A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external P…
|
Path Traversal
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-21751
— HCL Hive is affected by use of a cryptographic primitive with a risky implementation
HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credential leakage if a single internal compo…
Remote
|
Cryptography
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the…
Remote
|
Cross-Site Scripting
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2025-68833
— HCL Hive is affected by use of a cryptographic primitive with a risky implementation
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78365
— IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read…
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record…
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78247
— SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirm_order. The manipulation o…
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-21759
— HCL Hive is affected by an information exposure vulnerability
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, expos…
Remote
|
Information Disclosure
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-21756
— HCL Hive is affected by a broken access control vulnerability
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environmen…
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78323
— Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates
A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without …
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78291
— WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78290
— WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78280
— WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.
hash_form
|
Remote
|
Cross-Site Request Forgery
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78279
— WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerab…
Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.
Remote
|
Cross-Site Request Forgery
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78278
— WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) v…
Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78277
— WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerabili…
Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
Remote
|
Server-Side Request Forgery
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78272
— WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78270
— WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability
Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.
Remote
|
Injection
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78269
— WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability
Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78258
— WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78246
— itsourcecode Online Clinic Management System Admin Login login.php sql injection
A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulatio…
Remote
|
Injection
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
