Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
12,374 results · Feed
-
Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabili…
-
High 8.2
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Conn…
-
Critical 10.0
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Pr…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability …
-
High 8.2
OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite
The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data.
-
Medium 6.4
Reviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wp_display() shortcode handler, used by multiple shortcodes, allowing attacker-controlled …
-
Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabili…
-
Critical 9.8
OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings
The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full account take…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability …
-
High 8.8
Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling
A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat …
-
Critical 9.1
Arbitrary file overwrite and deletion local and remote in OpenRGB
Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3.
-
High 7.5CVE-2026-16444 Public exploit
Improper Validation of File Paths in TeamViewer Desktop Clients
Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipbo…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Medium 6.3
Broken access control in dashboard snapshots
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).
-
High 8.2
Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS
The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.
-
High 8.2
Remote UDP DoS by sending multiple DNS Cookie options
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remo…
-
Medium 6.9
Remote TCP DoS by throttling the TCP receive window
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
-
High 8.2
Wrong interpretation of ACL ranges
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access cou…
-
High 8.8
Thinking Software Technology｜Efence - Arbitrary File Upload
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
-
High 8.2
Thinking Software Technology｜Efence - SQL Injection
Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents.
-
Critical 9.8
Thinking Software Technology｜EFence - Arbitrary File Upload
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
-
Medium 5.3
CAYIN Technology｜CAYIN CMS-WS/CMS-SE - Missing Authentication
CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure.
-
High 7.2
CAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Upload
CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server.
-
Medium 6.3
SQL injection vulnerability in ZTE SCP product
With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This v…
-
High 8.8
Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie
The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbw_get_hash_key() function that uses the current user's …
-
High 7.5
WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters
The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient prep…
-
Medium 6.4
Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode
The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i…
-
High 7.8
Insufficient input validation in Admin By Request (ABR)
Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended.
-
High 8.8
Insecure PIN derivation mechanism in Admin By Request (ABR)
An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.
-
Low 1.2
Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own …
-
Low 2.4
A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly w…
-
Low 2.4
A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps o…
-
High 7.2
Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient inp…
-
Critical 9.8CVE-2026-18431 Public exploit
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input val…
-
Medium 6.4
Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping.…
-
Medium 5.3
Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and…
-
Medium 5.5
RegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' Parameter
The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.
-
Medium 4.3
Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDOR
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, r…
-
Medium 6.5
Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page
The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal dat…
-
Medium 5.3
Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public pag…