Total
397434 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-34884 | 1 Apache | 1 Skywalking Mcp | 2026-09-02 | N/A | 9.8 CRITICAL |
| SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue. | |||||
| CVE-2026-16821 | 1 Ibm | 2 Aix, Vios | 2026-09-02 | N/A | 7.0 HIGH |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a format string vulnerability. | |||||
| CVE-2026-75528 | 2026-09-02 | N/A | 7.2 HIGH | ||
| The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow on a link submitted by the attacker via the WordPress comment author URL field, after which the attacker's HTTP server issues a redirect to a URL containing an HTML/JavaScript payload that is stored verbatim in the link log. | |||||
| CVE-2026-9055 | 2026-09-02 | N/A | 9.8 CRITICAL | ||
| The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password. | |||||
| CVE-2026-84438 | 2026-09-02 | 4.0 MEDIUM | 3.5 LOW | ||
| A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-78657 | 2026-09-02 | N/A | 9.8 CRITICAL | ||
| The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The malicious path traversal URL is submitted via form upload field and stored in the database, with deletion triggered when an administrator deletes the submission record from the admin panel. | |||||
| CVE-2026-84430 | 2026-09-02 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit_personal Endpoint. Such manipulation of the argument position_id leads to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 6.0.3 is able to resolve this issue. Upgrading the affected component is advised. | |||||
| CVE-2026-84425 | 2026-09-02 | 4.0 MEDIUM | 4.3 MEDIUM | ||
| A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tools/browser/browser_tool.py of the component Browser Tool. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-84442 | 2026-09-02 | 3.2 LOW | 4.4 MEDIUM | ||
| A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component com.mapquest.android.ace. The manipulation leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-81294 | 2026-09-02 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions. | |||||
| CVE-2026-84797 | 2026-09-02 | N/A | 6.3 MEDIUM | ||
| Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user's unsaved draft without proper authorization checks, gaining access to the victim's in-progress content. | |||||
| CVE-2026-84802 | 2026-09-02 | N/A | 4.3 MEDIUM | ||
| Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access. | |||||
| CVE-2026-84807 | 2026-09-02 | N/A | 5.4 MEDIUM | ||
| Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team; because the endpoints POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team reuse an existing team of the same name and add the current user as teamlead without verifying that the user is authorized to manage that team, the attacker gains unauthorized team-lead (administration) rights over the existing team. Fixed in 2.65.0. | |||||
| CVE-2026-81289 | 2026-09-02 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions. | |||||
| CVE-2026-84792 | 2026-09-02 | N/A | 4.3 MEDIUM | ||
| Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized sections by overwriting the sectionId attribute after initial authorization checks, bypassing the destination section permission validation. | |||||
| CVE-2026-81771 | 2026-09-02 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions. | |||||
| CVE-2026-83562 | 2026-09-02 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions. | |||||
| CVE-2026-84760 | 2026-09-02 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions. | |||||
| CVE-2026-84771 | 2026-09-02 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions. | |||||
| CVE-2026-81774 | 2026-09-02 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment <= 2.3.3 versions. | |||||