Total
398385 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-81279 | 2026-08-28 | N/A | 5.4 MEDIUM | ||
| Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions. | |||||
| CVE-2026-78257 | 2026-08-28 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions. | |||||
| CVE-2026-78271 | 2026-08-28 | N/A | 7.2 HIGH | ||
| Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions. | |||||
| CVE-2026-81202 | 2026-08-28 | 7.5 HIGH | 7.3 HIGH | ||
| A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. | |||||
| CVE-2026-78289 | 2026-08-28 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions. | |||||
| CVE-2026-5097 | 2026-08-28 | N/A | 7.5 HIGH | ||
| The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | |||||
| CVE-2026-78274 | 2026-08-28 | N/A | 9.1 CRITICAL | ||
| Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions. | |||||
| CVE-2026-81273 | 2026-08-28 | N/A | 8.1 HIGH | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions. | |||||
| CVE-2026-81562 | 2026-08-28 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.10.3 is able to mitigate this issue. The patch is named a86d9e55694c98a122943eeff859461d0b9aa6d6. It is suggested to upgrade the affected component. | |||||
| CVE-2026-81486 | 2026-08-28 | 5.0 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function read_context of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-32550 | 2026-08-28 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions. | |||||
| CVE-2026-81485 | 2026-08-28 | 5.0 MEDIUM | 5.3 MEDIUM | ||
| A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file src/tools/campaign-management.ts of the component Media Upload. Such manipulation of the argument filePath leads to path traversal. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-78276 | 2026-08-28 | N/A | 7.2 HIGH | ||
| Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions. | |||||
| CVE-2026-81272 | 2026-08-28 | N/A | 4.9 MEDIUM | ||
| Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions. | |||||
| CVE-2026-78285 | 2026-08-28 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions. | |||||
| CVE-2026-78288 | 2026-08-28 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions. | |||||
| CVE-2026-32566 | 2026-08-28 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. | |||||
| CVE-2026-81421 | 2026-08-28 | 7.5 HIGH | 7.3 HIGH | ||
| A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component raw_sentry_api. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-15055 | 1 Bouncycastle | 3 Bc-java, Bcpkix-fips, Bouncy Castle For Java Lts | 2026-08-28 | N/A | 8.2 HIGH |
| In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). | |||||
| CVE-2026-0301 | 1 Paloaltonetworks | 3 Cloud Ngfw, Pan-os, Prisma Access | 2026-08-28 | N/A | 7.5 HIGH |
| An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability. | |||||