Skip to content
OpenAdvisories

Archive

3 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /3 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

349 results · Feed

  • High 8.0
    CVE-2026-85012

    OS command injection in the Amazon CodeCatalyst blueprints SDK

    Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to exec…

    AWS @amazon-codecatalyst/blueprints.blueprint
  • Critical 9.1
    CVE-2026-58400 Exploited

    GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter

    GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling J…

    geonetwork core-geonetwork
  • Medium 5.3
    CVE-2026-84968

    Heap out-of-bounds read via corrupt nested BSON in field path error message

    An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to applicatio…

    MongoDB PHP Driver php-mongodb php-mongodb Debian Ubuntu
  • Medium 6.3
    CVE-2026-85186

    itsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted upload

    A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller.php?action=photos of the component Customer Controller. Executing a manipulation …

    itsourcecode Online Medicine Delivery System
  • Medium 5.3
    CVE-2026-85304

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor (Free Wid…

    Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
  • Medium 5.3
    CVE-2026-85309

    WordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.

    supsystic Ultimate Maps by Supsystic
  • Medium 5.3
    CVE-2026-85308

    WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5.

    Brainstorm Force SureForms
  • Medium 5.3
    CVE-2026-85307

    WordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08.

    Kevin Pirnie KP Agent Ready
  • Medium 6.5
    CVE-2026-75602

    OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

    OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary direc…

    OpenListTeam OpenList github.com/OpenListTeam/OpenList github.com/OpenListTeam/OpenList/v4 Go
  • Medium 6.5
    CVE-2026-85306

    WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5.

    Cascadia Web Services MountDev AI MCP Connector for WordPress Web / CMS
  • Medium 5.4
    CVE-2026-85305

    WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1.

    SEOPress SEOPress
  • Medium 6.5
    CVE-2026-85303

    WordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7.

    Magepeople Booking and Rental Manager
  • Medium 6.5
    CVE-2026-85302

    WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2.

    WPKoi WordPress Themes WPKoi Templates for Elementor
  • High 7.1
    CVE-2026-84848

    WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.

    brightvesseldev Quick Event Manager
  • High 7.5
    CVE-2026-84847

    WordPress Quick Event Manager plugin <= 9.17 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.

    brightvesseldev Quick Event Manager
  • Critical 9.8
    CVE-2026-84834

    WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.

    EyeCix Technologies JobSearch
  • High 7.1
    CVE-2026-84836

    WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.

    Kirillbdev WC Ukraine Shipping
  • Critical 9.8
    CVE-2026-84814

    WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.

    Bricksforge Bricksforge
  • Critical 9.3
    CVE-2026-84813

    WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability

    Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.

    Paolo GeoDirectory
  • High 7.1
    CVE-2026-84812

    WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.

    wordplus BP Better Messages
  • High 8.1
    CVE-2026-84779

    WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents <= 1.51.0 versions.

    Sheikh Heera Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents
  • High 7.5
    CVE-2026-84778

    WordPress Migrate Guru – Site Migration & Cloning plugin <= 6.65 - Denial of Service Attack vulnerability

    Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration &amp; Cloning <= 6.65 versions.

    migrateguru Migrate Guru – Site Migration &amp; Cloning
  • High 7.4
    CVE-2026-84777

    WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability

    Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.

    Really Simple Plugins Really Simple SSL
  • High 7.5
    CVE-2026-84776

    WordPress MalCare Security plugin <= 6.69 - Denial of Service Attack vulnerability

    Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.

    malcare MalCare Security
  • Medium 6.1
    CVE-2026-84774

    WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.

    VeronaLabs WP Statistics
  • High 7.2
    CVE-2026-84773

    WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.

    Shane Bishop EWWW Image Optimizer
  • Medium 6.5
    CVE-2026-84769

    WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.

    Strategy11 Team Business Directory
  • Critical 9.3
    CVE-2026-84768

    WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability

    Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.

    e4jvikwp VikAppointments Services Booking Calendar
  • Medium 5.9
    CVE-2026-84766

    WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability

    Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.

    WP ManageNinja FluentBooking Pro
  • Medium 5.3
    CVE-2026-84767

    WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerability

    Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.

    Nexcess BookIt
  • High 7.1
    CVE-2026-84765

    WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.

    John Havlik Breadcrumb NavXT
  • Medium 5.3
    CVE-2026-84762

    WordPress WP EasyPay plugin <= 4.5.3 - Bypass Vulnerability vulnerability

    Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.

    Saad Iqbal WP EasyPay
  • High 7.1
    CVE-2026-84763

    WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.

    rometheme RTMKit
  • High 7.2
    CVE-2026-84761

    WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Server Side Request Forgery.This issue affects LiteSpeed Cache: from n/a through 7.9.

    Hai Zheng / Lite Speed Cache LiteSpeed Cache
  • Medium 6.5
    CVE-2026-84758

    WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.

    Strategy11 Team Business Directory
  • High 8.2
    CVE-2026-84757

    WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability

    Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.

    aresit WP Compress
  • High 7.1
    CVE-2026-84756

    WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.

    WC Lovers WCFM Membership
  • Medium 6.5
    CVE-2026-84754

    WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.

    WPFunnels WPFunnels
  • Medium 6.5
    CVE-2026-84755

    WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.

    WPFunnels Mail Mint
  • Critical 9.8
    CVE-2026-84753 Public exploit

    WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.

    WPFunnels Mail Mint