Skip to content
OpenAdvisories

Archive

13 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /13 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

606 results · Feed

  • High 8.8
    CVE-2026-19293

    SMP security request

    SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.

    silabs.com WiseConnect
  • High 8.8
    CVE-2026-19292

    Bluetooth re-pairing with legitimate device can use lower security level

    Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.

    silabs.com WiseConnect
  • High 8.8
    CVE-2026-19291

    Bluetooth re-pairing can use a lower security level than previous

    Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.

    silabs.com WiseConnect
  • High 8.8
    CVE-2026-16101

    forced re-pairing with already bonded device

    Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below

    silabs.com WiseConnect
  • High 8.6
    CVE-2026-19734

    IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

    Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and bar…

    Roskus Prospero Flow CRM
  • High 8.8
    CVE-2026-68454

    KVM: s390: pci: Fix handling of AIF enable without AISB

    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix handling of AIF enable without AISB When a guest seeks to register IRQs without a summary bit specified, ensure that the associated GAITE then stores 0 for the guest AISB …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-68453

    s390/zcrypt: Fix buffer over-read in cca_cipher2protkey

    In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Add validation of both the actual key buffer size and token length fields in all the cca_check_sec*token() functions. Additionally chec…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68452

    s390/zcrypt: Validate length for CCA AES cipher key requests

    In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68451

    s390/zcrypt: Validate length for CCA ECC private key requests

    In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests cca_ecc2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-14456

    Unbounded Memory Growth in QUIC Server Incoming Channel Queue

    Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can m…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • High 7.2
    CVE-2026-66256

    Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)

    ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code executi…

    Apache Software Foundation Apache Shindig Social-Api Apache Shindig Common
  • High 8.5
    CVE-2026-28002

    WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.

    Arraytics Booktics
  • Medium 5.3
    CVE-2026-73403

    WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.

    WPEverest User Registration
  • Medium 5.3
    CVE-2026-73401

    WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.

    InstaWP InstaWP Connect
  • Medium 6.5
    CVE-2026-73357

    WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability

    Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.

    Nexcess GiveWP
  • Medium 5.3
    CVE-2026-73353

    WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.

    revolutbusiness Revolut Gateway for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-73349

    WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

    Nexcess GiveWP
  • High 7.6
    CVE-2026-73346

    WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability

    Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.

    Mailchimp MailChimp For WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-73340

    WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions.

    fifu.app Featured Image from URL
  • Medium 5.9
    CVE-2026-73344

    WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability

    Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.

    Passionate Programmer Peter WP Data Access
  • High 7.1
    CVE-2026-66700

    WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.

    ZAYTECH Smart Online Order for Clover
  • High 7.2
    CVE-2026-66704

    WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability

    Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.

    Jegstudio Gutenverse Companion
  • High 7.1
    CVE-2026-66697

    WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.

    Colissimo Colissimo Officiel : Méthodes de livraison pour WooCommerce Web / CMS
  • High 7.1
    CVE-2026-66698

    WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.

    Brainstorm Force SureDash
  • Medium 6.5
    CVE-2026-66693

    WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Motors <= 1.4.113 versions.

    stylemix Motors
  • Medium 6.3
    CVE-2026-66689

    WordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Anti Spam and list cleaner &#8211; AcyChecker <= 2.0.0 versions.

    AcyMailing Newsletter Team Anti Spam and list cleaner &#8211; AcyChecker
  • Critical 9.8
    CVE-2026-66691

    WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.

    scriptsbundle Nokri
  • Medium 6.5
    CVE-2026-66687

    WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

    Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.

    MagePeople Team WpBookingly
  • High 7.7
    CVE-2026-66661

    WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.

    Onokazu Directories Pro
  • Medium 6.5
    CVE-2026-66660

    WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.

    Scott Paterson Contact Form 7 – PayPal & Stripe Add-on
  • High 8.5
    CVE-2026-66658

    WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability

    Subscriber SQL Injection in Reviewer <= 3.14.2 versions.

    MVP Themes Reviewer
  • High 8.1
    CVE-2026-66656

    WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.

    Mikado-Themes Foton Core
  • High 8.1
    CVE-2026-66657

    WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.

    Mikado-Themes Biagiotti Core
  • High 7.1
    CVE-2026-66655

    WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.

    multiparcels MultiParcels Shipping For WooCommerce Web / CMS
  • Medium 6.0
    CVE-2026-66654

    WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability

    Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.

    TangibleWP Vehica Core
  • High 8.1
    CVE-2026-66653

    WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

    Edge-Themes Barista
  • Critical 9.3
    CVE-2026-66478

    WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.

    andy_moyle Church Admin
  • Critical 9.3
    CVE-2026-66472

    WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.

    Everest themes Everest Backup
  • Medium 6.5
    CVE-2026-66471

    WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.

    Themepoints Accordion
  • High 7.5
    CVE-2026-66469

    WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.

    Afonso Matos Arvow AI SEO Writer