Skip to content
OpenAdvisories

Archive

6 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /6 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

493 results · Feed

  • Low 3.3
    CVE-2026-19046

    NocteDefensor LudusMCP ludus_environment_guides_search ludusEnvironmentGuidesSearch.ts path traversal

    A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludus_environment_guides_search. Such manipulation of the arg…

    NocteDefensor LudusMCP
  • High 7.5
    CVE-2026-53977

    OpenChamber 1.11.7 Unauthenticated DoS via /api/system/shutdown

    OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middl…

    Bohdan Triapitsyn OpenChamber
  • High 7.5
    CVE-2026-70646

    aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

    aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing…

    vovchic17 aiosend aiosend PyPI
  • High 7.5
    CVE-2025-49506

    Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

    APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as …

    Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-32327

    Apache Portable Runtime Utility: apr-util XML stack recursion crash

    A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this …

    Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-34191

    Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

    Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Alpine
  • High 7.5
    CVE-2026-34501

    Apache Portable Runtime Utility: Heap buffer overflow in APR redis client

    Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.

    Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-34502

    Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

    Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

    Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-19045

    NocteDefensor LudusMCP get_credential_from_user secretDialog.ts SecretDialog.showSecretDialog command injection

    A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of the argument Descri…

    NocteDefensor LudusMCP
  • High 7.1
    CVE-2026-66711

    WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.

    Amir Helzer WooCommerce Multilingual & Multicurrency Web / CMS
  • Critical 9.1
    CVE-2026-66709

    WordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability

    Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.

    WebAppick CTX Feed
  • High 8.1
    CVE-2026-66710

    WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.

    E2Pdf e2pdf
  • High 8.2
    CVE-2026-66708

    WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.

    Bold Grid Total Upkeep
  • Medium 5.9
    CVE-2026-66706

    WordPress Subscribe to Comments plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

    Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.

    Mark Jaquith Subscribe to Comments
  • High 7.1
    CVE-2026-66707

    WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.

    Facebook Facebook for WooCommerce Web / CMS
  • High 7.1
    CVE-2026-66705

    WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.

    Facebook Facebook for WordPress Web / CMS
  • Medium 6.5
    CVE-2026-66703

    WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.

    Proper Fraction MailOptin
  • High 7.1
    CVE-2026-66702

    WordPress Rank Math SEO plugin <= 1.0.274.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.

    Rank Math SEO Rank Math SEO
  • Medium 5.3
    CVE-2026-66701

    WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.

    Cozmoslabs Profile Builder
  • Medium 4.3
    CVE-2026-66696

    WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability

    Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.

    Nexcess Gutenberg Blocks by Kadence Blocks
  • Medium 5.3
    CVE-2026-66699

    WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability

    Custom role Broken Access Control in Dokan <= 5.0.10 versions.

    Dokan Dokan
  • Medium 6.5
    CVE-2026-66695

    WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability

    Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions.

    Bold Grid W3 Total Cache
  • High 7.1
    CVE-2026-66694

    WordPress Thrive Architect plugin <= 10.9.3.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.

    Thrive Themes Coupon Thrive Architect
  • Medium 4.3
    CVE-2026-66692

    WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability

    Customer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.

    Colissimo Colissimo Officiel : Méthodes de livraison pour WooCommerce Web / CMS
  • High 7.1
    CVE-2026-66690

    WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.

    Nexcess GiveWP
  • Medium 6.5
    CVE-2026-66686

    WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.

    Vladimir Garagulya Plugins Garbage Collector (Database Cleanup)
  • Medium 6.5
    CVE-2026-66688

    WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.

    Brainstorm Force Ultimate Addons for Elementor
  • Medium 5.3
    CVE-2026-66685

    WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.

    Alex Featured Video Plus
  • Medium 5.3
    CVE-2026-66684

    WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.

    Akshay Menariya Export Import Menus
  • Medium 5.3
    CVE-2026-66683

    WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.

    WP Zone Custom CSS and JavaScript
  • Medium 4.3
    CVE-2026-66681

    WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.

    Jeff Farthing Theme My Login Web / CMS
  • Critical 10.0
    CVE-2026-66665

    WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability

    Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.

    Brandexponents Type Hub
  • Medium 4.3
    CVE-2026-66678

    WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability

    Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.

    Justin Kruit Advanced Custom Fields: Font Awesome Field
  • High 7.1
    CVE-2026-66664

    WordPress SEO plugin by Squirrly SEO plugin <= 14.2.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.

    SEO Squirrly SEO Plugin by Squirrly SEO
  • Critical 9.8
    CVE-2026-66662

    WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.

    Shabti Kaplan Frontend Admin by DynamiApps
  • High 7.1
    CVE-2026-66663

    WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.

    Passionate Programmer Peter WP Data Access
  • High 7.1
    CVE-2026-66470

    WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.

    Shabti Kaplan Frontend Admin by DynamiApps
  • High 7.1
    CVE-2026-66457

    WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.

    Pixelite Events Manager
  • Medium 6.5
    CVE-2026-66452

    WordPress Legal Text Connector of the IT-Recht Kanzlei plugin <= 1.0.13 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.

    IT-Recht Kanzlei Legal Text Connector of the IT-Recht Kanzlei
  • Medium 6.5
    CVE-2026-66451

    WordPress WP Event SOlution plugin <= 4.1.9 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.

    Arraytics WP Event Solution