EUVD-2026-62385

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

CVE-2026-73384

Pay with Contact Form 7 is a WordPress plugin affected by an unauthenticated sensitive data exposure vulnerability in versions

mysql: X Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...

Reverse-Lookup Service Exposed Millions of Photos of People’s Faces

The people-search tool ClarityCheck says its reverse image search service is “private and secure”—but it left a database containing more than 9 million image files exposed...

Vulnerabilities found in Oracle Financial Services

Oracle has identified vulnerabilities in various Financial Services Enterprise modules. These vulnerabilities exist in third-party products such as Apache Kafka, Log4j, and the Spring Framework. Updates have been released by the developers for these products. These updates are now integrated into...

MINI-8V39-V7X2-9FH3

Bulletin has no description...

CVE-2026-18231

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plug...

CVE-2026-16616

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...

CVE-2026-19417

KiviCare WordPress plugin before 4.5.4 serves media files without verifying the requesting user's entitlement, enabling authenticated patient-level users to download any media library file including other patients' medical reports via an IDOR vulnerability; upgrade to 4.5.4. No active exploitatio...

EUVD-2026-62288

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

EUVD-2026-62283

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address...

PT-2026-78387

phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape t...

Azul Zulu Java Multiple Vulnerabilities (2026-08-18)

The version of Azul Zulu installed on the remote host is 6 prior to 6.81.0.204 / 7 prior to 7.87.0.204 / 8 prior to 8.95.0.204 / 11 prior to 11.89.204 / 17 prior to 17.67.204 / 21 prior to 21.51.204 / 25 prior to 25.35.204 / 26 prior to 26.32.204. It is, therefore, affected by multiple...

Linux Distros Unpatched Vulnerability : CVE-2026-61308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versio...

MINI-PPQH-JQVV-X7GQ

Bulletin has no description...

CVE-2026-54348

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:25+00:00| published-proof-of-concept| https://github.com/froxlor/froxlor/security/advisories/GHSA-w27m-rmmf-g5w4 2026-08-19 13:32:06+00:00| seen| https://gist.github.com/alon710/af2c8d3762565eaa4715277e9dc15159...

CVE-2026-71167

creationtimestamp| type| source ---|---|--- 2026-08-18 22:27:46+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfb7webif2m 2026-08-19 09:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtgga7evwi2t 2026-08-19 17:17:04+00:00| seen|...

CVE-2026-53959 4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for every user through GET /api/users and retrieve arbitrary accounts through GET /api/users/:id. The users/index and users/show actions rely only...

CVE-2026-73922

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this...

CVE-2026-71087

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain component: CAX Client. The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector...