Skip to content
OpenAdvisories

Archive

24 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /24 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

319 results · Feed

  • Unscored —
    RUSTSEC-2026-0438

    Rejected authentication challenges can poison the Key Vault scope cache

    Affected versions of `KeyVaultAuthorizer::on_challenge` cache the authentication scope from a `WWW-Authenticate` response before verifying that the challenge resource matches the requested endpoint. When verification rejects the challenge, the scope remains c…

    azure_security_keyvault_secrets crates.io
  • Unscored —
    RUSTSEC-2026-0437

    Rejected authentication challenges can poison the Key Vault scope cache

    Affected versions of `KeyVaultAuthorizer::on_challenge` cache the authentication scope from a `WWW-Authenticate` response before verifying that the challenge resource matches the requested endpoint. When verification rejects the challenge, the scope remains c…

    azure_security_keyvault_certificates crates.io
  • Unscored —
    RUSTSEC-2026-0331

    Panic on Decoding Short Hybrid Keys

    The deserialization functions `X25519MlKem768Draft00PrivateKey::decode` `X25519MlKem768Draft00PublicKey::decode` and `XWingKemDraft06PublicKey::decode` would panic during an indexing operation when provided an input slice that is shorter than the length of th…

    libcrux-kem crates.io
  • Unscored —
    GHSA-mr2v-63pc-gmr4

    Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)

    `BitVecCore::clear` drops every occupied element with `drop_in_place` and only afterwards clears the occupancy bits and resets `len`. If an element's `Drop` panics, those metadata updates are skipped, so the slot of the already-dropped element stays marked as…

    stable-vec crates.io
  • Critical 9.8
    CVE-2026-66650

    WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.

    ThemeREX FreightCo
  • High 8.1
    CVE-2026-66670

    WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Måne <= 1.7 versions.

    Elated-Themes Mane
  • Critical 9.8
    CVE-2026-66648

    WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.

    MVP Themes Jawn
  • High 7.1
    CVE-2026-66610

    WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.

    thembay Urna
  • High 7.5
    CVE-2026-66585

    WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.

    WPCafe WP Cafe Pro
  • Critical 9.8
    CVE-2026-66587

    WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

    WPCafe WP Cafe Pro
  • Critical 9.8
    CVE-2026-32558

    WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.

    RedefiningTheWeb Affiliate Pro - Affiliate Program for WooCommerce & WordPress Web / CMS
  • Critical 9.3
    CVE-2026-32551

    WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0.

    DiviNext Woo Essential
  • High 8.5
    CVE-2026-32478

    WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability

    Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.

    weDevs Pte WP Project Manager Pro
  • High 8.6
    CVE-2026-32477

    WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability

    Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.

    RadiusTheme ShopBuilder Pro – Elementor WooCommerce Builder Addons Web / CMS
  • High 7.1
    CVE-2026-32476

    WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.

    AmpleByte Pvt Brave Conversion Engine (PRO)
  • High 8.5
    CVE-2026-32471

    WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability

    Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.

    ThemeBing ProLancer Element
  • High 8.6
    CVE-2026-28171

    WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability

    Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.

    vanquish WooCommerce File Approval Web / CMS
  • High 7.1
    CVE-2026-28190

    WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.

    ThemeBing ProLancer Element
  • High 7.5
    CVE-2026-28167

    WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path Traversal.This issue affects Super Forms: from n/a through 6.3.316.

    WebRehab Super Forms
  • High 7.1
    CVE-2026-28166

    WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.

    GoodLayers Tourmaster
  • Critical 9.8
    CVE-2026-28165

    WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Digits <= 9.2 versions.

    UnitedOver Digits
  • High 7.1
    CVE-2026-28162

    WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.

    Franky Events Made Easy
  • High 7.5
    CVE-2026-28153

    WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS, Webhooks &amp; More <= 1.7.1 versions.

    Notification Master Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS, Webhooks &amp; More Web / CMS
  • High 8.1
    CVE-2026-28152

    WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.

    Select-Themes Tonda Core
  • High 8.1
    CVE-2026-28151

    WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Tonda < 2.6 versions.

    Select-Themes Tonda
  • High 8.1
    CVE-2026-66671

    WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.

    Elated-Themes Verdure Core
  • Medium 4.3
    CVE-2026-78280

    WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.

    HashThemes Hash Form
  • Medium 6.5
    CVE-2026-78290

    WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.

    ThemeGrill Magazine Blocks
  • Medium 5.4
    CVE-2026-78279

    WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.

    WP ManageNinja Fluent Support Pro
  • Medium 4.9
    CVE-2026-78277

    WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability

    Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.

    WP ManageNinja FluentCRM Pro
  • Medium 5.3
    CVE-2026-78278

    WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.

    WP ManageNinja Fluent Boards Pro
  • Medium 5.4
    CVE-2026-78272

    WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.

    WP ManageNinja Fluent Support Pro
  • High 7.6
    CVE-2026-78270

    WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability

    Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.

    WP ManageNinja FluentCRM Pro
  • Medium 5.3
    CVE-2026-78258

    WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.

    Magepeople Booking and Rental Manager
  • Medium 6.4
    CVE-2026-78269

    WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

    Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.

    Tammersoft Shared Files
  • High 7.1
    CVE-2026-66623

    WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.

    Inisev Social Media & Share Icons
  • High 7.1
    CVE-2026-66584

    WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.

    Code for Recovery 12 Step Meeting List
  • High 7.1
    CVE-2026-66599

    WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.

    Liquid Web / StellarWP WPComplete
  • Medium 5.3
    CVE-2026-78291

    WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.

    Webful Creations RepairBuddy
  • High 7.3
    CVE-2026-78246

    itsourcecode Online Clinic Management System Admin Login login.php sql injection

    A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote ex…

    itsourcecode Online Clinic Management System