Skip to content
OpenAdvisories

Archive

2 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /2 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

50 results · Feed

  • High 7.5
    CVE-2026-15151

    Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications

    The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations W…

    Web / CMS
  • Medium 4.3
    CVE-2026-14938

    FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR

    The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy an…

    Web / CMS
  • High 8.2
    CVE-2026-14920

    AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter

    ## Summary

  • Medium 5.4
    CVE-2026-14864

    JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode

    The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of…

    Web / CMS
  • Medium 6.1
    CVE-2026-14841

    King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget

    The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a …

    Web / CMS
  • Medium 6.5
    CVE-2026-18573

    Keycloak-services: keycloak-services: client access-type policy condition bypass during client update

    A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confi…

    Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6
  • Medium 6.5
    CVE-2026-18572

    Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes

    Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their auth…

    Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6
  • Medium 6.6
    CVE-2026-18571

    Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

    A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator i…

    Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6
  • Medium 5.4
    CVE-2026-18570

    Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed

    A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occur…

    Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6
  • Medium 6.5
    CVE-2026-9335 Public exploit

    Improper Handling of HDF5 ExternalLinks in keras-team/keras

    A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe…

    Keras keras-team/keras keras keras Debian Ubuntu PyPI