CVE-2026-13405

Royal Elementor Addons before 1.7.1066 fails to sanitize custom widget markup before writing it to an executed file. An attacker with manage_options capability (or non-super Multisite subsite admin) can inject arbitrary PHP code, achieving remote code execution. CVSS 6.6 MEDIUM. No exploitation o...

CVE-2026-15049 Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...

CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

EUVD-2026-63202

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...

CVE-2026-76347

creationtimestamp| type| source ---|---|--- 2026-08-20 04:47:02+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76344

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:55+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76329

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:21+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76328

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:19+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76324

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:09+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76317

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:53+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-22 00:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmy6cio222u...

CVE-2026-76316

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:50+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 23:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmwink3bv24...

CVE-2026-76315

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:48+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 23:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmuszamoh23...

CVE-2026-76261

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:27+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76256

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:15+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76254

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:10+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76251

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:03+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-20 18:07:12+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtjtlthw232p 2026-08-20 18:07:14+00:00|...

Apache Airflow <=1.10.10 - Remote Code Execution

Apache Airflow versions 1.10.10 and below are vulnerable to remote code/command injection vulnerabilities in one of the example DAGs shipped with Airflow. This could allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler depending on the executor in us...

Malicious code in @httttt/mcp-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2914b799b1c4e540a2ff20338186041f8053fd03cc28ad544ecdb36531a33278 The package's main/bin entry contains a top-level await execAsync... that downloads a file named javaagent from...

Malicious code in expect-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc39d28e4d33afe723182c097769f087bf528732e5468b1511bf2bff41db01e The package's main entry runs a worker that performs an HTTPS GET to https://realase-0626.vercel.app/api/v1 and passes the response's parser string...

Atmail-exploit-toolchain

AtMail Email Server Appliance 6.4 - Exploit-Toolchain XSS CSRF RCE PacketStorm WLB-2020080010 Haftungsausschluss: Diese Exploit-Toolchain wurde von EDB-ID 20009 inspiriert. Ziel Das Ziel dieser Exploit-Toolchain ist es, EDB-ID 20009 zu ersetzen. Vorteile dieser Toolchain gegenüber dem EDB-ID...