CVE-2026-76798: Improper Neutralization of Input During Web Page Generation

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

CVE-2026-78614: Deserialization of Untrusted Data

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78612: Deserialization of Untrusted Data

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-82285: Server-Side Request Forgery (SSRF)

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-78615: Improper Neutralization of Input During Web Page Generation

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

PT-2026-83276

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

PT-2026-83275

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-78047 Dimension Stored XSS in Scheduled Report Task

A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...

CVE-2026-78615 WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

CVE-2026-78612 Dimension SQL Injection in Scheduled Report

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78612 Dimension SQL Injection in Scheduled Report

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78047 Dimension Stored XSS in Scheduled Report Task

A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...

CVE-2026-78615

A Reflected DOM-based XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in an authenticated user's browser via a specially crafted URL. The CVSS 4.0 base score is 4.6 (MEDIUM) , with high privileges and active user interaction requir...

CVE-2026-78615 WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

CVE-2026-78614 Dimension SQL Injection in Audit Report

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78614 Dimension SQL Injection in Audit Report

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78614

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature . An authenticated user with report administration permissions can send specially crafted requests to gain arbitrary command execution as the Dimension WebUI process user. The CNA-assigned CVSS ...

CVE-2026-75325

creationtimestamp| type| source ---|---|--- 2026-08-27 21:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu3tcscpy42j...

CVE-2026-26448

creationtimestamp| type| source ---|---|--- 2026-08-27 20:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu3pfm77at2m...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)

Last week, there were 274 vulnerabilities disclosed in 213 WordPress Plugins and 17 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 116 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...