CVE Database

CVE-2026-66461 High · 7.5 CWE-862 Aug 13, 2026

WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

CVE-2026-66459 Medium · 6.5 CWE-862 Aug 13, 2026

WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.

CVE-2026-66455 Medium · 6.0 CWE-862 Aug 13, 2026

WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.

CVE-2026-66454 Medium · 6.5 CWE-862 Aug 13, 2026

WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.

CVE-2026-66441 High · 7.5 CWE-862 Aug 13, 2026

WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.

CVE-2026-66431 High · 7.5 CWE-862 Aug 13, 2026

WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.

CVE-2026-61984 High · 7.5 CWE-862 Aug 13, 2026

WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

CVE-2026-61978 Medium · 6.5 CWE-862 Aug 13, 2026

WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.

CVE-2026-28188 High · 7.3 CWE-862 Aug 13, 2026

WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.

CVE-2026-28186 High · 8.1 CWE-862 Aug 13, 2026

WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

CVE-2026-28181 Medium · 6.5 CWE-862 Aug 13, 2026

WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.

CVE-2026-28173 High · 7.1 CWE-862 Aug 13, 2026

WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability

Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.

CVE-2026-28159 Medium · 6.5 CWE-862 Aug 13, 2026

WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.

CVE-2026-27999 Medium · 6.5 CWE-862 Aug 13, 2026

WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.

CVE-2026-27535 High · 7.1 CWE-862 Aug 13, 2026

WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

CVE-2026-27345 High · 7.5 CWE-862 Aug 13, 2026

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

CVE-2026-6471 High · 7.2 CWE-862 Aug 13, 2026

PostgreSQL logical decoding can dlopen arbitrary file

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVE-2026-6470 Medium · 4.3 CWE-862 Aug 13, 2026

PostgreSQL fails to check type USAGE privilege

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVE-2026-73609 Medium · 5.8 CWE-862 Aug 13, 2026

SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents.

CVE-2026-73608 High · 8.6 CWE-862 Aug 13, 2026

SiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTarget

SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4-alpha.3) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization checks (no CheckReadonly, no publish-access or encrypted-notebook gating). Given a database identifier taken from a published page and a keyword, an anonymous reader can query the endpoint to retrieve matching database row content, including rows that publish filters (FilterAttributeViewByPublishAccess) would otherwise withhold. No released stable version is affected.

CVE-2026-73607 Medium · 5.8 CWE-862 Aug 13, 2026

SiYuan before v3.7.4 Information Disclosure via getOutlineStorage

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.

CVE-2026-73605 Medium · 5.8 CWE-862 Aug 13, 2026

SiYuan before v3.7.4 Path Traversal via getUniqueFilename

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on the host, enabling reconnaissance of the filesystem layout and installed software.

CVE-2026-73603 Medium · 5.3 CWE-862 Aug 13, 2026

Flowise before 3.1.4 Credential Abuse via Text-to-Speech

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a valid chatflow UUID, incurring costs on the chatflow owner's account.

CVE-2026-14332 Medium · 5.4 CWE-862 Aug 13, 2026

Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action

The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it.

CVE-2026-73326 High · 7.6 CWE-862 Aug 12, 2026

CamaleonCMS Missing Authorization via Plugin Administration Endpoints

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration parameters at runtime across the attack, front_cache, cama_meta_tag, and cama_contact_form plugins to alter cached page behavior, modify public meta-tag output, or reconfigure contact forms, enabling account takeover when chained with stored cross-site scripting through the contact form's before_html field.