CVE Vulnerabilities - 6 August 2026

A critical function in Microsoft Planetary Computer Pro is missing authentication, allowing an attacker with network access to gain elevated privileges without permission. This could lead to unauthori...

An attacker can gain elevated access to your Azure SQL Database over a network if authentication is not properly set up. This is a serious risk because it allows unauthorized access to sensitive data....

An unauthorized attacker can elevate their privileges on a network using a missing authorization in Microsoft Teams. This means they could potentially gain control over systems and data they shouldn't...

Traefik, a web server helper, had a security weakness that allowed hackers to fake identity information. This could happen if a hacker reached a protected part of a website. The good news is that this...

The Premium SEO WordPress plugin contains a hidden backdoor that can create a secret administrator account and allow an attacker to take control of your website without needing a password. This could ...

The official update distribution for MonsterInsights Pro has been compromised. This means that if you've updated your website recently, you may have inadvertently installed a malicious file. We recomm...

If left unpatched, an attacker could upload malicious files to Type Hub without needing a login. This could lead to unauthorized access or damage to your project, so it's essential to update to a secu...

A security flaw in the Spider Analyser WordPress plugin allows hackers to execute malicious code on a website without needing a password. This could lead to sensitive data being stolen or modified. Up...

The JWT authentication in [Software Name] can accept tokens signed with unknown algorithms, allowing attackers to gain unauthorized access to the system. This could lead to the compromise of administr...

An attacker with authorized access to Azure Service Bus can potentially execute malicious code on a network. This is a concern because it could allow unauthorized actions. To protect your system, ensu...

The Azure SRE Agent has a missing authorization check, which allows an authorized attacker to gain higher privileges on a network. This means an attacker could potentially take control of the system. ...

An authorized attacker can use a specific path in Microsoft Entra Provisioning Service to gain more access than they should have over a network. This could potentially allow them to make changes or ac...

Azure Active Directory has a vulnerability that allows an authorized user to gain more access than they should over a network. This could potentially lead to unauthorized changes or data theft. It's e...

Prior to version 1.0.2 of OpenReception's appointment booking software, a user with limited admin privileges could accidentally or intentionally gain full control over all other users and tenants on t...

An attacker with a Flowise account can access and manipulate files and settings from other workspaces by exploiting a flaw in the integration with OpenAI Assistants. This could lead to unauthorized da...

Betheme theme for WordPress has a vulnerability that allows attackers to run malicious code on a website. This could lead to unauthorized access, data theft, or even website takeover. Update Betheme t...

The Microsoft 365 Admin Center has a weakness that could allow an attacker to gain higher levels of access to the system than they should have. This is a concern because an attacker could use this vul...

An attacker can upload malicious files to the system, potentially executing unauthorized code. This could compromise the system's security and allow the attacker to take control. To protect your syste...

A security issue in macOS Screen Sharing allowed an attacker on the same network to access the feature without a password. This could potentially let an unauthorized person see or control your Mac's s...

A vulnerability in OpenReception's appointment booking software allowed an attacker to take over a user's account without their password. This happened when an attacker submitted a fake registration r...

Prior to version 1.0.1, OpenReception's appointment booking software allowed anyone to create administrative accounts without a password. This means that an attacker could gain full control over the p...

A security issue in WGDashboard allows an attacker with permission to inject malicious code, giving them full control over the system. This could lead to unauthorized changes, data theft, or complete ...

Authenticated users can execute commands with root privileges on vulnerable WGDashboard installations. This allows attackers to access sensitive data and take control of the system. Update to the late...

Authenticated attackers can make unauthorized web requests and access their responses. This could lead to data theft or unauthorized actions. Update to version 4.2.4 or later to fix the issue.

A security issue in Dinky's file upload feature allows anyone who can access the default HTTP port (8888) to write arbitrary files as the Dinky service account. This can lead to unauthorized access an...