CVE-2026-81767

HIGH7.5

Published 2026-08-28 · Source audit@patchstack.com

Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-862

Same severity, most recent

CVE-2026-82227
Contributor SQL Injection in WPBulky <= 1.2.2 versions.
2026-08-28 · score 8.5
CVE-2026-81760
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2.
2026-08-28 · score 7.1
CVE-2026-81757
Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.
2026-08-28 · score 7.2
CVE-2026-81285
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
2026-08-28 · score 7.5
CVE-2026-81020
wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.
2026-08-28 · score 7.4