CVE-2026-74992

The Kirki WordPress plugin before 6.2.3 fails to validate archive contents and clean up extracted files during font zip uploads by Editor-role users, allowing arbitrary file placement in a web-accessible directory. This enables Stored XSS and remote code execution on some server configurations. N...

CVE-2026-15049

CVE-2026-15049 affects the Depicter — Popup & Slider Builder WordPress plugin in versions prior to 4.8.0 . The plugin's import feature does not validate the type of uploaded files and fails to remove malformed uploads, allowing any user with editor-level access to write an arbitrary file—includin...

CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

CVE-2026-15049 Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...

CVE-2026-13405

Royal Elementor Addons before 1.7.1066 fails to sanitize custom widget markup before writing it to an executed file. An attacker with manage_options capability (or non-super Multisite subsite admin) can inject arbitrary PHP code, achieving remote code execution. CVSS 6.6 MEDIUM. No exploitation o...

EUVD-2026-63202

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...

CVE-2026-76347

creationtimestamp| type| source ---|---|--- 2026-08-20 04:47:02+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76344

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:55+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76329

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:21+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76328

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:19+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76324

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:09+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76317

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:53+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-22 00:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmy6cio222u...

CVE-2026-76316

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:50+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 23:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmwink3bv24...

CVE-2026-76315

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:48+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 23:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmuszamoh23...

CVE-2026-76261

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:27+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76256

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:15+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76254

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:10+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76251

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:03+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-20 18:07:12+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtjtlthw232p 2026-08-20 18:07:14+00:00|...

Aviatrix Controller - Remote Code Execution

An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloudtype for...

IBM Operational Decision Manager - JNDI Injection

IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145. id: CVE-2024-22319 info: name: IBM Operational Decision Manager -...