CVE-2026-18297

A flaw was found in GStreamer. This vulnerability, a stack-based buffer overflow, occurs during the parsing of OGG files due to improper validation of user-supplied data length. A remote attacker could exploit this by tricking a user into visiting a malicious page or opening a malicious file,...

CVE-2026-18296

A flaw was found in GStreamer. A remote attacker could exploit a heap-based buffer overflow vulnerability when parsing specially crafted MRF Multimedia Research Forum files. This vulnerability arises from insufficient validation of user-supplied data length before copying it to a heap-based buffe...

CVE-2026-67359

J2Store (a Joomla e-commerce extension by j2commerce.com) is affected by an order content disclosure vulnerability in versions 1.0.0–3.3.20, 4.0.0–4.0.20, and 4.1.0–4.1.5 . An unauthenticated attacker can supply an arbitrary order_id as a query parameter to render the full checkout confirmation p...

CVE-2026-67359 Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

CVE-2026-67359 Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

EUVD-2026-64060

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

GHSA-8HGV-XC77-JMCR Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin

Summary Grav 2.0 renders editor-authored Twig in page content by default and relies on the Twig content sandbox to contain it. The shipped sandbox policy allowlists addcss and addjs on Grav\Common\Assets system/src/Grav/Common/Twig/Sandbox/SandboxDefaults.php:307. Because the sandbox arbitrates t...

Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin

Summary Grav 2.0 renders editor-authored Twig in page content by default and relies on the Twig content sandbox to contain it. The shipped sandbox policy allowlists addcss and addjs on Grav\Common\Assets system/src/Grav/Common/Twig/Sandbox/SandboxDefaults.php:307. Because the sandbox arbitrates t...

CVE-2026-71862

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

CVE-2026-71862

Checkmate (open-source self-hosted monitoring tool) versions 3.3.0 through 3.9.2 are vulnerable to sensitive credential exposure . When the global showURL setting is enabled, the unauthenticated endpoint GET /api/v1/status-page/:url returns complete monitor objects from statusPageController.ts, i...

CVE-2026-71862 Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

CVE-2026-71862 Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

EUVD-2026-64039

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 10, 2026 to August 16, 2026)

Last week, there were 259 vulnerabilities disclosed in 199 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 142 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Exploit for CVE-2026-76564

Stored XSS via User-Agent in Admin Order View in PhocaCart...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version v12.1.1.2 Vulnerability Details CVEID:CVE-2022-40152 DESCRIPTION: Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the parser is running on user suppli...

Exploit for CVE-2026-76565

Reflected XSS via pricefrom / priceto Filter Parameters in P...

python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module

A flaw was found in Python's http.cookies module. The Morsel.jsoutput function, responsible for generating JavaScript output for cookies, does not properly neutralize the HTML sequence. This oversight could allow a remote attacker to inject malicious script into a web page, potentially leading to...

Security Bulletin: Vulnerabilities in IBM AIX and PowerVM VIOS

Summary Updated Aug 21, 2026: Updated the summary to highlight the additional installation instructions. IBM is providing security updates for supported AIX and VIOS releases that are under active fix support. Delivered through Service Packs SPs and Fix Packs FPs, these updates remediate...

The Vulners team has released nmap-vulners 2.0

The Vulners team has releasednmap-vulners 2.0. This plugin an NSE script turns the popular Nmap port scanner into a black-box vulnerability scanner. Simply run $ nmap -sV --script vulners to get a prioritized report on vulnerabilities and exploits. And all of this is available for free with no...