CVE-2026-53532
— OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a crafted HTJ2K-compressed EXR file c…
|
Denial of Service
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78435
— Faveo Helpdesk Logo SettingsController.php unlink path traversal
A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Suc…
Remote
|
Path Traversal
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78434
— Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing au…
A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component p…
Remote
|
Authentication
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78284
— WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.
Remote
|
Path Traversal
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78282
— WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.
Remote
|
Cross-Site Scripting
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78268
— WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram,…
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.
Remote
|
Information Disclosure
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78267
— WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78266
— WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability
Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78265
— WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
Remote
|
Injection
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78264
— WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.
Remote
|
Cross-Site Scripting
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78263
— WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.
Remote
|
Cross-Site Scripting
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78262
— WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-78259
— WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.
Remote
|
Authentication
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-77384
— libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remo…
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally…
Remote
|
Denial of Service
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-77337
— CakePHP: Potential Authentication bypass with CookieAuthenticator
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow …
Remote
|
Authentication
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-68516
— OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can c…
Remote
|
Memory Corruption
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-45404
— OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a …
|
Race Condition
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-32563
— WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Obje…
Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
Remote
|
Injection
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-32561
— WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.
Remote
|
Authorization
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
CVE-2026-32560
— WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin …
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.
Remote
|
Path Traversal
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
