Skip to content
OpenAdvisories

Archive

12 September 2026

Vulnerabilities first published on this day (UTC), newest first.

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-78006 Public exploit

    The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

    The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed…

  • Critical 9.8
    CVE-2026-78159 Public exploit

    The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation

    The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload t…

  • Critical 10.0
    CVE-2026-85706 Exploited Public exploit Scanner template EPSS 97%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitra…

    KEV Sep 11, 2026