CVE-2026-63508 - Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability
CVE ID :CVE-2026-63508
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.
Severity: 10.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-63508
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.
Severity: 10.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-65667 - Microsoft Teams Elevation of Privilege Vulnerability
CVE ID :CVE-2026-65667
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
Severity: 10.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-65667
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
Severity: 10.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-65668 - Microsoft Purview eDiscovery Elevation of Privilege Vulnerability
CVE ID :CVE-2026-65668
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-65668
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-68823 - Azure Confidential Ledger Remote Code Execution Vulnerability
CVE ID :CVE-2026-68823
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.
Severity: 9.1 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-68823
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.
Severity: 9.1 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-70332 - Microsoft Office SharePoint Spoofing Vulnerability
CVE ID :CVE-2026-70332
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Severity: 9.6 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-70332
Published : Aug. 7, 2026, 12:16 a.m. | 3 hours, 53 minutes ago
Description :Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Severity: 9.6 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-19190 - StableBit Scanner ScannerService Scanner.Service.exe permission
CVE ID :CVE-2026-19190
Published : Aug. 7, 2026, 2:30 a.m. | 1 hour, 39 minutes ago
Description :A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Files (x86)\StableBit\Scanner\Service\Scanner.Service.exe of the component ScannerService. This manipulation causes permission issues. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-19190
Published : Aug. 7, 2026, 2:30 a.m. | 1 hour, 39 minutes ago
Description :A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Files (x86)\StableBit\Scanner\Service\Scanner.Service.exe of the component ScannerService. This manipulation causes permission issues. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-19189 - Power Sofware PowerISO Kernel Driver scdemu.sys privileges management
CVE ID :CVE-2026-19189
Published : Aug. 7, 2026, 3:16 a.m. | 53 minutes ago
Description :A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functionality in the library C:\Windows\System32\drivers\scdemu.sys of the component Kernel Driver. The manipulation results in improper privilege management. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-19189
Published : Aug. 7, 2026, 3:16 a.m. | 53 minutes ago
Description :A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functionality in the library C:\Windows\System32\drivers\scdemu.sys of the component Kernel Driver. The manipulation results in improper privilege management. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-45198 - GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted
CVE ID :CVE-2026-45198
Published : Aug. 7, 2026, 3:16 a.m. | 53 minutes ago
Description :Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-45198
Published : Aug. 7, 2026, 3:16 a.m. | 53 minutes ago
Description :Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-45204 - GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory
CVE ID :CVE-2026-45204
Published : Aug. 7, 2026, 3:16 a.m. | 53 minutes ago
Description :Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of execution leading to kernel exceptions, platform instability and denial of service.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-45204
Published : Aug. 7, 2026, 3:16 a.m. | 53 minutes ago
Description :Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of execution leading to kernel exceptions, platform instability and denial of service.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-49746 - GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem
CVE ID :CVE-2026-49746
Published : Aug. 7, 2026, 3:16 a.m. | 53 minutes ago
Description :Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-49746
Published : Aug. 7, 2026, 3:16 a.m. | 53 minutes ago
Description :Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-14331 - Subscribe2 < 10.46 - Reflected XSS via email Parameter
CVE ID :CVE-2026-14331
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-14331
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-14943 - Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API
CVE ID :CVE-2026-14943
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-14943
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-15032 - wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion
CVE ID :CVE-2026-15032
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-15032
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-15214 - Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR
CVE ID :CVE-2026-15214
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-15214
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-15215 - Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation
CVE ID :CVE-2026-15215
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-15215
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-15245 - BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode
CVE ID :CVE-2026-15245
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing the affected content.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-15245
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing the affected content.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-15359 - Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite
CVE ID :CVE-2026-15359
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and redirecting the site's cloud template library to attacker-controlled content.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-15359
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and redirecting the site's cloud template library to attacker-controlled content.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-15361 - Content Views < 4.5 - Subscriber+ SQL Injection via preview_request
CVE ID :CVE-2026-15361
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-15361
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-15386 - Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text
CVE ID :CVE-2026-15386
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor (including administrators) who views a post containing such a gallery.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-15386
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor (including administrators) who views a post containing such a gallery.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-16030 - MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication
CVE ID :CVE-2026-16030
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-16030
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-16038 - MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways
CVE ID :CVE-2026-16038
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-16038
Published : Aug. 7, 2026, 6:16 a.m. | 1 hour, 54 minutes ago
Description :The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...