Total
408320 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-73346 | 2026-08-14 | N/A | 7.6 HIGH | ||
| Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions. | |||||
| CVE-2026-19838 | 2026-08-14 | 4.0 MEDIUM | 4.3 MEDIUM | ||
| A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases." | |||||
| CVE-2026-73357 | 2026-08-14 | N/A | 6.5 MEDIUM | ||
| Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions. | |||||
| CVE-2026-73344 | 2026-08-14 | N/A | 5.9 MEDIUM | ||
| Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. | |||||
| CVE-2026-19846 | 2026-08-14 | 9.0 HIGH | 8.8 HIGH | ||
| A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used. | |||||
| CVE-2026-66658 | 2026-08-14 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in Reviewer <= 3.14.2 versions. | |||||
| CVE-2026-19748 | 2026-08-14 | 2.6 LOW | 3.7 LOW | ||
| A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument SESSION leads to insufficient entropy. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult. | |||||
| CVE-2026-66472 | 2026-08-14 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. | |||||
| CVE-2026-19757 | 2026-08-14 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-66689 | 2026-08-14 | N/A | 6.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions. | |||||
| CVE-2026-73340 | 2026-08-14 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions. | |||||
| CVE-2026-66467 | 2026-08-14 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions. | |||||
| CVE-2026-19789 | 2026-08-14 | 9.0 HIGH | 8.8 HIGH | ||
| A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGuestSet of the component httpd web management interface. This manipulation of the argument shareSpeed causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. | |||||
| CVE-2026-66478 | 2026-08-14 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. | |||||
| CVE-2026-73401 | 2026-08-14 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions. | |||||
| CVE-2026-66464 | 2026-08-14 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions. | |||||
| CVE-2026-19824 | 2026-08-14 | 9.0 HIGH | 8.8 HIGH | ||
| A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. | |||||
| CVE-2026-19750 | 2026-08-14 | 7.6 HIGH | 8.1 HIGH | ||
| A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipulation can lead to use of hard-coded password. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been published and may be used. | |||||
| CVE-2026-66657 | 2026-08-14 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions. | |||||
| CVE-2026-19752 | 2026-08-14 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||