Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
5,333 results · Clear filters · Feed
-
High 7.5
AVideo SSRF Guard Bypass via IPv6 Transition Addresses
AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protect…
-
High 7.7
OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin c…
-
High 7.5
Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources
Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py are declared with a permission class that admits an…
-
High 8.4
rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape
The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor repla…
-
High 8.6
Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton
The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with a…
-
High 8.6
mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter …
-
High 8.2
APITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints
APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx …
-
High 7.5
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource…
-
High 8.6
Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges
Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from e…
-
High 7.2
Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforc…
-
High 8.8
Multiple Vulnerabilities in TOOOLS' iSquad
The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the e…
-
High 8.8
Multiple Vulnerabilities in TOOOLS' iSquad
A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker…
-
High 7.5
Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection
Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable …
-
High 7.6
A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions…
-
High 8.6
Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys
Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines …
-
High 7.1
Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing
Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export.
-
High 7.0
Apache APISIX: Cross-user response poisoning in serverless plugins
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APIS…
-
High 8.7
Apache APISIX: Unauthenticated CPU-exhaustion DoS
Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to …
-
High 7.0
Apache APISIX: ldap-auth plugin cross-subtree identity impersonation
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different e…
-
High 8.8
Stack buffer overflow in Greenbone OS and openvas-scanner
A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overflow and gain full access on the compromised system.
-
High 8.5
WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability
Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.
-
High 8.1
WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.
-
High 8.8
WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
-
High 7.5
WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
-
High 7.1
WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.
-
High 7.1
WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.
-
High 8.5
WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability
Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.
-
High 7.1
WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.
-
High 7.1
WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
-
High 7.2
WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.
-
High 7.2
WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability
Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.
-
High 7.1
WordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.
-
High 8.8
WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.
-
High 8.5
WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability
Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
-
High 8.5
WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability
Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.
-
High 8.6
WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.
-
High 8.8
User input in WibuKey is used (without proper sanitization) to compute the address of a pointer, which can be exploited to let the user point to any storage, to which Windows responds with a denial of service.
Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possi…
-
High 8.8
An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows
In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to exec…
-
High 7.7
Improper Authentication of Session Handles
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read …
-
High 7.5
Missing Sanity Checks for Buffer Lengths
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segme…