CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- wp manage ninja fluentcrm proWordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability7.2 High
- realtyna organic idx pluginWordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- epaycoWordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability9.3 Critical
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability8.8 High
- acpt (pro) - custom post types plugin for wordpressWordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability9.8 Critical
- acpt (pro) - custom post types plugin for wordpressWordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability8.5 High
- liquid web, llc kadence shop kitWordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability8.5 High
- codepress it solutions llc visitor traffic real time statistics proWordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability9.3 Critical
- weptile mobile app for woocommerceWordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability8.6 High
- murali push notification for post and buddypressWordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability5.4 Medium
- wibu-systems-ag wibukeyUser input in WibuKey is used (without proper sanitization) to compute the address of a pointer, which can be exploited to let the user point to any storage, to which Windows responds with a denial of…8.8 High
- wibu-systems-ag wibukeyAn untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows8.8 High
- wibu-systems-ag codemeter-runtimeImproper Authentication of Session Handles7.7 High
- wibu-systems-ag codemeter-runtimeMissing Sanity Checks for Buffer Lengths7.5 High
- wibu-systems-ag codemeter-runtimeFormat String Vulnerability in Logger8.2 High
- wibu-systems-ag codemeter-runtimeImproper Access Control in Local-Only Configuration Commands8.6 High
- wibu-systems-ag codemeter-runtimeLocal Privilege Escalation in CodeMeter Runtime on Windows7.8 High
- broadcom spring authorization server, spring authorization server +1 moreSpring Authorization Server: Open Redirect via request_uri parameter6.1 Medium
- vmware spring security, vmware by broadcom spring security (oauth2 authorization server module) +1 moreSpring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata9.6 Critical
- aa web servant 12 step meeting list12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log8.8 High
- unknown notifimaNotifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR4.3 Medium
- daman jeet finale liteFinale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html4.3 Medium
- unknown storegrowthStoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart7.5 High
- thimpress learnpressLearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure5.3 Medium
- unknown workeeraWorkeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment8.8 High
- unknown workeeraWorkeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment7.7 High
- unknown workeeraWorkeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment9.6 Critical
- davidanderson updraftplus: wp backup & migration pluginUpdraftPlus < 1.26.7 - Backup Restoration via CSRF5.9 Medium
- unknown wp oauth server ( login with wordpress )WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File7.5 High
- unknown jetbackupJetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download4.4 Medium
- unknown defender securityDefender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite6.6 Medium
- unknown smushSmush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite7.2 High
- unknown mobile app for woocommerce: shopapper mobile app builder service for woocommerceShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update4.3 Medium
- unknown mobile app for woocommerce: shopapper mobile app builder service for woocommerceShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR4.3 Medium
- unknown document embedderDocument Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle5.3 Medium
- unknown cmpCMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia3.5 Low
- unknown cmpCMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings7.2 High
- unknown cmpCMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax4.8 Medium
- joomlaeventmanager.net jem - joomla event manager extension for joomlaJoomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.19.4 Critical
- joomlaeventmanager.net jem - joomla event manager extension for joomlaJoomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.16.9 Medium
- joomlaeventmanager.net jem - joomla event manager extension for joomlaJoomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.15.3 Medium
- joomlaeventmanager.net jem - joomla event manager extension for joomlaJoomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.15.1 Medium
- joomlaeventmanager.net jem - joomla event manager extension for joomlaJoomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.15.3 Medium
- spring framework, vmware spring framework +1 moreSpring Framework maxInMemorySize Bypassed in Jaxb2Decoder9.8 Critical
- spring framework, vmware spring framework +1 moreSpring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse7.5 High
- spring framework, vmware spring framework +1 moreSpring Framework Memory Leak via SETUP Frame in RSocketMessageHandler7.5 High
- spring framework, vmware spring framework +1 moreSpring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions7.5 High
- spring framework, vmware spring framework +1 moreSpring Framework maxPartSize Ignored in PartEventHttpMessageReader7.5 High
- spring framework, vmware spring framework +1 moreSpring Framework Improper Path Limitation in XsltView9.8 Critical
- spring framework, vmware spring framework +1 moreSpring Framework Open Redirect in UrlHandlerFilter6.1 Medium
- Show moreLoading…