Skip to content
OpenAdvisories

Archive

13 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /13 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

275 results · Clear filters · Feed

  • High 7.1
    CVE-2026-65580

    WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.

    bracketweb Agrion
  • High 7.5
    CVE-2026-61980

    WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability

    Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.

    Daan.dev OMGF Pro
  • High 8.1
    CVE-2026-61979

    WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

    miniOrange SAML SP Single Sign On
  • High 7.1
    CVE-2026-61974

    WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.

    kitae-park Mang Board WP
  • High 7.1
    CVE-2026-61965

    WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

    ahmadgb GeekyBot
  • High 7.4
    CVE-2026-28189

    WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability

    Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.

    Roland Barker Participants Database
  • High 7.1
    CVE-2026-61960

    WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.

    themeisle WP Full Stripe Free
  • High 7.3
    CVE-2026-28188

    WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.

    themefic Hydra Booking
  • High 7.1
    CVE-2026-28187

    WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

    Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance
  • High 8.1
    CVE-2026-28186

    WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

    themefic Travelfic Toolkit
  • High 8.8
    CVE-2026-28176

    WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

    Booking Activities Team Booking Activities
  • High 7.1
    CVE-2026-28175

    WordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.

    wp-buy Visitors Traffic Real Time Statistics
  • High 7.1
    CVE-2026-28173

    WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability

    Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.

    Arraytics WP Event Solution
  • High 7.1
    CVE-2026-28170

    WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.

    1meril Blog Floating Button
  • High 8.5
    CVE-2026-28168

    WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability

    Subscriber SQL Injection in CubeWP <= 1.1.30 versions.

    Imran Tauqeer CubeWP
  • High 8.8
    CVE-2026-28161

    WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.

    Aonetheme Service Finder Booking
  • High 7.5
    CVE-2026-28157

    WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability

    Subscriber Path Traversal in Do Lasso <= 358 versions.

    Lasso Analytics Do Lasso
  • High 7.1
    CVE-2026-28158

    WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.

    Lasso Analytics Do Lasso
  • High 8.5
    CVE-2026-28156

    WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability

    Subscriber SQL Injection in Do Lasso <= 358 versions.

    Lasso Analytics Do Lasso
  • High 7.1
    CVE-2026-28003

    WordPress Maspik – Spam blacklist plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.

    yonifre Maspik – Spam blacklist
  • High 7.1
    CVE-2026-28004

    WordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

    Strategy11 Team Business Directory
  • High 8.1
    CVE-2026-27543

    WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.

    FluxBuilder MStore API
  • High 7.1
    CVE-2026-27539

    WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.

    Welcart Welcart e-Commerce
  • High 7.5
    CVE-2026-27538

    WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

    Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

    Wp Directory Kit WP Directory Kit
  • High 7.1
    CVE-2026-27536

    WordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.

    PluginOps MailChimp Subscribe Forms
  • High 7.2
    CVE-2026-27380

    WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

    Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

    MagePeople Team Car Rental Manager
  • High 7.1
    CVE-2026-27535

    WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

    solacewp Solace Extra
  • High 7.5
    CVE-2026-27345

    WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

    MagePeople Team Taxi Booking Manager for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-48702

    Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

    Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers …

    sigstore rekor kubescape zarf Debian Ubuntu Wolfi Go
  • High 8.7
    CVE-2026-49478

    Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

    Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a maliciou…

    sigstore fulcio kubescape kots Debian Ubuntu Wolfi Go
  • High 7.2
    CVE-2026-6471 Public exploit

    PostgreSQL logical decoding can dlopen arbitrary file

    Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary cod…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-14671

    PostgreSQL refint plan cache type confusion executes arbitrary code

    Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "re…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.1
    CVE-2026-6464

    PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands

    Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits …

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-19385

    PostgreSQL pg_dump heap buffer overflow executes arbitrary code

    Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, an…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-18408

    PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client

    Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command in…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-16239

    PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code

    Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.6, 17.11, 16.15, …

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-16238

    PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code

    Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before Postg…

    postgresql-9.3 postgresql15 postgresql16 postgresql17 Debian Ubuntu Alpine
  • High 8.8
    CVE-2026-15742

    PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound

    Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-15741

    PostgreSQL expression deparse allows SQL injection via EXTRACT argument

    SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-14680

    PostgreSQL type confusion via "internal" arguments

    Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompati…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi