Critical · CVSS 9.1
Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10-19.10.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Simphony accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Simphony. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Published Aug 18, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.1
Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Published Aug 18, 2026 · Updated Aug 20, 2026
Critical · CVSS 10
A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.
Published Aug 18, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published Aug 18, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.1
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Published Aug 18, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published Aug 18, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.1
An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjuction with "execute_mode=PREPARE" parameter in the "run.php" endpoint.
Published Aug 18, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.3
Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code.
Published Aug 18, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.1
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Apps - Marketing accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Published Aug 18, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.3
Unauthenticated SQL Injection in Capella <= 2.5.5 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.3
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.1
Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.3
Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.3
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.9
Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.9
Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.3
Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.3
Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injection.
This issue affects FAYDAM Datalogger: from 2.7.1 before 2.8.0.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.9
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities trackled by CVE-2026-20359 are related to insufficiently protected credentials issues that are grouped under the Common Weakness Enumeration (CWE) CWE-522.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.6
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20318 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-20.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 10
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20317 are related to improper authentication issues that are grouped under the Common Weakness Enumeration (CWE) CWE-287.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.1
stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can register a malicious peer and gain access to or tamper with federation traffic. Fixed in 0.9.0a2, which introduces a pending approval flow requiring administrator fingerprint verification before peer tokens are accepted.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.1
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.3
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate validation.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.1
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web interface.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.1
phpMyFAQ before 4.1.7 (affected versions <= 4.1.5) fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back to the database. At login the anti-replay comparison is skipped by its own null guard, allowing an attacker who captures a successful WebAuthn assertion to replay it indefinitely and authenticate as the user without any interaction or hardware key.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection.
This issue affects Logsign SIEM: before 6.4.115.
Published Jul 31, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer underflow.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.3
Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.6
Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery.
This issue affects Easy Elementor Addons: from n/a through 2.3.7.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.9
Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.1
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.9
A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection.
This issue affects WAH7601: through 20072026.
Published Aug 10, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safe_mode setting leading to remote code execution.
Published Aug 18, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.4
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser.
Published Aug 19, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.8
The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.
Published Aug 20, 2026 · Updated Aug 20, 2026
Critical · CVSS 9.9
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published Aug 18, 2026 · Updated Aug 20, 2026
