CVE-2026-18951
(8.8 HIGH)

EPSS: 0.00%

updated 2026-08-11T06:31:19

2 posts

A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permissions into the native Kubernetes `edit ClusterRole`. This allows any user with `edit ClusterRole` permissions in a namespace to create, modify, and delete `TrainJobs`. When combined with a separate vulnerability (TRN-01) that permits arbitrar

CVE-2026-18950
(8.8 HIGH)

EPSS: 0.00%

updated 2026-08-11T06:31:19

2 posts

A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the `roleRef` field, allowing a user to specify an arbitrary role, including highly privileged ones like `cluster-admin`. This can lead to privilege escalation, where an attacker gains unauthorized elevated access withi

CVE-2026-18949
(8.8 HIGH)

EPSS: 0.00%

updated 2026-08-11T06:31:19

2 posts

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.

CVE-2026-18947
(8.5 HIGH)

EPSS: 0.00%

updated 2026-08-11T06:31:19

2 posts

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The cons

CVE-2026-19516
(9.1 CRITICAL)

EPSS: 0.00%

updated 2026-08-11T06:17:13.433000

2 posts

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and r

CVE-2026-13716
(9.1 CRITICAL)

EPSS: 0.00%

updated 2026-08-11T06:17:12.870000

2 posts

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

CVE-2026-19425
(9.8 CRITICAL)

EPSS: 0.00%

updated 2026-08-11T05:17:14.680000

2 posts

Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

CVE-2026-18948
(9.9 CRITICAL)

EPSS: 0.00%

updated 2026-08-11T05:17:13.793000

4 posts

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the regis

CVE-2026-71983
(9.8 CRITICAL)

EPSS: 1.62%

updated 2026-08-11T03:18:01.180000

1 posts

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary commands by injecting malicious input through the pin2g, pin5g, or pin6g parameters. Attackers can exploit these unsanitized parameters to execute arbitrary commands on the affected device and obtain root privileges.

CVE-2026-71949
(9.8 CRITICAL)

EPSS: 2.09%

updated 2026-08-11T03:18:00.893000

1 posts

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges.

CVE-2026-71944
(9.8 CRITICAL)

EPSS: 2.09%

updated 2026-08-11T03:18:00.770000

1 posts

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.

CVE-2026-14526
(9.8 CRITICAL)

EPSS: 0.61%

updated 2026-08-11T02:16:49.880000

2 posts

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create a new administrator-level user account and achieve full site takeover by saving and executing a malic

CVE-2026-66763
(7.9 HIGH)

EPSS: 0.00%

updated 2026-08-11T01:17:23

2 posts

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected inform

CVE-2026-58243
(8.8 HIGH)

EPSS: 0.00%

updated 2026-08-11T01:17:22.160000

2 posts

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality

CVE-2026-44763
(7.6 HIGH)

EPSS: 0.00%

updated 2026-08-11T01:17:20.930000

2 posts

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker�s control. Successful exploitation could allow files to be written outside the i

CVE-2026-44758
(9.1 CRITICAL)

EPSS: 0.00%

updated 2026-08-11T01:17:20.670000

4 posts

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability

CVE-2026-34265
(9.8 CRITICAL)

EPSS: 0.00%

updated 2026-08-11T01:17:20.240000

6 posts

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.

CVE-2026-73030
(8.1 HIGH)

EPSS: 0.00%

updated 2026-08-10T21:32:15

2 posts

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.

CVE-2026-63622
(7.8 HIGH)

EPSS: 0.00%

updated 2026-08-10T21:32:08

2 posts

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for

CVE-2026-16594
(7.5 HIGH)

EPSS: 0.14%

updated 2026-08-10T21:31:59

1 posts

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.

CVE-2026-8037
(9.6 CRITICAL)

EPSS: 99.31%

updated 2026-08-10T20:19:44.760000

2 posts

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Nuclei template

2 repos

https://github.com/HORKimhab/CVE-2026-8037

https://github.com/Caster-chen/CVE-2026-8037-POC

CVE-2026-15038
(9.8 CRITICAL)

EPSS: 0.19%

updated 2026-08-10T20:17:26.803000

1 posts

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.

1 repos

https://github.com/Polosss/By-Poloss..-..CVE-2026-15038-POC

CVE-2026-72730
(8.7 HIGH)

EPSS: 0.00%

updated 2026-08-10T19:17:33.807000

1 posts

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

CVE-2026-72691
(7.5 HIGH)

EPSS: 0.00%

updated 2026-08-10T19:17:33.320000

1 posts

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication

CVE-2026-66738
(8.8 HIGH)

EPSS: 0.00%

updated 2026-08-10T18:32:17

2 posts

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET reque

CVE-2026-19389
(7.1 HIGH)

EPSS: 0.24%

updated 2026-08-10T18:17:42.883000

1 posts

Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information

CVE-2026-10595
(7.5 HIGH)

EPSS: 0.49%

updated 2026-08-10T18:17:38.870000

1 posts

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without sanitization or containment checks. URL-encoded dot-dot sequences (`%2e%2e`) bypass Starlette's built-in path

CVE-2026-71955
(9.8 CRITICAL)

EPSS: 2.13%

updated 2026-08-10T17:17:36.333000

1 posts

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resulting in command execution with root privileges.

CVE-2026-71576
(8.5 HIGH)

EPSS: 0.00%

updated 2026-08-10T17:17:36.060000

1 posts

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cl

CVE-2026-19341
(8.8 HIGH)

EPSS: 0.44%

updated 2026-08-10T16:19:29.797000

1 posts

A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/pptpSrvGlobalConfig. Such manipulation of the argument EncryptionMode leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did n

CVE-2026-72689
(7.5 HIGH)

EPSS: 0.00%

updated 2026-08-10T15:33:59

1 posts

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and returns full records including sender and signer PII and a pre-signed document download URL whenever the

CVE-2026-63106
(9.8 CRITICAL)

EPSS: 0.00%

updated 2026-08-10T15:33:59

1 posts

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform time-based blind SQL injection through the unsanitized rating parameter to extract the full database contents,

CVE-2026-13206
(9.8 CRITICAL)

EPSS: 0.00%

updated 2026-08-10T15:33:42

1 posts

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026.

CVE-2026-71989
(9.8 CRITICAL)

EPSS: 1.35%

updated 2026-08-10T15:17:44.397000

2 posts

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

CVE-2026-71948
(9.8 CRITICAL)

EPSS: 2.09%

updated 2026-08-10T14:17:26.467000

1 posts

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.

CVE-2026-67620
(7.7 HIGH)

EPSS: 0.43%

updated 2026-08-10T14:17:26.107000

1 posts

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticated attackers to force the server to issue arbitrary GET requests to cloud instance metadata services.

1 repos

https://github.com/abdugafforov-bobur/CVE-2026-67620-poc

CVE-2026-18786(CVSS UNKNOWN)

EPSS: 0.19%

updated 2026-08-10T09:31:28

1 posts

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to

CVE-2026-16985(CVSS UNKNOWN)

EPSS: 0.19%

updated 2026-08-10T09:31:27

1 posts

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution.

CVE-2026-19381
(7.8 HIGH)

EPSS: 0.11%

updated 2026-08-10T03:31:08

2 posts

A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSFX.sys of the component Driver. Performing a manipulation results in improper privilege management. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The vendor was contacted e

CVE-2026-19387
(7.6 HIGH)

EPSS: 0.24%

updated 2026-08-10T03:31:01

1 posts

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code ex

CVE-2026-15534
(0 None)

EPSS: 0.20%

updated 2026-08-09T22:16:30.373000

1 posts

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the sig

CVE-2026-19348
(9.8 CRITICAL)

EPSS: 2.46%

updated 2026-08-09T12:32:52

2 posts

A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1. Performing a manipulation of the argument enable/name/mac results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be us

CVE-2026-19346
(8.8 HIGH)

EPSS: 2.22%

updated 2026-08-09T12:32:46

1 posts

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-19195
(7.8 HIGH)

EPSS: 0.11%

updated 2026-08-09T06:32:38

1 posts

A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond

1 repos

https://github.com/patrickt2017/CVE-2026-19195-PoC

CVE-2026-19193
(7.8 HIGH)

EPSS: 0.11%

updated 2026-08-09T06:32:38

1 posts

A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

1 repos

https://github.com/patrickt2017/CVE-2026-19193-PoC

CVE-2026-64564
(9.8 CRITICAL)

EPSS: 0.48%

updated 2026-08-09T04:17:43.283000

6 posts

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds

3 repos

https://github.com/suominen/sctphantom

https://github.com/ethanolgolf/CVE-2026-64564

https://github.com/HackSpeak/CVE-2026-64564

CVE-2026-71993
(9.8 CRITICAL)

EPSS: 1.35%

updated 2026-08-09T00:31:13

3 posts

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.

CVE-2026-71986
(9.8 CRITICAL)

EPSS: 1.35%

updated 2026-08-09T00:31:13

2 posts

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the dmz function to execute malicious commands and obtain root privileges on the underlying system.

CVE-2026-71992
(9.8 CRITICAL)

EPSS: 1.35%

updated 2026-08-09T00:31:13

2 posts

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.

CVE-2026-71984
(9.8 CRITICAL)

EPSS: 1.35%

updated 2026-08-09T00:31:13

1 posts

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the urlfilter function to inject malicious commands and obtain root privileges on the underlying system.

CVE-2026-71987
(9.8 CRITICAL)

EPSS: 1.35%

updated 2026-08-09T00:31:07

2 posts

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

CVE-2026-71988
(9.8 CRITICAL)

EPSS: 1.35%

updated 2026-08-09T00:31:07

2 posts

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

CVE-2026-71991
(9.8 CRITICAL)

EPSS: 1.35%

updated 2026-08-09T00:31:07

2 posts

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the Telnet configuration interface to inject malicious commands and obtain root privileges on the underlying system.

CVE-2026-71990
(9.8 CRITICAL)

EPSS: 1.35%

updated 2026-08-09T00:16:48.130000

2 posts

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the SSH configuration interface to inject malicious commands and obtain root privileges on the underlying system.

CVE-2026-71985
(9.8 CRITICAL)

EPSS: 1.35%

updated 2026-08-09T00:16:47.360000

1 posts

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute malicious commands and obtain root privileges on the underlying system.

CVE-2026-71953
(9.8 CRITICAL)

EPSS: 2.09%

updated 2026-08-08T18:30:30

1 posts

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with root privileges.

CVE-2026-71958
(9.8 CRITICAL)

EPSS: 0.56%

updated 2026-08-08T18:30:30

1 posts

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a specific payload, or cause the device to crash.

CVE-2026-71954
(9.8 CRITICAL)

EPSS: 2.13%

updated 2026-08-08T18:30:30

1 posts

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.

CVE-2026-71947
(9.8 CRITICAL)

EPSS: 2.09%

updated 2026-08-08T18:30:29

1 posts

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges.

CVE-2026-71945
(9.8 CRITICAL)

EPSS: 2.09%

updated 2026-08-08T18:30:29

1 posts

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.

CVE-2026-71952
(9.8 CRITICAL)

EPSS: 2.09%

updated 2026-08-08T18:30:29

1 posts

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution with root privileges.

CVE-2026-71951
(9.8 CRITICAL)

EPSS: 2.09%

updated 2026-08-08T18:30:29

1 posts

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value field, resulting in command execution with root privileges.

CVE-2026-71950
(9.8 CRITICAL)

EPSS: 2.09%

updated 2026-08-08T18:30:29

1 posts

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.

CVE-2026-71957
(9.8 CRITICAL)

EPSS: 0.59%

updated 2026-08-08T18:30:29

1 posts

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist[].name field and execute arbitrary commands by crafting a specific payload, or cause the device to crash.

CVE-2026-42170
(7.8 HIGH)

EPSS: 0.19%

updated 2026-08-08T18:30:29

1 posts

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corrupt

CVE-2026-71946
(9.8 CRITICAL)

EPSS: 2.09%

updated 2026-08-08T18:30:25

1 posts

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.

CVE-2026-71956
(9.8 CRITICAL)

EPSS: 1.74%

updated 2026-08-08T18:16:56.503000

1 posts

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileges.

CVE-2026-16948(CVSS UNKNOWN)

EPSS: 0.13%

updated 2026-08-08T09:30:28

1 posts

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.

CVE-2026-16955(CVSS UNKNOWN)

EPSS: 0.16%

updated 2026-08-08T09:30:28

1 posts

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is

CVE-2026-71560
(9.1 CRITICAL)

EPSS: 0.55%

updated 2026-08-08T03:32:14

1 posts

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service. Users are recommended to

CVE-2026-5857
(8.1 HIGH)

EPSS: 0.53%

updated 2026-08-08T03:16:46.377000

1 posts

Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcp_input() re-invokes the parser with topic_received==0, and the persisted topic_len_received==1 skips the length-reading block containing the guard, fall

CVE-2026-71558
(9.8 CRITICAL)

EPSS: 0.71%

updated 2026-08-08T00:52:49.367000

1 posts

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to den

CVE-2026-20347
(7.5 HIGH)

EPSS: 0.33%

updated 2026-08-07T22:16:58.003000

1 posts

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-O files during scanning, which may result in an out-of-bounds buffer read. An attacker could ex

CVE-2026-20339
(7.5 HIGH)

EPSS: 0.33%

updated 2026-08-07T22:16:57.707000

2 posts

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an integer overflow. An attacker could exploit thi

CVE-2026-15361
(8.1 HIGH)

EPSS: 0.22%

updated 2026-08-07T21:31:36

1 posts

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.

CVE-2026-16263
(8.8 HIGH)

EPSS: 0.34%

updated 2026-08-07T21:31:36

1 posts

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.

CVE-2026-15972
(7.5 HIGH)

EPSS: 0.39%

updated 2026-08-07T21:30:40

1 posts

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-

CVE-2026-64636
(7.7 HIGH)

EPSS: 0.21%

updated 2026-08-07T21:30:37

1 posts

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

CVE-2026-16262
(7.5 HIGH)

EPSS: 0.16%

updated 2026-08-07T21:30:34

1 posts

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.

CVE-2026-19082
(7.5 HIGH)

EPSS: 0.29%

updated 2026-08-07T21:17:27.317000

1 posts

Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags. copy_string_tags() computes an ASCII EXIF tag's length as `entry->size - 1` to strip the trailing NUL. A zero-count ASCII entry sets `entry->size` to 0, and the derived length reaches i_tags_add() as -1, which is interpreted as a request

CVE-2026-48097
(7.8 HIGH)

EPSS: 0.27%

updated 2026-08-07T20:16:51.893000

1 posts

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of `shell=True` with commands that rely on executable resolution through the `PATH` environment variable. An attacker controlling the execution environment can place malicious executables such as sudo ea

CVE-2025-63235
(7.5 HIGH)

EPSS: 0.32%

updated 2026-08-07T20:16:49.087000

1 posts

In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK but fail to close the session or deallocate internal resources. This behavior allows an attacker to c

CVE-2026-48039
(9.1 CRITICAL)

EPSS: 0.34%

updated 2026-08-07T19:29:59

2 posts

# Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token | Field | Value | | ---------------- | ----- | | Repository | pipeboard-co/meta-ads-mcp | | Affected version | ≤ 1.0.101 (commit 496c988 ~ 7d14226); Versions 1.0.102–1.0.105 lack git tags, so patch status is unconfirmed. | | Vulnerability | CWE-287 — Improper Authentication | | Severity | Critic

CVE-2026-50481
(9.9 CRITICAL)

EPSS: 0.46%

updated 2026-08-07T19:29:09.813000

1 posts

Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

CVE-2026-56161
(9.6 CRITICAL)

EPSS: 0.38%

updated 2026-08-07T19:28:41.040000

1 posts

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.

CVE-2026-64638
(0 None)

EPSS: 0.77%

updated 2026-08-07T19:18:51.610000

7 posts

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all

Nuclei template

20 repos

https://github.com/0xlipon/xss2shell

https://github.com/MR-LeonardoGomes/XSS2Shell-CVE-2026-64638

https://github.com/HackSpeak/CVE-2026-64638

https://github.com/HORKimhab/CVE-2026-64638

https://github.com/0xBlackash/CVE-2026-64638

https://github.com/yogaGymn/XSS2Shell-CVE-2026-64638

https://github.com/ZSecur1ty/XSS2Shell-CVE-2026-64638

https://github.com/imbas007/CVE-2026-64638-POC

https://github.com/mohwahyudi/poc-CVE-2026-64638-

https://github.com/Dungsocool/CVE-2026-64638

https://github.com/tc4dy/CVE-2026-64638-PoC-Exploit

https://github.com/4minx/CVE-2026-64638

https://github.com/wordsec/XSS2Shell

https://github.com/eh-amish/CVE-2026-64638-XSS-to-Shell-PoC

https://github.com/jendmaoul/XSS2Shell-CVE-2026-64638

https://github.com/686f6c61/POC-WP-XSS2Shell-CVE-2026-64638

https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-

https://github.com/renzi25031469/CVE-2026-64638-WordPress-Core-XSS2Shell

https://github.com/5yu4n/CVE-2026-64638

https://github.com/g0d150ne/XSS2Shell

CVE-2026-64637
(9.9 CRITICAL)

EPSS: 0.23%

updated 2026-08-07T19:18:51.483000

2 posts

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.

CVE-2026-20346
(7.5 HIGH)

EPSS: 0.33%

updated 2026-08-07T19:17:41.360000

1 posts

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit

CVE-2026-16258
(9.8 CRITICAL)

EPSS: 0.47%

updated 2026-08-07T19:17:36.727000

1 posts

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.

CVE-2026-16041
(7.5 HIGH)

EPSS: 0.21%

updated 2026-08-07T19:17:36.343000

1 posts

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

CVE-2026-16038
(9.1 CRITICAL)

EPSS: 0.24%

updated 2026-08-07T19:17:36.110000

1 posts

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.

CVE-2026-15215
(8.8 HIGH)

EPSS: 0.35%

updated 2026-08-07T19:17:34.677000

1 posts

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) t

CVE-2026-71851
(9.0 None)

EPSS: 0.32%

updated 2026-08-07T18:50:37

2 posts

### Summary `CryptoJS.lib.WordArray.random()` in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small enough to enumerate on commodity hardware. Coinspect's [Ill Bloom](https://www.coinspect.com/blog/ill-bloom-investigation/) investigation c

CVE-2026-16030
(8.1 HIGH)

EPSS: 0.23%

updated 2026-08-07T18:32:49

1 posts

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.

CVE-2026-71559
(7.5 HIGH)

EPSS: 0.59%

updated 2026-08-07T18:32:49

1 posts

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0.  Users of other language implementations are not affected. Users are recommended to upgrade to version 1.5.0

CVE-2026-67688
(9.8 CRITICAL)

EPSS: 0.59%

updated 2026-08-07T18:32:48

1 posts

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code.

CVE-2026-45198
(7.8 HIGH)

EPSS: 0.12%

updated 2026-08-07T18:32:48

1 posts

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main mem

CVE-2026-20348
(7.5 HIGH)

EPSS: 0.33%

updated 2026-08-07T18:31:54

1 posts

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that

CVE-2026-20345
(7.5 HIGH)

EPSS: 0.33%

updated 2026-08-07T18:31:54

1 posts

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion operation, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerabil

CVE-2026-20338
(7.5 HIGH)

EPSS: 0.33%

updated 2026-08-07T18:31:53

4 posts

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to ca

CVE-2026-68772
(8.0 HIGH)

EPSS: 0.40%

updated 2026-08-07T18:31:53

1 posts

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands wh

CVE-2026-20337
(7.5 HIGH)

EPSS: 0.36%

updated 2026-08-07T18:31:52

5 posts

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A success

CVE-2026-70628
(7.8 HIGH)

EPSS: 0.15%

updated 2026-08-07T18:31:42

1 posts

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-c

CVE-2026-67422
(7.5 HIGH)

EPSS: 0.58%

updated 2026-08-07T18:26:08

1 posts

### Summary Four inline processors in pymdown-extensions contain regular expressions with exponential backtracking. A single untrusted Markdown line under 50 bytes drives `markdown.markdown()` into unbounded CPU on the rendering thread (seconds at ~45 bytes, growing exponentially with each added character). All four fire in the extension's **default configuration** and are reachable through the d

CVE-2026-70634
(8.1 HIGH)

EPSS: 0.41%

updated 2026-08-07T18:17:22.580000

1 posts

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML

CVE-2026-70632
(7.8 HIGH)

EPSS: 0.21%

updated 2026-08-07T18:17:22.307000

1 posts

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing

CVE-2026-67622
(9.9 CRITICAL)

EPSS: 0.25%

updated 2026-08-07T18:17:21.357000

1 posts

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownership verification. Attackers can enumerate cross-workspace assistant metadata, retrieve file and vector s

CVE-2026-67621
(7.6 HIGH)

EPSS: 0.27%

updated 2026-08-07T18:17:21.223000

1 posts

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, con

CVE-2026-64665
(8.1 HIGH)

EPSS: 0.31%

updated 2026-08-07T18:17:20.827000

1 posts

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by emai

CVE-2026-15733
(9.8 CRITICAL)

EPSS: 3.90%

updated 2026-08-07T18:17:08.840000

1 posts

A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.

CVE-2026-14943
(7.5 HIGH)

EPSS: 0.26%

updated 2026-08-07T18:17:08.120000

1 posts

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed i

CVE-2026-14365
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-08-07T18:17:07.753000

1 posts

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to change the password of arbitrary user accounts, including administrators, which can b

CVE-2026-14364
(9.8 CRITICAL)

EPSS: 0.29%

updated 2026-08-07T18:17:07.627000

1 posts

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts,

CVE-2026-14205
(9.8 CRITICAL)

EPSS: 0.27%

updated 2026-08-07T18:17:07.073000

1 posts

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.

CVE-2026-50515
(9.9 CRITICAL)

EPSS: 0.91%

updated 2026-08-07T18:05:55.493000

1 posts

Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.

CVE-2026-70559
(7.5 HIGH)

EPSS: 0.33%

updated 2026-08-07T17:17:07.733000

1 posts

Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can reach the Dinky HTTP port (8888 by default) receives the full live system configuration (54 entries on a

1 repos

https://github.com/codeb0ssx/CVE-2026-70559-PoC

CVE-2026-5855
(7.5 HIGH)

EPSS: 0.54%

updated 2026-08-07T17:17:05.047000

1 posts

Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exactly one byte triggers up to five out-of-bo

CVE-2026-67687
(8.8 HIGH)

EPSS: 0.53%

updated 2026-08-07T16:17:27.217000

1 posts

Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java

1 repos

https://github.com/qflksheep/CVE-2026-67687-ICS-Park-Smart-Park-Management-System-v2.0

CVE-2026-19189
(7.8 HIGH)

EPSS: 0.11%

updated 2026-08-07T16:17:23.463000

1 posts

A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functionality in the library C:\Windows\System32\drivers\scdemu.sys of the component Kernel Driver. The manipulation results in improper privilege management. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The vendor

CVE-2026-67689
(9.8 CRITICAL)

EPSS: 0.69%

updated 2026-08-07T15:34:17

1 posts

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints

1 repos

https://github.com/qflksheep/CVE-2026-67689-FineAdmin.Mvc-vulnerability

CVE-2026-49007
(7.5 HIGH)

EPSS: 0.34%

updated 2026-08-07T09:32:04

1 posts

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface.

CVE-2026-19192
(7.8 HIGH)

EPSS: 0.11%

updated 2026-08-07T06:30:27

1 posts

A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C:\DeepCool\resources\service\x64\DeepCoolDisplayService.exe. Performing a manipulation results in improper access controls. The attack must be initiated from a local position. The exploit is now public and may be used.

CVE-2026-19191
(7.8 HIGH)

EPSS: 0.11%

updated 2026-08-07T06:30:26

1 posts

A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\DrivePool\DrivePool.Service.exe of the component DrivePoolService. Such manipulation leads to permission issues. The attack must be carried out locally. The exploit has been disclosed publicly and may be used.

CVE-2026-19190
(7.8 HIGH)

EPSS: 0.14%

updated 2026-08-07T06:30:25

1 posts

A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Files (x86)\StableBit\Scanner\Service\Scanner.Service.exe of the component ScannerService. This manipulation causes permission issues. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks.

CVE-2026-65400
(7.1 HIGH)

EPSS: 0.30%

updated 2026-08-07T03:31:32

2 posts

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

CVE-2026-49163
(8.8 HIGH)

EPSS: 0.62%

updated 2026-08-07T00:31:28

1 posts

Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileges over a network.

CVE-2026-70558
(9.8 CRITICAL)

EPSS: 0.60%

updated 2026-08-07T00:31:27

1 posts

Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path) and file.transferTo(dest) with no path validation. The route is marked @SaIgnore and /download/** is excluded from the Sa-Token interceptor, so the only guard is a header equality check against a dinkyToken value whose default (efda1551-7958-4e0f-80a8-dfd107df3e38) is hardcoded i

CVE-2026-56162
(10.0 CRITICAL)

EPSS: 0.48%

updated 2026-08-07T00:31:27

1 posts

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-53984
(9.1 CRITICAL)

EPSS: 0.38%

updated 2026-08-07T00:31:26

1 posts

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_backup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single full_restore command with a caller-supplied SQL blob. Attackers can connect to the Socket.IO server on port 700

CVE-2026-53983
(8.6 HIGH)

EPSS: 0.33%

updated 2026-08-07T00:31:26

1 posts

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authenti

CVE-2026-19036
(7.2 HIGH)

EPSS: 2.47%

updated 2026-08-06T22:16:51.977000

1 posts

A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument ppp_custom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.

CVE-2026-19035
(7.2 HIGH)

EPSS: 2.47%

updated 2026-08-06T16:16:40.753000

1 posts

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulation of the argument new_qoslimit_enable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This project is superseded by FreshTomato.