PT-2026-78510

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end receiving file in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUH PATH. A syn i w m e...

CVE-2026-66589 WordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30...

CVE-2026-21580

This Critical severity Stored XSS, PrivEsc Privilege Escalation, and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and...

CVE-2026-21580

This Critical severity Stored XSS, PrivEsc Privilege Escalation, and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and...

CVE-2026-21580

This Critical severity Stored XSS, PrivEsc Privilege Escalation, and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and...

CVE-2026-21580

Confluence Data Center and Server versions 7.1.1 through 10.2.0 are affected by a Critical (CVSS 9.3) Stored XSS, privilege escalation, and security misconfiguration issue exploitable by unauthenticated attackers. Atlassian recommends upgrading to 9.2.21 or 10.2.13 or later; no in-the-wild exploi...

GO-2026-6095 Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi

Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi...

CVE-2026-75926

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...

CVE-2026-71573 Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260802 - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests...

EUVD-2026-61034

Joomla! Core - 20260802 - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests...

CVE-2026-75587

creationtimestamp| type| source ---|---|--- 2026-08-18 12:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mte6yfl4r62d...

GHSA-V269-8R2R-VJ93 vulnerabilities

Vulnerabilities for packages: jenkins...

PT-2026-77034

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

PT-2026-78242

Name of the Vulnerable Software and Affected Versions Confluence Data Center and Server versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 Description A stored Cross-Site Scripting XSS, privilege escalation, and...

CVE-2026-21580: Improper Neutralization of Input During Web Page Generation

This Critical severity Stored XSS, PrivEsc Privilege Escalation, and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and...

GHSA-QQQ4-5773-PMW5

creationtimestamp| type| source ---|---|--- 2026-08-17 20:32:43+00:00| seen| https://gist.github.com/alon710/714a45d6d9776f210b84a676518696fb...

MINI-XH34-53RP-9J9Q

Bulletin has no description...

nginx: Multiple Vulnerabilities

Background nginx is a robust, small, and high performance HTTP and reverse proxy server. Description Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround...

CVE-2021-43716

creationtimestamp| type| source ---|---|--- 2026-08-15 08:00:08+00:00| seen| Telegram/KZva-AqPLSqOM7FFaN2xmlp5RH1as8bfWVHnuu2lh7A0hs 2026-08-15 08:00:08+00:00| seen| Telegram/fgLB1C36paZjghRukCyLhva12xDXyeSFjJghnq0Trmh6Q 2026-08-16 00:00:14+00:00| published-proof-of-concept|...

GHSA-V3JC-474W-2WM6 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, apache-nifi, logstash, elasticsearch, jbang, kayenta, wazuh-indexer, nacos-docker, airbyte-server-fips, dependency-track-apiserver, airbyte-platform, airbyte-server, opensearch-fips, pinot, apache-hop-fips, geoserver, flyway, nuxeo, traccar, floci,...