CVE-2026-82226
— WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.
Remote
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-82225
— WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-82224
— WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-82221
— WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81892
— EasyAdmin custom-action dispatcher bypasses access_control on other routes
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom act…
Remote
|
Authorization
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81891
— elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() witho…
Remote
|
Misconfiguration
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81890
— elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConn…
Remote
|
Cross-Site Request Forgery
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81889
— elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protecti…
Remote
|
Server-Side Request Forgery
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81888
— @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF…
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, …
Remote
|
Cross-Site Request Forgery
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81887
— Livewire DOM-based cross-site scripting during client-side state handling
Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotN…
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81780
— WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81779
— WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability
Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted.
This issue affects Newspapers X: from 1.0.46 through 1.0.48.
Remote
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81778
— WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81768
— WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81765
— WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81764
— WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
Remote
|
Cross-Site Scripting
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81763
— WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.
Remote
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81762
— WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
Remote
|
Authorization
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81758
— WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.
Remote
|
Authorization
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
CVE-2026-81756
— WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vuln…
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
Remote
|
Injection
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
