Archive
12 September 2026
Vulnerabilities first published on this day (UTC), newest first.
3 results · Clear filters · Feed
-
Critical 9.8CVE-2026-78006 Public exploit
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed…
-
Critical 9.8CVE-2026-78159 Public exploit
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload t…
-
Critical 10.0
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitra…
KEV Sep 11, 2026