CVE-2026-78286
— WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-78285
— WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability
Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-78283
— WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulne…
Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.
Remote
|
Cross-Site Scripting
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-78281
— WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
Remote
|
Cross-Site Scripting
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-78276
— WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.
Remote
|
Injection
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-78275
— WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability
Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.
Remote
|
Path Traversal
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-78274
— WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability
Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.
Remote
|
Path Traversal
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-78273
— WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.
Remote
|
Cross-Site Scripting
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-78271
— WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability
Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.
Remote
|
Authorization
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-78261
— WordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulner…
Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.
Remote
|
Cross-Site Scripting
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-78260
— WordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability
Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.
Remote
|
Injection
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-78257
— WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.
Remote
|
Injection
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-75020
— Apache APISIX: ldap-auth plugin cross-subtree identity impersonation
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX.
A caller who holds valid credentials for one entry in the LDAP directory can auth…
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Inefficient Algorithmic Complexity vulnerability in Apache APISIX.
A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes.
This issue a…
apisix
|
Remote
|
Denial of Service
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-74848
— Apache APISIX: Cross-user response poisoning in serverless plugins
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX.
An attacker could make other clients receive attacker-chosen or other users' response…
apisix
|
Remote
|
Misconfiguration
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-59355
— Spring Authorization Server: Open Redirect via request_uri parameter
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an…
Remote
|
Misconfiguration
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-59354
— Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Re…
In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient valida…
Remote
|
Cross-Site Scripting
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-32566
— WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privileg…
Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
Remote
|
Authorization
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-32564
— WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Inje…
Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
Remote
|
Injection
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
CVE-2026-32550
— WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability
Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.
Remote
|
Injection
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
Aug 27, 2026
