CVE-2026-44901

In Wazuh versions 4.0.0 to 4.14.5 and 5.0.0-beta2, the AffectedItemsWazuhResult.merge() method in framework/wazuh/core/results.py resolves the attacker-controlled sort_casting field through Python builtins without an allowlist. A compromised cluster worker can set sort_casting to exec and embed P...

CVE-2020-10204

creationtimestamp| type| source ---|---|--- 2026-08-19 15:00:17+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2020/CVE-2020-10204.yaml 2026-08-20 00:00:17+00:00| confirmed|...

CVE-2026-52889

Formie (a Craft CMS plugin) versions 3.0.0-beta.1 through 3.1.26 are vulnerable to Server-Side Template Injection (SSTI) . The root cause is in Hidden::getFrontEndInputOptions(), which assigns request-derived Hidden field defaults (HTTP User Agent, Referer URL, Current URL, Query Parameter, Cooki...

CVE-2026-76224

ArcadeDB before 26.8.1 arcadedb-gremlin, affected = 26.7.3 contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java gremlin-lang engine, ArcadeGremlin.executeStatement silently falls back to the insecure Groovy engine...

CVE-2026-75916 SiYuan XSS-to-RCE via unescaped block metadata in hint popup

SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '' block-reference autocomplete hint popup. In genHintItemHTML app/src/protyle/hint/extend.ts, a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can se...

CVE-2026-75916 SiYuan XSS-to-RCE via unescaped block metadata in hint popup

SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '' block-reference autocomplete hint popup. In genHintItemHTML app/src/protyle/hint/extend.ts, a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can se...

MINI-3CM3-CP96-CFMX

Bulletin has no description...

CVE-2026-66613

Unauthenticated Remote Code Execution RCE in JetEngine = 3.8.14 versions...

EUVD-2026-62375

Unauthenticated Remote Code Execution RCE in JetEngine = 3.8.14 versions...

CVE-2026-66613 WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in JetEngine = 3.8.14 versions...

Exploit for Eval Injection in Xwiki

CVE-2025-24893 - XWiki SolrSearch SSTI to unauthenticated RCE...

WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.14...

Exploit for SQL Injection in Wordpress

PoC: WP2Shell — CVE-2026-63030 & CVE-2026-60137...

EUVD-2026-62285

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...

CVE-2026-18937 Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...

CVE-2026-18937

The Broken Link Checker plugin before 2.4.12 accepts unrestricted query variables on sites using plain permalinks, letting unauthenticated users overwrite arbitrary PHP globals and achieve remote code execution when a classic editor is active. CVSS 9.0 (Critical). No exploitation evidence is prov...

CVE-2026-19942

The Atarim WordPress plugin (≤5.1.1) allows authenticated author-level attackers to delete arbitrary server files. The root cause is insufficient file path validation in AVCF_Abilities_Media::register's replace-media-file execute_callback. Attackers first use atarim/update-post-field to set _wp_a...

Exploit for Deserialization of Untrusted Data in Citrix Session_Recording

cve-id Donate Support the maintenance of this project wit...

PT-2026-78740

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can achieve Remote Code...

CVE-2026-70667

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:16+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f 2026-08-19 08:31:37+00:00| seen| https://gist.github.com/alon710/db3f4019c2372dbb6dfede560d6093f7...