Total
9895 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-66431 | 2026-08-14 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions. | |||||
| CVE-2026-28181 | 2026-08-14 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions. | |||||
| CVE-2026-66455 | 2026-08-14 | N/A | 6.0 MEDIUM | ||
| Subscriber Broken Access Control in ReactPress <= 3.4.0 versions. | |||||
| CVE-2026-27345 | 2026-08-14 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions. | |||||
| CVE-2026-61978 | 2026-08-14 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions. | |||||
| CVE-2026-66441 | 2026-08-14 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions. | |||||
| CVE-2026-28159 | 2026-08-14 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions. | |||||
| CVE-2026-27999 | 2026-08-14 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in Tourfic <= 2.23.1 versions. | |||||
| CVE-2026-66459 | 2026-08-14 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions. | |||||
| CVE-2026-27535 | 2026-08-14 | N/A | 7.1 HIGH | ||
| Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions. | |||||
| CVE-2026-28188 | 2026-08-14 | N/A | 7.3 HIGH | ||
| Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions. | |||||
| CVE-2026-66461 | 2026-08-14 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions. | |||||
| CVE-2026-28186 | 2026-08-14 | N/A | 8.1 HIGH | ||
| Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions. | |||||
| CVE-2026-28173 | 2026-08-14 | N/A | 7.1 HIGH | ||
| Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions. | |||||
| CVE-2026-61984 | 2026-08-14 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions. | |||||
| CVE-2026-19404 | 2026-08-14 | N/A | 6.5 MEDIUM | ||
| A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can leave replication inconsistent or unavailable. | |||||
| CVE-2026-19345 | 2026-08-14 | 6.4 MEDIUM | 6.5 MEDIUM | ||
| A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument task_id/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. | |||||
| CVE-2026-62915 | 1 Microsoft | 2 Exchange Server, Exchange Server Subscription Edition | 2026-08-14 | N/A | 6.5 MEDIUM |
| Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network. | |||||
| CVE-2026-58482 | 1 Network-ai | 1 Network-ai | 2026-08-13 | N/A | 5.9 MEDIUM |
| Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is the network surface of the human-in-the-loop Approval Gate, which `ApprovalGate` uses to require explicit human approval for high-risk operations. The HTTP server it exposes has no authentication of any kind and sets `Access-Control-Allow-Origin: *` on every route, including the state-changing `POST /approvals/:id/approve` and `/deny`. As a result, in versions 5.0.0 through 5.12.1, any party who can send an HTTP request to the inbox port — a co-located process, a container/SSRF on the same host, a remote client when the operator binds a non-loopback address, or any website the operator visits in a browser (via the wildcard CORS) — can enumerate pending approvals and approve them, defeating the entire human-in-the-loop control and causing the gated high-risk action (e.g. a shell command the agent was holding for review) to execute without consent. This issue is fixed in v5.12.2. `ApprovalInbox` now accepts a `secret` option. When set, the mutating endpoints `POST /:id/approve` and `POST /:id/deny` require an `Authorization: Bearer <secret>` header, validated in constant time with `crypto.timingSafeEqual`. `startServer()` already binds to `127.0.0.1` by default; operators exposing the inbox on a network must set a secret. | |||||
| CVE-2026-73296 | 2026-08-13 | N/A | 9.4 CRITICAL | ||
| Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control against an ADB-connected Android device, disclose screen and device data, and modify device state. This issue is fixed in version 3.0.8. | |||||