Archive
24 August 2026
Vulnerabilities first published on this day (UTC), newest first.
47 results · Clear filters · Feed
-
Critical 9.8
WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
-
Critical 9.8
WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
-
Critical 9.8
WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
-
Critical 9.8
WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
-
Critical 9.9
WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions.
-
Critical 9.3
WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability
Unauthenticated SQL Injection in Boost <= 2.0.4 versions.
-
Critical 9.3
WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.
-
Critical 9.1
CakePHP: Potential Authentication bypass with CookieAuthenticator
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion…
-
Critical 9.2CVE-2026-77635 Public exploit
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the json…
-
Critical 9.4
RansomLook API Key Disclosure Through /admin/apikeys HTML Source
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable…
-
Critical 9.4
Combodo iTop: Remote code execution using external auth variable value
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actio…
-
Critical 9.1
OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set
OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go p…
-
Critical 9.1
DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify co…
-
Critical 9.8
DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi
Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this …
-
Critical 9.8
DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm
Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of UDP message content after START_SPEED_TEST before command execution. A remote attacker can trigger t…
-
Critical 10.0
Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread ne…
-
Critical 9.8CVE-2026-78329 Public exploit
Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base…
-
Critical 9.8CVE-2026-71300 Public exploit
Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection
Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which conn…
-
Critical 9.1CVE-2026-66906 Public exploit
Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure S…
-
Critical 9.8
rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php
rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables t…
-
Critical 9.8CVE-2026-76071 Public exploit
Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter
Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in netis.cgi. …
-
Critical 9.8CVE-2026-76070 Public exploit
Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter
Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi.…
-
Critical 9.1CVE-2026-19874 Public exploit
Konami's Metal Gear Online 3 contains a heap-based buffer overflow
A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data ke…
-
Critical 9.4
RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification
RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check befo…
-
Critical 9.1
phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache
phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without includ…
-
Critical 9.1
Remote Code Execution
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.
-
Critical 9.1
Authentication bypass between ZCC and client connector portal
An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal.
-
Critical 9.6
RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length
RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read in libs/clip…
-
Critical 9.2
RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data
RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through seve…
-
Critical 10.0
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipul…
-
Critical 9.2
RansomLook Unauthenticated Database Export Exposes Private Data
RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/<database> endpoint permits selected internal databases to be exp…
-
Critical 9.3
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request…
-
Critical 9.8
WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.
-
Critical 9.8
WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.
-
Critical 9.8
WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
-
Critical 9.8
WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
-
Critical 9.3
WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0.
-
Critical 9.8
WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Digits <= 9.2 versions.
-
Critical 9.9
Instance template path traversal allows arbitrary host file write as root
A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths spec…
-
Critical 9.3
Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5
Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the loadStyles method of the frontend page model.