| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-84148 | Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System | Manacle Technologies | Multi-tenant ERP System | Critical | 9.2 | 2026-09-01 12:38:26 | Deep Dive |
| CVE-2026-84147 | Remote Code Execution Vulnerability in Manacle Technologies ERP System | Manacle Technologies | Multi-tenant ERP System | Critical | 10.0 | 2026-09-01 12:33:00 | Deep Dive |
| CVE-2026-84200 | Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions | kyverno | kyverno | Critical | 9.0 | 2026-09-01 11:34:00 | Deep Dive |
| CVE-2026-18550 | Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter | scriptsbundle | Nokri – Job Board WordPress Theme | Critical | 9.8 | 2026-09-01 11:31:08 | Deep Dive |
| CVE-2026-4813 | Code injection in the Lutece Core | Lutece | Lutece Core | Critical | 9.4 | 2026-09-01 10:54:04 | Deep Dive |
| CVE-2026-78319 | TOCTOU Vulnerability in file exchange | Sauter | modu680-AS | Critical | 9.3 | 2026-09-01 06:44:51 | Deep Dive |
| CVE-2026-83772 | Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection | Cobham | SATCOM VSAT7090 Maritime Satellite Router | Critical | 9.9 | 2026-09-01 05:30:41 | Deep Dive |
| CVE-2026-75865 | WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint | wplegalpages | WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | Critical | 9.8 | 2026-09-01 02:26:49 | Deep Dive |
| CVE-2026-67394 | WebPros Plesk 命令注入漏洞 | WebPros | Plesk | Critical | 9.0 | 2026-09-01 02:07:42 | Deep Dive |
| CVE-2026-83524 | RedPort Optimizer wXa-223 System Clock datetime.php exec command injection | RedPort | Optimizer wXa-203 | Critical | 9.9 | 2026-08-31 22:45:38 | Deep Dive |
| CVE-2026-82971 🧪 | QVidium Opera11 CGI Script net_tr.cgi command injection | QVidium | Opera11 | Critical | 10.0 | 2026-08-31 22:15:40 | Deep Dive |
| CVE-2026-82954 | Dokploy Settings application.ts writeTraefikConfigInPath path traversal | - | Dokploy | Critical | 9.9 | 2026-08-31 21:45:07 | Deep Dive |
| CVE-2026-81779 🧪 | WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability | Silk Themes | Newspapers X | Critical | 10.0 | 2026-08-31 20:42:27 | Deep Dive |
| CVE-2026-82226 | WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability | Tickera | Tickera | Critical | 9.8 | 2026-08-31 20:30:55 | Deep Dive |
| CVE-2026-81780 | WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability | hashthemes | Hash Form | Critical | 10.0 | 2026-08-31 20:30:52 | Deep Dive |
| CVE-2026-81763 | WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability | ウェブ屋のさとーさん | Throws SPAM Away | Critical | 9.3 | 2026-08-31 20:30:49 | Deep Dive |
| CVE-2026-81756 | WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability | Autorius E-goi | Smart Marketing SMS and Newsletters Forms | Critical | 9.3 | 2026-08-31 20:30:47 | Deep Dive |
| CVE-2026-81293 | WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability | Passionate Programmer Peter | WP Data Access | Critical | 9.3 | 2026-08-31 20:30:44 | Deep Dive |
| CVE-2026-53552 | Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers | zhenorzz | goploy | Critical | 9.6 | 2026-08-31 18:46:42 | Deep Dive |
| CVE-2026-79748 | MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args) | samanhappy | mcphub | Critical | 9.9 | 2026-08-31 17:55:09 | Deep Dive |