CVE-2026-78293 - WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-78293
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78293
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-80433 - WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability
CVE ID :CVE-2026-80433
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-80433
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81271 - WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-81271
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81271
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81272 - WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability
CVE ID :CVE-2026-81272
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81272
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81273 - WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-81273
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81273
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81274 - WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
CVE ID :CVE-2026-81274
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81274
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81276 - WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability
CVE ID :CVE-2026-81276
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81276
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81277 - WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability
CVE ID :CVE-2026-81277
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81277
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81279 - WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability
CVE ID :CVE-2026-81279
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81279
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81572 - Local Privilege Escalation in CodeMeter Runtime on Windows
CVE ID :CVE-2026-81572
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted with System privileges and potentially enable local privilege escalation.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81572
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted with System privileges and potentially enable local privilege escalation.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81573 - Improper Access Control in Local-Only Configuration Commands
CVE ID :CVE-2026-81573
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81573
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81574 - Format String Vulnerability in Logger
CVE ID :CVE-2026-81574
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this vulnerability.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81574
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this vulnerability.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81575 - Missing Sanity Checks for Buffer Lengths
CVE ID :CVE-2026-81575
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segmentation fault that ultimately crashes the CodeMeter Runtime.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81575
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segmentation fault that ultimately crashes the CodeMeter Runtime.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81576 - Improper Authentication of Session Handles
CVE ID :CVE-2026-81576
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81576
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81579 - An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows
CVE ID :CVE-2026-81579
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81579
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81581 - User input in WibuKey is used (without proper sanitization) to compute the address of a pointer, which can be exploited to let the user point to any storage, to which Windows responds with a denial of service.
CVE ID :CVE-2026-81581
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges).
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81581
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges).
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81625 - Stack buffer overflow in Greenbone OS and openvas-scanner
CVE ID :CVE-2026-81625
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overflow and gain full access on the compromised system.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81625
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overflow and gain full access on the compromised system.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-17562 - IDOR in Zirve Security's AdisyonPro
CVE ID :CVE-2026-17562
Published : Aug. 27, 2026, 1:16 p.m. | 2 hours, 28 minutes ago
Description :Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AdisyonPro: before v5.21.0.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-17562
Published : Aug. 27, 2026, 1:16 p.m. | 2 hours, 28 minutes ago
Description :Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AdisyonPro: before v5.21.0.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-5218 - HTML Injection in Softtr's E-Commerce Pack
CVE ID :CVE-2026-5218
Published : Aug. 27, 2026, 1:18 p.m. | 2 hours, 27 minutes ago
Description :Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting (XSS). This issue affects E-Commerce Pack: before 5.03.01.49.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-5218
Published : Aug. 27, 2026, 1:18 p.m. | 2 hours, 27 minutes ago
Description :Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting (XSS). This issue affects E-Commerce Pack: before 5.03.01.49.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66155 - Element maps-ng Cross-Site Scripting Vulnerability
CVE ID :CVE-2026-66155
Published : Aug. 27, 2026, 1:18 p.m. | 2 hours, 27 minutes ago
Description :A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session.
Severity: 7.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66155
Published : Aug. 27, 2026, 1:18 p.m. | 2 hours, 27 minutes ago
Description :A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session.
Severity: 7.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-74232 - Zbtlink MQWrt yunmgrd Cloud C2 Implant
CVE ID :CVE-2026-74232
Published : Aug. 27, 2026, 1:18 p.m. | 2 hours, 27 minutes ago
Description :Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-74232
Published : Aug. 27, 2026, 1:18 p.m. | 2 hours, 27 minutes ago
Description :Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...