24h | 7d | 30d

CVE-2026-18039

Overview

  • Unknown
  • Essential Addons for Elementor
14 Aug 2026
Published
14 Aug 2026
Updated
CVSS
Pending
EPSS
0.15%
KEV

Description

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.

Statistics

  • 1 Post
Last activity: 22 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

Essential Addons for Elementor (≤5.8.6) has a CRITICAL CWE-269 bug (CVE-2026-18039) allowing unauthenticated attackers to register admin accounts via custom profile fields. Disable user registration or adjust config until patched. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 22h ago

CVE-2026-17186

Overview

  • IBM
  • Db2 Mirror for i
14 Aug 2026
Published
14 Aug 2026
Updated
CVSS v3.1
CRITICAL (9.9)
EPSS
Pending
KEV

Description

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.

Statistics

  • 1 Post
Last activity: 6 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

IBM Db2 Mirror for i (7.4 – 7.6) faces CRITICAL OS command injection (CVE-2026-17186, CVSS 9.9) 🛡️. No patch yet — restrict access, monitor for abuse. No exploits seen in wild. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 6h ago

CVE-2026-15303

Overview

  • sixstorage
  • 6Storage Rentals
15 Aug 2026
Published
15 Aug 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
Pending
KEV

Description

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user resolved by the attacker-supplied email address. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting that user's email address.

Statistics

  • 1 Post
Last activity: 3 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-15303: CRITICAL auth bypass in sixstorage 6Storage Rentals <=2.27.0. Unauthenticated attackers can impersonate any WP user via exposed AJAX handler. Restrict endpoint or disable plugin until patched. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 3h ago

CVE-2026-72829

Overview

  • getgrav
  • grav
14 Aug 2026
Published
14 Aug 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
Pending
KEV

Description

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a result, an api.users.write-scoped key minted on a super account can set access.api.super or assign a super-granting group to mint or promote a full super account, then authenticate as that account for uncapped administrative privileges.

Statistics

  • 1 Post
Last activity: 18 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-72829 (CRITICAL): getgrav grav API plugin <1.0.13 allows api.users.write-scoped keys from super accounts to escalate to full admin. Restrict API key use & monitor for privilege changes. Details: radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 18h ago

CVE-2015-5531

Overview

  • Pending
17 Aug 2015
Published
06 Aug 2024
Updated
CVSS vV2
MEDIUM (5.0)
EPSS
94.79%
KEV

Description

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.

Statistics

  • 1 Post
Last activity: 15 hours ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Spiderlabs~ RAVEN tool enables bulk data exfiltration and resilient persistence via rogue users, API keys, and Watcher schedules on Elasticsearch. - IOCs: CVE-2015-5531, RAVEN - #DataExfil #Elasticsearch #ThreatIntel
  • 0
  • 0
  • 0
  • 15h ago

CVE-2026-56862

Overview

  • Go standard library
  • crypto/tls
  • crypto/tls
13 Aug 2026
Published
14 Aug 2026
Updated
CVSS
Pending
EPSS
0.18%
KEV

Description

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

Statistics

  • 1 Post
Last activity: 19 hours ago

Bluesky

Profile picture fallback
Lambda Watchdog @lambdawatchdog.bsky.social
🚨 New UNKNOWN CVE detected in AWS Lambda 🚨 CVE-2026-56862 impacts stdlib in 25 Lambda base images. Details: https://github.com/aws/aws-lambda-base-images/issues/671 More: https://lambdawatchdog.com/ #AWS #Lambda #CVE #CloudSecurity #Serverless
  • 0
  • 0
  • 0
  • 19h ago

CVE-2026-56860

Overview

  • Go standard library
  • net/url
  • net/url
13 Aug 2026
Published
14 Aug 2026
Updated
CVSS
Pending
EPSS
0.18%
KEV

Description

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Statistics

  • 1 Post
Last activity: 19 hours ago

Bluesky

Profile picture fallback
Lambda Watchdog @lambdawatchdog.bsky.social
🚨 New UNKNOWN CVE detected in AWS Lambda 🚨 CVE-2026-56860 impacts stdlib in 25 Lambda base images. Details: https://github.com/aws/aws-lambda-base-images/issues/670 More: https://lambdawatchdog.com/ #AWS #Lambda #CVE #CloudSecurity #Serverless
  • 0
  • 0
  • 0
  • 19h ago

CVE-2026-56853

Overview

  • Go standard library
  • net/http
  • net/http
13 Aug 2026
Published
14 Aug 2026
Updated
CVSS
Pending
EPSS
0.22%
KEV

Description

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Statistics

  • 1 Post
Last activity: 19 hours ago

Bluesky

Profile picture fallback
Lambda Watchdog @lambdawatchdog.bsky.social
🚨 New UNKNOWN CVE detected in AWS Lambda 🚨 CVE-2026-56853 impacts stdlib in 25 Lambda base images. Details: https://github.com/aws/aws-lambda-base-images/issues/667 More: https://lambdawatchdog.com/ #AWS #Lambda #CVE #CloudSecurity #Serverless
  • 0
  • 0
  • 0
  • 19h ago

CVE-2026-43074

Overview

  • Linux
  • Linux
06 May 2026
Published
05 Aug 2026
Updated
CVSS v3.1
HIGH (7.8)
EPSS
0.48%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree() to an RCU callback to prevent UAF.

Statistics

  • 1 Post
Last activity: 18 hours ago

Bluesky

Profile picture fallback
yayafa.bsky.social @yayafa.bsky.social
Linuxカーネルのeventpollにroot権限奪取の脆弱性、Pixel 10 ProでのPoCエクスプロイトが公開(CVE-2026-43074) AnthropicのMythosが発見した脆弱性|セキュリティニュースのセキュリティ対策Lab https://www.yayafa.com/2864941/ 2026年8月10日、Linuxカー…
  • 0
  • 0
  • 0
  • 18h ago

CVE-2026-33818

Overview

  • Go standard library
  • encoding/asn1
  • encoding/asn1
13 Aug 2026
Published
14 Aug 2026
Updated
CVSS
Pending
EPSS
0.18%
KEV

Description

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

Statistics

  • 1 Post
Last activity: 19 hours ago

Bluesky

Profile picture fallback
Lambda Watchdog @lambdawatchdog.bsky.social
🚨 New UNKNOWN CVE detected in AWS Lambda 🚨 CVE-2026-33818 impacts stdlib in 25 Lambda base images. Details: https://github.com/aws/aws-lambda-base-images/issues/666 More: https://lambdawatchdog.com/ #AWS #Lambda #CVE #CloudSecurity #Serverless
  • 0
  • 0
  • 0
  • 19h ago
Showing 31 to 40 of 61 CVEs