CVE-2026-29036

A flaw was found in cJSON, a JSON parser and generator. This vulnerability allows unauthenticated attackers to manipulate JSON Patch operations by supplying crafted JSON Pointer escape sequences. This can lead to silent corruption of data or the deletion of unintended keys, potentially bypassing...

CVE-2026-19088

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

CVE-2026-18945

The CVE-2026-18945 entry concerns the WP Helper Premium WordPress plugin (version prior to 4.7.6). The underlying issue is that the plugin does not verify the order key when rendering the custom order confirmation page or handling related AJAX actions. This permits unauthenticated users to view o...

CVE-2026-14213

The CVE-2026-14213 entry concerns the WordPress plugin Booking for Appointments and Events Calendar , affected versions before 2.4.6 . The issue is an access control flaw: an authenticated employee (provider) is not verified to be assigned to the appointment being accessed, enabling any employee ...

CVE-2026-14213

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...

EUVD-2026-57729

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

EUVD-2026-57727

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...

CVE-2026-13610

The CVE describes a vulnerability in the KiviCare WordPress plugin prior to version 4.5.2 . The root cause is that the plugin’s unauthenticated registration endpoint does not restrict the roles assignable to new accounts, allowing an unauthenticated attacker to create an active, privileged clinic...

CVE-2026-72506

CVE-2026-72506 affects VoiceTra by the National Institute of Information and Communications Technology (NICT). The issue is an incorrectly specified destination in a communication channel, which may redirect users to a server or service controlled by an attacker. Consequences described include po...

CVE-2026-72506

VoiceTra provided by National Institute of Information and Communications Technology NICT contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server or service controlled by an attacker, potentially resulting in the theft of input dat...

CVE-2026-0290

An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker to view sensitive data...

EUVD-2026-57704

An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker to view sensitive data...

EUVD-2026-57600

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser...

The vulnerability of the Directum HR Pro system, which exists due to insufficient verification of input data, allows a perpetrator to disclose protected information.

The vulnerability of the Directum HR Pro system exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to disclose protected information by sending a specially crafted POST request...

The vulnerability of the Directum RX ECM system, related to deficiencies in access control, allows a perpetrator to compromise data integrity.

The vulnerability of the Directum RX ECM system is related to deficiencies in access control. Exploiting this vulnerability could allow a remote attacker to compromise data integrity...

CVE-2026-71193

creationtimestamp| type| source ---|---|--- 2026-08-12 23:30:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mswbvrkghe2m 2026-08-13 00:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mswdmfvd3w22 2026-08-13 00:21:27+00:00| seen|...

CVE-2026-47718

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. When secureEnabled=true, FUXA 1.3.0-2773 still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue...

GHSA-W62W-66V9-VVGV

creationtimestamp| type| source ---|---|--- 2026-08-12 22:31:56+00:00| seen| https://gist.github.com/alon710/57586b5d8bd6ec2753b002d5acf877e5 2026-08-13 00:01:14+00:00| seen| https://gist.github.com/alon710/57586b5d8bd6ec2753b002d5acf877e5...

CVE-2026-73499

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

CVE-2026-18744

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — testfunc only checks ismycase, not ownership of kwargs'member'. Bypasses sharestatus; leaks embargoed vendor affected/not-affected + statement text cross-tenant...