CVEs published August 16, 2026
109 CVEs were published on August 16, 2026: 17 critical, 30 high.
- Published
- 109
- Critical
- 17
- High
- 30
- Medium
- 61
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 44
Most affected products
- scriban · Scriban.Signed
- 13
- Edimax EW-7478APC
- 5
- code-projects Online Shopping System
- 3
- OpenBoxes
- 3
- opentofu · github.com/opentofu/opentofu
- 3
- stoatchat
- 3
- expresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…
- 2
- ladela Online Scheduling and Appointment Booking System – B…
- 2
- Net-OAuth
- 2
- ProSolution WP Client
- 2
Critical 17
- CVE-2026-19961Edimax EW-7478APC formWlSiteSurvey buffer overflowEdimax EW-7478APC
- CVE-2026-19959Edimax EW-7478APC formWanTcpipSetup stack-based overflowEdimax EW-7478APC
- CVE-2026-72887Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_tokenNet-OAuth
- CVE-2026-19349Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backendsLemonldap-NG-Portal
- CVE-2026-74791Scriban before 7.0.0 Authorization Bypass via Stale Include Cachescriban · Scriban.Signed
- CVE-2026-74790Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cachescriban · Scriban.Signed
- CVE-2026-73061Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessorscriban
- CVE-2026-73056SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Tokensiyuan-note siyuan
- CVE-2026-74251Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6phoca.cz Phoca Cart extension for Joomla
- CVE-2024-13784Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injectionreputeinfosystems Contact Form, Survey, Quiz & Popup Form B…
- CVE-2026-19725WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connectWPvivid — Backup, Migration & Staging
- CVE-2026-19714Simple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience ValidationSimple JWT Login
- CVE-2026-18316Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Actionsolacewp Solace Extra
- CVE-2026-14524ProSolution WP Client <= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' ParametersProSolution WP Client
- CVE-2026-16098ProSolution WP Client <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename OverrideProSolution WP Client
- CVE-2026-18432Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parametershabti Frontend Admin by DynamiApps
- CVE-2026-19924Tenda AC10 httpd R7WebsSecurityHandler improper authenticationTenda AC10
High 30
- CVE-2026-74796OpenTofu before 1.11.7 Symlink Following Path Traversalopentofu · github.com/opentofu/opentofu
- CVE-2026-74795Scriban before 6.6.0 Denial of Service via Uncontrolled Recursionscriban · Scriban.Signed
- CVE-2026-74794Scriban before 6.6.0 Denial of Service via Infinite Recursionscriban · Scriban.Signed
- CVE-2026-74792Scriban before 7.0.0 Stack Overflow via nested array initializersscriban · Scriban.Signed
- CVE-2026-74789Scriban before 7.0.0 LoopLimit Bypass via Built-in Operationsscriban · Scriban.Signed
- CVE-2026-74788Scriban before 7.0.0 Denial of Service via string.pad_left/pad_rightscriban · Scriban.Signed
- CVE-2026-74787Scriban before 7.0.0 Uncontrolled Recursion via object.to_jsonscriban · Scriban.Signed
- CVE-2026-74786Scriban before 7.0.0 Denial of Service via Unbounded Template Outputscriban · Scriban.Signed
- CVE-2026-74785Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumptionscriban · Scriban.Signed
- CVE-2026-74784Scriban before 7.2.0 Denial of Service via array.insert_atscriban · Scriban.Signed
- CVE-2026-74783Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Servicescriban · Scriban.Signed
- CVE-2026-73062Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplicationscriban · Scriban.Signed
- CVE-2026-73060Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiplyscriban
- CVE-2026-73059stoatchat before 0.15.0 Permission Bypass via message_fetchstoatchat
- CVE-2026-73057stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Servicestoatchat
- CVE-2024-58375OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluationopentofu · github.com/opentofu/opentofu
- CVE-2026-74578crypto: algif_skcipher - force synchronous processing on trees without ctx->stateLinux
- CVE-2026-13424Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX actionladela Online Scheduling and Appointment Booking System – B…
- CVE-2026-17087WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameterwptravelengine WP Travel Engine – Tour Booking Plugin – Tou…
- CVE-2026-2497Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array KeysGallery by BestWebSoft – Customizable Image and Photo Galle…
- CVE-2026-10734Infility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log EndpointInfility Global
- CVE-2026-19728Extra Product Options Builder for WooCommerce < 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileuploadExtra Product Options Builder for WooCommerce
- CVE-2026-19717CatFolders Document Gallery < 2.0.7 - Unauthenticated Attachment Disclosure via REST APICatFolders Document Gallery & PDF Library
- CVE-2026-18653WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section ParameterWP Directory Kit
- CVE-2026-17533All-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST ImportAll-in-One WP Migration and Backup
- CVE-2026-17581WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Enginekilbot WCPOS – Point of Sale (POS) plugin for WooCommerce
- CVE-2026-15002Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameterbluemediapl Autopay
- CVE-2026-17123Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Settingwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2026-16099Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parametereteubert Podlove Podcast Publisher
- CVE-2026-14498Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameterdaggerhart Query Wrangler
Medium, low and unrated 62
- CVE-2026-19964Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injectionJij-Inc Jij-MCP-Server
- CVE-2026-19963Edimax EW-7478APC stainfo command injectionEdimax EW-7478APC
- CVE-2026-19962Edimax EW-7478APC setWAN command injectionEdimax EW-7478APC
- CVE-2026-19960Edimax EW-7478APC formWlbasic command injectionEdimax EW-7478APC
- CVE-2026-19958iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injectioniatsiuk pptr-mcp
- CVE-2026-19957graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fetch server-side request forgerygraphlit-mcp-server
- CVE-2026-19956gomarble-ai facebook-ads-mcp-server server.py fetch_pagination_url server-side request forgerygomarble-ai facebook-ads-mcp-server
- CVE-2026-19955TrailDB TOC Validation tdb.c tdb_open out-of-boundsTrailDB
- CVE-2026-72888Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_requireNet-OAuth
- CVE-2026-74797OpenTofu before 1.11.4 Denial of Service via malicious zipopentofu · github.com/opentofu/opentofu
- CVE-2026-73058stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypassstoatchat
- CVE-2026-18347Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameterthemeum Kirki – Freeform Page Builder, Website Builder & Cu…
- CVE-2026-17604Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameterthemeum Kirki – Freeform Page Builder, Website Builder & Cu…
- CVE-2026-17608WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletionaresit WP Compress – Instant Performance & Speed Optimizati…
- CVE-2026-2357Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingboldthemes Bold Page Builder
- CVE-2026-12998Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameterwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2026-19726Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configuration DisclosureVisualizer
- CVE-2026-19712Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz DescriptionMasteriyo LMS
- CVE-2026-19711Premium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal RequestPremium Packages
- CVE-2026-19613ECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF SourceECS
- CVE-2026-15384Manual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDORManual Image Crop
- CVE-2026-13712Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URLDivi
- CVE-2026-15351WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameterwcvendors WC Vendors – WooCommerce Multivendor, WooCommerce…
- CVE-2026-9767The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameterweblizar The School Management – Education & Learning ERP
- CVE-2026-15345ShortPixel Adaptive Images <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' ParameterShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimiz…
- CVE-2026-17582Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)quantumcloud Slider Hero with Video Background, Animation
- CVE-2026-16775Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attributesmub Smash Balloon Social Post Feed – Simple Social Feeds f…
- CVE-2026-15056StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URLkodezen StoreEngine — Complete eCommerce Solution with Memb…
- CVE-2026-10035Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injectionwpweaver Turnkey bbPress by WeaverTheme
- CVE-2026-16758Snippet Shortcodes <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesaliakro Snippet Shortcodes
- CVE-2026-2283User Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameterfaiyazalam User Login History
- CVE-2026-18402SureDash <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attributebrainstormforce SureDash – Community, Courses & Member Dash…
- CVE-2026-15790Video Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcodeemarket-design Video Gallery – YouTube Gallery, Playlist &…
- CVE-2026-15604Toocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post MetaToocheke Companion
- CVE-2026-19934itsourcecode Hospital Management System vieworder.php sql injectionitsourcecode Hospital Management System
- CVE-2026-19933DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflowDefaultFuction Customer-Relationship-Management-In-C-Project
- CVE-2026-16779Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Actionextendthemes Kubio AI Page Builder
- CVE-2026-15726Serious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attributecryout-creations Serious Slider
- CVE-2026-15963Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Optionexpresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…
- CVE-2025-10005Password Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Updatebuildwps PPWP – Password Protect Pages
- CVE-2026-15009Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parametersaadiqbal Advanced File Manager – Ultimate File Manager for…
- CVE-2026-15066Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Commentstimwhitlock Loco Translate
- CVE-2026-13167Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpointswpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- CVE-2026-15441Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameterwcproducttable Product Table & List Builder For WooCommerce
- CVE-2026-11780Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameterexpresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…
- CVE-2026-13358Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposurecroixhaug Simply Schedule Appointments
- CVE-2026-16079Fullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Contentpdamsten Fullscreen Galleria
- CVE-2026-12477Gravity Booster <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameterwpmonks Gravity Booster – Styles & Layouts for Gravity Forms
- CVE-2026-18385Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Fieldproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2026-15602NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameterwebaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-12905Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameterladela Online Scheduling and Appointment Booking System – B…
- CVE-2026-19932DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injectionDefaultFuction Notice-System-Managent
- CVE-2026-2487Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Settingweblizar Admin Custom Login
- CVE-2026-19930Dolibarr User Cloning card.php ldap injectionDolibarr
- CVE-2026-19929OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engineOpenBoxes
- CVE-2026-19928OpenBoxes Role Interceptor RoleInterceptor.groovy needManager privileges managementOpenBoxes
- CVE-2026-19927OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgeryOpenBoxes
- CVE-2026-19926Evergreen open-ils.fielder OpenSRF Service osrf-gateway-v1 sql injectionEvergreen
- CVE-2026-19925SourceCodester Stock Management System Master.php delete_supplier sql injectionSourceCodester Stock Management System
- CVE-2026-19923code-projects Online Shopping System checkout_process.php sql injectioncode-projects Online Shopping System
- CVE-2026-19922code-projects Online Shopping System checkout.php cross site scriptingcode-projects Online Shopping System
- CVE-2026-19921code-projects Online Shopping System homeaction.php sql injectioncode-projects Online Shopping System