CVEs published August 9, 2026
77,396 CVEs in 2026
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary commands on the affected device.
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute arbitrary commands on the affected device.
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allows remote attackers to execute arbitrary…
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows remote attackers to execute arbitrary commands…
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary commands on the affected device.
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arbitrary commands on the affected device.
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitrary commands on the affected device.
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitrary commands on the affected device.
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device.
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute arbitrary commands on the affected device.
A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a.
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite…
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
A vulnerability was determined in Tenda CH22 1.0.0.1.
A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306.
The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users.
The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on…
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it…
The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive…
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing…
Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute. print_attribute() sizes the destination buffer for a…
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title…
A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`.
A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06.
A vulnerability was determined in MingSoft MCMS up to 3.0.6.
A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28.
A vulnerability has been found in code-projects Task Management System 1.0.
A flaw has been found in code-projects Task Management System 1.0.
A vulnerability was detected in code-projects Task Management System 1.0.
A vulnerability was found in code-projects Task Management System 1.0.
The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing…
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a…
The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content…
The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a…
A vulnerability has been found in NocteDefensor LudusMCP 1.0.24.
A vulnerability was determined in itsourcecode Hospital Management System 1.0.
A weakness has been identified in 3CORESec Trapdoor up to 1.2.2.
A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09.
A vulnerability has been found in Dolibarr ERP up to 23.0.3.
A vulnerability was identified in itsourcecode Hospital Management System 1.0.
A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0.
A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43.
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard,…
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor.
A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0.
A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0.
A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0.
A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0.
A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0.
A flaw has been found in NocteDefensor LudusMCP up to 1.0.24.
A vulnerability was identified in Ichigo3766 image-gen-mcp 0.1.0.
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0.
A vulnerability has been found in lmammino oidc-authorizer 0.4.0.
A security flaw has been discovered in MingSoft MCMS up to 3.0.6.
A vulnerability was identified in MingSoft MCMS up to 3.0.6.
A vulnerability was identified in automateyournetwork MCPyATS up to 0.1.4.
A vulnerability was determined in adenot mcp-google-search up to 0.3.1.
A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6.
A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0.
A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9.
A vulnerability was detected in NightTrek Supabase-MCP cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170/db03237d92f7dc2f0da0d70a87dba84ebcde5b66.
A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0.
A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0.
A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0.
A vulnerability was found in andreahaku codex_mcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390.
A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0.
A flaw has been found in abracadabra50 claude-sesh 1.0.0.
A security vulnerability has been detected in IncomeStreamSurfer roo-code-memory-bank-mcp-server up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e.
A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0.
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated…
A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2.
A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3.
A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0.
A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1.
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in…
The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is…
A flaw has been found in macrozheng mall 0504e86.
A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch.
A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0.
A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38.
A vulnerability was determined in mifi lossless-cut up to 3.69.0.
The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read…
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used…