CVE-2026-15142 | High | 7.5 | 2026-08-15 | The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper ca… |
CVE-2026-14279 | High | 8.8 | 2026-08-15 | The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX… |
CVE-2026-16145 | High | 7.2 | 2026-08-15 | The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' para… |
CVE-2026-13360 | High | 7.2 | 2026-08-15 | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in al… |
CVE-2026-15965 | High | 8.8 | 2026-08-15 | The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and inc… |
CVE-2026-15312 | High | 8.8 | 2026-08-15 | The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. Thi… |
CVE-2026-15162 | High | 7.5 | 2026-08-15 | The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type parameter of its /wp-json/object-sync-for-sa… |
CVE-2026-15001 | High | 8.8 | 2026-08-15 | The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is… |
CVE-2026-14433 | High | 7.2 | 2026-08-15 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' paramet… |
CVE-2026-73683 | High | 8.1 | 2026-08-14 | Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens b… |
CVE-2026-69414 | High | 7.8 | 2026-08-14 | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak &quo… |
CVE-2026-73682 | High | 8.8 | 2026-08-14 | Semaphore versions prior to 2.18.20 contain an OS command injection (argument injection) vulnerability in the repository git_url handling that allows authentic… |
CVE-2026-50523 | High | 7.8 | 2026-08-14 | Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code local… |
CVE-2026-73680 | High | 8.8 | 2026-08-14 | Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload p… |
CVE-2026-19910 | High | 7.5 | 2026-08-14 | PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attacker… |
CVE-2026-19909 | High | 7.5 | 2026-08-14 | PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitra… |
CVE-2026-19908 | High | 7.1 | 2026-08-14 | PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and… |
CVE-2026-18554 | High | 7.5 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to… |
CVE-2026-17179 | High | 8.5 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection. |
CVE-2026-17177 | High | 7.5 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to uncontrolled recursion. |
CVE-2026-17175 | High | 7.5 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement. |
CVE-2026-17081 | High | 8.2 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary files due to improper limitation of a pathname to a restricted director… |
CVE-2026-16915 | High | 7.5 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. |
CVE-2026-16879 | High | 8.8 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-sup… |
CVE-2026-16708 | High | 8.3 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration. |
CVE-2026-73679 | High | 7.2 | 2026-08-14 | ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary… |
CVE-2026-45699 | High | 7.5 | 2026-08-14 | Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists i… |
CVE-2026-72970 | High | 8.3 | 2026-08-14 | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-19847 | High | 8.8 | 2026-08-14 | A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-19846 | High | 8.8 | 2026-08-14 | A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2026-19680 | High | 7.1 | 2026-08-14 | A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database. |
CVE-2026-19679 | High | 8.8 | 2026-08-14 | An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a… |
CVE-2026-19635 | High | 8.8 | 2026-08-14 | A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary co… |
CVE-2026-19629 | High | 8.1 | 2026-08-14 | A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single… |
CVE-2026-12366 | High | 8.8 | 2026-08-14 | Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an object's storage (k_free(dyn->data)) once its reference cou… |
CVE-2026-12364 | High | 8.4 | 2026-08-14 | The user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c was a pure pass-through: it forwarded the caller-supplied sour… |
CVE-2026-46603 | High | 7.5 | 2026-08-14 | VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree gr… |
CVE-2026-46439 | High | 7.8 | 2026-08-14 | compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulne… |
CVE-2026-19845 | High | 8.8 | 2026-08-14 | A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the… |
CVE-2026-19844 | High | 8.8 | 2026-08-14 | A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2026-19628 | High | 7.2 | 2026-08-14 | A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve ar… |
CVE-2026-66271 | High | 7.2 | 2026-08-14 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attac… |
CVE-2026-66270 | High | 7.2 | 2026-08-14 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attac… |
CVE-2026-63700 | High | 7.8 | 2026-08-14 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local acces… |
CVE-2026-53970 | High | 7.5 | 2026-08-14 | ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execut… |
CVE-2026-16772 | High | 8.1 | 2026-08-14 | In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administ… |
CVE-2026-69101 | High | 7.7 | 2026-08-14 | Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery an… |
CVE-2026-73633 | High | 7.5 | 2026-08-14 | Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request… |
CVE-2026-19768 | High | 8.1 | 2026-08-14 | Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authentica… |
CVE-2026-73673 | High | 8.8 | 2026-08-14 | Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmw… |
CVE-2026-19826 | High | 7.3 | 2026-08-14 | A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerial… |
CVE-2026-19825 | High | 7.3 | 2026-08-14 | A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /clas… |
CVE-2026-19824 | High | 8.8 | 2026-08-14 | A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIp… |
CVE-2026-19823 | High | 8.8 | 2026-08-14 | A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the co… |
CVE-2026-72859 | High | 7.7 | 2026-08-14 | Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject… |
CVE-2026-72837 | High | 8.8 | 2026-08-14 | File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid u… |
CVE-2026-72836 | High | 8.1 | 2026-08-14 | FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and C… |
CVE-2026-72833 | High | 8.8 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-… |
CVE-2026-72831 | High | 8.8 | 2026-08-14 | The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController… |
CVE-2026-72828 | High | 7.2 | 2026-08-14 | Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisio… |
CVE-2026-72827 | High | 8.8 | 2026-08-14 | Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute ar… |
CVE-2026-72825 | High | 7.6 | 2026-08-14 | The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController)… |
CVE-2026-72819 | High | 8.8 | 2026-08-14 | Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute… |
CVE-2026-72810 | High | 8.6 | 2026-08-14 | SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfilter… |
CVE-2026-19822 | High | 8.8 | 2026-08-14 | A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the function lstAdd of the file /goform/editQos of the compone… |
CVE-2026-19821 | High | 8.8 | 2026-08-14 | A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoR… |
CVE-2026-19815 | High | 8.8 | 2026-08-14 | A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cg… |
CVE-2026-19814 | High | 8.8 | 2026-08-14 | A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setMacQos of the file /cgi-bin/cstecgi.cgi of the component fir… |
CVE-2026-19813 | High | 8.8 | 2026-08-14 | A security vulnerability has been detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setMacFilterRules of the file /cgi-bin/cstecgi.c… |
CVE-2026-19812 | High | 8.8 | 2026-08-14 | A weakness has been identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the c… |
CVE-2026-19794 | High | 7.2 | 2026-08-14 | The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitizatio… |
CVE-2026-19811 | High | 8.8 | 2026-08-14 | A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setIpQosRules of the file /cgi-bin/cstecgi.c… |
CVE-2026-18039 | High | 8.1 | 2026-08-14 | The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attribut… |
CVE-2026-15205 | High | 8.6 | 2026-08-14 | The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its publ… |
CVE-2026-19792 | High | 8.8 | 2026-08-14 | A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web m… |
CVE-2026-19791 | High | 8.8 | 2026-08-14 | A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component http… |
CVE-2026-19790 | High | 8.8 | 2026-08-14 | A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd… |
CVE-2026-19789 | High | 8.8 | 2026-08-14 | A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGues… |
CVE-2026-19788 | High | 8.8 | 2026-08-14 | A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the compone… |
CVE-2026-18109 | High | 7.2 | 2026-08-14 | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due t… |
CVE-2026-19771 | High | 7.2 | 2026-08-14 | A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web I… |
CVE-2026-19764 | High | 7.3 | 2026-08-14 | A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/us… |
CVE-2026-19762 | High | 7.3 | 2026-08-14 | A vulnerability was found in DTStack Taier 1.4.0. Affected by this vulnerability is the function Paths.ge of the file FileChunkController.java of the component… |
CVE-2026-19758 | High | 7.3 | 2026-08-14 | A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the compo… |
CVE-2026-19757 | High | 7.3 | 2026-08-14 | A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component Fi… |
CVE-2026-19753 | High | 7.3 | 2026-08-13 | A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py… |
CVE-2026-73841 | High | 8.8 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal… |
CVE-2026-73667 | High | 8.8 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under sampl… |
CVE-2026-73666 | High | 8.2 | 2026-08-13 | OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisable… |
CVE-2026-73659 | High | 8.1 | 2026-08-13 | Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/ap… |
CVE-2026-73658 | High | 8.2 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4Fet… |
CVE-2026-73408 | High | 7.6 | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped… |
CVE-2026-73305 | High | 8.8 | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.ap… |
CVE-2026-72857 | High | 7.7 | 2026-08-13 | Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings an… |
CVE-2026-72856 | High | 8.1 | 2026-08-13 | Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On… |
CVE-2026-72855 | High | 8.5 | 2026-08-13 | Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-l… |
CVE-2026-72853 | High | 7.6 | 2026-08-13 | Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in id… |
CVE-2026-72849 | High | 7.7 | 2026-08-13 | Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat ide… |
CVE-2026-72840 | High | 8.8 | 2026-08-13 | OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for m… |
CVE-2026-56865 | High | 8.4 | 2026-08-13 | A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-… |