNA v4.00.4%2026-08-06Fix
CVE-2026-62836Microsoft Azure SQL Managed Instance elevation of privilege8.7CNA v3.10.6%2026-08-06Fix
CVE-2026-62830Microsoft Azure SRE Agent elevation of privilege9.9CNA v3.10.8%2026-08-06Fix
CVE-2026-61982SiteGuard WP WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-61964Ninja Tables WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-61963Media LIbrary Assistant WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-61961EmbedPress WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-61959Business Directory WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-08-06Fix
CVE-2026-61632PyMdown Extensions b64 extension path traversal5.3CNA v3.10.4%2026-08-06Fix
CVE-2026-61466Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation9.1CISA ADP v3.10.7%2026-08-06Fix
CVE-2026-59118Microsoft Copilot Cowork elevation of privilege9.3CNA v3.10.7%2026-08-06Fix
CVE-2026-59115Microsoft Entra Provisioning Service elevation of privilege9.9CNA v3.11.0%2026-08-06Fix
CVE-2026-57819Apache CXF: No default restriction on the amount of form parameters per message7.5CISA ADP v3.10.7%2026-08-06Fix
CVE-2026-57818Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider8.1CISA ADP v3.10.5%2026-08-06Fix
CVE-2026-57817Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow8.1CISA ADP v3.10.7%2026-08-06Fix
CVE-2026-56162Microsoft Azure SQL Database elevation of privilege10.0CNA v3.10.9%2026-08-06Fix
CVE-2026-56161Microsoft Azure Logic Apps information disclosure9.6CNA v3.10.7%2026-08-06Fix
CVE-2026-55980Denial of service vulnerability in CatchPulse5.5CNA v3.10.1%2026-08-06
CVE-2026-55979Improper access control check in CatchPulse's named pipe communication interface5.2CNA v3.10.1%2026-08-06
CVE-2026-55978Improper access control vulnerability in CatchPulse8.4CNA v3.10.1%2026-08-06
CVE-2026-54717Silverstripe: XSS in breadcrumbs in page list view5.4CNA v3.10.3%2026-08-06Fix
CVE-2026-54489Dell Virtual Storage Integrator for VMware vSphere Client session hijacking9.1CNA v3.10.6%2026-08-06Fix
CVE-2026-54225Apache CXF: Denial of service attack via large attachments7.5CISA ADP v3.10.7%2026-08-06Fix
CVE-2026-53985Ground Station Unauthenticated DoS via service_control Socket.IO8.7CNA v4.00.7%2026-08-06Fix
CVE-2026-53984Ground Station Unauthenticated Database Wipe and arbitrary data injection8.8CNA v4.00.7%2026-08-06Fix
CVE-2026-53983Ground Station Unauthenticated Persistent Blind server-side request forgery9.2CNA v4.00.6%2026-08-06Fix
CVE-2026-53977OpenChamber unauthenticated DoS via /API/system/shutdown8.7CNA v4.01.0%2026-08-06
CVE-2026-53976OpenChamber path traversal File Read via allowOutsideWorkspace parameter9.3CNA v4.02.6%2026-08-06Nuclei
CVE-2026-53975OpenChamber unauthenticated RCE via /API/fs/exec9.3CNA v4.01.7%2026-08-06
CVE-2026-50515Microsoft Azure Service Bus remote code execution9.9CNA v3.11.7%2026-08-06Fix
CVE-2026-50481Microsoft Azure Active Directory elevation of privilege9.9CNA v3.10.8%2026-08-06Fix
CVE-2026-50159Mermaid allows CSS injection applying to sibling elements of the diagram5.3CNA v4.00.6%2026-08-06Fix
CVE-2026-49391Frappe: Stored XSS in Column headers via Data Import5.1CNA v4.00.5%2026-08-06Fix
CVE-2026-49163Microsoft Application Insights Profiler elevation of privilege8.8CNA v3.11.0%2026-08-06Fix
CVE-2026-48088OpenReception appointment booking software staff encryption key registration missing authorization9.4CNA v3.10.4%2026-08-06Fix
CVE-2026-48087OpenReception appointment booking software WebAuthn registration authentication bypass9.8CNA v3.10.6%2026-08-06Fix
CVE-2026-48086OpenReception appointment booking software staff role update privilege escalation9.9CNA v3.10.4%2026-08-06Fix
CVE-2026-48085OpenReception appointment booking software admin account setup missing authorization9.8CNA v3.10.6%2026-08-06Fix
CVE-2026-48084OpenReception appointment booking software passphrase login vulnerability7.4CNA v3.10.4%2026-08-06Fix
CVE-2026-48083OpenReception appointment booking software log endpoint log injection6.5CNA v3.10.4%2026-08-06Fix
CVE-2026-48082OpenReception appointment booking software bootstrap challenge proof-of-work denial of service3.7CNA v3.10.4%2026-08-06Fix
CVE-2026-48081open-reception appointment-booking-software OpenReception vulnerable to stored click-triggered XSS8.1CNA v3.10.2%2026-08-06Fix
CVE-2026-48080OpenReception appointment booking software tenant detail endpoint information disclosure8.0CNA v3.10.5%2026-08-06Fix
CVE-2026-48079OpenReception appointment booking software logout flow insufficient session expiration7.4CNA v3.10.5%2026-08-06Fix
CVE-2026-48078OpenReception appointment booking software schedule endpoint information disclosure5.3CNA v3.10.3%2026-08-06Fix
CVE-2026-48077OpenReception appointment booking software appointment lookup endpoint missing authorization5.3CNA v3.10.4%2026-08-06Fix
CVE-2026-48076OpenReception appointment booking software bootstrap booking flow incorrect authorization6.5CNA v3.10.3%2026-08-06
CVE-2026-48075OpenReception appointment booking software add-to-tunnel endpoint missing authorization6.5CNA v3.10.4%2026-08-06Fix
CVE-2026-48074OpenReception appointment booking software staff deletion invite cleanup incorrect authorization2.7CNA v3.10.3%2026-08-06Fix
CVE-2026-48071OpenReception appointment booking software PIN challenge throttle vulnerability5.8CNA v3.10.4%2026-08-06Fix
CVE-2026-48054OpenZeppelin Contracts Wizard has code injection in Generated Hardhat and Foundry Tests8.8CNA v3.10.6%2026-08-06Fix
CVE-2026-47765Frappe: Lack of Permissions in restore/bulk_restore7.1CNA v4.00.5%2026-08-06Fix
CVE-2026-47194Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain8.6CNA v4.00.3%2026-08-06Fix
CVE-2026-47185Frappe has broken access control in its Workspace Save API5.1CNA v4.00.4%2026-08-06Fix
CVE-2026-45573Decidim: Push subscriptions can be abused for server-side requests6.4CNA v3.10.3%2026-08-06Fix
CVE-2026-45572Decidim: HTML content blocks allow stored script execution4.8CNA v3.10.3%2026-08-06Fix
CVE-2026-45415Decidim: CSV census record endpoints improper authorization6.0CNA v3.10.4%2026-08-06Fix
CVE-2026-45414Decidim: JWT-backed authentication can be replayed across organizations8.5CNA v3.10.5%2026-08-06Fix
CVE-2026-45378Decidim: Verification documents can be downloaded through reusable links7.5CNA v3.10.4%2026-08-06Fix
CVE-2026-43632llama.cpp b7492-b9060 use-after-free in Tokenization endpoints9.2CNA v4.00.5%2026-08-06Fix
CVE-2026-43631llama.cpp b7492-b9060 use-after-free RCE via llama-server9.2CNA v4.00.6%2026-08-06Fix
CVE-2026-43630llama.cpp b4882-b8487 out-of-bounds read information disclosure6.3CNA v4.00.5%2026-08-06Fix
CVE-2026-43629llama.cpp b4882-b9058 buffer overflow in KV Cache State Restore9.2CNA v4.00.7%2026-08-06Fix
CVE-2026-43628llama.cpp b3978-b9058 integer underflow via DRY Sampler8.5CNA v4.00.2%2026-08-06Fix
CVE-2026-43627llama.cpp b1283-b9058 integer overflow in llama_batch_init function8.5CNA v4.00.2%2026-08-06Fix
CVE-2026-43622llama.cpp b1886-b7445 double free via llama-android.cpp8.5CNA v4.00.2%2026-08-06Fix
CVE-2026-41861Arbitrary Root File Write via path traversal in BOSH agent4.2CNA v3.10.2%2026-08-06
CVE-2026-34502Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client7.5CISA ADP v3.10.5%2026-08-06Fix
CVE-2026-34501Apache Portable Runtime Utility: Heap buffer overflow in APR redis client7.5CISA ADP v3.10.5%2026-08-06Fix
CVE-2026-34191Apache Portable Runtime Utility: SQL injection in apr_dbd_oracle9.1CISA ADP v3.10.6%2026-08-06Fix
CVE-2026-32548SureCart WordPress plugin broken access control5.3CNA v3.10.3%2026-08-06Fix
CVE-2026-32469CAPTCHA 4WP WordPress plugin Captcha bypass vulnerability5.3CNA v3.10.3%2026-08-06Fix
CVE-2026-32327Apache Portable Runtime Utility: Apr-util XML stack recursion crash9.1CISA ADP v3.10.5%2026-08-06Fix
CVE-2026-28183PublishPress Capabilities WordPress plugin privilege escalation7.2CNA v3.10.5%2026-08-06Fix
CVE-2026-28180Mercado Pago payments for WooCommerce WordPress plugin insecure direct object references (IDOR)5.3CNA v3.10.3%2026-08-06Fix
CVE-2026-28179FiboSearch WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2026-08-06Fix
CVE-2026-28178Powerkit WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-08-06Fix
CVE-2026-28177Popup Maker WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-28172Tracking Code Manager WordPress plugin CSRF to stored XSS7.1CNA v3.10.1%2026-08-06Fix
CVE-2026-28169YITH WooCommerce Zoom Magnifier WordPress plugin sensitive data exposure5.3CNA v3.10.3%2026-08-06Fix
CVE-2026-28146Unlimited Elements For Elementor WordPress plugin arbitrary file download6.5CNA v3.10.4%2026-08-06Fix
CVE-2026-28143Forminator WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-28141NextGEN Gallery WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.5%2026-08-06NucleiFix
CVE-2026-28140JetFormBuilder WordPress plugin broken access control7.5CNA v3.10.3%2026-08-06Fix
CVE-2026-28139Ajax Search Lite WordPress plugin PHP object injection9.8CNA v3.10.6%2026-08-06Reported exploitedFix
CVE-2026-28111Forminator WordPress plugin privilege escalation8.8CNA v3.10.4%2026-08-06Fix
CVE-2026-28082JetEngine WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-06Fix
CVE-2026-28005Kadence WooCommerce Email Designer WordPress plugin privilege escalation9.8CNA v3.10.5%2026-08-06Fix
CVE-2026-25403Ultimate Store Kit Elementor Addons WordPress plugin broken access control6.5CNA v3.10.3%2026-08-06Fix
CVE-2026-19177Google Chrome sandbox escape8.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19176Google Chrome Skia use-after-free7.5CISA ADP v3.10.5%2026-08-06Fix
CVE-2026-19175Google Chrome Payments use-after-free9.6CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19174Google Chrome V8 integer overflow8.8CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-19173Google Chrome Skia out-of-bounds write8.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19172Google Chrome Views use-after-free8.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19171Google Chrome Media use-after-free9.6CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19170Google Chrome WebGL use-after-free9.6CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19169Google Chrome privilege escalation8.8CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19168Google Chrome V8 inappropriate implementation8.8CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-19167Google Chrome GPU integer overflow3.1CISA ADP v3.10.2%2026-08-06Fix
CVE-2026-19166Google Chrome Web Authentication use-after-free9.6CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-19165Google Chrome extensions use-after-free7.5CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19164Google Chrome sandbox escape9.6CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19163Google Chrome Media use-after-free8.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19162Google Chrome V8 out-of-bounds write8.8CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-19161Google Chrome uninitialized variable use3.1CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19160Google Chrome uninitialized variable use3.1CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-19159Google Chrome Views use-after-free7.5CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19158Google Chrome Views use-after-free7.5CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19157Google Chrome ANGLE out-of-bounds write9.6CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-19156Google Chrome Base heap-based buffer overflow7.5CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19155Google Chrome Payments use-after-free8.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19154Google Chrome Skia use-after-free8.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19153Google Chrome improper input validation8.1CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19152Google Chrome Navigation insufficient policy enforcement8.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19151Google Chrome V8 use-after-free8.8CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-19150Google Chrome V8 inappropriate implementation8.8CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-19149Google Chrome Aura use-after-free9.6CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19148Google Chrome GPU out-of-bounds write8.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19147Google Chrome Aura use-after-free8.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19146Google Chrome uninitialized variable use5.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19145Google Chrome Translate use-after-free8.8CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-19144Google Chrome HTML use-after-free8.8CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19143Google Chrome sandbox escape8.6CISA ADP v3.10.1%2026-08-06Fix
CVE-2026-19142Google Chrome Views use-after-free7.5CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19141Google Chrome Resources use-after-free8.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19140Google Chrome GPU use-after-free8.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19139Google Chrome race condition7.4CISA ADP v3.10.1%2026-08-06Fix
CVE-2026-19138Google Chrome CrashReporting heap-based buffer overflow8.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19137Google Chrome WebGL use-after-free8.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-19127Postiz lifetime-deal redemption codes vulnerability6.5CNA v3.10.3%2026-08-06Fix
CVE-2026-19111AWS strands-agents-tools mongodb_memory insecure direct object reference8.6CNA v4.00.5%2026-08-06Fix
CVE-2026-19110DataGear chart title rendering cross-site scripting4.8CNA v4.00.4%2026-08-06
CVE-2026-19108MZ Automation libiec61850 URCB revalidation use-after-free4.8CNA v4.00.2%2026-08-06Fix
CVE-2026-19071itsourcecode Hospital Management System viewappointment.php SQL injection5.3CNA v4.00.3%2026-08-06
CVE-2026-19070itsourcecode Hospital Management System viewadmin.php SQL injection5.3CNA v4.00.3%2026-08-06
CVE-2026-19069itsourcecode Hospital Management System treatmentrecord.php SQL injection5.3CNA v4.00.3%2026-08-06
CVE-2026-19068itsourcecode Hospital Management System treatmentdetail.php SQL injection5.3CNA v4.00.3%2026-08-06
CVE-2026-19067itsourcecode Hospital Management System treatment.php SQL injection5.3CNA v4.00.3%2026-08-06
CVE-2026-19066SourceCodester Online Examination and Learning Management System view_students.php authorization5.3CNA v4.00.4%2026-08-06
CVE-2026-19065SourceCodester Online Examination and Learning Management System unrestricted file upload5.3CNA v4.00.3%2026-08-06
CVE-2026-19064SourceCodester Online Examination and Learning Management System view.php authorization5.3CNA v4.00.4%2026-08-06
CVE-2026-19062chiuwingyan house selectall.action SQL injection6.9CNA v4.00.4%2026-08-06
CVE-2026-19061Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity6.3CNA v4.00.2%2026-08-06
CVE-2026-19060FoundationAgents MetaGPT code injection4.8CNA v4.00.2%2026-08-06
CVE-2026-19059FoundationAgents MetaGPT editor.py read path traversal4.8CNA v4.00.2%2026-08-06
CVE-2026-19058FoundationAgents MetaGPT data_interpreter.py DataInterpreter code injection4.8CNA v4.00.2%2026-08-06
CVE-2026-19054Lspace-io lspace-server Repositories File API repository.ts deleteFile path traversal4.8CNA v4.00.2%2026-08-06
CVE-2026-19047NocteDefensor LudusMCP ludus_cli_execute cliWrapper.ts executeCommand command injection4.8CNA v4.01.1%2026-08-06
CVE-2026-19046NocteDefensor LudusMCP environment guides search tool path traversal4.8CNA v4.00.2%2026-08-06
CVE-2026-19045NocteDefensor LudusMCP credential secret dialog command injection4.8CNA v4.01.1%2026-08-06
CVE-2026-19044LeeSinLiang godot-mcp create_scene/add_node index.ts executeOperation command injection4.8CNA v4.01.1%2026-08-06
CVE-2026-19041MissionSquad mcp-api NPM package install handler command injection5.3CNA v4.02.1%2026-08-06Fix
CVE-2026-19040MissionSquad mcp-api dcrClients.ts server-side request forgery5.3CNA v4.00.4%2026-08-06Fix
CVE-2026-19039Kino-Kafkaesque ssh-mcp-server SSH index.ts ssh_exec command injection4.8CNA v4.01.2%2026-08-06
CVE-2026-19038MonomythDevelopment la-forge-mcp screenshot_element tool index.ts screenshotElement path traversal5.3CNA v4.00.5%2026-08-06Fix
CVE-2026-19037WonderTrader Internal Limit Order Book Cache MatchEngine.cpp update_lob behavioral workflow5.3CNA v4.00.4%2026-08-06
CVE-2026-19036Shibby Tomato wanoptions sub_40F88C os command injection8.6CNA v4.03.2%2026-08-06
CVE-2026-19035Shibby Tomato qoslimit new_qoslimit_start os command injection8.6CNA v4.03.2%2026-08-06
CVE-2026-19034Shibby Tomato qoslimittc_stop.sh new_qoslimit_stop os command injection8.6CNA v4.03.2%2026-08-06
CVE-2026-19022OpenHands send_pull_request.py initialize_repo command injection5.3CNA v4.01.8%2026-08-06
CVE-2026-19021SourceCodester Computer Repair Shop Management System Master.php delete_product SQL injection6.9CNA v4.00.4%2026-08-06
CVE-2026-19020itsourcecode Hospital Management System servicetype.php SQL injection5.3CNA v4.00.3%2026-08-06
CVE-2026-19019poco-ai poco-agent Claude file workspace.py WorkspaceManager._setup_session_persistence cleanup6.3CNA v4.00.5%2026-08-06
CVE-2026-19011TinyAGI agents.ts buildSystemPrompt file inclusion6.9CNA v4.00.5%2026-08-06
CVE-2026-19010TinyAGI Message API endpoint index.ts processMessage authorization6.9CNA v4.00.5%2026-08-06
CVE-2026-19009TinyAGI Message API endpoint response.ts collectFiles file inclusion6.9CNA v4.00.5%2026-08-06
CVE-2026-19008mf-yang openclaw-cn apply_patch tool sandbox-paths.ts assertNoSymlinkEscape link following5.3CNA v4.00.4%2026-08-06
CVE-2026-19007mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management5.3CNA v4.00.4%2026-08-06
CVE-2026-19006mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization5.3CNA v4.00.4%2026-08-06
CVE-2026-19005nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management5.3CNA v4.00.4%2026-08-06
CVE-2026-19000JeecgBoot Anonymous Chat Attachment send server-side request forgery6.9CNA v4.00.5%2026-08-06
CVE-2026-18998cosmicstack-labs mercury-agent delegate_task tool sub-agent.ts SubAgent.run improper authorization5.3CNA v4.00.4%2026-08-06
CVE-2026-18997cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization5.3CNA v4.00.4%2026-08-06
CVE-2026-18996cosmicstack-labs mercury-agent run command handler incorrect privilege assignment5.3CNA v4.00.4%2026-08-06
CVE-2026-18995netease-youdao LobsterAI media path handler information disclosure5.3CNA v4.00.5%2026-08-06
CVE-2026-18993NousResearch hermes-agent Memory Toolset model_tools.py access control5.3CNA v4.00.4%2026-08-06
CVE-2026-18992zhayujie CowAgent Self-Evolution Review agent executor.py _select_tools authorization5.3CNA v4.00.4%2026-08-06
CVE-2026-18991nanocoai NanoClaw send_file core.ts path traversal6.9CNA v4.00.6%2026-08-06
CVE-2026-18990letta-ai LettaBot API Status route server.ts missing authentication6.9CNA v4.00.7%2026-08-06
CVE-2026-18980nearai ironclaw shell.rs classify_command_risk command injection5.3CNA v4.02.3%2026-08-06
CVE-2026-18976NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment5.3CNA v4.00.4%2026-08-06
CVE-2026-18974heshengtao super-agent-party execute_tool_manually endpoint information disclosure6.9CNA v4.00.5%2026-08-06
CVE-2026-18973heshengtao super-agent-party extension proxy route server-side request forgery6.9CNA v4.00.5%2026-08-06
CVE-2026-18967Red Hat Build of Keycloak SAML identity broker vulnerability6.4CNA v3.10.2%2026-08-06
CVE-2026-18915Exposure of OTP Secret through Process Command-Line arguments in TÜBİTAK BİLGEM's eta-otp-lock5.0CNA v3.10.1%2026-08-06Fix
CVE-2026-18909ELAN Microelectronics ELAN Smart-Pad stack-based buffer overflow5.6CNA v4.00.1%2026-08-06
CVE-2026-18649Red Hat Enterprise Linux GStreamer RTP depayloader vulnerability7.5CNA v3.11.0%2026-08-06Exploit codeFix
CVE-2026-18597Blind SSRF on Foxit PDF Services API8.5CNA v3.10.3%2026-08-06Fix
CVE-2026-18510TranslatePress WordPress plugin unauthenticated stored cross-site scripting via comment content7.2CNA v3.10.4%2026-08-06Fix
CVE-2026-18501UsersWP WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-08-06Fix
CVE-2026-18487Epiphany: Address bar / host spoofing via userinfo in ephy_uri_get_decoded_host5.4CNA v3.10.3%2026-08-06Fix
CVE-2026-18427@fastify/static vulnerable to route guard bypass via non-canonical path segments7.5CNA v3.10.7%2026-08-06Fix
CVE-2026-18400Slider, Gallery, and Carousel by MetaSlider WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-08-06Fix
CVE-2026-18395Child Pages Card WordPress plugin Contributor+ stored XSS via shortcode attributes5.4CISA ADP v3.10.2%2026-08-06Fix
CVE-2026-18367Sophos Endpoint for macOS improper authorization9.3CNA v3.10.2%2026-08-06Fix
CVE-2026-18359Server-side request forgery (SSRF) in eScriptorium8.5CNA v3.10.4%2026-08-06
CVE-2026-18325Forminator Forms WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.5%2026-08-06Fix
CVE-2026-18277Missing authorization in eScriptorium7.1CNA v3.10.4%2026-08-06
CVE-2026-18276Missing authorization in eScriptorium4.3CNA v3.10.4%2026-08-06
CVE-2026-18275Authorization bypass through user-controlled key in eScriptorium6.5CNA v3.10.4%2026-08-06
CVE-2026-18258Authorization bypass through user-controlled key in eScriptorium8.8CNA v3.10.5%2026-08-06
CVE-2026-18050Events Manager pending upload endpoint information disclosure7.5CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-17264Medixant RadiAnt DICOM out-of-bounds write5.3CNA v4.00.5%2026-08-06Fix
CVE-2026-17032google-maps-easy-pro WordPress plugin Supsystic multiple Pro plugins backdoor9.8CNA v3.10.5%2026-08-06Fix
CVE-2026-16954AI Engine WordPress plugin Editor+ sensitive information disclosure of API Key and Bearer Tokens6.5CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-16734Stripe Payment Forms by WP Full Pay payment intent handling missing authorization7.5CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-16731Authentication and authorization bypass via cryptographic timing side-channel attack in StationScout8.3CNA v4.00.4%2026-08-06Fix
CVE-2026-16636FluentSMTP WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.5%2026-08-06Fix
CVE-2026-16620WPC Name Your Price for WooCommerce select price mode web parameter tampering7.5CNA v3.10.4%2026-08-06Fix
CVE-2026-16619miniOrange 2FA WordPress plugin 2FA bypass via Unlimited Second-Factor Attempts7.5CNA v3.10.3%2026-08-06Fix
CVE-2026-16537Slick Slider WordPress plugin Contributor+ stored XSS via Gallery shortcode5.4CISA ADP v3.10.2%2026-08-06Fix
CVE-2026-16316Malformed IEC 61850 Sampled Values frames cause partial denial of service in StationGuard1.3CNA v4.00.2%2026-08-06Fix
CVE-2026-16315Authentication and authorization bypass via cryptographic timing side-channel attack in StationGuard8.1CNA v4.00.4%2026-08-06Fix
CVE-2026-16290ProfileGrid group member list endpoint missing authorization5.3CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-16268Newsletters WordPress plugin unauthenticated server-side request forgery via SNS Bounce Handler8.2CISA ADP v3.10.7%2026-08-06NucleiFix
CVE-2026-16067Event Booking Manager for WooCommerce (Pro) ticket checkout vulnerability5.3CNA v3.10.3%2026-08-06Fix
CVE-2026-16065Welcart e-Commerce WordPress plugin Editor+ SQL injection via CSV import6.5CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-16054Drag and Drop Multiple File Upload for WooCommerce WordPress plugin unauthenticated file deletion9.1CISA ADP v3.10.5%2026-08-06Fix
CVE-2026-15991File Manager - missing authorization to Authenticated arbitrary file read and Deletion8.8CNA v3.11.1%2026-08-06Fix
CVE-2026-15734WGDashboard server-side template injection9.8CISA ADP v3.10.7%2026-08-06
CVE-2026-15733WGDashboard remote code execution9.8CISA ADP v3.110.0%2026-08-06Nuclei
CVE-2026-15732WGDashboard server-side request forgery9.8CISA ADP v3.10.6%2026-08-06
CVE-2026-15599Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner3.3CNA v3.10.1%2026-08-06Fix
CVE-2026-15459WPMU DEV Dashboard WordPress plugin authentication bypass to arbitrary plugin installation8.1CNA v3.10.9%2026-08-06Reported exploitedFix
CVE-2026-15256Ninja Forms form field default value handler vulnerability4.8CNA v3.10.2%2026-08-06Fix
CVE-2026-15246RealHomes Memberships WordPress plugin Subscriber+ Membership Payment bypass4.3CNA v3.10.1%2026-08-06Fix
CVE-2026-15208RegistrationMagic PayPal capture verification insufficient verification of data authenticity5.3CNA v3.10.2%2026-08-06Fix
CVE-2026-15152WP Hotel Booking WordPress plugin unauthenticated PayPal Payment bypass5.3CNA v3.10.2%2026-08-06Fix
CVE-2026-15149WP Hotel Booking WordPress plugin unauthenticated Payment bypass via Price manipulation5.3CNA v3.10.3%2026-08-06Fix
CVE-2026-15147Five Star Restaurant Reservations insufficient verification of data authenticity5.3CNA v3.10.2%2026-08-06Fix
CVE-2026-14936Simple Membership PayPal IPN receiver insufficient verification of data authenticity5.3CNA v3.10.2%2026-08-06Fix
CVE-2026-14842Events Made Easy WordPress plugin unauthenticated Payment bypass5.3CNA v3.10.3%2026-08-06Fix
CVE-2026-14831Easy Booking WordPress plugin unauthenticated Minimum Booking Duration bypass5.3CNA v3.10.3%2026-08-06Fix
CVE-2026-14829Checkimate WordPress plugin unauthenticated License deactivation via hard-coded secret8.2CISA ADP v3.10.3%2026-08-06
CVE-2026-14812Premium SEO unauthenticated backdoor (Admin Creation / RCE / SSRF / content injection)10.0CNA v3.10.8%2026-08-06
CVE-2026-14547Estatik Real Estate WordPress plugin unauthenticated Arbitrary-Recipient Mail Relay via request form5.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-14314PeproDev WooCommerce Receipt Uploader attachment access token information disclosure5.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-14313PeproDev WooCommerce Receipt Uploader WordPress plugin unauthenticated order Receipt tampering5.3CISA ADP v3.10.2%2026-08-06Fix
CVE-2026-14306Tutor LMS WordPress plugin Subscriber+ Paid Course content disclosure via Enrollment check bypass4.3CNA v3.10.3%2026-08-06Fix
CVE-2026-14240Tourmaster WordPress plugin unauthenticated sensitive data disclosure via order export5.3CISA ADP v3.10.3%2026-08-06Fix
CVE-2026-14225Easy Appointments for WordPress Contributor+ shortcode Allowlist bypass2.7CNA v3.10.3%2026-08-06Fix
CVE-2026-14204Google Authenticator WordPress plugin 2FA Secret Overwrite via CSRF6.5CISA ADP v3.10.2%2026-08-06Fix
CVE-2026-13703SEO Redirection Plugin 301 Redirect Manager WordPress plugin Subscriber+ redirect Rule disclosure5.4CISA ADP v3.10.2%2026-08-06Fix
CVE-2026-13399Payment Plugins for PayPal WooCommerce payment REST endpoint missing authorization7.5CNA v3.10.4%2026-08-06Fix
CVE-2026-13342Security Optimizer IP-based login restriction vulnerability5.3CNA v3.10.3%2026-08-06Fix
CVE-2026-13154Essential Blocks REST API queries endpoint information disclosure7.5CISA ADP v3.10.4%2026-08-06Fix
CVE-2026-13153Essential Blocks WordPress plugin unauthenticated WooCommerce Sales data disclosure7.5CISA ADP v3.11.5%2026-08-06NucleiFix
CVE-2026-12901GetPaid WordPress plugin unauthenticated Worldpay Payment bypass via insufficient IPN verification5.9CNA v3.10.2%2026-08-06Fix
CVE-2026-12713WPCargo Track and Trace WordPress plugin unauthenticated SQL injection via wpcargo_tracking_number9.1CISA ADP v3.10.5%2026-08-06Fix
CVE-2026-12605Eclipse Glassfish server-side request forgery9.6CNA v3.10.4%2026-08-06Fix
CVE-2026-12584Payment Gateway for Redsys and WooCommerce Lite Inespay callback handler vulnerability7.5CNA v3.10.2%2026-08-06Fix
CVE-2026-12501WP Travel Engine PayPal IPN payment verification vulnerability5.3CNA v3.10.2%2026-08-06Fix
CVE-2026-11983Ad Inserter WordPress plugin missing authorization to block Visibility bypass via ai_ajax5.3CNA v3.10.4%2026-08-06Fix
CVE-2026-11976MonsterInsights Pro/ Backdoored via AWS S3 bucket compromise10.0CNA v3.10.5%2026-08-06Fix
CVE-2026-11803PDF File Parsing vulnerabilities in certain Autodesk Desktop Products7.8CNA v3.10.2%2026-08-06Fix
CVE-2026-11588EONSR AEO Agent WordPress plugin unauthenticated stored XSS via Scheduled post creation6.1CISA ADP v3.10.3%2026-08-06
CVE-2026-11361Formidable Forms PayPal subscription integration vulnerability5.9CNA v3.10.2%2026-08-06Fix
CVE-2026-10599Integrate PhonePe with WooCommerce payment verification insecure direct object reference7.5CNA v3.10.2%2026-08-06
CVE-2026-10524CoCart WordPress plugin unauthenticated arbitrary Price manipulation7.5CNA v3.10.4%2026-08-06Fix
CVE-2026-8325PDF File Parsing vulnerabilities in certain Autodesk Desktop Products7.8CNA v3.10.2%2026-08-06Fix
CVE-2026-8166Stored XSS in Logo Software's e-Logo Purchasing Portal5.4CNA v3.10.2%2026-08-06Fix
CVE-2026-7867Red Hat Enterprise Linux 10 udisks2: Udisks2: Local privilege escalation via as-user option spoofing7.8CNA v3.10.2%2026-08-06Exploit codeFix
CVE-2026-7406BMP File Parsing untrusted pointer dereference in certain Autodesk products7.8CNA v3.10.2%2026-08-06Fix
CVE-2026-7405TIF File Parsing out-of-bounds read in certain Autodesk products5.5CNA v3.10.2%2026-08-06Fix
CVE-2026-5857Contiki-NG MQTT client out-of-bounds write in PUBLISH Topic parser9.2CNA v4.00.9%2026-08-06
CVE-2026-5856Contiki-NG DNS/mDNS Resolver out-of-bounds read7.1CNA v4.00.3%2026-08-06
CVE-2026-5855Contiki-NG LwM2M TLV parser out-of-bounds read via Unchecked Buffer Length in lwm2m_tlv_read8.7CNA v4.00.7%2026-08-06
CVE-2026-5430WSO2 Multiple Products path traversal10.0CNA v3.10.6%2026-08-06KEVExploit codeFix
CVE-2026-5423neo4j graphql subscription authentication bypass via Unverified connectionParams.jwt8.2CNA v4.00.6%2026-08-06Fix
CVE-2026-5391LatePoint WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-08-06Fix
CVE-2026-5336Dataverse Integration WordPress plugin server-side template injection to information disclosure6.8CNA v3.10.4%2026-08-06Fix
CVE-2026-5158Post Grid Gutenberg Blocks for News WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-08-06Fix
CVE-2026-5134SQLi in Loca Software's CMS9.8CNA v3.10.5%2026-08-06
CVE-2026-3430Creative Mail - unauthenticated SQLi8.6CNA v3.10.4%2026-08-06
CVE-2026-3418Arbitrary file upload via System REST API in multiple WSO2 Products allows remote code execution9.1CNA v3.10.8%2026-08-06Fix
CVE-2026-3415WSO2 API Manager SchemaValidator Mediator XML external entity injection8.7CNA v3.10.5%2026-08-06Fix
CVE-2026-1728Privilege escalation via System REST APIs in multiple WSO2 Products permits Admin account takeover9.8CNA v3.10.5%2026-08-06Fix
CVE-2026-1289PDF File Parsing vulnerabilities in certain Autodesk Desktop Products7.8CNA v3.10.2%2026-08-06Fix
CVE-2026-0673Element Pack Addons for Elementor WordPress plugin unauthenticated SMTP header injection5.3CNA v3.10.4%2026-08-06Fix
CVE-2026-0637Sensitive information disclosure via Event Publisher Logging in multiple WSO2 Products4.4CNA v3.10.2%2026-08-06Fix
CVE-2026-71321Nuxt island renderer endpoint denial of service7.5CNA v3.10.7%2026-08-05Fix
CVE-2026-71320Nuxt: Server-Side remote code execution via Runtime template injection in Nuxt Server Island Props8.1CNA v3.10.7%2026-08-05Fix
CVE-2026-71319nuxt devtools nuxt.js Unauthenticated WebSocket RPC Call leading to remote code execution9.6CNA v3.10.6%2026-08-05Fix
CVE-2026-71318Nuxt: Unauthorized Component Instantiation via Server Island Props4.8CNA v3.10.3%2026-08-05Fix
CVE-2026-71316Nuxt payload cache information disclosure7.5CNA v3.10.5%2026-08-05Fix
CVE-2026-71315Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates8.2CNA v3.10.5%2026-08-05Fix
CVE-2026-71314Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering7.5CNA v3.10.7%2026-08-05Fix
CVE-2026-71313rclone local backend filename encoding path traversal6.9CNA v3.10.3%2026-08-05Fix
CVE-2026-71312rclone SFTP PowerShell hashing command injection8.0CNA v3.10.5%2026-08-05Fix
CVE-2026-71311rclone FTP command handling CRLF injection6.4CNA v3.10.4%2026-08-05Fix
CVE-2026-71310rclone HTTP CONNECT proxy handling denial of service5.9CNA v3.10.6%2026-08-05Fix
CVE-2026-71309rclone serve restic command path traversal8.6CNA v4.00.5%2026-08-05Fix
CVE-2026-71294Cotonti CMS comments plugin PHP object injection via Unrestricted unserialize in Create/Edit Actions7.7CNA v3.10.4%2026-08-05Exploit code
CVE-2026-71293Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user variable6.2CNA v3.10.4%2026-08-05
CVE-2026-71292Subrion CMS Admin Grid SQL injection via Unwhitelisted ORDER BY sort parameter7.2CNA v3.10.6%2026-08-05
CVE-2026-71291Bolt CMS server-side template injection via Unsandboxed allow_twig Field Rendering8.8CNA v3.10.5%2026-08-05
CVE-2026-71289NASA-AMMOS ANMS / JHUAPL dtnma-tools unauthenticated remote command execution9.8CNA v3.10.7%2026-08-05
CVE-2026-71288Koha guided_reports.pl SQL injection8.8CNA v3.10.5%2026-08-05
CVE-2026-71287Cacti sanitize_sql_column function SQL injection8.8CNA v3.10.5%2026-08-05
CVE-2026-71286ember-dynamic-render-template Client-Side template injection via Unsanitized templateString6.1CNA v3.10.3%2026-08-05
CVE-2026-71285louislam uptime-kuma Uptime Kuma stored XSS via Matomo Analytics Site ID on Public Status pages8.1CNA v3.10.4%2026-08-05
CVE-2026-71284Fledge IoT Gateway Backup Restore OS command injection via Tar Member Filename7.2CNA v3.10.9%2026-08-05
CVE-2026-71283Fledge IoT Gateway Backup Restore Tar path traversal4.9CNA v3.10.4%2026-08-05
CVE-2026-71282ChirpStack SQLite Backend SQL injection via Device Tag Key in ListDevices Filter6.5CNA v3.10.4%2026-08-05
CVE-2026-71281peft unsafe deserialization via torch.load Without weights_only in LoRA-GA and CorDA modules8.8CNA v3.10.5%2026-08-05Fix
CVE-2026-71280go-shiori server-side request forgery via Unrestricted Bookmark URL Fetch8.5CNA v3.10.3%2026-08-05
CVE-2026-71279Zigbee2MQTT External JS extension path traversal leading to remote code execution8.1CNA v3.10.6%2026-08-05
CVE-2026-71278rust-iot-platform unauthenticated remote code execution via Unsandboxed Calc-Rule Script Evaluation9.8CNA v3.10.7%2026-08-05
CVE-2026-71277rust-iot-platform authentication bypass via Non-Validated Authorization header9.1CNA v3.10.4%2026-08-05
CVE-2026-71276Magistrala (formerly Mainflux) IoT Platform SQL injection via format Query parameter7.1CNA v3.10.3%2026-08-05
CVE-2026-71275openshwprojects OpenBK7231T_App OpenBK7231T reflected XSS via OTA host parameter5.4CNA v3.10.2%2026-08-05
CVE-2026-71274openshwprojects OpenBK7231T_App OpenBK7231T stored XSS via Unsanitized MQTT-Set Channel Labels8.5CNA v3.10.3%2026-08-05
CVE-2026-71273OpenBK7231T cfg_wifi_set endpoint cross-site request forgery6.5CNA v3.10.2%2026-08-05
CVE-2026-71272Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext8.5CNA v3.10.3%2026-08-05
CVE-2026-71271Memos webhook URL validation server-side request forgery8.5CNA v3.10.3%2026-08-05
CVE-2026-71270Stirling-PDF server-side request forgery via /API/v1/convert/URL/pdf WeasyPrint Subprocess8.6CNA v3.10.4%2026-08-05
CVE-2026-71268thiagoralves OpenPLC Runtime v3 compile_program function path traversal9.9CNA v3.10.6%2026-08-05
CVE-2026-71267microtar stack buffer overflow in mtar_write_file_header and mtar_write_dir_header9.8CNA v3.10.6%2026-08-05
CVE-2026-71266tinyobjloader-c stack buffer overflow in MTL Material File Line Parsing7.8CNA v3.10.2%2026-08-05
CVE-2026-71265Domoticz MochadTCP stack buffer overflow via MOCHAD_RFSEC strcpy7.5CNA v3.10.3%2026-08-05
CVE-2026-71264WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State8.2CNA v3.10.3%2026-08-05
CVE-2026-71263FreeModbus LINUXTCP Port off-by-one global buffer overflow in xMBPortTCPPool9.1CNA v3.10.5%2026-08-05
CVE-2026-71262IoTSharp BlobStorageController missing authentication and path traversal9.8CNA v3.10.6%2026-08-05
CVE-2026-71261dr_libs dr_wav W64 CUE chunk parsing integer overflow7.8CNA v3.10.2%2026-08-05
CVE-2026-71260ESPHome web_server plaintext password Disclosure via JSON value field6.5CNA v3.10.3%2026-08-05
CVE-2026-71259ESPHome external_components file:// Scheme Validation Bypass leading to remote code execution8.6CNA v3.10.2%2026-08-05
CVE-2026-71256nanoMODBUS Client-Side out-of-bounds read leading to Wild-Pointer Write via object_id9.8CNA v3.10.6%2026-08-05
CVE-2026-71255nanoMODBUS Client-Side out-of-bounds write via object_length in recv_read_device_identification_res8.6CNA v3.10.4%2026-08-05
CVE-2026-71254nanoMODBUS Server-Side out-of-bounds write in handle_read_file_record9.8CNA v3.10.6%2026-08-05
CVE-2026-71252toner-management Unauthenticated State-Changing Admin Actions8.2CNA v3.10.5%2026-08-05
CVE-2026-71251Akaunting customer portal download endpoint insecure direct object reference6.5CNA v3.10.3%2026-08-05
CVE-2026-71250Firefly III webhook URL validation server-side request forgery4.3CNA v3.10.3%2026-08-05
CVE-2026-71249299Ko unauthenticated reflected XSS in Public Contact form6.1CNA v3.10.3%2026-08-05
CVE-2026-71248Inventory-Management-System-PHP unauthenticated SQL injection in Login and Product Deletion9.8CNA v3.10.7%2026-08-05
CVE-2026-71247Documenso Assistant Recipient can Forge another Signer's Signature in Sequential-Signing Documents6.5CNA v3.10.3%2026-08-05
CVE-2026-71246Pixelfed authenticated SSRF via Remote URL Search4.3CNA v3.10.3%2026-08-05
CVE-2026-71244Paperless-ngx mail account test connection server-side request forgery6.5CNA v3.10.3%2026-08-05
CVE-2026-71243backmeup (npm) OS command injection via Backup Option Values8.8CNA v3.10.5%2026-08-05
CVE-2026-71242Crater Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy8.2CNA v3.10.4%2026-08-05
CVE-2026-71241Book-Management-System Unauthenticated Disclosure of Student PII and Borrowing History7.5CNA v3.10.5%2026-08-05
CVE-2026-71240DjangoCRM unauthenticated open redirect via toggle_default_sorting next_url parameter4.3CNA v3.10.3%2026-08-05
CVE-2026-71239DjangoCRM server-side template injection in Mass Mail Message Rendering8.1CNA v3.10.4%2026-08-05
CVE-2026-71238DjangoCRM Hard-coded Django SECRET_KEY enables Session and CSRF Token Forgery9.1CNA v3.10.4%2026-08-05
CVE-2026-71237Miantang IoT-PHP unauthenticated SQL injection in /userlogin9.8CNA v3.10.8%2026-08-05
CVE-2026-71236Grocy stored XSS via HTMLPurifier Output Double-Decode8.7CNA v3.10.4%2026-08-05
CVE-2026-71235Magistrala IoT Platform Unrestricted Go/Lua Script Execution in Rules Engine8.8CNA v3.10.5%2026-08-05
CVE-2026-71234Documize Community Attachment Download authorization bypass via Non-Validated secure Token7.5CNA v3.10.4%2026-08-05
CVE-2026-71233InvoiceNinja stored XSS via Invoice/Quote Terms field8.7CNA v3.10.4%2026-08-05
CVE-2026-71232MacCMS10 Incomplete Function Blacklist in Template Editor enables Authenticated RCE7.2CNA v3.10.5%2026-08-05
CVE-2026-71231IOTSmartHome unauthenticated SQL injection via lastLogin Cookie9.8CNA v3.10.7%2026-08-05
CVE-2026-71227Stephan Muelle libkcapi _kcapi_aio_read_all function denial of service5.1NVD v3.10.2%2026-08-05Fix
CVE-2026-71226Libkcapi: Memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path7.3NVD v3.10.1%2026-08-05Fix
CVE-2026-71225Stephan Muelle libkcapi insufficient randomness6.5NVD v3.10.3%2026-08-05Fix
CVE-2026-71215art-template path traversal in Sub-Template Resolution via include/extend7.5CNA v3.10.6%2026-08-05
CVE-2026-71214NASA AMMOS plandev sequencing-server authorization middleware missing authentication9.8CNA v3.10.5%2026-08-05
CVE-2026-71213typemill no Rate Limiting on Login endpoint enables Unlimited Password brute-force9.1CNA v3.10.5%2026-08-05
CVE-2026-71212xidown argument injection via Unterminated yt-dlp Command Line Construction4.4CNA v3.10.2%2026-08-05
CVE-2026-71211MLflow Unvalidated Gateway Secret api_base enables SSRF via Gateway Proxy endpoint7.1CNA v3.10.3%2026-08-05Exploit code
CVE-2026-71210mealie DNS-Rebinding TOCTOU in SSRF Guard allows Internal Network and Cloud Metadata Access5.3CNA v3.10.2%2026-08-05
CVE-2026-71209audiobookshelf cover image cache path traversal7.5CNA v3.11.9%2026-08-05Nuclei
CVE-2026-71208KubeSphere SSRF via Unvalidated Cluster CRD Connection endpoint in Cluster Reconciliation6.5CNA v3.10.4%2026-08-05
CVE-2026-71207Stock Inventory Management System login.php SQL injection9.8CNA v3.10.7%2026-08-05
CVE-2026-71206Shiori JWT token validation vulnerability8.2CNA v3.10.4%2026-08-05Exploit code
CVE-2026-71205changedetection.io no Rate Limiting on /login enables Unlimited Password brute-force6.5CNA v3.10.3%2026-08-05Exploit code
CVE-2026-71204changedetection.io Omitted Checkbox in /settings Save Silently Disables API Key Enforcement6.3CNA v3.10.3%2026-08-05Exploit code
CVE-2026-71203changedetection.io missing authentication on /API/v1/full-spec Discloses Full OpenAPI Schema5.3CNA v3.10.3%2026-08-05Exploit code
CVE-2026-71202raster integer underflow in crop Offset Handling causes Capacity-overflow panic7.5CNA v3.10.5%2026-08-05
CVE-2026-71201OpenStack Ironic incorrect authorization5.0CNA v3.10.3%2026-08-05Fix
CVE-2026-71192OpenStack Swift incorrect authorization6.0CNA v4.00.4%2026-08-05Fix
CVE-2026-71191OpenStack Swift incorrect authorization6.0CNA v4.00.4%2026-08-05Fix
CVE-2026-71190OpenStack Swift regular expression denial of service8.7CNA v4.00.8%2026-08-05Fix
CVE-2026-70618Spacebar Server missing authorization via member-ids endpoint5.3CNA v4.00.3%2026-08-05
CVE-2026-70617Spacebar Server missing authorization via Group DM Recipient endpoint8.6CNA v4.00.4%2026-08-05
CVE-2026-70616boringproxy resource exhaustion DoS via GET /loading endpoint7.1CNA v4.00.3%2026-08-05
CVE-2026-70615boringproxy SSH authorized_keys injection via Tunnel Creation8.5CNA v4.00.4%2026-08-05
CVE-2026-70612Electron: Sandboxed iframes can launch external protocol handlers5.4CNA v3.10.4%2026-08-05Fix
CVE-2026-70611Electron: DevTools embedder handler executes arbitrary files via shell open6.9CNA v3.10.2%2026-08-05Fix
CVE-2026-70610Electron: ContextBridge object copy honors prototype setters5.4CNA v3.10.6%2026-08-05Fix
CVE-2026-70609Electron: DevTools JavaScript injection via Unsanitized Dock State parameter5.7CNA v3.10.5%2026-08-05Fix
CVE-2026-70608Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path7.2CNA v3.10.4%2026-08-05Fix
CVE-2026-70607Electron: Window.open features string controls some window options considered privileged5.3CNA v3.10.6%2026-08-05Fix
CVE-2026-70606Electron: ProtocolResponse.url reuses the default session cache instead of the registering session5.9CNA v3.10.3%2026-08-05Fix
CVE-2026-70605Electron: HTTP redirect followed into local file loader5.9CNA v3.10.3%2026-08-05Fix
CVE-2026-70604Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads7.4CNA v3.10.4%2026-08-05Fix
CVE-2026-70603Electron: Shell.openPath path validation bypass via embedded null byte6.0CNA v3.10.1%2026-08-05Fix
CVE-2026-70602Electron: Extension tab APIs operate across session boundaries6.6CNA v3.10.3%2026-08-05Fix
CVE-2026-70601Electron: Context isolation bypass via Function.prototype.bind hijack7.5CNA v3.10.3%2026-08-05Fix
CVE-2026-70600Electron: Cross-origin iframe can position native autofill popup3.1CNA v3.10.2%2026-08-05Fix
CVE-2026-70599Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin5.9CNA v3.10.2%2026-08-05Fix
CVE-2026-70598Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size3.9CNA v3.10.1%2026-08-05Fix
CVE-2026-70597Electron: Parent process code-sign check is spoofable6.3CNA v3.10.1%2026-08-05Fix