CVE Vulnerabilities - 13 August 2026

Budibase, a low-code platform, has a security issue that allows attackers to inject malicious SQL code without being authenticated. This could lead to sensitive data being stolen, modified, or permane...

The WP BASE Booking plugin has a security issue that allows an attacker to execute malicious code on your website without needing a password. This could lead to unauthorized access, data theft, or oth...

A security flaw in QA Analytics versions up to 5.2.0.0 allows attackers to run malicious code without needing a password. This puts sensitive data at risk and could lead to system compromise. Update t...

: Improper Authentication vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft ...

The Link Factory WordPress plugin contains a hidden backdoor that allows unauthorized access to the plugin's functionality. This could allow an attacker to manipulate or steal sensitive data, posing a...

Authenticated users can upload malicious files to gain root access. This happens because the system doesn't properly check where uploaded files are saved. To fix this, administrators should update the...

A security issue affects OpenWrt's luci-app-lxc, allowing users with limited access to control containers and potentially gain root access on the device. This means that an attacker could gain control...

An attacker with an API key for one Trigger.dev project can hijack another project's deployment by linking their own worker to it. This can cause the hijacked project to move to the wrong deployment s...

Argo Workflows versions before 3.7.15 and 4.0.6 have a security issue. This issue allows attackers to inject malicious code into a workflow, potentially giving them control over the workflow's environ...

AgenticSeek's API endpoint is accessible to anyone on the network, allowing an attacker to execute arbitrary commands on the system. This could result in unauthorized access to sensitive data or the c...

An attacker can create an account with full access to all files on the server, even if they're not supposed to have any permissions. This is a significant risk because it allows unauthorized access to...

IBM Documentation Offline is a software that stores and displays documentation offline. If exploited, an attacker could gain unauthorized access and execute malicious code on a vulnerable system. To p...

IBM Documentation Offline, a tool for offline documentation access, has a security issue that could allow an attacker to run malicious code on your system. This is a serious issue because it could lea...

A buffer overflow vulnerability in IBM i 7.6, 7.5, 7.4, and 7.3 allows a remote attacker to potentially take control of your system. This is a serious issue because it could allow an attacker to execu...

IBM i systems running Db2 Mirror are vulnerable to a SQL injection attack. This could allow a remote attacker to access or modify sensitive data in the database. IBM i users should update their system...

IBM i systems with affected versions are vulnerable to unauthorized access. An attacker can exploit this vulnerability if they can trick a legitimate user into authenticating with the system. Users sh...

Tenda routers with certain models are vulnerable to a command injection attack when accessed remotely. This means that an attacker could potentially take control of the router and disrupt its operatio...

IBM i versions 7.6, 7.5, 7.4, and 7.3 may be vulnerable to unauthorized access by a remote attacker. This means an attacker could potentially bypass security controls and gain access to sensitive data...

A vulnerability in Velocity.js, a JavaScript templating engine, allows an attacker to inject and run malicious code on your server if you're using a version prior to 2.1.7. This is particularly concer...

A vulnerability in CyberPanel's WebTerminal allows attackers to bypass authentication and gain root access. This could let unauthorized users access sensitive parts of the system. CyberPanel users sho...

An attacker with a restricted Gitea token can create a full-access token without knowing the account password. This happens when the attacker passes the token in a specific format in the API request. ...

Fluent Forms Pro plugins may be compromised by malicious code. This can lead to unauthorized access to your website and data. To protect yourself, update to the latest version of Fluent Forms Pro and ...

Ninja Tables Pro, a WordPress plugin, contains a critical security flaw that allows malicious code to be injected and executed on a website. This can lead to unauthorized access, data theft, and other...

If you use CoreDNS to manage your DNS data, a security update is available to prevent unauthorized access to your DNS settings. This update is necessary to ensure that only authorized users can perfor...

A security update is available for CoreDNS, a DNS server software. In previous versions, an attacker could bypass security checks and access sensitive features like zone transfers and dynamic DNS upda...