Skip to content
OpenAdvisories

Archive

13 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /13 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

275 results · Clear filters · Feed

  • High 8.8
    CVE-2026-19293

    SMP security request

    SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.

    silabs.com WiseConnect
  • High 8.8
    CVE-2026-19292

    Bluetooth re-pairing with legitimate device can use lower security level

    Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.

    silabs.com WiseConnect
  • High 8.8
    CVE-2026-19291

    Bluetooth re-pairing can use a lower security level than previous

    Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.

    silabs.com WiseConnect
  • High 8.8
    CVE-2026-16101

    forced re-pairing with already bonded device

    Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below

    silabs.com WiseConnect
  • High 8.6
    CVE-2026-19734

    IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

    Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and bar…

    Roskus Prospero Flow CRM
  • High 8.8
    CVE-2026-68454

    KVM: s390: pci: Fix handling of AIF enable without AISB

    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix handling of AIF enable without AISB When a guest seeks to register IRQs without a summary bit specified, ensure that the associated GAITE then stores 0 for the guest AISB …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-68453

    s390/zcrypt: Fix buffer over-read in cca_cipher2protkey

    In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Add validation of both the actual key buffer size and token length fields in all the cca_check_sec*token() functions. Additionally chec…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68452

    s390/zcrypt: Validate length for CCA AES cipher key requests

    In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68451

    s390/zcrypt: Validate length for CCA ECC private key requests

    In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests cca_ecc2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-14456

    Unbounded Memory Growth in QUIC Server Incoming Channel Queue

    Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can m…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • High 7.2
    CVE-2026-66256

    Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)

    ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code executi…

    Apache Software Foundation Apache Shindig Social-Api Apache Shindig Common
  • High 8.5
    CVE-2026-28002

    WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.

    Arraytics Booktics
  • High 7.6
    CVE-2026-73346

    WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability

    Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.

    Mailchimp MailChimp For WooCommerce Web / CMS
  • High 7.1
    CVE-2026-66700

    WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.

    ZAYTECH Smart Online Order for Clover
  • High 7.2
    CVE-2026-66704

    WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability

    Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.

    Jegstudio Gutenverse Companion
  • High 7.1
    CVE-2026-66697

    WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.

    Colissimo Colissimo Officiel : Méthodes de livraison pour WooCommerce Web / CMS
  • High 7.1
    CVE-2026-66698

    WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.

    Brainstorm Force SureDash
  • High 7.7
    CVE-2026-66661

    WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.

    Onokazu Directories Pro
  • High 8.5
    CVE-2026-66658

    WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability

    Subscriber SQL Injection in Reviewer <= 3.14.2 versions.

    MVP Themes Reviewer
  • High 8.1
    CVE-2026-66656

    WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.

    Mikado-Themes Foton Core
  • High 8.1
    CVE-2026-66657

    WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.

    Mikado-Themes Biagiotti Core
  • High 7.1
    CVE-2026-66655

    WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.

    multiparcels MultiParcels Shipping For WooCommerce Web / CMS
  • High 8.1
    CVE-2026-66653

    WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

    Edge-Themes Barista
  • High 7.5
    CVE-2026-66469

    WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.

    Afonso Matos Arvow AI SEO Writer
  • High 7.1
    CVE-2026-66468

    WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.

    powerfulwp Local Delivery Drivers for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-66466

    WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.

    wedevs StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart Web / CMS
  • High 7.5
    CVE-2026-66463

    WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.

    Hassan Fakih iCARRY
  • High 7.5
    CVE-2026-66461

    WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

    Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

    smepay SMEPay: UPI Gateway for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-66462

    WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.

    BookingWP WooCommerce Appointments Web / CMS
  • High 8.1
    CVE-2026-66450

    WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.

    Dylan Kuhn Geo Mashup
  • High 7.1
    CVE-2026-66449

    WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.

    Dylan Kuhn Geo Mashup
  • High 7.5
    CVE-2026-66443

    WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.

    Pete Nelson REST API Log
  • High 7.5
    CVE-2026-66441

    WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.

    MultiVendorX MultiVendorX
  • High 7.5
    CVE-2026-66432

    WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability

    Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.

    denishua WPJAM Basic
  • High 8.5
    CVE-2026-66430

    WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability

    Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

    codepress Visitor Traffic Real Time Statistics Pro
  • High 7.5
    CVE-2026-66431

    WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.

    WoompaLoompa Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) Web / CMS
  • High 7.1
    CVE-2026-66429

    WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

    codepress Visitor Traffic Real Time Statistics Pro
  • High 7.1
    CVE-2026-66426

    WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.

    Lester Chan WP-Stats
  • High 7.7
    CVE-2026-65582

    WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability

    Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.

    LiquidThemes AI Hub
  • High 7.5
    CVE-2026-61984

    WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

    Amauri WPMobile.App