CVE-2026-21756
— HCL Hive is affected by a broken access control vulnerability
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environmen…
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78365
— IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read…
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record…
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78247
— SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirm_order. The manipulation o…
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78323
— Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates
A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without …
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78291
— WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78290
— WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78280
— WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.
hash_form
|
Remote
|
Cross-Site Request Forgery
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78279
— WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerab…
Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.
Remote
|
Cross-Site Request Forgery
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78278
— WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) v…
Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78277
— WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerabili…
Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
Remote
|
Server-Side Request Forgery
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78272
— WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78270
— WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability
Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.
Remote
|
Injection
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78269
— WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability
Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78258
— WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78246
— itsourcecode Online Clinic Management System Admin Login login.php sql injection
A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulatio…
Remote
|
Injection
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-6017
— Missing Authentication for Critical Function in KAON PG5298
Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal.
This vuln…
|
Information Disclosure
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-66671
— WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
Remote
|
Path Traversal
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-66670
— WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
Remote
|
Path Traversal
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-66650
— WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.
Remote
|
Injection
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-66648
— WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.
Remote
|
Authentication
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
