CVE-2026-8840 | Medium | 5.3 | 2026-08-15 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This… |
CVE-2026-16080 | Medium | 6.5 | 2026-08-15 | The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'post_title' parameter in all versions up to, and including… |
CVE-2026-12128 | Medium | 5.3 | 2026-08-15 | The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` parameter in all versions up to, and inclu… |
CVE-2026-74250 | Medium | 6.3 | 2026-08-14 | In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect d… |
CVE-2026-74247 | Medium | 4.2 | 2026-08-14 | A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulner… |
CVE-2026-74245 | Medium | 5.9 | 2026-08-14 | A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper a… |
CVE-2026-74244 | Medium | 5.9 | 2026-08-14 | A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending cra… |
CVE-2026-74243 | Medium | 6.5 | 2026-08-14 | A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the… |
CVE-2026-74242 | Medium | 5.3 | 2026-08-14 | A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can… |
CVE-2026-74241 | Medium | 4.8 | 2026-08-14 | A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during auth… |
CVE-2026-74240 | Medium | 5.4 | 2026-08-14 | A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues relate… |
CVE-2026-74248 | Medium | 4.3 | 2026-08-14 | OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an auth… |
CVE-2026-18178 | Medium | 5.4 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal. |
CVE-2026-17227 | Medium | 5.4 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special el… |
CVE-2026-17209 | Medium | 6.3 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. |
CVE-2026-17173 | Medium | 6.5 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths. |
CVE-2026-17079 | Medium | 6.3 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to the ability to disable server-side in… |
CVE-2026-16905 | Medium | 5.3 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication. |
CVE-2026-50029 | Medium | 5.3 | 2026-08-14 | js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (obje… |
CVE-2026-73847 | Medium | 6.8 | 2026-08-14 | Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a… |
CVE-2026-49282 | Medium | 5.1 | 2026-08-14 | Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to… |
CVE-2026-19639 | Medium | 4.3 | 2026-08-14 | An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their ass… |
CVE-2026-19636 | Medium | 5.3 | 2026-08-14 | An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This ha… |
CVE-2026-19631 | Medium | 4.9 | 2026-08-14 | A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting… |
CVE-2026-12365 | Medium | 5.8 | 2026-08-14 | A use-after-free exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayable work timeouts. When a delayable work item's tim… |
CVE-2026-12363 | Medium | 4.2 | 2026-08-14 | The LoRaWAN Fragmented Data Block Transport service (subsys/lorawan/services/frag_transport.c) does not validate the fragment counter in a received DATA_FRAGME… |
CVE-2026-73846 | Medium | 6.5 | 2026-08-14 | CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with un… |
CVE-2026-73845 | Medium | 5.3 | 2026-08-14 | CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/q… |
CVE-2026-46380 | Medium | 6.7 | 2026-08-14 | compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user… |
CVE-2026-19839 | Medium | 4.7 | 2026-08-14 | A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. T… |
CVE-2026-19838 | Medium | 4.3 | 2026-08-14 | A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the co… |
CVE-2026-66272 | Medium | 5.3 | 2026-08-14 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker… |
CVE-2026-63702 | Medium | 6.3 | 2026-08-14 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local acces… |
CVE-2026-63701 | Medium | 6.3 | 2026-08-14 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. A low privileged attacker wi… |
CVE-2026-19836 | Medium | 4.3 | 2026-08-14 | A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of th… |
CVE-2026-19834 | Medium | 4.7 | 2026-08-14 | A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component… |
CVE-2026-13002 | Medium | 4.4 | 2026-08-14 | A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dns… |
CVE-2026-58224 | Medium | 6.5 | 2026-08-14 | A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malf… |
CVE-2026-19879 | Medium | 5.3 | 2026-08-14 | A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16… |
CVE-2026-53472 | Medium | 6.3 | 2026-08-14 | A flaw was found in migration-planner. Insufficient validation of the `AgentStatusUpdate.CredentialUrl` field allows an authenticated attacker to store a malic… |
CVE-2026-1621 | Medium | 5.3 | 2026-08-14 | Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of Trusted Identifiers.
This issue affec… |
CVE-2026-19830 | Medium | 5.3 | 2026-08-14 | A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of the file /etc/bftpd.conf of the component… |
CVE-2026-19829 | Medium | 4.3 | 2026-08-14 | A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the… |
CVE-2026-19828 | Medium | 6.3 | 2026-08-14 | A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snaps… |
CVE-2026-19827 | Medium | 5.3 | 2026-08-14 | A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the file /admin/controller/JobLogController.java of th… |
CVE-2026-73630 | Medium | 5.8 | 2026-08-14 | SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth o… |
CVE-2026-73049 | Medium | 5.8 | 2026-08-14 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list… |
CVE-2026-73048 | Medium | 5.8 | 2026-08-14 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing… |
CVE-2026-72838 | Medium | 6.5 | 2026-08-14 | FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to writ… |
CVE-2026-72835 | Medium | 6.8 | 2026-08-14 | filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined de… |
CVE-2026-72834 | Medium | 4.3 | 2026-08-14 | filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch of resourceGetHandler reads the entire… |
CVE-2026-72832 | Medium | 5.4 | 2026-08-14 | Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Secur… |
CVE-2026-72823 | Medium | 5.4 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks is… |
CVE-2026-72821 | Medium | 5.4 | 2026-08-14 | Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw… |
CVE-2026-72820 | Medium | 4.9 | 2026-08-14 | Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the ha… |
CVE-2026-72817 | Medium | 6.5 | 2026-08-14 | go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr… |
CVE-2026-72816 | Medium | 6.5 | 2026-08-14 | go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled h… |
CVE-2026-72812 | Medium | 6.5 | 2026-08-14 | SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger p… |
CVE-2026-19617 | Medium | 5.5 | 2026-08-14 | A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This cou… |
CVE-2026-16810 | Medium | 6.5 | 2026-08-14 | The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via… |
CVE-2026-16739 | Medium | 5.9 | 2026-08-14 | The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the target… |
CVE-2026-14290 | Medium | 6.8 | 2026-08-14 | The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowin… |
CVE-2026-12743 | Medium | 4.9 | 2026-08-14 | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' param… |
CVE-2025-10308 | Medium | 4.3 | 2026-08-14 | The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing n… |
CVE-2026-19787 | Medium | 4.7 | 2026-08-14 | A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_cargo_… |
CVE-2026-19786 | Medium | 4.3 | 2026-08-14 | A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulati… |
CVE-2026-19785 | Medium | 6.3 | 2026-08-14 | A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medica… |
CVE-2026-19784 | Medium | 4.3 | 2026-08-14 | A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation caus… |
CVE-2026-19770 | Medium | 5.3 | 2026-08-14 | A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/… |
CVE-2026-19767 | Medium | 6.3 | 2026-08-14 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Ex… |
CVE-2026-19765 | Medium | 6.3 | 2026-08-14 | A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec80593616e49054e5. This vulnerability affects the function loadSour… |
CVE-2026-19761 | Medium | 4.7 | 2026-08-14 | A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the comp… |
CVE-2026-19756 | Medium | 6.3 | 2026-08-13 | A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code… |
CVE-2026-73840 | Medium | 5.3 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in in… |
CVE-2026-73657 | Medium | 4.2 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` i… |
CVE-2026-73489 | Medium | 4.3 | 2026-08-13 | Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request wi… |
CVE-2026-73479 | Medium | 5.0 | 2026-08-13 | dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OS… |
CVE-2026-73428 | Medium | 4.6 | 2026-08-13 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted H… |
CVE-2026-73304 | Medium | 4.9 | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by pack… |
CVE-2026-73039 | Medium | 5.4 | 2026-08-13 | streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' v… |
CVE-2026-56860 | Medium | 5.9 | 2026-08-13 | Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in qu… |
CVE-2026-56858 | Medium | 6.1 | 2026-08-13 | Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. |
CVE-2026-19752 | Medium | 6.3 | 2026-08-13 | A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file sr… |
CVE-2026-19751 | Medium | 6.3 | 2026-08-13 | A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the… |
CVE-2026-73480 | Medium | 5.0 | 2026-08-13 | gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file… |
CVE-2026-18741 | Medium | 4.8 | 2026-08-13 | Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administr… |
CVE-2026-18715 | Medium | 6.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities. |
CVE-2026-18671 | Medium | 6.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer overflow during bounds ch… |
CVE-2026-18086 | Medium | 4.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking. |
CVE-2026-18068 | Medium | 4.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion. |
CVE-2026-18020 | Medium | 5.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking. |
CVE-2026-17649 | Medium | 5.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read. |
CVE-2026-17476 | Medium | 4.8 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write. |
CVE-2026-17468 | Medium | 5.3 | 2026-08-13 | IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key. |
CVE-2026-17438 | Medium | 4.4 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management. |
CVE-2026-17226 | Medium | 5.4 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds r… |
CVE-2026-17216 | Medium | 5.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an integer error when processing DRDA large-object headers. |
CVE-2026-17212 | Medium | 5.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read. |
CVE-2026-17088 | Medium | 4.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability. |
CVE-2026-17078 | Medium | 5.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion. |