CVE-2026-69110
(9.1 CRITICAL)

EPSS: 0.00%

updated 2026-08-04T17:16:59.733000

2 posts

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can retrieve intermediate audio, video artifacts, and subtitles belonging to other users' jobs, and additionall

CVE-2026-69100
(8.8 HIGH)

EPSS: 0.00%

updated 2026-08-04T17:16:59.320000

2 posts

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend

CVE-2026-48323
(10.0 CRITICAL)

EPSS: 0.62%

updated 2026-08-04T17:16:55.413000

2 posts

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-25292
(7.6 HIGH)

EPSS: 0.00%

updated 2026-08-04T17:16:53.797000

2 posts

Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.

CVE-2026-24084
(7.5 HIGH)

EPSS: 0.00%

updated 2026-08-04T17:16:52.453000

2 posts

Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.

CVE-2026-24083
(7.8 HIGH)

EPSS: 0.00%

updated 2026-08-04T17:16:52.040000

2 posts

Memory Corruption while processing IOCTL device driver requests with invalid arguments.

CVE-2026-60007
(0 None)

EPSS: 0.00%

updated 2026-08-04T16:16:26.367000

2 posts

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with

CVE-2026-48326
(9.9 CRITICAL)

EPSS: 0.48%

updated 2026-08-04T16:16:25.497000

2 posts

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-18686
(9.8 CRITICAL)

EPSS: 2.61%

updated 2026-08-04T16:16:21.593000

2 posts

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of

CVE-2026-18401(CVSS UNKNOWN)

EPSS: 0.00%

updated 2026-08-04T15:32:23

1 posts

The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters). An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service.

CVE-2026-69246
(7.2 HIGH)

EPSS: 0.21%

updated 2026-08-04T15:16:42.927000

1 posts

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly as written and push that Host into CURLOPT_HTTPHEADER; StreamHandler does the same through fopen(). libcurl then parses the authority itself, percent-decoding it and, on an IDN-capable buil

CVE-2026-66315
(7.5 HIGH)

EPSS: 0.62%

updated 2026-08-04T15:16:38.033000

1 posts

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-48333
(9.8 CRITICAL)

EPSS: 0.47%

updated 2026-08-04T15:16:35.963000

1 posts

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated privileges. Exploitation of this issue does not require user interaction.

CVE-2026-12816
(0 None)

EPSS: 0.16%

updated 2026-08-04T14:50:12.360000

1 posts

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

CVE-2026-58062
(0 None)

EPSS: 0.20%

updated 2026-08-04T14:50:12.360000

2 posts

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

CVE-2026-8763
(0 None)

EPSS: 0.33%

updated 2026-08-04T14:50:12.360000

2 posts

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

CVE-2026-59638
(0 None)

EPSS: 0.28%

updated 2026-08-04T14:50:12.360000

1 posts

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).

CVE-2026-48331
(10.0 CRITICAL)

EPSS: 0.47%

updated 2026-08-04T14:48:22.933000

1 posts

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-62354
(0 None)

EPSS: 0.26%

updated 2026-08-04T14:48:22.933000

1 posts

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of

CVE-2026-48330
(10.0 CRITICAL)

EPSS: 0.68%

updated 2026-08-04T14:48:22.933000

1 posts

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the application. Exploitation of this is

CVE-2026-34641
(7.8 HIGH)

EPSS: 0.14%

updated 2026-08-04T14:48:22.933000

1 posts

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-6837
(7.2 HIGH)

EPSS: 0.95%

updated 2026-08-04T14:47:47.393000

2 posts

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

CVE-2026-18577
(8.1 HIGH)

EPSS: 2.53%

updated 2026-08-04T14:27:12.530000

15 posts

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

1 repos

https://github.com/HORKimhab/CVE-2026-18577

CVE-2026-18556
(7.4 HIGH)

EPSS: 0.27%

updated 2026-08-04T13:58:04.463000

5 posts

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

CVE-2026-14804
(9.1 CRITICAL)

EPSS: 0.30%

updated 2026-08-04T13:17:35.893000

3 posts

Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

CVE-2026-14175
(9.8 CRITICAL)

EPSS: 0.40%

updated 2026-08-04T12:34:56

4 posts

Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload a Web Shell to a Web Server. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

CVE-2026-15721
(9.8 CRITICAL)

EPSS: 0.23%

updated 2026-08-04T12:34:56

2 posts

Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

CVE-2026-10685
(7.6 HIGH)

EPSS: 0.18%

updated 2026-08-04T12:31:51.160000

1 posts

The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0). Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may

CVE-2026-17349
(9.6 CRITICAL)

EPSS: 0.30%

updated 2026-08-04T12:31:51.160000

1 posts

/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_password, and tunnel_password. When a non-owner triggered an adhoc connect against

CVE-2026-18754
(9.1 CRITICAL)

EPSS: 0.31%

updated 2026-08-04T09:31:41

1 posts

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

CVE-2026-15958(CVSS UNKNOWN)

EPSS: 0.14%

updated 2026-08-04T09:31:41

1 posts

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.

CVE-2026-66066
(0 None)

EPSS: 1.70%

updated 2026-08-04T05:16:40.060000

3 posts

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated a

7 repos

https://github.com/0xBlackash/CVE-2026-66066

https://github.com/HackSpeak/CVE-2026-66066

https://github.com/0xsha/KindaRails2Shell

https://github.com/paveg/rails-activestorage-vips-audit

https://github.com/shinthink/CVE-2026-66066

https://github.com/Zer0SumGam3/CVE-2026-66066-POC

https://github.com/rails/rails-forensics-CVE-2026-66066

CVE-2026-68981(CVSS UNKNOWN)

EPSS: 0.32%

updated 2026-08-04T00:35:57

1 posts

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommend

CVE-2026-68979(CVSS UNKNOWN)

EPSS: 0.35%

updated 2026-08-04T00:35:57

1 posts

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing auth

CVE-2026-18684
(9.8 CRITICAL)

EPSS: 2.03%

updated 2026-08-04T00:35:01

1 posts

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure and confir

CVE-2026-66310
(7.7 HIGH)

EPSS: 0.40%

updated 2026-08-04T00:35:01

1 posts

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

CVE-2026-66318
(8.1 HIGH)

EPSS: 0.37%

updated 2026-08-04T00:35:01

1 posts

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

CVE-2026-18685
(9.8 CRITICAL)

EPSS: 1.99%

updated 2026-08-04T00:35:01

1 posts

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure and confirmed the existence of t

CVE-2026-66803
(10.0 CRITICAL)

EPSS: 0.49%

updated 2026-08-04T00:17:39.977000

1 posts

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.

CVE-2026-59913
(7.8 HIGH)

EPSS: 0.11%

updated 2026-08-03T21:31:44

1 posts

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

CVE-2026-59912
(7.8 HIGH)

EPSS: 0.10%

updated 2026-08-03T21:31:36

1 posts

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and arbitrary code execution.

CVE-2026-18108
(9.8 CRITICAL)

EPSS: 0.22%

updated 2026-08-03T21:31:35

1 posts

Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature. _verify_encrypted_assertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via "return $xml unless $xpath->exists('dsig:Signature', $assert);". The signature check and the trus

CVE-2026-67288
(7.5 HIGH)

EPSS: 0.35%

updated 2026-08-03T21:31:31

1 posts

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process

CVE-2026-69240
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-08-03T20:29:52

1 posts

### Summary SQL Injection is possible with strings only **if dialect is set to `oracle`**. The vulnerability was confirmed on Sequelize v6.37.3. ### Details The `escape` function defined in `sql-string.js` does not escape quotes if the value starts with `TO_TIMESTAMP` or `TO_DATE`. ```javascript } else if (dialect === 'oracle' && typeof val === 'string') { if (val.startsWith('TO_TIMESTAMP'

CVE-2026-67357
(7.5 HIGH)

EPSS: 0.25%

updated 2026-08-03T20:17:27.833000

1 posts

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise.

CVE-2026-67298
(7.5 HIGH)

EPSS: 0.38%

updated 2026-08-03T20:17:26.477000

1 posts

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first verifying orderLength is at least the header length. For orderLength values 0..3 this caus

CVE-2026-8457
(9.8 CRITICAL)

EPSS: 0.40%

updated 2026-08-03T19:16:53.733000

2 posts

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims, combined with the security nonce r

CVE-2026-67294
(5.9 MEDIUM)

EPSS: 0.27%

updated 2026-08-03T19:16:50.143000

1 posts

FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back to client-purpose and any-purpose verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the

CVE-2026-67289
(9.8 CRITICAL)

EPSS: 0.38%

updated 2026-08-03T19:16:50

2 posts

FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or

CVE-2026-66402
(9.8 CRITICAL)

EPSS: 0.29%

updated 2026-08-03T19:16:49.210000

2 posts

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepti

CVE-2026-48449
(10.0 CRITICAL)

EPSS: 0.54%

updated 2026-08-03T19:16:47.320000

1 posts

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-18614
(9.8 CRITICAL)

EPSS: 2.01%

updated 2026-08-03T19:16:45.200000

1 posts

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and conf

CVE-2026-16300
(9.8 CRITICAL)

EPSS: 0.30%

updated 2026-08-03T18:31:51

1 posts

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

CVE-2026-18612
(9.8 CRITICAL)

EPSS: 2.16%

updated 2026-08-03T18:30:56

1 posts

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and co

CVE-2026-67296
(7.5 HIGH)

EPSS: 0.34%

updated 2026-08-03T18:16:40.860000

1 posts

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory allocation on the server.

CVE-2026-18574
(0 None)

EPSS: 0.99%

updated 2026-08-03T17:40:27.300000

2 posts

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system. Check Point discovered

CVE-2026-68579
(9.6 CRITICAL)

EPSS: 0.27%

updated 2026-08-03T17:16:44.330000

1 posts

FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprdr.c). When an OLE paste consumer (e.g. explorer.exe) calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStream_Read requests file contents from the RDP server and then copies the response into the caller's buffer using the serv

CVE-2026-67356
(8.8 HIGH)

EPSS: 0.25%

updated 2026-08-03T17:16:43.343000

1 posts

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks. Attackers with UPDATE_SCHEMA permission can create triggers that execute JavaScript to create server-wide admin users, escalating privileges beyond their authorization level.

CVE-2026-67305
(0 None)

EPSS: 0.49%

updated 2026-08-03T17:16:40.637000

1 posts

FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data payload significantly larger than requested, causing arbitrary heap memory corruption that may enable

CVE-2026-67300
(7.5 HIGH)

EPSS: 0.33%

updated 2026-08-03T17:16:40.480000

1 posts

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibili

CVE-2026-67290
(7.5 HIGH)

EPSS: 0.43%

updated 2026-08-03T17:16:40.020000

1 posts

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.

CVE-2026-65321
(9.8 CRITICAL)

EPSS: 0.44%

updated 2026-08-03T17:16:39.617000

2 posts

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function that backslash-escapes single quotes rather than doubling them. Because Athena and Trino do not treat backslashes as escape char

1 repos

https://github.com/rahulreddykarne/CVE-2026-65321-pyathena

CVE-2025-71399
(8.6 HIGH)

EPSS: 0.31%

updated 2026-08-03T17:16:28.867000

1 posts

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can allow attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extr

CVE-2026-67336
(8.7 HIGH)

EPSS: 0.16%

updated 2026-08-03T16:16:30.790000

1 posts

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.

CVE-2026-3245
(7.5 HIGH)

EPSS: 0.24%

updated 2026-08-03T16:16:29.437000

1 posts

A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution.

CVE-2026-33591(CVSS UNKNOWN)

EPSS: 0.52%

updated 2026-08-03T12:32:43

2 posts

A vulnerability in Wapt Server before version 2.6.1.17813 allows a  remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retrieve a valid session token for the targeted account.

CVE-2026-18589
(9.8 CRITICAL)

EPSS: 0.61%

updated 2026-08-03T09:32:46

1 posts

A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was contacted early, responded in a very prof

CVE-2026-9593
(6.7 MEDIUM)

EPSS: 0.11%

updated 2026-08-03T09:32:46

1 posts

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disruption of device data or operation.

CVE-2026-58061(CVSS UNKNOWN)

EPSS: 0.21%

updated 2026-08-03T09:32:36

1 posts

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

CVE-2026-12803(CVSS UNKNOWN)

EPSS: 0.17%

updated 2026-08-03T09:32:36

1 posts

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12.

CVE-2026-59639(CVSS UNKNOWN)

EPSS: 0.17%

updated 2026-08-03T06:32:44

1 posts

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).

CVE-2026-59650(CVSS UNKNOWN)

EPSS: 0.26%

updated 2026-08-03T06:32:44

1 posts

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.

CVE-2026-68580
(7.5 HIGH)

EPSS: 0.24%

updated 2026-08-02T15:30:26

1 posts

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all pl

CVE-2026-68578
(7.5 HIGH)

EPSS: 0.21%

updated 2026-08-02T15:30:25

1 posts

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.

CVE-2026-68581
(8.1 HIGH)

EPSS: 0.32%

updated 2026-08-02T15:30:25

1 posts

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-share JWT whose numeric ID equals a target user's ID is treated as that user by the /api/v1/tokens endpoints. An authenticated attacker can obtain a target's num

CVE-2026-68582
(6.5 MEDIUM)

EPSS: 0.21%

updated 2026-08-02T15:30:25

1 posts

Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. For a link-share token holder, the task scope is pinned to the share's own project, but the vie

CVE-2026-18352
(7.5 HIGH)

EPSS: 0.68%

updated 2026-08-02T00:31:17

1 posts

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is possible because when attachment_url_to_postid() returns 0 for a traversal

CVE-2026-13339
(7.5 HIGH)

EPSS: 0.64%

updated 2026-08-02T00:31:16

1 posts

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publi

CVE-2026-67292
(6.5 MEDIUM)

EPSS: 0.26%

updated 2026-08-01T15:30:36

1 posts

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong t

CVE-2026-67291
(7.5 HIGH)

EPSS: 0.34%

updated 2026-08-01T15:30:36

1 posts

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes.

CVE-2026-67304
(7.5 HIGH)

EPSS: 0.35%

updated 2026-08-01T15:30:36

1 posts

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer access in free_reader_states functions.

CVE-2026-67301
(7.5 HIGH)

EPSS: 0.34%

updated 2026-08-01T15:30:36

1 posts

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy point data from the address of the order structure instead of from polygonSC->points /

CVE-2026-67299
(7.5 HIGH)

EPSS: 0.33%

updated 2026-08-01T15:30:36

1 posts

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, update_recv_window_info_order()

CVE-2026-67308
(10.0 CRITICAL)

EPSS: 0.45%

updated 2026-08-01T15:30:36

1 posts

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and

CVE-2026-67341
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-08-01T15:30:30

1 posts

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.

CVE-2026-67342
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-08-01T15:30:30

1 posts

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

CVE-2026-67297
(7.5 HIGH)

EPSS: 0.34%

updated 2026-08-01T15:30:26

1 posts

FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering the configured size limit.

CVE-2026-15414
(8.8 HIGH)

EPSS: 0.34%

updated 2026-08-01T03:31:19

1 posts

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` membership plan meta from `$_POST` without an allowlist that excludes privileged roles — the only validations applied, `sanitize_key()` and `wp_roles()->is_role()`, both accept `'ad

CVE-2026-63223
(9.8 CRITICAL)

EPSS: 0.49%

updated 2026-08-01T00:17:17.750000

1 posts

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads u

2 repos

https://github.com/imbas007/CVE-2026-63223-POC

https://github.com/shinthink/CVE-2026-63223

CVE-2026-53504
(7.5 HIGH)

EPSS: 0.34%

updated 2026-08-01T00:17:16.823000

1 posts

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0.

CVE-2026-66418
(9.3 CRITICAL)

EPSS: 0.34%

updated 2026-07-31T23:17:26.170000

1 posts

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive C

1 repos

https://github.com/theopaid/CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

CVE-2026-43832
(7.5 HIGH)

EPSS: 0.24%

updated 2026-07-31T21:32:56

1 posts

Successful exploitation of the vulnerability could allow an unauthenticated attacker to exploit a stack-based buffer overflow in the Cookie parsing methods to conduct code execution when the SafeEnhancement feature is enabled.

CVE-2025-69933
(9.8 CRITICAL)

EPSS: 0.26%

updated 2026-07-31T21:32:55

1 posts

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.

CVE-2026-43829
(7.5 HIGH)

EPSS: 0.24%

updated 2026-07-31T21:32:55

1 posts

Successful exploitation of the vulnerability could allow an unauthenticated attacker to exploit a stack-based buffer overflow in the password functionality to conduct code execution when the SafeEnhancement feature is enabled.

CVE-2026-43831
(7.5 HIGH)

EPSS: 0.24%

updated 2026-07-31T21:32:55

1 posts

Successful exploitation of the vulnerability could allow an unauthenticated attacker to exploit a stack-based buffer overflow in the log message functionality to conduct code execution.

CVE-2026-15048
(7.5 HIGH)

EPSS: 0.26%

updated 2026-07-31T21:32:55

1 posts

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.

CVE-2026-67822
(9.8 CRITICAL)

EPSS: 0.29%

updated 2026-07-31T21:31:55

1 posts

Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow.

CVE-2026-14930
(7.5 HIGH)

EPSS: 0.24%

updated 2026-07-31T21:31:54

1 posts

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.

CVE-2026-53501
(8.2 HIGH)

EPSS: 0.21%

updated 2026-07-31T20:16:51.280000

1 posts

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation. Thi

CVE-2026-43830
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-07-31T20:16:50.463000

1 posts

Full details and mitigation steps are currently restricted and will be published at a later date.

CVE-2026-15258
(8.1 HIGH)

EPSS: 0.22%

updated 2026-07-31T20:16:48.207000

1 posts

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.

CVE-2026-14483
(9.8 CRITICAL)

EPSS: 0.61%

updated 2026-07-31T20:16:46.443000

1 posts

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installation

2 repos

https://github.com/0xdak/CVE-2026-14483_exploit

https://github.com/MadExploits/CVE-2026-14483

CVE-2026-14319
(7.5 HIGH)

EPSS: 0.32%

updated 2026-07-31T20:16:46.290000

1 posts

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.

CVE-2026-56670
(8.2 HIGH)

EPSS: 0.22%

updated 2026-07-31T19:17:11.290000

1 posts

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline because image/svg+xml and related XML content types were absent from the dangerous-content-type handling, allowing stored cross-site scripting in the ComfyUI origin. This issue is fixed in version 0.28.0.

CVE-2026-54725
(9.6 CRITICAL)

EPSS: 0.32%

updated 2026-07-31T19:17:10.833000

1 posts

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount can cause a ServiceAccount JW

CVE-2026-52856
(7.5 HIGH)

EPSS: 0.34%

updated 2026-07-31T19:17:09.120000

1 posts

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

CVE-2025-69936
(9.8 CRITICAL)

EPSS: 0.26%

updated 2026-07-31T19:17:03.667000

1 posts

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.

CVE-2025-69935
(9.8 CRITICAL)

EPSS: 0.26%

updated 2026-07-31T19:17:03.420000

1 posts

CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.

CVE-2025-69934
(9.8 CRITICAL)

EPSS: 0.26%

updated 2026-07-31T19:17:03.113000

1 posts

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.

CVE-2026-53503
(7.5 HIGH)

EPSS: 0.42%

updated 2026-07-31T18:54:57

1 posts

### Summary Thumbor's `filters:convolution(<matrix>, <columns>, <should_normalize>)` filter passes the user-controlled `<columns>` value to a C extension (`thumbor/ext/filters/_convolution.c`) where it is used as a divisor (for `%` and `/`) without validating `columns > 0`. When `columns=0`, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIG

CVE-2026-62391
(8.1 HIGH)

EPSS: 0.40%

updated 2026-07-31T18:33:21

1 posts

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which fixes the issue.

CVE-2025-69937
(9.8 CRITICAL)

EPSS: 0.26%

updated 2026-07-31T18:33:16

1 posts

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.

CVE-2026-58048(CVSS UNKNOWN)

EPSS: 0.50%

updated 2026-07-31T18:32:25

2 posts

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

1 repos

https://github.com/imbas007/POC-CVE-2026-58048

CVE-2026-17346
(8.8 HIGH)

EPSS: 0.43%

updated 2026-07-31T18:32:24

1 posts

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in test_sql_string_literal_lint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and subscription names sourced from pg_catalog via the browser tree could never contain an apostrophe. Po

CVE-2026-17351
(9.0 None)

EPSS: 0.45%

updated 2026-07-31T18:32:24

1 posts

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing can disagree with PostgreSQL's own parser: under standard_conforming_strings = on (PostgreSQL's defau

1 repos

https://github.com/Hunt-Benito/pgadmin-ai-assistant-sql-injection-cve-2026-17351-lexer-differential-bypass

CVE-2026-35847
(9.8 CRITICAL)

EPSS: 0.37%

updated 2026-07-31T18:17:14.613000

1 posts

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file

CVE-2026-18446
(7.5 HIGH)

EPSS: 0.22%

updated 2026-07-31T18:17:13.383000

1 posts

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward

CVE-2026-12720
(7.5 HIGH)

EPSS: 0.30%

updated 2026-07-31T18:17:10.337000

1 posts

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress v

1 repos

https://github.com/webshellseo8/CVE-2026-12720-Proof-of-Concept

CVE-2026-12695
(8.1 HIGH)

EPSS: 0.29%

updated 2026-07-31T18:17:10.150000

1 posts

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.

CVE-2026-12251
(8.1 HIGH)

EPSS: 0.23%

updated 2026-07-31T18:17:09.777000

1 posts

The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a

CVE-2026-14919
(9.8 CRITICAL)

EPSS: 0.28%

updated 2026-07-31T17:16:32.863000

1 posts

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.

CVE-2026-13609
(8.8 HIGH)

EPSS: 0.25%

updated 2026-07-31T17:16:32.347000

1 posts

The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the Frontend Admin by DynamiApps WordPress plugin before 3.29.9'

CVE-2026-12721
(8.6 HIGH)

EPSS: 0.26%

updated 2026-07-31T17:16:31.993000

1 posts

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

CVE-2026-63362
(5.9 MEDIUM)

EPSS: 1.53%

updated 2026-07-31T16:17:09.013000

1 posts

An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet.

CVE-2026-63222
(7.5 HIGH)

EPSS: 0.45%

updated 2026-07-31T16:17:08.903000

1 posts

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.

CVE-2026-52855
(9.9 CRITICAL)

EPSS: 0.27%

updated 2026-07-31T16:16:48

1 posts

### Impact **Type:** Exposure of sensitive information / insufficiently protected credentials leading to privilege escalation and full node compromise. Wings exposes its **entire** daemon configuration to the egg configuration-file templating engine. When Wings renders a server's configuration files, any `{{config.<path>}}` placeholder in a replacement value is resolved against the full marshall

CVE-2026-63221
(9.4 CRITICAL)

EPSS: 0.38%

updated 2026-07-31T14:16:50.873000

1 posts

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed i

CVE-2026-14830
(7.5 HIGH)

EPSS: 0.21%

updated 2026-07-31T14:16:46.133000

1 posts

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.

CVE-2026-14333
(7.5 HIGH)

EPSS: 0.30%

updated 2026-07-31T14:16:45.960000

1 posts

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.

CVE-2026-52539
(9.1 CRITICAL)

EPSS: 0.30%

updated 2026-07-31T12:30:30

1 posts

Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT session tokens with arbitrary user data and full administrative permissions.

CVE-2026-38709
(9.8 CRITICAL)

EPSS: 2.67%

updated 2026-07-31T12:16:49.683000

2 posts

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the net.set_wan interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.

CVE-2026-18452
(10.0 CRITICAL)

EPSS: 0.43%

updated 2026-07-31T09:31:30

1 posts

DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.

CVE-2026-16236
(8.8 HIGH)

EPSS: 0.63%

updated 2026-07-31T09:31:30

1 posts

The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes it possible for auth

CVE-2026-65309
(7.5 HIGH)

EPSS: 0.15%

updated 2026-07-31T09:31:30

1 posts

ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords.

CVE-2026-65310
(7.5 HIGH)

EPSS: 0.32%

updated 2026-07-31T09:31:30

1 posts

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.

CVE-2026-12562
(8.8 HIGH)

EPSS: 0.28%

updated 2026-07-31T00:30:29

1 posts

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework (TCF) service that does not require any authentication, allowing an attacker to directly interact with the Linux environment that power

CVE-2026-51291
(9.8 CRITICAL)

EPSS: 0.00%

updated 2026-07-30T21:31:47

1 posts

sqlite 3.41 is vulnerable to use after free in the json.c jsonCacheInsert function of the JSON cache management module.

CVE-2026-43760
(8.6 HIGH)

EPSS: 0.24%

updated 2026-07-30T19:17:30.313000

1 posts

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access user-sensitive data.

CVE-2026-17191
(9.1 CRITICAL)

EPSS: 2.83%

updated 2026-07-30T19:10:52.250000

1 posts

An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. This issue was discovered internally by Arista and the company is not awa