CVE-2026-18729
(8.8 HIGH)

EPSS: 0.46%

updated 2026-08-31T21:54:24.870000

1 posts

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

1 repos

https://github.com/rmhowe425/POC-CVE-2026-18729

CVE-2026-19295
(9.9 CRITICAL)

EPSS: 0.98%

updated 2026-08-31T21:33:57.960000

1 posts

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing

1 repos

https://github.com/rmhowe425/POC-CVE-2026-19295

CVE-2026-81578
(9.8 CRITICAL)

EPSS: 0.39%

updated 2026-08-31T21:31:56

13 posts

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

2 repos

https://github.com/virologi-info/papercut-toolkit

https://github.com/yora1928/PaperCut-CVE-2026-81578-82078

CVE-2026-83596
(8.8 HIGH)

EPSS: 0.00%

updated 2026-08-31T21:17:55.190000

2 posts

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

CVE-2026-82908
(8.8 HIGH)

EPSS: 0.00%

updated 2026-08-31T21:17:54.503000

2 posts

A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of the component MMIO Write Path Handler. Performing a manipulation of the argument count/elementSize results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used. The vendor was contacte

CVE-2026-82226
(9.8 CRITICAL)

EPSS: 0.00%

updated 2026-08-31T21:17:53.447000

2 posts

Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.

CVE-2026-82616
(9.9 CRITICAL)

EPSS: 0.61%

updated 2026-08-31T20:56:08.800000

1 posts

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

CVE-2026-82592
(9.9 CRITICAL)

EPSS: 0.77%

updated 2026-08-31T20:56:08.800000

1 posts

A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the file /boafrm/formDiskFormat of the component Disk Formatting Handler Endpoint. The manipulation of the argument partition results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used.

CVE-2026-82657
(7.5 HIGH)

EPSS: 0.27%

updated 2026-08-31T20:56:08.800000

1 posts

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/announcements.php, disclosing titles, full post text, author names, and timestamps.

CVE-2026-82653
(8.9 HIGH)

EPSS: 0.22%

updated 2026-08-31T20:56:08.800000

1 posts

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.

CVE-2026-82638
(7.5 HIGH)

EPSS: 0.30%

updated 2026-08-31T20:56:08.800000

1 posts

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content.

CVE-2026-82539
(9.1 CRITICAL)

EPSS: 0.60%

updated 2026-08-31T20:56:08.800000

1 posts

A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function setMacFilterRules of the file cstecgi.cgi of the component MAC Filtering. Executing a manipulation of the argument desc can lead to memory corruption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

1 repos

https://github.com/Xernary/CVE-2026-82539

CVE-2026-82463
(8.1 HIGH)

EPSS: 0.30%

updated 2026-08-31T20:56:08.800000

1 posts

pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.

CVE-2026-82450
(8.8 HIGH)

EPSS: 0.57%

updated 2026-08-31T20:56:08.800000

1 posts

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unaut

CVE-2026-82285
(8.2 HIGH)

EPSS: 0.31%

updated 2026-08-31T20:56:08.800000

1 posts

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using ca

CVE-2026-16947
(9.1 CRITICAL)

EPSS: 0.24%

updated 2026-08-31T20:14:36.250000

1 posts

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to an arbitrary host (disclosing the merchant's payment-gateway credentials) and to forge a success respon

CVE-2026-76586
(7.5 HIGH)

EPSS: 0.21%

updated 2026-08-31T20:14:36.250000

1 posts

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.

CVE-2026-14494
(9.8 CRITICAL)

EPSS: 0.69%

updated 2026-08-31T20:14:36.250000

1 posts

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. This makes it possible for unauthenticat

CVE-2026-82635
(8.8 HIGH)

EPSS: 0.40%

updated 2026-08-31T19:27:23.020000

1 posts

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the

CVE-2026-73125
(9.8 CRITICAL)

EPSS: 0.53%

updated 2026-08-31T19:18:40.503000

2 posts

Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability.

CVE-2026-77977
(8.1 HIGH)

EPSS: 0.23%

updated 2026-08-31T19:18:40.503000

1 posts

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings, resulting in a loss of configuration and service availability.

CVE-2026-3627
(9.1 CRITICAL)

EPSS: 0.51%

updated 2026-08-31T19:17:22.933000

1 posts

IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVE-2026-82472
(7.5 HIGH)

EPSS: 0.41%

updated 2026-08-31T19:17:20.790000

1 posts

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.

CVE-2026-82461
(8.1 HIGH)

EPSS: 0.19%

updated 2026-08-31T19:17:20.150000

2 posts

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.

CVE-2026-82460
(9.8 CRITICAL)

EPSS: 0.77%

updated 2026-08-31T19:17:20.013000

1 posts

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.

CVE-2026-82454
(9.1 CRITICAL)

EPSS: 0.23%

updated 2026-08-31T19:17:19.747000

1 posts

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 an

CVE-2026-82291
(8.1 HIGH)

EPSS: 0.30%

updated 2026-08-31T19:17:18.407000

1 posts

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.

CVE-2026-82286
(8.6 HIGH)

EPSS: 0.35%

updated 2026-08-31T19:17:18.013000

1 posts

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourced from attacker-controlled URLs.

1 repos

https://github.com/BiiTts/CVE-2026-82286-gpt-crawler-Arbitrary-File-Write

CVE-2026-82282
(8.0 HIGH)

EPSS: 0.26%

updated 2026-08-31T19:17:17.753000

1 posts

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

CVE-2026-82270
(7.5 HIGH)

EPSS: 0.28%

updated 2026-08-31T19:17:17.097000

1 posts

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal services and exfiltrate provider API keys.

CVE-2026-82253
(7.5 HIGH)

EPSS: 0.50%

updated 2026-08-31T19:17:16.430000

1 posts

gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritan

CVE-2026-81849
(8.8 HIGH)

EPSS: 0.57%

updated 2026-08-31T19:17:15.310000

1 posts

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the intended download directory with root privileges, via crafted object keys in the S3 source the document is

CVE-2026-81532
(8.8 HIGH)

EPSS: 0.28%

updated 2026-08-31T19:17:14.357000

1 posts

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message, memory adjacent to that buffer is overwritten with user-supplied content. This can terminate the hosting

CVE-2026-81490
(7.7 HIGH)

EPSS: 0.24%

updated 2026-08-31T19:17:13.893000

1 posts

A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configured retries are exhausted, proceeds without a valid result, ending the schema refresh routine. The mongos

CVE-2026-79748
(9.9 CRITICAL)

EPSS: 0.00%

updated 2026-08-31T19:17:13.667000

2 posts

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations and then immediately spawn the configured stdio process via child_process.spawn. Authentication is requi

CVE-2026-76639
(8.8 HIGH)

EPSS: 0.71%

updated 2026-08-31T19:17:11.783000

2 posts

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers

1 repos

https://github.com/OlivierLaflamme/UniBLEed

CVE-2026-55584
(7.5 HIGH)

EPSS: 2.42%

updated 2026-08-31T19:17:00.940000

1 posts

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, me

1 repos

https://github.com/mirackayikci/CVE-2026-55584

CVE-2026-55565
(9.9 CRITICAL)

EPSS: 0.46%

updated 2026-08-31T19:17:00.220000

1 posts

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /

CVE-2026-54755
(9.6 CRITICAL)

EPSS: 0.39%

updated 2026-08-31T19:16:52.973000

1 posts

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32 accumulators. Crafted values such as two 0x80000000 entries wrap the validation sum to zero and pass CheckVa

CVE-2026-82078
(9.1 CRITICAL)

EPSS: 0.46%

updated 2026-08-31T18:41:41.897000

11 posts

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on

2 repos

https://github.com/virologi-info/papercut-toolkit

https://github.com/yora1928/PaperCut-CVE-2026-81578-82078

CVE-2026-17615
(7.5 HIGH)

EPSS: 0.00%

updated 2026-08-31T18:31:39

2 posts

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitiv

CVE-2026-79750
(7.7 HIGH)

EPSS: 0.00%

updated 2026-08-31T18:17:20.627000

2 posts

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.30, MCPHub scopes non-admin users to servers they own (list views and config edits enforce ownership), but the tool-execution API does not. Any authenticated non-admin user can invoke tools on MCP servers owned by othe

CVE-2026-79746
(8.1 HIGH)

EPSS: 0.00%

updated 2026-08-31T18:17:20.057000

2 posts

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' (or 'custom') is used against a group route, isBearerKeyAllowedForRequest grants access to the entire group as long as any single server in that group appears in the key

CVE-2026-83492
(0 None)

EPSS: 0.00%

updated 2026-08-31T17:17:47.483000

2 posts

Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affects Kubio AI Website Builder: before 2.9.1.

CVE-2026-82641
(8.6 HIGH)

EPSS: 0.34%

updated 2026-08-31T17:17:45.880000

1 posts

keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.

CVE-2026-46595
(10.0 CRITICAL)

EPSS: 0.50%

updated 2026-08-31T13:18:18.560000

1 posts

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

CVE-2026-82613
(7.3 HIGH)

EPSS: 0.26%

updated 2026-08-31T06:30:31

1 posts

A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the function loadResultList of the file /index.php?q=product of the component Product Search Interface. Performing a manipulation of the argument Search results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

CVE-2026-82593
(9.9 CRITICAL)

EPSS: 0.51%

updated 2026-08-31T00:30:32

1 posts

A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module Firmware Upgrade. This manipulation of the argument fota_url causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVE-2026-56718
(7.5 HIGH)

EPSS: 0.58%

updated 2026-08-30T21:30:34

1 posts

AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext R

CVE-2026-82549
(8.3 HIGH)

EPSS: 0.19%

updated 2026-08-30T18:33:59

1 posts

A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component SecurityModeComplete Handler. Such manipulation leads to improper validation of integrity check value. The attack may be launched remotely. The exploit is publicly available and might be used.

CVE-2026-82645
(8.6 HIGH)

EPSS: 0.13%

updated 2026-08-30T15:30:35

1 posts

AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream() access gate and the restream ownership check, causing the endpoint to return any restream's stream_key and stream_url (credentials for external platforms such as YouTube, Facebook

CVE-2026-82644
(7.5 HIGH)

EPSS: 0.26%

updated 2026-08-30T15:30:35

1 posts

WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlobal) that silently discards writes for any client identified as a bot by isBot(). Because isBot() treats a missing User-Agent header as a bot by default —

CVE-2026-82639
(7.5 HIGH)

EPSS: 0.30%

updated 2026-08-30T15:30:35

1 posts

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing 'api.openai.com' to pass validation and receive the server's credentials in the Authorization header.

CVE-2026-82642
(8.8 HIGH)

EPSS: 0.38%

updated 2026-08-30T15:30:34

1 posts

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute

CVE-2026-82542
(10.0 CRITICAL)

EPSS: 0.64%

updated 2026-08-30T15:30:34

2 posts

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-82655
(7.5 HIGH)

EPSS: 0.33%

updated 2026-08-30T15:30:29

1 posts

Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in role_list and inject SQL through relation_type_list to extract database contents including password hashes and user credentials.

CVE-2026-82654
(8.9 HIGH)

EPSS: 0.22%

updated 2026-08-30T15:30:28

1 posts

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block.

CVE-2026-82636
(7.9 HIGH)

EPSS: 0.79%

updated 2026-08-30T15:30:27

1 posts

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c.

CVE-2026-15980
(9.8 CRITICAL)

EPSS: 0.45%

updated 2026-08-30T06:30:22

2 posts

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication c

CVE-2026-16259
(9.8 CRITICAL)

EPSS: 0.28%

updated 2026-08-30T03:32:22

1 posts

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password,

CVE-2026-16061
(8.6 HIGH)

EPSS: 0.26%

updated 2026-08-30T03:32:22

1 posts

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

CVE-2026-77012
(9.3 CRITICAL)

EPSS: 0.20%

updated 2026-08-30T03:31:22

1 posts

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the server, force it to issue arbitrary requests and retrieve the responses, and write attacker-supplied conten

CVE-2026-16600
(7.7 HIGH)

EPSS: 0.20%

updated 2026-08-30T03:31:21

1 posts

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external URLs and read the response, resulting in a full-read Server-Side Request Forgery.

CVE-2026-76548
(8.2 HIGH)

EPSS: 0.19%

updated 2026-08-30T03:31:21

1 posts

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.

CVE-2026-77007
(7.5 HIGH)

EPSS: 0.26%

updated 2026-08-30T03:31:21

1 posts

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server.

CVE-2026-72984
(8.8 HIGH)

EPSS: 0.44%

updated 2026-08-30T01:20:24.150000

1 posts

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-15369
(9.8 CRITICAL)

EPSS: 0.40%

updated 2026-08-29T21:30:26

1 posts

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the af_reg_checkout_data_to_order_meta_data_block() function, persisting it in o

CVE-2026-82474
(7.8 HIGH)

EPSS: 0.13%

updated 2026-08-29T18:31:38

1 posts

Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.

CVE-2026-82473
(8.2 HIGH)

EPSS: 0.35%

updated 2026-08-29T18:31:38

1 posts

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade scheduling.

CVE-2026-75807
(7.5 HIGH)

EPSS: 0.29%

updated 2026-08-29T18:31:38

1 posts

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mo_saml_required_certificate option before the signature-validation verdict is enforced, because mo_saml_find_certificate() r

CVE-2026-82475
(8.1 HIGH)

EPSS: 0.26%

updated 2026-08-29T18:31:38

1 posts

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.

CVE-2026-82466
(8.7 HIGH)

EPSS: 0.34%

updated 2026-08-29T18:31:32

1 posts

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.

CVE-2026-82457
(7.8 HIGH)

EPSS: 0.12%

updated 2026-08-29T15:30:27

1 posts

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target programs with root privileges instead of intended unprivileged accounts.

CVE-2026-82456
(10.0 CRITICAL)

EPSS: 0.37%

updated 2026-08-29T15:30:27

1 posts

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.

CVE-2026-82452
(9.8 CRITICAL)

EPSS: 0.46%

updated 2026-08-29T15:30:27

1 posts

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.

CVE-2026-82453
(7.5 HIGH)

EPSS: 0.28%

updated 2026-08-29T15:30:21

1 posts

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.

CVE-2026-82448
(9.8 CRITICAL)

EPSS: 0.41%

updated 2026-08-29T15:30:20

1 posts

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.

CVE-2026-82252
(7.5 HIGH)

EPSS: 0.39%

updated 2026-08-29T14:16:37.800000

1 posts

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and ur

CVE-2026-82251
(7.5 HIGH)

EPSS: 0.39%

updated 2026-08-29T14:16:37.677000

1 posts

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.

CVE-2026-82447
(8.8 HIGH)

EPSS: 0.45%

updated 2026-08-29T13:16:38.643000

1 posts

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.

CVE-2026-80714
(9.8 CRITICAL)

EPSS: 0.40%

updated 2026-08-29T07:16:52.880000

2 posts

In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connection flags from the destination into cp->flags. IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced connection inherits IP_VS_C

CVE-2026-41012
(7.7 HIGH)

EPSS: 0.10%

updated 2026-08-29T03:31:04

1 posts

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can intercept traffic between the BOSH Director and vCenter can establish a malicious server impersonati

CVE-2026-38638
(7.5 HIGH)

EPSS: 0.45%

updated 2026-08-29T00:32:03

1 posts

An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2026-56854
(7.5 HIGH)

EPSS: 0.33%

updated 2026-08-29T00:32:03

1 posts

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote

CVE-2026-81533
(7.1 HIGH)

EPSS: 0.21%

updated 2026-08-29T00:31:12

1 posts

An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length

CVE-2026-81518
(7.5 HIGH)

EPSS: 0.15%

updated 2026-08-29T00:31:12

1 posts

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session an

CVE-2026-81517
(7.5 HIGH)

EPSS: 0.26%

updated 2026-08-29T00:31:12

1 posts

An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operation subsequently fails, the resulting error is not handled and the shared mongosqld process ends, ending service for all connected SQL clients. The proces

CVE-2026-82017
(7.6 HIGH)

EPSS: 0.15%

updated 2026-08-29T00:31:12

1 posts

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject malicious kernel command line parameters that execute with boot environment privileg

CVE-2026-81520
(7.5 HIGH)

EPSS: 0.24%

updated 2026-08-29T00:31:04

1 posts

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend

CVE-2026-18891
(8.2 HIGH)

EPSS: 0.29%

updated 2026-08-29T00:31:02

1 posts

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.

CVE-2026-19286
(9.8 CRITICAL)

EPSS: 0.61%

updated 2026-08-29T00:31:02

1 posts

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

1 repos

https://github.com/rmhowe425/POC-CVE-2026-19286

CVE-2026-18904
(8.2 HIGH)

EPSS: 0.31%

updated 2026-08-29T00:31:02

1 posts

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

CVE-2026-18899
(7.5 HIGH)

EPSS: 0.46%

updated 2026-08-29T00:31:02

1 posts

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.

CVE-2026-18527
(9.9 CRITICAL)

EPSS: 0.29%

updated 2026-08-29T00:31:01

1 posts

IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability to execute actions under another user's authenticated profile gaining elevated privileges on the IBM i system.

CVE-2026-17203
(7.5 HIGH)

EPSS: 0.43%

updated 2026-08-29T00:31:01

1 posts

IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.

CVE-2026-55784
(7.5 HIGH)

EPSS: 0.25%

updated 2026-08-28T23:17:07.517000

1 posts

free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by internal/sbi/processor/ue_authentication.go creates an AusfUeContext, and AddAusfUeContextToPool executes ausfContext.Ue

CVE-2026-55848
(8.6 HIGH)

EPSS: 0.33%

updated 2026-08-28T22:33:36

1 posts

### Summary XXE on MapFish Print allows reading arbitrary files of certain types. Eg /etc/passwd or k8 secrets and certs. https://github.com/mapfish/mapfish-print/commit/13020c0fbc299e5f604e4e66066311c4bf04d507 ### Details To trigger the XXE it is required to host a remote script and dtd file. When using the Print feature its possible to send the attacker server url as url of the gml layer. The

CVE-2026-55484
(7.5 HIGH)

EPSS: 0.34%

updated 2026-08-28T22:16:50.640000

1 posts

ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed

CVE-2026-37237
(7.5 HIGH)

EPSS: 0.53%

updated 2026-08-28T22:16:48.207000

1 posts

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read() without enforcing a maximum response size, allowing an attacker to exhaust server memory by providing a URL to an arbitrarily large file.

CVE-2026-55841
(7.5 HIGH)

EPSS: 0.36%

updated 2026-08-28T22:13:01

1 posts

### Impact A security issue has been identified in Graylog affecting the parsing of syslog messages that use a key-value format, such as those generated by Fortigate devices. The vulnerability allows attackers to overwrite individual message fields, or to produce invalid messages which Graylog will discard. This effectively enables log evasion techniques to obscure malicious activity. ### Patch

CVE-2026-50979
(8.1 HIGH)

EPSS: 1.43%

updated 2026-08-28T21:32:17

1 posts

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter

1 repos

https://github.com/bugresearch/CVE-2026-50979

CVE-2026-18886(CVSS UNKNOWN)

EPSS: 0.25%

updated 2026-08-28T21:32:13

2 posts

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation.  ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to ou

CVE-2026-18885(CVSS UNKNOWN)

EPSS: 0.43%

updated 2026-08-28T21:32:13

2 posts

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond what was intended.  ServiceNow deployed a security update to hosted instances and ServiceNow provid

CVE-2026-82284
(8.1 HIGH)

EPSS: 0.24%

updated 2026-08-28T21:31:36

1 posts

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary chats, and inject fabricated messages into other users' conversations.

CVE-2026-82329
(9.8 CRITICAL)

EPSS: 0.38%

updated 2026-08-28T21:31:36

1 posts

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

CVE-2026-82278
(8.8 HIGH)

EPSS: 0.56%

updated 2026-08-28T21:31:29

1 posts

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, which executes them with exec() without sandboxing, gaining access to filesystem, credentials, and internal network resources.

CVE-2026-82275
(7.5 HIGH)

EPSS: 0.37%

updated 2026-08-28T21:31:29

1 posts

Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary files accessible by the server process.

CVE-2026-82279
(8.1 HIGH)

EPSS: 0.27%

updated 2026-08-28T21:31:29

1 posts

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.

CVE-2026-82288
(7.5 HIGH)

EPSS: 0.32%

updated 2026-08-28T21:31:28

1 posts

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.

CVE-2026-82287
(8.1 HIGH)

EPSS: 0.28%

updated 2026-08-28T21:31:28

1 posts

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website to read analytics data, account information, and perform authenticated state-changing operations as the

CVE-2026-82283
(8.1 HIGH)

EPSS: 0.24%

updated 2026-08-28T21:31:27

1 posts

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints.

CVE-2026-82277
(9.8 CRITICAL)

EPSS: 0.43%

updated 2026-08-28T21:31:26

1 posts

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.

CVE-2026-82269
(8.1 HIGH)

EPSS: 0.30%

updated 2026-08-28T21:31:25

1 posts

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.

CVE-2026-82268
(7.5 HIGH)

EPSS: 0.28%

updated 2026-08-28T21:31:25

1 posts

Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio interface to make the server issue HTTP requests to arbitrary internal addresses including metadata services and read retrieved content through parsed docum

CVE-2026-75124
(7.5 HIGH)

EPSS: 0.48%

updated 2026-08-28T21:31:24

1 posts

PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an ove

CVE-2026-75486
(8.0 HIGH)

EPSS: 1.25%

updated 2026-08-28T21:31:24

1 posts

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child_process.exec() via an unescape

CVE-2026-82266
(9.8 CRITICAL)

EPSS: 0.34%

updated 2026-08-28T21:31:23

1 posts

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.

CVE-2026-82021
(8.3 HIGH)

EPSS: 0.23%

updated 2026-08-28T21:31:19

1 posts

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromises the upstream repository can propagate malicious code to every host that installs the affected catalo

CVE-2026-77586
(8.0 HIGH)

EPSS: 0.23%

updated 2026-08-28T21:31:18

1 posts

In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to a sampled MongoDB collection can choose a name that closes the quoted identifier early, so that additional SQL text becomes part of the gen

CVE-2026-56100
(8.1 HIGH)

EPSS: 0.29%

updated 2026-08-28T21:31:17

1 posts

SpringBlade versions 2.7.3 through 3.5.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks. Attackers can exploit the gateway's authentication filter, which only validates JWT parsing

CVE-2026-37736
(7.5 HIGH)

EPSS: 0.34%

updated 2026-08-28T21:31:12

1 posts

An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2026-74820(CVSS UNKNOWN)

EPSS: 0.25%

updated 2026-08-28T21:31:08

2 posts

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended.  ServiceNow deployed a security update to hosted ins

CVE-2026-82123
(6.5 MEDIUM)

EPSS: 0.18%

updated 2026-08-28T20:20:15.080000

1 posts

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tangible Loops & Logic.

CVE-2026-18983
(7.5 HIGH)

EPSS: 0.50%

updated 2026-08-28T20:17:23.810000

1 posts

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type validation in wp_handle_upload() called without a MIME allow-list, with post-write validation relying on the attacker-controlled client-supplied Content-Type

CVE-2026-55634
(9.9 CRITICAL)

EPSS: 0.45%

updated 2026-08-28T19:17:43

1 posts

## Overview A DataObject **class-definition field name** is concatenated, without an identifier allowlist, into the PHP class source that Pimcore generates for every DataObject class (`protected $<fieldName>;`). A user holding only the ordinary `objects` (DataObjects) permission can import a class definition whose field name closes the property and injects arbitrary PHP into the generated class f

CVE-2026-55215
(7.5 HIGH)

EPSS: 0.42%

updated 2026-08-28T19:03:39

1 posts

### Summary When SSL/TLS is enabled but no CA / server certificate is provided, the connector verifies the server's identity using fingerprint validation. The check is effective, the connection is ultimately rejected when it fails, but it happens *after* the authentication exchange. As a result, the credentials are sent before validation occurs, so an active man-in-the-middle who presents their

CVE-2026-55247
(9.1 CRITICAL)

EPSS: 0.34%

updated 2026-08-28T18:59:43

1 posts

### Impact By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk (SSRF), and store XSS. ### Patches The problem has been patched in `plone.app.event`. * For Plone 6.2: upgrade to `plone.app.event` 6.0.1 * For Plone 6.1: upgrade to `plone.app.event` 5.2.4 * For Plone 6.0

CVE-2026-55248
(9.1 CRITICAL)

EPSS: 0.32%

updated 2026-08-28T18:41:35

1 posts

### Impact By adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers (SSRF). A malicious RSS feed could cause stored XSS, when the url of a feed item is a javascript url. ### Patches T

CVE-2026-81767
(7.5 HIGH)

EPSS: 0.20%

updated 2026-08-28T18:31:39

1 posts

Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.

CVE-2026-82227
(8.5 HIGH)

EPSS: 0.23%

updated 2026-08-28T18:31:39

1 posts

Contributor SQL Injection in WPBulky <= 1.2.2 versions.

CVE-2026-81285
(7.5 HIGH)

EPSS: 0.26%

updated 2026-08-28T18:31:34

1 posts

Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.

CVE-2026-55485
(8.8 HIGH)

EPSS: 0.39%

updated 2026-08-28T18:14:13

1 posts

## Summary `piccolo_admin` uses a helper called `superuser_validators` to gate access to the user and session tables for non-superusers. The helper rejects `PUT`, `PATCH`, `DELETE`, and `POST`, but **does not reject `GET`**. The `sessions` table stores live session tokens **in plaintext**, and the token column is not marked `secret=True`, so it is included in every `GET` response. Any non-superu

CVE-2026-55559
(9.8 CRITICAL)

EPSS: 0.55%

updated 2026-08-28T17:23:05

1 posts

### Summary `templateArgs` sent to `POST /api/instances` (and `PATCH /api/instances/{instance}`) are written into the rendered instance config as raw text, then parsed as YAML and loaded. Yamcs instantiates each `services:` entry by its `class:`, so injecting YAML through a template arg lets you add a `services:` entry for `org.yamcs.ProcessRunner` and run a command on the host. The args aren't e

CVE-2026-55552
(7.5 HIGH)

EPSS: 0.43%

updated 2026-08-28T17:20:43

1 posts

### Attack type:  Unauthenticated remote  ### Impact: Attackers can access any system files from the underlying host. ### Affected components: HttpRequestHandler.java, StaticFileHandler.java An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensi

CVE-2026-55521
(8.8 HIGH)

EPSS: 0.36%

updated 2026-08-28T17:09:36

1 posts

### Summary Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges (e.g., an unprivileged "Guest"), to bypass intended access controls. An attacker can exploit these flaws to extract sensitive telemetry metadata, disrupt satellite communication link protocols (C

CVE-2026-55511
(9.1 CRITICAL)

EPSS: 0.68%

updated 2026-08-28T17:06:57

1 posts

## Overview Yamcs compiles StreamSQL expressions to Java on the fly with the Janino `SimpleCompiler` (no restrictive class-loading policy or expression sandbox). When a StreamSQL aggregate such as `sum(...)` is applied to a **column**, the column's *name* is interpolated **unescaped** into the generated Java source. Because Yamcs accepts arbitrary characters in a double-quoted column identifier a

1 repos

https://github.com/junfuture1103/CVE-2026-55511

CVE-2026-55065
(8.1 HIGH)

EPSS: 0.35%

updated 2026-08-28T16:50:36

1 posts

### Summary A user with only a single self-owned project can permanently destroy the Kanban bucket assignments (`task_buckets`) and task ordering (`task_positions`) of **any other project view in the entire instance**. The `ProjectView.Delete` model method runs three SQL statements: the first is properly scoped to `(view_id, project_id)`, but the next two cascading deletes on `task_buckets` and `

CVE-2026-54788
(7.5 HIGH)

EPSS: 0.56%

updated 2026-08-28T16:35:04

1 posts

### Impact Datadog tracing libraries that implement W3C Trace Context (`tracecontext`) propagation parse the incoming `tracestate` header without enforcing a size cap on the Datadog vendor entry (`dd=...`). The `dd=` value contains semicolon-separated `key:value` pairs, and the parser allocates a hash-map entry for each pair. A remote, unauthenticated attacker can send a `tracestate` header whose

CVE-2026-54754
(9.6 CRITICAL)

EPSS: 0.30%

updated 2026-08-28T16:22:16

1 posts

## Summary When a marketplace order is settled (`MarketBuy` / `BuyItNow`, and auction `Claim`), the buyer's payment is split three ways — **referral**, **royalties**, and the **seller (market-order owner) remainder**: ``` marketOwnerAmount = CurrentBid − referralAmount − royaltiesAmount ``` Referral and royalties are paid out **unconditionally**, but the seller remainder is only paid **when pos