Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
12,374 results · Feed
-
High 7.5
Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection
Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable …
-
High 7.6
A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions…
-
Critical 9.3
Multiple Vulnerabilities in TOOOLS' iSquad
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is…
-
Medium 5.3
AlexGladkov claude-in-mobile client.ts execSync os command injection
A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been…
-
Medium 5.4
Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and mo…
-
Medium 4.3
HTML Injection in Softtr's E-Commerce Pack
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting (XSS). This issue affects E-Commerce Pack: before 5.03.01.49.
-
Medium 6.5
IDOR in Zirve Security's AdisyonPro
Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AdisyonPro: before v5.21.0.
-
Critical 9.8CVE-2026-74233 Exploited
Zbtlink MQWrt infosrvd Command Injection
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.…
-
Critical 9.8CVE-2026-74232 Exploited
Zbtlink MQWrt yunmgrd Cloud C2 Implant
Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmwar…
-
Medium 5.3
blackms aistack Static File server.ts path traversal
A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static File Handler. Such manipulation of the argument req.url leads to path traversal. The atta…
-
High 8.6
Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys
Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines …
-
Medium 6.5
Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain hi…
-
High 7.1
Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing
Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export.
-
High 7.0
Apache APISIX: Cross-user response poisoning in serverless plugins
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APIS…
-
High 8.7
Apache APISIX: Unauthenticated CPU-exhaustion DoS
Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to …
-
High 7.0
Apache APISIX: ldap-auth plugin cross-subtree identity impersonation
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different e…
-
High 8.8
Stack buffer overflow in Greenbone OS and openvas-scanner
A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overflow and gain full access on the compromised system.
-
High 8.5
WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability
Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.
-
Medium 5.3
WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
-
Medium 5.3
WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.
-
High 8.1
WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.
-
High 8.8
WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
-
Medium 4.9
WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability
Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.
-
High 7.5
WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
-
High 7.1
WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.
-
High 7.1
WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.
-
Critical 9.8
WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.
-
Critical 9.3
WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability
Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.
-
Critical 9.8
WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.
-
High 8.5
WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability
Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.
-
High 7.1
WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.
-
High 7.1
WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
-
High 7.2
WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.
-
Medium 6.8
WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability
Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.
-
Medium 6.5
WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.
-
Critical 9.1
WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability
Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.
-
High 7.2
WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability
Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.
-
Critical 9.3
WordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability
Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.
-
High 7.1
WordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.
-
High 8.8
WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.