Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
12,374 results · Feed
-
Critical 9.8
WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Digits <= 9.2 versions.
-
High 7.1
WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.
-
High 7.5
WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 versions.
-
High 8.1
WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.
-
High 8.1
WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Tonda < 2.6 versions.
-
High 8.1
WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
-
Medium 4.3
WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.
-
Medium 6.5
WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
-
Medium 5.4
WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.
-
Medium 4.9
WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability
Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
-
Medium 5.3
WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.
-
Medium 5.4
WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
-
High 7.6
WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability
Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.
-
Medium 5.3
WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.
-
Medium 6.4
WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability
Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.
-
High 7.1
WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
-
High 7.1
WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.
-
High 7.1
WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
-
Medium 5.3
WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
-
High 7.3
itsourcecode Online Clinic Management System Admin Login login.php sql injection
A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote ex…
-
High 8.5
Authenticated RCE in KAON PG5298
Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.8…
-
High 7.1
Missing Authentication for Critical Function in KAON PG5298
Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal. This vulnerability has been fixed in firmware version: 3.0.82 for PG52…
-
Medium 6.5
Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates
A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS con…
-
Medium 4.8
Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG
Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application ori…
-
High 7.3
itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload
A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted uploa…
-
High 7.3
itsourcecode Real Estate Management System search.php sql injection
A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Performing a manipulation of the argument search/delivery_type/search_price/property_type results in s…
-
Medium 5.4
Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string …
-
High 7.4
Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a cano…
-
Medium 5.9
Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerability
It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16…
-
High 7.5
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an…
-
High 7.5
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a diffe…
-
High 7.5
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input int…
-
High 8.8
DIAEnergie - SQL Injection
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
-
High 8.8
DIAEnergie - SQL Injection
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
-
High 8.8
DIAEnergie - SQL Injection
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
-
High 8.8
DIAEnergie - SQL Injection
SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.
-
High 7.5
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a res…
-
Critical 9.9
Instance template path traversal allows arbitrary host file write as root
A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths spec…
-
Medium 6.0
DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, pre…
-
High 8.5CVE-2026-78306 Public exploit
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacke…