CVE Vulnerabilities - 24 August 2026

The python sandbox used by ContextForge’s MCP server can be tricked into running any command because it exposes a function that bypasses its safety checks. An attacker could send specially crafted cod...

If someone with permission on your Thread network sends specially crafted messages, OpenThread may stop working, leading to a denial of service. The problem is caused by errors in how OpenThread proce...

The miniOrange OAuth Client extension for Joomla (versions before 3.2.0) can be fooled by changing a small piece of data stored in the web browser, allowing someone to log in as any user, even an admi...

The T16000M router (firmware 14.20.2) has a flaw in its session‑checking routine that lets an attacker bypass the normal authentication process. This means a remote user could gain access to the devic...

The file‑upload feature in UltimateAI version 3.1 and earlier does not properly check what is being uploaded. A malicious user could place a harmful file on your server, potentially gaining control or...

LXD’s template feature can be tricked into writing any file on the underlying server, even system files that require administrator rights. An attacker who can edit containers or launch a specially cra...

Versions of UTT HiPER 1250GW up to 3.2.7‑210907‑180535 mishandle a specific web request, causing the system to overflow its memory. An attacker on the network can send a crafted request and potentiall...

The TranslatePress plugin versions up to 3.3.2 allow a person who is not logged in to gain full administrator privileges on your website. This means an attacker could change settings, install maliciou...

Versions of the WP Project Manager plugin up to 4.0.6 let anyone on the internet send specially crafted data that can make the website run their own code. This could let attackers steal data, change s...

Versions of The Events Calendar up to 6.17.2 can be tricked into loading malicious data without requiring any login. This could let an attacker execute commands on your server, potentially stealing da...

The Advanced Custom Post Types (ACPT) Pro plugin for WordPress up to version 2.0.63 can be tricked into executing malicious code when a low‑privilege user (subscriber) provides specially crafted input...

Certain versions of Apache Camel that use the Undertow connector do not properly screen extra information attached to incoming messages. This can let a specially crafted request cause data to be sent ...

Older versions of Apache Camel that handle WebSocket connections let outside data decide which client receives a message. An attacker could hide a notification or send it to a different client they co...

Several DrayTek VigorSwitch network switches let an attacker send specially crafted data to the setget.cgi page, even before any user logs in. This can let the attacker run any command on the device w...

The NetworkManager program on Linux does not properly limit a setting that tells the system where to look for trusted Wi‑Fi authentication files. This lets a regular user point a secure Wi‑Fi (WPA‑Ent...

Several DrayTek VigorAP Wi‑Fi devices can be tricked into running any code they want when they receive a specially crafted network message. An attacker from outside could gain full control of the devi...

The Netis NC63 router’s firmware up to version 3.0.0.3327 can be tricked into running malicious code when a specially crafted request is sent. An attacker does not need to log in and can gain full con...

Versions of rConfig from 8.0.0 through 8.2.12 let a person who is not logged in create a new account that automatically receives administrator rights. With that access they can view saved device passw...

The web interface on Netis NC63 routers (up to firmware version V3.0.0.3327) can be fooled by sending an overly long, specially encoded password. This overload lets an unauthenticated remote user take...

The FreightCo theme for WordPress, versions up to 1.1.15, can be accessed by anyone on the internet to inject malicious data that causes the server to execute unwanted commands. This could let a hacke...

The Jawn theme for WordPress, in versions up to 1.4.2, can be used by anyone on the internet to take control of the site. An attacker could give themselves administrator privileges and change or steal...

The WP Cafe Pro add‑on for WordPress, in any version older than 3.0.15, lets anyone on the internet view files stored on your web server. This could reveal sensitive information such as passwords, con...

The Affiliate Pro add‑on for WordPress and WooCommerce (versions up to 8.9.1) lets anyone on the internet gain full administrative control of your site. An attacker could change settings, view sensiti...

Websites that use the Digits extra feature for WordPress, up to version 9.2, can be accessed by anyone on the internet who can then gain administrator privileges. This could let an attacker change sit...

The GCB Doctor tool from 4MOSAn Security Technology contains a web page that was left in place for testing. Because it does not require any login, an outsider can send specially crafted data to that p...