CVE Vulnerabilities - 7 August 2026

Plesk's XML-RPC API has a security issue that lets an authenticated reseller access the root user account without permission. This is a serious issue because it allows someone who shouldn't have acces...

The LightRAG API server is open to the internet without password protection. This allows unauthorized users to access and modify sensitive data, and potentially disrupt the service. To fix this, updat...

CodeIgniter, a popular web framework, had a security issue where malicious files could be uploaded if a website allowed users to choose their own filenames and store those files in a location where th...

An attacker can access sensitive files on the server and use this information to take control of the Postiz instance without a password. This is a serious risk because it could allow unauthorized acce...

Weaver E-cology versions 9.0 to 10.51 are vulnerable to a file upload security risk. This means an attacker can upload malicious files without permission, potentially allowing them to take control of ...

Dell OpenManage Server Administrator versions before 11.1.0.2 are at risk of unauthorized remote access. An attacker with remote access could gain access to the system without a password. Update to ve...

Apache Fory's C++ deserialization feature is affected by a security flaw. If exploited, this could cause your server to crash or allow attackers to take control of it. To fix this, upgrade to the late...

The Ajax Search Lite plugin for WordPress allows attackers to inject malicious code without a password. This can lead to unauthorized access and control of your website. Update the plugin to version 4...

WP Events Manager, a popular WordPress plugin, has a security issue that allows any authenticated user to book paid events without paying. This can lead to financial losses for event organizers. To fi...

The TrueBooker plugin for WordPress is affected if you use it on your site. An attacker could change passwords for any user, including administrators, allowing them to gain access to those accounts. T...

The TrueBooker plugin for WordPress has a security flaw that allows attackers to change anyone's password without needing a password. This means they could gain access to administrator accounts and po...

OpenYak's desktop backend, used in a local workspace, allows malicious web pages to access and control the local server. This allows hackers to execute commands on the host, access sensitive data, and...

Kata Containers versions prior to 4.0.0 allow a user to load any file from the host system, potentially allowing an attacker to execute malicious code on the host with root privileges. This can be exp...

The TeamDavid Webbox application has a security issue that allows an attacker to crash the server by sending a specially crafted JSON message. This could lead to the server being unavailable, and pote...

The TeamDavid Webbox application is vulnerable to a server crash when it receives excessively long form data. This could be exploited by an attacker to shut down the server. To protect against this, i...

The TeamDavid Webbox application allows an attacker to crash the server by uploading a file with a very long name. This could potentially be used to take control of the server. To fix this, update to ...

Using CodeIgniter's deleteBatch() function between versions 4.3.0 and 4.7.3 can allow malicious users to inject their own SQL code. This could lead to unauthorized data changes or even complete databa...

A security issue in Debian Linux's package manager allows an attacker to run malicious code on a system without being authenticated. This could happen if a user installs a compromised package. To prot...

An unauthenticated attacker can access and download files from your Joomla website. This is a serious issue because it allows an attacker to potentially steal sensitive information or disrupt your sit...

An attacker can shut down the TeamDavid Webbox server without a password, causing it to be unavailable. This is a concern because it can lead to lost productivity and revenue. To protect against this,...

The TeamDavid Webbox allows unauthorized access to sensitive user information, including passwords, without needing a login. This can happen when an attacker repeatedly requests a specific URL. Update...

The scimPatch library in Node.js versions up to 0.9.0 can be exploited by an attacker to modify system settings and potentially gain unauthorized access or disrupt system functionality. This vulnerabi...

Craft CMS's passkey login system can be tricked into accepting previously captured login data, allowing an attacker to reuse a legitimate user's passkey. This is a concern because it weakens the secur...

Apache Fory versions from 0.14.0 to 1.4.9 are at risk of exposing sensitive information or crashing if given a specially crafted input. To fix this, update to version 1.5.0 if you use Apache Fory C++....

The MStore API WordPress plugin allows an attacker to mark an order as paid without payment, potentially giving them free access to goods or services. This affects any sites using MStore API version 4...