Total
412723 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-84834 | 2026-09-07 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions. | |||||
| CVE-2026-84778 | 2026-09-07 | N/A | 7.5 HIGH | ||
| Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions. | |||||
| CVE-2026-84769 | 2026-09-07 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions. | |||||
| CVE-2026-84763 | 2026-09-07 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions. | |||||
| CVE-2026-84756 | 2026-09-07 | N/A | 7.1 HIGH | ||
| Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions. | |||||
| CVE-2026-84238 | 2026-09-07 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions. | |||||
| CVE-2026-81295 | 2026-09-07 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions. | |||||
| CVE-2026-27086 | 2026-09-07 | N/A | 6.5 MEDIUM | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8. | |||||
| CVE-2026-11613 | 2026-09-07 | N/A | 9.8 CRITICAL | ||
| The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'. | |||||
| CVE-2026-2670 | 2026-09-07 | 8.3 HIGH | 7.2 HIGH | ||
| A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to address this issue. It is advisable to upgrade the affected component. The vendor explains: "The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data." | |||||
| CVE-2026-10840 | 2026-09-06 | N/A | 7.1 HIGH | ||
| A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate. | |||||
| CVE-2025-1244 | 2026-09-06 | N/A | 8.8 HIGH | ||
| A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect. | |||||
| CVE-2026-7163 | 1 Redhat | 1 Multicluster Engine For Kubernetes | 2026-09-05 | N/A | 6.1 MEDIUM |
| A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub. The credentials download endpoint (GET /v2/clusters/{cluster_id}/credentials, which returns the kubeadmin password) and the kubeconfig download endpoint are operational in AUTH_TYPE=local mode, the only authentication mode available in on-premises ACM/MCE hub deployments. The local authenticator unconditionally grants full administrative access to any request bearing a valid JWT, with no per-endpoint restrictions. A valid local JWT is embedded as a plaintext query parameter in InfraEnvStatus.ISODownloadURL and is readable by any user who has get rights on an InfraEnv object in their own namespace. The affected components ship as part of Multicluster Engine (MCE). The Red Hat Advanced Cluster Management (ACM) deployments that include MCE are equally affected. This issue does not affect the hosted SaaS offering (console.redhat.com), which uses a different authentication mode. Successful exploitation gives the attacker the kubeadmin password and kubeconfig for any OpenShift cluster provisioned through the affected hub, granting unrestricted root-level administrative access to those spoke clusters. | |||||
| CVE-2026-76827 | 2026-09-05 | N/A | 6.8 MEDIUM | ||
| A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix. | |||||
| CVE-2026-75485 | 2026-09-05 | N/A | 5.5 MEDIUM | ||
| A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive. | |||||
| CVE-2026-73834 | 2026-09-05 | N/A | 5.5 MEDIUM | ||
| A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive. | |||||
| CVE-2026-71846 | 1 Redhat | 2 Advanced Cluster Management For Kubernetes, Insights-client | 2026-09-05 | N/A | 6.5 MEDIUM |
| A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials. | |||||
| CVE-2026-71845 | 1 Redhat | 2 Advanced Cluster Management For Kubernetes, Insights-client | 2026-09-05 | N/A | 6.3 MEDIUM |
| A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API. | |||||
| CVE-2026-71475 | 1 Redhat | 2 Advanced Cluster Management For Kubernetes, Insights-client | 2026-09-05 | N/A | 6.8 MEDIUM |
| A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access. | |||||
| CVE-2026-71474 | 1 Redhat | 2 Advanced Cluster Management For Kubernetes, Insights-client | 2026-09-05 | N/A | 7.1 HIGH |
| A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services. | |||||