Total
398119 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-78289 | 2026-08-28 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions. | |||||
| CVE-2026-5097 | 2026-08-28 | N/A | 7.5 HIGH | ||
| The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | |||||
| CVE-2026-78274 | 2026-08-28 | N/A | 9.1 CRITICAL | ||
| Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions. | |||||
| CVE-2026-81273 | 2026-08-28 | N/A | 8.1 HIGH | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions. | |||||
| CVE-2026-81562 | 2026-08-28 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.10.3 is able to mitigate this issue. The patch is named a86d9e55694c98a122943eeff859461d0b9aa6d6. It is suggested to upgrade the affected component. | |||||
| CVE-2026-81486 | 2026-08-28 | 5.0 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function read_context of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-32550 | 2026-08-28 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions. | |||||
| CVE-2026-81485 | 2026-08-28 | 5.0 MEDIUM | 5.3 MEDIUM | ||
| A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file src/tools/campaign-management.ts of the component Media Upload. Such manipulation of the argument filePath leads to path traversal. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-78276 | 2026-08-28 | N/A | 7.2 HIGH | ||
| Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions. | |||||
| CVE-2026-81272 | 2026-08-28 | N/A | 4.9 MEDIUM | ||
| Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions. | |||||
| CVE-2026-78285 | 2026-08-28 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions. | |||||
| CVE-2026-78288 | 2026-08-28 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions. | |||||
| CVE-2026-32566 | 2026-08-28 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. | |||||
| CVE-2026-81421 | 2026-08-28 | 7.5 HIGH | 7.3 HIGH | ||
| A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component raw_sentry_api. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-15055 | 1 Bouncycastle | 3 Bc-java, Bcpkix-fips, Bouncy Castle For Java Lts | 2026-08-28 | N/A | 8.2 HIGH |
| In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). | |||||
| CVE-2026-0301 | 1 Paloaltonetworks | 3 Cloud Ngfw, Pan-os, Prisma Access | 2026-08-28 | N/A | 7.5 HIGH |
| An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability. | |||||
| CVE-2026-70805 | 1 Oracle | 1 Project Planning And Control | 2026-08-28 | N/A | 8.1 HIGH |
| Vulnerability in the Oracle Project Planning and Control product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Planning and Control. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Planning and Control accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Planning and Control accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). | |||||
| CVE-2026-70806 | 1 Oracle | 1 E-business Tax | 2026-08-28 | N/A | 7.1 HIGH |
| Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle E-Business Tax executes to compromise Oracle E-Business Tax. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Tax accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle E-Business Tax. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). | |||||
| CVE-2026-70808 | 1 Oracle | 1 Scripting | 2026-08-28 | N/A | 7.1 HIGH |
| Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Scripting accessible data as well as unauthorized update, insert or delete access to some of Oracle Scripting accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). | |||||
| CVE-2026-70809 | 1 Oracle | 1 Scripting | 2026-08-28 | N/A | 7.1 HIGH |
| Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Scripting. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L). | |||||