Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
12,374 results · Feed
-
Medium 6.9
Redis Glob Pattern Injection Allows Unauthorized Enumeration of Private Ransomlook Data
Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. The /api/health/<name> endpoint attempted to resolve the supplied name to…
-
High 7.4
HCL Hive is affected by use of a cryptographic primitive with a risky implementation
HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credential leakage if a single internal component is breached.
-
Medium 4.3CVE-2026-78250 Public exploit
bytebot-ai bytebot Agent Execution Workflow infinite loop
A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipulation leads to infinite loop. The attack may be performed from remote. The exploit is publicly avail…
-
High 8.8
act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend
act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArti…
-
Medium 6.5
adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction
adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens…
-
High 7.4
webpack-dev-middleware before 7.4.6 and 8.3.0 Path Traversal via Non-Slash-Terminated publicPath
webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string pr…
-
High 7.8
Flair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load
The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib.load(str(model_file))) and so executes arbitrary Python while loading a model file. Loading a model …
-
High 8.8
Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders
Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trust_remote_code=True as a literal or as an unconditional default: RerankModel._ge…
-
High 8.2
Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients
The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment (get, capture, cancel), paymentRefund (create…
-
Critical 9.6
RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length
RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read in libs/clip…
-
Critical 9.2
RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data
RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through seve…
-
Critical 10.0
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipul…
-
Critical 9.2
RansomLook Unauthenticated Database Export Exposes Private Data
RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/<database> endpoint permits selected internal databases to be exp…
-
High 7.3
SourceCodester Simple Online Food Ordering System ajax.php save_settings sql injection
A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. This manipulation of the argument Name causes sql injection. The attack is possible …
-
High 8.8
Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook
RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanis…
-
High 7.2
HCL Hive is affected by a broken access control vulnerability
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.
-
Critical 9.3
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request…
-
High 7.3
SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirm_order. The manipulation of the argument ID results in sql injection. The attack can b…
-
Medium 4.3
HCL Hive is affected by an information exposure vulnerability
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase …
-
Unscored —
Rejected authentication challenges can poison the Key Vault scope cache
Affected versions of `KeyVaultAuthorizer::on_challenge` cache the authentication scope from a `WWW-Authenticate` response before verifying that the challenge resource matches the requested endpoint. When verification rejects the challenge, the scope remains c…
-
Unscored —
Rejected authentication challenges can poison the Key Vault scope cache
Affected versions of `KeyVaultAuthorizer::on_challenge` cache the authentication scope from a `WWW-Authenticate` response before verifying that the challenge resource matches the requested endpoint. When verification rejects the challenge, the scope remains c…
-
Unscored —
Rejected authentication challenges can poison the Key Vault scope cache
Affected versions of `KeyVaultAuthorizer::on_challenge` cache the authentication scope from a `WWW-Authenticate` response before verifying that the challenge resource matches the requested endpoint. When verification rejects the challenge, the scope remains c…
-
Unscored —
Panic on Decoding Short Hybrid Keys
The deserialization functions `X25519MlKem768Draft00PrivateKey::decode` `X25519MlKem768Draft00PublicKey::decode` and `XWingKemDraft06PublicKey::decode` would panic during an indexing operation when provided an input slice that is shorter than the length of th…
-
Unscored —
Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)
`BitVecCore::clear` drops every occupied element with `drop_in_place` and only afterwards clears the occupancy bits and resets `len`. If an element's `Drop` panics, those metadata updates are skipped, so the slot of the already-dropped element stays marked as…
-
Critical 9.8
WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.
-
High 8.1
WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
-
Critical 9.8
WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.
-
High 7.1
WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.
-
High 7.5
WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
-
Critical 9.8
WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
-
Critical 9.8
WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
-
Critical 9.3
WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0.
-
High 8.5
WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability
Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.
-
High 8.6
WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
-
High 7.1
WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.
-
High 8.5
WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability
Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.
-
High 8.6
WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.
-
High 7.1
WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability
Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.
-
High 7.5
WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path Traversal.This issue affects Super Forms: from n/a through 6.3.316.
-
High 7.1
WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.