Security News

Critical vulnerabilities, as they're published

We track newly-disclosed CVEs with a critical CVSS score so you know when something could affect your servers.

CRITICAL 9.8 CVE-2026-32470 18 Aug 2026

FundEngine PHP Object Injection Vulnerability

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

CRITICAL 9.9 CVE-2026-32463 18 Aug 2026

Sync Post With Other Site Plugin Arbitrary File Upload Vulnerability

Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.

CRITICAL 9.9 CVE-2026-32444 18 Aug 2026

Cwicly WordPress Plugin Contributor Remote Code Execution Vulnerability

Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

CRITICAL 9.6 CVE-2026-28192 18 Aug 2026

Piotnet Addons For Elementor Pro Arbitrary File Upload Vulnerability

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.

CRITICAL 9.1 CVE-2026-75837 18 Aug 2026

Grav CMS Privilege Escalation Vulnerability

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.

CRITICAL 9.8 CVE-2026-75627 18 Aug 2026

Bastillion Authentication Bypass via URI Path Validation Flaw

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.

CRITICAL 9.8 CVE-2026-15748 18 Aug 2026

Forminator WordPress Plugin Arbitrary File Upload Vulnerability

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged S

CRITICAL 9.8 CVE-2026-67919 17 Aug 2026

Halo Plugin Installation Remote Code Execution Vulnerability

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components

CRITICAL 9.8 CVE-2026-42164 17 Aug 2026

Mahara Text Block Content Disclosure Vulnerability

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section.

CRITICAL 9.1 CVE-2026-42162 17 Aug 2026

Mahara File Path Manipulation Leads to Unauthorized Artefact Access

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated.

CRITICAL 9.6 CVE-2026-71424 17 Aug 2026

Onyx MCP API Vulnerability Exposes Users' OAuth Authorization Headers

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_server_to_api_mcp_server returns that row through auth_template.headers to any BAS

CRITICAL 9.8 CVE-2026-67960 17 Aug 2026

PbootCMS Arbitrary Code Execution Vulnerability

An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components

CRITICAL 9.8 CVE-2026-67854 17 Aug 2026

Qcms SQL Injection Vulnerability

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code

CRITICAL 9.8 CVE-2026-42163 17 Aug 2026

Mahara LTI Authentication Bypass Vulnerability

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.

CRITICAL 9.1 CVE-2026-75106 17 Aug 2026

OpnForm Predictable Submission Secret Vulnerability

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.

CRITICAL 9.8 CVE-2026-67926 17 Aug 2026

JeecgBoot AI Chat Module Remote Code Execution Vulnerability

An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module

CRITICAL 9.9 CVE-2026-65974 17 Aug 2026

ERPNext Server-Side Template Injection Leads to Remote Code Execution

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.

CRITICAL 9.8 CVE-2026-67678 17 Aug 2026

RainyGao-Hithub DocSys File Upload Vulnerability Allows Remote Code Execution

File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code

CRITICAL 9.4 CVE-2026-19478 17 Aug 2026

GitLab CE/EE GraphQL Directive Flaw Lets Unauthenticated Users Modify or Delete Data

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

CRITICAL 9.1 CVE-2026-51346 17 Aug 2026

StudIP SQL Injection Vulnerability Allows Remote Code Execution

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store() functions.

Page 17 of 18 (345 total)

Think your server has been compromised?

Tell us what happened. We'll review your request and provide an initial response within 1 hour.

Get Emergency Help help@myserverhacked.com