Total
397465 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-16600 | 2026-08-31 | N/A | 7.7 HIGH | ||
| The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external URLs and read the response, resulting in a full-read Server-Side Request Forgery. | |||||
| CVE-2026-14494 | 2026-08-31 | N/A | 9.8 CRITICAL | ||
| The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation. | |||||
| CVE-2026-81660 | 2026-08-31 | N/A | 8.8 HIGH | ||
| The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields before storing them and outputting them back in an administrative area, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users. | |||||
| CVE-2025-6508 | 2026-08-31 | N/A | 4.3 MEDIUM | ||
| The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services. | |||||
| CVE-2026-81766 | 2026-08-31 | N/A | 6.6 MEDIUM | ||
| The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute arbitrary code in the network-shared Really Simple Security WordPress plugin before 9.8.0 directory, which WordPress otherwise reserves to the network administrator. Exploitation requires the network administrator to have enabled the Really Simple Security WordPress plugin before 9.8.0 administration menu for subsites, which is not the default. | |||||
| CVE-2026-18233 | 2026-08-31 | N/A | 6.5 MEDIUM | ||
| The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made. | |||||
| CVE-2024-6541 | 2026-08-31 | N/A | 6.8 MEDIUM | ||
| The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products. | |||||
| CVE-2026-14307 | 2026-08-31 | N/A | 7.1 HIGH | ||
| The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request. | |||||
| CVE-2026-71676 | 2026-08-31 | N/A | 7.5 HIGH | ||
| Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, triggered when the message type byte of a NAS PDU is mutated | |||||
| CVE-2026-50772 | 2026-08-31 | N/A | 9.8 CRITICAL | ||
| An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function. | |||||
| CVE-2026-30047 | 2026-08-31 | N/A | 7.5 HIGH | ||
| A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request. | |||||
| CVE-2026-51977 | 2026-08-31 | N/A | 9.1 CRITICAL | ||
| An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component | |||||
| CVE-2026-67926 | 2026-08-31 | N/A | 9.8 CRITICAL | ||
| An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module | |||||
| CVE-2026-30046 | 2026-08-31 | N/A | 7.5 HIGH | ||
| A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request. | |||||
| CVE-2026-67925 | 2026-08-31 | N/A | 6.1 MEDIUM | ||
| Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload | |||||
| CVE-2026-30056 | 2026-08-31 | N/A | 7.5 HIGH | ||
| A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGAP messages during the initialization of a new RAN connection. | |||||
| CVE-2026-67854 | 2026-08-31 | N/A | 9.8 CRITICAL | ||
| SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code | |||||
| CVE-2026-52606 | 2026-08-31 | N/A | 6.1 MEDIUM | ||
| A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the execute_mode=PREPARE parameter of run.php. | |||||
| CVE-2026-67960 | 2026-08-31 | N/A | 9.8 CRITICAL | ||
| An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components | |||||
| CVE-2026-75336 | 2026-08-31 | N/A | 9.8 CRITICAL | ||
| Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json. | |||||