Explore CVE records

HighPublished 18 Aug 2026, 21:33 WIB

CVE-2026-61407

Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 10:55 WIB

Official record

MedPublished 18 Aug 2026, 21:24 WIB

CVE-2026-73426

Trix: Stored XSS vulnerability through serialized attributes

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

HighPublished 18 Aug 2026, 21:24 WIB

CVE-2026-75898

RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or requests.put without cal…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

HighPublished 18 Aug 2026, 21:23 WIB

CVE-2026-63639

Valkey: UAF in stream deserialization may lead to remote code execution

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:36 WIB

Official record

HighPublished 18 Aug 2026, 21:19 WIB

CVE-2026-56684

Valkey: TLS pending-data processing use-after-free may allow remote code execution

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 10:56 WIB

Official record

HighPublished 18 Aug 2026, 21:10 WIB

CVE-2026-66046

Expat Denial of Service via storeAtts() Quadratic Complexity

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthent…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:20 WIB

Official record

MedPublished 18 Aug 2026, 21:06 WIB

CVE-2026-75872

HTML Injection in MailerUp double opt-in verification email

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first_name field of the subscription reques…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Aug 2026, 23:04 WIB

Official record

CritPublished 18 Aug 2026, 21:00 WIB

CVE-2026-74015

WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability

Unauthenticated SQL Injection in Readabler < 2.0.18 versions.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 04:25 WIB

Official record

HighPublished 18 Aug 2026, 21:00 WIB

CVE-2026-74012

WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:20 WIB

Official record

MedPublished 18 Aug 2026, 21:00 WIB

CVE-2026-74009

WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:48 WIB

Official record

MedPublished 18 Aug 2026, 21:00 WIB

CVE-2026-74008

WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.24 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated07 Oct 2026, 21:58 WIB

Official record

MedPublished 18 Aug 2026, 21:00 WIB

CVE-2026-74007

WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery plugin <= 1.16.20 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:10 WIB

Official record

MedPublished 18 Aug 2026, 21:00 WIB

CVE-2026-74006

WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability

Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:48 WIB

Official record

MedPublished 18 Aug 2026, 21:00 WIB

CVE-2026-74004

WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions.

Excerpt language: en.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:40 WIB

Official record

MedPublished 18 Aug 2026, 21:00 WIB

CVE-2026-74003

WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability

Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:48 WIB

Official record

HighPublished 18 Aug 2026, 21:00 WIB

CVE-2026-73997

WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:35 WIB

Official record

CritPublished 18 Aug 2026, 21:00 WIB

CVE-2026-73996

WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 22:10 WIB

Official record

MedPublished 18 Aug 2026, 21:00 WIB

CVE-2026-73995

WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability

Subscriber Broken Authentication in User Registration <= 5.2.6 versions.

Excerpt language: en.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:48 WIB

Official record

HighPublished 18 Aug 2026, 21:00 WIB

CVE-2026-73994

WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2026, 21:40 WIB

Official record

MedPublished 18 Aug 2026, 21:00 WIB

CVE-2026-73404

WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability

Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:48 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage