CVEs published August 16, 2026
109 CVEs were published on August 16, 2026: 17 critical, 30 high. Browse them by severity, product and exploitation status.
- Published
- 109
- Critical
- 17
- High
- 30
- Medium
- 61
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 44
Most affected products
- scriban · Scriban.Signed
- 13
- Edimax EW-7478APC
- 5
- code-projects Online Shopping System
- 3
- OpenBoxes
- 3
- opentofu · github.com/opentofu/opentofu
- 3
- stoatchat
- 3
- expresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…
- 2
- ladela Online Scheduling and Appointment Booking System – B…
- 2
- Net-OAuth
- 2
- ProSolution WP Client
- 2
Critical 17
- CVE-2026-19961Edimax EW-7478APC formWlSiteSurvey buffer overflowEdimax EW-7478APC
- CVE-2026-19959Edimax EW-7478APC formWanTcpipSetup stack-based overflowEdimax EW-7478APC
- CVE-2026-72887Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in…Net-OAuth
- CVE-2026-19349Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow…Lemonldap-NG-Portal
- CVE-2026-74791Scriban before 7.0.0 Authorization Bypass via Stale Include Cachescriban · Scriban.Signed
- CVE-2026-74790Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cachescriban · Scriban.Signed
- CVE-2026-73061Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessorscriban
- CVE-2026-73056SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Tokensiyuan-note siyuan
- CVE-2026-74251Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6phoca.cz Phoca Cart extension for Joomla
- CVE-2024-13784Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injectionreputeinfosystems Contact Form, Survey, Quiz & Popup Form B…
- CVE-2026-19725WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connectWPvivid — Backup, Migration & Staging
- CVE-2026-19714Simple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience ValidationSimple JWT Login
- CVE-2026-18316Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip…solacewp Solace Extra
- CVE-2026-14524ProSolution WP Client <= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' ParametersProSolution WP Client
- CVE-2026-16098ProSolution WP Client <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename OverrideProSolution WP Client
- CVE-2026-18432Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parametershabti Frontend Admin by DynamiApps
- CVE-2026-19924Tenda AC10 httpd R7WebsSecurityHandler improper authenticationTenda AC10
High 30
- CVE-2026-74796OpenTofu before 1.11.7 Symlink Following Path Traversalopentofu · github.com/opentofu/opentofu
- CVE-2026-74795Scriban before 6.6.0 Denial of Service via Uncontrolled Recursionscriban · Scriban.Signed
- CVE-2026-74794Scriban before 6.6.0 Denial of Service via Infinite Recursionscriban · Scriban.Signed
- CVE-2026-74792Scriban before 7.0.0 Stack Overflow via nested array initializersscriban · Scriban.Signed
- CVE-2026-74789Scriban before 7.0.0 LoopLimit Bypass via Built-in Operationsscriban · Scriban.Signed
- CVE-2026-74788Scriban before 7.0.0 Denial of Service via string.pad_left/pad_rightscriban · Scriban.Signed
- CVE-2026-74787Scriban before 7.0.0 Uncontrolled Recursion via object.to_jsonscriban · Scriban.Signed
- CVE-2026-74786Scriban before 7.0.0 Denial of Service via Unbounded Template Outputscriban · Scriban.Signed
- CVE-2026-74785Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumptionscriban · Scriban.Signed
- CVE-2026-74784Scriban before 7.2.0 Denial of Service via array.insert_atscriban · Scriban.Signed
- CVE-2026-74783Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Servicescriban · Scriban.Signed
- CVE-2026-73062Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplicationscriban · Scriban.Signed
- CVE-2026-73060Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiplyscriban
- CVE-2026-73059stoatchat before 0.15.0 Permission Bypass via message_fetchstoatchat
- CVE-2026-73057stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Servicestoatchat
- CVE-2024-58375OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluationopentofu · github.com/opentofu/opentofu
- CVE-2026-74578crypto: algif_skcipher - force synchronous processing on trees without ctx->stateLinux
- CVE-2026-13424Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons…ladela Online Scheduling and Appointment Booking System – B…
- CVE-2026-17087WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameterwptravelengine WP Travel Engine – Tour Booking Plugin – Tou…
- CVE-2026-2497Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array KeysGallery by BestWebSoft – Customizable Image and Photo Galle…
- CVE-2026-10734Infility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log EndpointInfility Global
- CVE-2026-19728Extra Product Options Builder for WooCommerce < 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileuploadExtra Product Options Builder for WooCommerce
- CVE-2026-19717CatFolders Document Gallery < 2.0.7 - Unauthenticated Attachment Disclosure via REST APICatFolders Document Gallery & PDF Library
- CVE-2026-18653WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section ParameterWP Directory Kit
- CVE-2026-17533All-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST ImportAll-in-One WP Migration and Backup
Show all 30 entriesShow fewer entries
- CVE-2026-17581WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Enginekilbot WCPOS – Point of Sale (POS) plugin for WooCommerce
- CVE-2026-15002Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameterbluemediapl Autopay
- CVE-2026-17123Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url'…wproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2026-16099Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data'…eteubert Podlove Podcast Publisher
- CVE-2026-14498Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameterdaggerhart Query Wrangler
Medium, low and unrated 62
- CVE-2026-19964Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injectionJij-Inc Jij-MCP-Server
- CVE-2026-19963Edimax EW-7478APC stainfo command injectionEdimax EW-7478APC
- CVE-2026-19962Edimax EW-7478APC setWAN command injectionEdimax EW-7478APC
- CVE-2026-19960Edimax EW-7478APC formWlbasic command injectionEdimax EW-7478APC
- CVE-2026-19958iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injectioniatsiuk pptr-mcp
- CVE-2026-19957graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fetch server-side request forgerygraphlit-mcp-server
- CVE-2026-19956gomarble-ai facebook-ads-mcp-server server.py fetch_pagination_url server-side request forgerygomarble-ai facebook-ads-mcp-server
- CVE-2026-19955TrailDB TOC Validation tdb.c tdb_open out-of-boundsTrailDB
- CVE-2026-72888Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_requireNet-OAuth
- CVE-2026-74797OpenTofu before 1.11.4 Denial of Service via malicious zipopentofu · github.com/opentofu/opentofu
- CVE-2026-73058stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypassstoatchat
- CVE-2026-18347Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameterthemeum Kirki – Freeform Page Builder, Website Builder & Cu…
- CVE-2026-17604Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameterthemeum Kirki – Freeform Page Builder, Website Builder & Cu…
- CVE-2026-17608WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletionaresit WP Compress – Instant Performance & Speed Optimizati…
- CVE-2026-2357Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingboldthemes Bold Page Builder
- CVE-2026-12998Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameterwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2026-19726Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configuration DisclosureVisualizer
- CVE-2026-19712Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz DescriptionMasteriyo LMS
- CVE-2026-19711Premium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal RequestPremium Packages
- CVE-2026-19613ECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF SourceECS
- CVE-2026-15384Manual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDORManual Image Crop
- CVE-2026-13712Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URLDivi
- CVE-2026-15351WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameterwcvendors WC Vendors – WooCommerce Multivendor, WooCommerce…
- CVE-2026-9767The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameterweblizar The School Management – Education & Learning ERP
- CVE-2026-15345ShortPixel Adaptive Images <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via…ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimiz…
Show all 62 entriesShow fewer entries
- CVE-2026-17582Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field…quantumcloud Slider Hero with Video Background, Animation
- CVE-2026-16775Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attributesmub Smash Balloon Social Post Feed – Simple Social Feeds f…
- CVE-2026-15056StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URLkodezen StoreEngine — Complete eCommerce Solution with Memb…
- CVE-2026-10035Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injectionwpweaver Turnkey bbPress by WeaverTheme
- CVE-2026-16758Snippet Shortcodes <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesaliakro Snippet Shortcodes
- CVE-2026-2283User Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameterfaiyazalam User Login History
- CVE-2026-18402SureDash <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attributebrainstormforce SureDash – Community, Courses & Member Dash…
- CVE-2026-15790Video Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcodeemarket-design Video Gallery – YouTube Gallery, Playlist &…
- CVE-2026-15604Toocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post MetaToocheke Companion
- CVE-2026-19934itsourcecode Hospital Management System vieworder.php sql injectionitsourcecode Hospital Management System
- CVE-2026-19933DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflowDefaultFuction Customer-Relationship-Management-In-C-Project
- CVE-2026-16779Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion…extendthemes Kubio AI Page Builder
- CVE-2026-15726Serious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attributecryout-creations Serious Slider
- CVE-2026-15963Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Optionexpresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…
- CVE-2025-10005Password Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post…buildwps PPWP – Password Protect Pages
- CVE-2026-15009Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parametersaadiqbal Advanced File Manager – Ultimate File Manager for…
- CVE-2026-15066Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Commentstimwhitlock Loco Translate
- CVE-2026-13167Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated…wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- CVE-2026-15441Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameterwcproducttable Product Table & List Builder For WooCommerce
- CVE-2026-11780Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameterexpresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…
- CVE-2026-13358Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct…croixhaug Simply Schedule Appointments
- CVE-2026-16079Fullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Contentpdamsten Fullscreen Galleria
- CVE-2026-12477Gravity Booster <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameterwpmonks Gravity Booster – Styles & Layouts for Gravity Forms
- CVE-2026-18385Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated…properfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2026-15602NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameterwebaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-12905Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive…ladela Online Scheduling and Appointment Booking System – B…
- CVE-2026-19932DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injectionDefaultFuction Notice-System-Managent
- CVE-2026-2487Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Settingweblizar Admin Custom Login
- CVE-2026-19930Dolibarr User Cloning card.php ldap injectionDolibarr
- CVE-2026-19929OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engineOpenBoxes
- CVE-2026-19928OpenBoxes Role Interceptor RoleInterceptor.groovy needManager privileges managementOpenBoxes
- CVE-2026-19927OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgeryOpenBoxes
- CVE-2026-19926Evergreen open-ils.fielder OpenSRF Service osrf-gateway-v1 sql injectionEvergreen
- CVE-2026-19925SourceCodester Stock Management System Master.php delete_supplier sql injectionSourceCodester Stock Management System
- CVE-2026-19923code-projects Online Shopping System checkout_process.php sql injectioncode-projects Online Shopping System
- CVE-2026-19922code-projects Online Shopping System checkout.php cross site scriptingcode-projects Online Shopping System
- CVE-2026-19921code-projects Online Shopping System homeaction.php sql injectioncode-projects Online Shopping System