CVE Vulnerabilities - 20 August 2026

The Azure Arc service, which links on‑premises and cloud resources, has a flaw that could let an unauthorized user increase their access rights across the network. This could allow the attacker to vie...

Azure Arc, the tool that links on‑premise resources to Azure, has a flaw that could let an outsider raise their access level across the network. This could expose sensitive data or allow changes to sy...

The Azure Managed Instance for Apache Cassandra does not properly handle special characters in commands, which could let an unauthorized user send crafted requests and cause the system to run their co...

Microsoft Entra ID can process data that an attacker controls, which could let them run their own programs on your system over the network. This could give an unauthorized user the ability to take act...

The cloud email service Microsoft Exchange Online can be tricked into contacting internal systems, allowing an outsider to raise their access level. This could let an attacker see or change sensitive ...

If someone who already has a user account on these IBM server operating systems sends specially crafted input, they can cause the system to run any command they choose. This could let an attacker take...

A flaw in Azure SQL Database could let someone who already has access use crafted database commands to raise their permission level across the network. This could let them view or change data they sho...

Microsoft Fabric may allow a person who already has some access to move to a higher level of control across your network. This could let the attacker view or change sensitive information. Install the ...

Azure Active Directory can be tricked into making internal network requests, allowing a user with limited rights to increase their privileges. This could let an attacker move beyond their original per...

A flaw in Azure SQL Database could let someone who already has access run specially crafted queries to boost their permissions. This could allow them to view or change data they shouldn’t. Apply the l...

The Multicloud Operators Subscription component lets a user who can create HelmRelease objects run Helm charts with high‑privilege permissions. Because the system does not check what the chart contain...

The web‑based management interface on Comfast CF‑N1‑S routers (firmware version 2.6.0.1) has a coding mistake that can let an attacker send specially crafted data and overflow the device’s memory. Thi...

The wireless router model Comfast CF-N1-S can be attacked from the network by sending a specially crafted Wi‑Fi name (SSID) to its configuration page. This triggers a memory error that could let an at...

The Warehouse Cargo theme for WordPress, up through version 2.6.9, can be tricked into accepting any file an attacker provides. This could let a malicious file be placed on your website, potentially g...

The WordPress theme called Smart Cleaning, up through version 4.8.6, allows a user with basic permissions to upload any type of file to the site. An attacker could place harmful files on your server, ...

The IT Residence theme for WordPress, up through version 3.2.1, lets anyone with a basic user account place any file onto the website. This could let a malicious person add harmful code, steal data, o...

Websites using SPIP versions older than 4.4.20 can be accessed by anyone on the internet who can then cause the server to run their own programs. This happens because the software misinterprets certai...

EverShop’s API for updating a customer record does not check who is making the request. Anyone who knows a customer’s identifier can send a request that changes the email address and password, giving ...

The AIX operating system versions 7.2 and 7.3, and the PowerVM VIOS version 4.1, contain a flaw that lets a remote attacker send crafted data to cause the system to execute unwanted code. This could l...

Versions of IBM AIX (7.2 and 7.3) and PowerVM VIOS 4.1 contain a flaw where specially crafted data can overflow memory and let an outsider execute their own programs on the server. This could give a r...

Versions of IBM AIX (7.2 and 7.3) and PowerVM VIOS 4.1 have a flaw that could let someone on the network run their own programs on the server. This happens because the software miscalculates a size va...

Versions of IBM AIX (7.2 and 7.3) and PowerVM VIOS (4.1) contain a coding error that could let a remote attacker run any program on the server. This could give the attacker full control of the system....

Versions of IBM AIX (7.2 and 7.3) and PowerVM VIOS 4.1 contain a flaw that lets specially crafted data overflow memory and run the attacker’s own programs from outside the network. If exploited, an at...

The IBM AIX operating system (versions 7.2 and 7.3) and the IBM PowerVM Virtual I/O Server version 4.1 have a weakness that could let someone on the network execute any command they choose. This could...