CVE-2024-13784 | Critical | 9.8 | 2026-08-16 | The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including… |
CVE-2026-18316 | Critical | 9.1 | 2026-08-16 | The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() functio… |
CVE-2026-18432 | Critical | 9.8 | 2026-08-16 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exi… |
CVE-2026-16098 | Critical | 9.8 | 2026-08-16 | The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpl… |
CVE-2026-14524 | Critical | 9.1 | 2026-08-16 | The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol_fileDeleteProces… |
CVE-2026-19924 | Critical | 9.8 | 2026-08-16 | A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the componen… |
CVE-2026-73053 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attack… |
CVE-2026-73052 | Critical | 9.0 | 2026-08-15 | SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu… |
CVE-2026-73050 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight u… |
CVE-2026-73046 | Critical | 9.8 | 2026-08-15 | SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards n… |
CVE-2026-73044 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attac… |
CVE-2026-73043 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and… |
CVE-2026-73042 | Critical | 9.0 | 2026-08-15 | SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, vie… |
CVE-2026-73041 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious ma… |
CVE-2026-18855 | Critical | 9.1 | 2026-08-15 | The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function i… |
CVE-2026-19598 | Critical | 9.8 | 2026-08-15 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and inclu… |
CVE-2026-16142 | Critical | 9.8 | 2026-08-15 | The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() A… |
CVE-2026-15826 | Critical | 9.8 | 2026-08-15 | The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due t… |
CVE-2026-15341 | Critical | 9.8 | 2026-08-15 | The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4… |
CVE-2026-15303 | Critical | 9.8 | 2026-08-15 | The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_creat… |
CVE-2026-14484 | Critical | 9.1 | 2026-08-15 | The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validati… |
CVE-2026-17186 | Critical | 9.9 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a c… |
CVE-2026-17184 | Critical | 9.8 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path. |
CVE-2026-17182 | Critical | 9.8 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validat… |
CVE-2026-17181 | Critical | 9.3 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path traversal. |
CVE-2026-73678 | Critical | 10.0 | 2026-08-14 | MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to exec… |
CVE-2026-50027 | Critical | 9.8 | 2026-08-14 | mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are served wi… |
CVE-2026-49457 | Critical | 9.1 | 2026-08-14 | erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The Cer… |
CVE-2026-19188 | Critical | 10.0 | 2026-08-14 | A critical OS command injection vulnerability has been identified in the
Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the
Net Check fea… |
CVE-2026-73849 | Critical | 9.8 | 2026-08-14 | Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the… |
CVE-2026-48528 | Critical | 9.8 | 2026-08-14 | Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated… |
CVE-2026-19682 | Critical | 9.9 | 2026-08-14 | A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on… |
CVE-2026-19681 | Critical | 9.9 | 2026-08-14 | An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading… |
CVE-2026-19626 | Critical | 9.9 | 2026-08-14 | A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could expl… |
CVE-2026-72830 | Critical | 9.8 | 2026-08-14 | Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler config… |
CVE-2026-72829 | Critical | 9.8 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These meth… |
CVE-2026-72826 | Critical | 9.8 | 2026-08-14 | The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiK… |
CVE-2026-72824 | Critical | 9.8 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check… |
CVE-2026-72822 | Critical | 9.8 | 2026-08-14 | The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibl… |
CVE-2026-72811 | Critical | 10.0 | 2026-08-14 | SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored bloc… |
CVE-2026-12949 | Critical | 9.8 | 2026-08-14 | The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3… |
CVE-2026-73843 | Critical | 9.6 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing mana… |
CVE-2026-73842 | Critical | 9.0 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api… |
CVE-2026-72851 | Critical | 10.0 | 2026-08-13 | Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST at… |
CVE-2026-72850 | Critical | 9.1 | 2026-08-13 | Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved d… |
CVE-2026-72842 | Critical | 9.9 | 2026-08-13 | luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes with… |
CVE-2026-72841 | Critical | 9.9 | 2026-08-13 | luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write a… |
CVE-2026-72839 | Critical | 9.8 | 2026-08-13 | filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated at… |
CVE-2026-72776 | Critical | 9.8 | 2026-08-13 | AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary com… |
CVE-2026-8715 | Critical | 9.6 | 2026-08-13 | Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration… |
CVE-2026-19297 | Critical | 9.1 | 2026-08-13 | IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive auth… |
CVE-2026-17482 | Critical | 9.8 | 2026-08-13 | IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths. |
CVE-2026-73656 | Critical | 9.9 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-w… |
CVE-2026-19747 | Critical | 9.8 | 2026-08-13 | A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAt… |
CVE-2026-14525 | Critical | 9.4 | 2026-08-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when th… |
CVE-2026-73653 | Critical | 9.4 | 2026-08-13 | Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreensh… |
CVE-2026-73649 | Critical | 9.8 | 2026-08-13 | Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __p… |
CVE-2026-73644 | Critical | 9.6 | 2026-08-13 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/se… |
CVE-2026-73567 | Critical | 9.1 | 2026-08-13 | sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKe… |
CVE-2026-67614 | Critical | 9.8 | 2026-08-13 | CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to f… |
CVE-2026-58508 | Critical | 9.1 | 2026-08-13 | Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) |
CVE-2026-58443 | Critical | 9.1 | 2026-08-13 | Public-only repository tokens can update private PR head branches |
CVE-2026-58433 | Critical | 9.1 | 2026-08-13 | Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting |
CVE-2026-56750 | Critical | 9.1 | 2026-08-13 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session |
CVE-2026-56654 | Critical | 9.8 | 2026-08-13 | Privilege Escalation via Access Token Scope Escalation in API |
CVE-2026-56443 | Critical | 9.6 | 2026-08-13 | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 |
CVE-2026-55982 | Critical | 9.1 | 2026-08-13 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes |
CVE-2026-13051 | Critical | 9.1 | 2026-08-13 | Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy… |
CVE-2022-4993 | Critical | 9.1 | 2026-08-13 | HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use er… |
CVE-2026-73533 | Critical | 9.8 | 2026-08-13 | Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server… |
CVE-2026-73532 | Critical | 9.8 | 2026-08-13 | Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server… |
CVE-2026-53791 | Critical | 9.1 | 2026-08-13 | rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by send… |
CVE-2026-66691 | Critical | 9.8 | 2026-08-13 | Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions. |
CVE-2026-66478 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. |
CVE-2026-66472 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. |
CVE-2026-66465 | Critical | 9.8 | 2026-08-13 | Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. |
CVE-2026-66458 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in RealPress <= 1.1.2 versions. |
CVE-2026-66453 | Critical | 9.8 | 2026-08-13 | Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions. |
CVE-2026-66446 | Critical | 9.3 | 2026-08-13 | Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions. |
CVE-2026-66436 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions. |
CVE-2026-66424 | Critical | 9.8 | 2026-08-13 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions. |
CVE-2026-61969 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Listdom <= 5.6.0 versions. |
CVE-2026-61967 | Critical | 9.8 | 2026-08-13 | Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions. |
CVE-2026-61966 | Critical | 9.3 | 2026-08-13 | Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions. |
CVE-2026-61962 | Critical | 10.0 | 2026-08-13 | Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions. |
CVE-2026-28185 | Critical | 9.8 | 2026-08-13 | Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions. |
CVE-2026-28149 | Critical | 9.8 | 2026-08-13 | Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. |
CVE-2026-28148 | Critical | 9.8 | 2026-08-13 | Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. |
CVE-2026-28142 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. |
CVE-2026-28008 | Critical | 9.8 | 2026-08-13 | Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions. |
CVE-2026-28001 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. |
CVE-2026-27544 | Critical | 10.0 | 2026-08-13 | Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. |
CVE-2026-49827 | Critical | 9.8 | 2026-08-13 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbi… |
CVE-2026-59507 | Critical | 9.3 | 2026-08-13 | CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control |
CVE-2026-59506 | Critical | 9.3 | 2026-08-13 | CWE-306: Missing Authentication for Critical Function |
CVE-2026-59504 | Critical | 9.1 | 2026-08-13 | CWE-602: Client-Side Enforcement of Server-Side Security |
CVE-2026-59503 | Critical | 9.1 | 2026-08-13 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor |
CVE-2026-59500 | Critical | 10.0 | 2026-08-13 | CWE-287: Improper Authentication |
CVE-2026-15413 | Critical | 10.0 | 2026-08-13 | The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link… |
CVE-2026-14182 | Critical | 9.8 | 2026-08-13 | The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a… |