[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 418304
> CVE-2026-65542 [HIGH 8.8]
[PUBLISHED: 2026-08-06] [EPSS 0.50%]
Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.
> CVE-2026-65541 [HIGH 7.3]
[PUBLISHED: 2026-08-06] [EPSS 0.30%]
Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.
> CVE-2026-65523 [HIGH 7.5]
[PUBLISHED: 2026-08-06] [EPSS 0.39%]
Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.
> CVE-2026-65520 [CRITICAL 9.3]
[PUBLISHED: 2026-08-06] [EPSS 0.40%]
Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
> CVE-2026-65517 [HIGH 7.1]
[PUBLISHED: 2026-08-06] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.
> CVE-2026-65515 [HIGH 7.1]
[PUBLISHED: 2026-08-06] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.
> CVE-2026-65513 [HIGH 7.1]
[PUBLISHED: 2026-08-06] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.
> CVE-2026-65509 [HIGH 7.1]
[PUBLISHED: 2026-08-06] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.
> CVE-2026-65508 [CRITICAL 9.3]
[PUBLISHED: 2026-08-06] [EPSS 0.40%]
Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.
> CVE-2026-65507 [CRITICAL 9.8]
[PUBLISHED: 2026-08-06] [EPSS 0.48%]
Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.
> CVE-2026-65504 [HIGH 7.5]
[PUBLISHED: 2026-08-06] [EPSS 0.39%]
Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.
> CVE-2026-65502 [MEDIUM 5.3]
[PUBLISHED: 2026-08-06] [EPSS 0.33%]
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.
> CVE-2026-61982 [HIGH 7.1]
[PUBLISHED: 2026-08-06] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.
> CVE-2026-61964 [HIGH 7.1]
[PUBLISHED: 2026-08-06] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.
> CVE-2026-61963 [HIGH 7.1]
[PUBLISHED: 2026-08-06] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.
> CVE-2026-61961 [HIGH 7.1]
[PUBLISHED: 2026-08-06] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.
> CVE-2026-61959 [MEDIUM 6.5]
[PUBLISHED: 2026-08-06] [EPSS 0.22%]
Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.
> CVE-2026-54489 [CRITICAL 9.1]
[PUBLISHED: 2026-08-06] [EPSS 0.62%]
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This vulnerab...
> CVE-2026-53976 [CRITICAL 9.3]
[PUBLISHED: 2026-08-06] [EPSS 2.61%] [🎯 NUCLEI]
OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing...
> CVE-2026-53975 [CRITICAL 9.3]
[PUBLISHED: 2026-08-06] [EPSS 1.68%]
OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn() without any allowlist, blocklist, or ar...
> CVE-2026-34502
[PUBLISHED: 2026-08-06] [EPSS 0.51%]
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
> CVE-2026-34501
[PUBLISHED: 2026-08-06] [EPSS 0.51%]
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
> CVE-2026-34191
[PUBLISHED: 2026-08-06] [EPSS 0.59%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3
> CVE-2026-32548 [MEDIUM 5.3]
[PUBLISHED: 2026-08-06] [EPSS 0.31%]
Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.
> CVE-2026-32469 [MEDIUM 5.3]
[PUBLISHED: 2026-08-06] [EPSS 0.33%]
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.
> CVE-2026-32327
[PUBLISHED: 2026-08-06] [EPSS 0.46%]
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
> CVE-2026-28183 [HIGH 7.2]
[PUBLISHED: 2026-08-06] [EPSS 0.46%]
Editor Privilege Escalation in PublishPress Capabilities <= 2.45.0 versions.
> CVE-2026-28180 [MEDIUM 5.3]
[PUBLISHED: 2026-08-06] [EPSS 0.31%]
Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.
> CVE-2026-28179 [MEDIUM 5.9]
[PUBLISHED: 2026-08-06] [EPSS 0.24%]
Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.
> CVE-2026-28178 [MEDIUM 6.5]
[PUBLISHED: 2026-08-06] [EPSS 0.22%]
Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.
> CVE-2026-28177 [HIGH 7.1]
[PUBLISHED: 2026-08-06] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions.
> CVE-2026-28172 [HIGH 7.1]
[PUBLISHED: 2026-08-06] [EPSS 0.13%]
Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.
> CVE-2026-28169 [MEDIUM 5.3]
[PUBLISHED: 2026-08-06] [EPSS 0.33%]
Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.
> CVE-2026-28146 [MEDIUM 6.5]
[PUBLISHED: 2026-08-06] [EPSS 0.44%]
Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.
> CVE-2026-28143 [HIGH 7.1]
[PUBLISHED: 2026-08-06] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.
> CVE-2026-28141 [HIGH 7.1]
[PUBLISHED: 2026-08-06] [EPSS 0.47%] [🎯 NUCLEI]
Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.
> CVE-2026-28140 [HIGH 7.5]
[PUBLISHED: 2026-08-06] [EPSS 0.35%]
Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.
> CVE-2026-28139 [CRITICAL 9.8]
[PUBLISHED: 2026-08-06] [EPSS 0.56%]
Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.
> CVE-2026-28111 [HIGH 8.8]
[PUBLISHED: 2026-08-06] [EPSS 0.42%]
Contributor Privilege Escalation in Forminator <= 1.56.0 versions.
> CVE-2026-28082 [HIGH 7.1]
[PUBLISHED: 2026-08-06] [EPSS 0.25%]
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.
> CVE-2026-28005 [CRITICAL 9.8]
[PUBLISHED: 2026-08-06] [EPSS 0.48%]
Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.
> CVE-2026-25403 [MEDIUM 6.5]
[PUBLISHED: 2026-08-06] [EPSS 0.27%]
Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
> CVE-2026-19045 [LOW 1.9]
[PUBLISHED: 2026-08-06] [EPSS 0.78%]
A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of the argument Description causes command injection. It is pos...
> CVE-2026-19044 [LOW 1.9]
[PUBLISHED: 2026-08-06] [EPSS 0.87%]
A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_scene/add_node. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The...
> CVE-2026-15246 [MEDIUM 4.3]
[PUBLISHED: 2026-08-06] [EPSS 0.14%]
The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages without...
> CVE-2025-49506
[PUBLISHED: 2026-08-06] [EPSS 0.38%]
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android. Use...
> CVE-2026-64993 [MEDIUM 6.8]
[PUBLISHED: 2026-08-06] [EPSS 0.24%]
Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A remote unauthenticated attacker could potentially exploit this vulnerability leading to loss of confidentiality and integrity.
> CVE-2026-5134 [CRITICAL 9.8]
[PUBLISHED: 2026-08-06] [EPSS 0.48%]
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in a...
> CVE-2026-19041 [LOW 2.1]
[PUBLISHED: 2026-08-06] [EPSS 2.12%]
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiate t...
> CVE-2026-19040 [LOW 2.1]
[PUBLISHED: 2026-08-06] [EPSS 0.30%]
A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to fix...