CVE Watchtower

← Back to CVE List

CVE-2026-78265NVD

Vulnerability Summary

Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.

Severity Level

CRITICAL(9.8)

Published Date

Aug 24, 2026

Last Modified

Aug 24, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

Data Pending

Root Weakness (CWE)

CWE-502: Unknown/Unlisted Weakness ↗

Refer to the official MITRE database for detailed architectural specifications regarding this weakness.

CVSS v3.1 Base Metrics

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

External References

https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-17-2-php-object-injection-vulnerability?_s_id=cve

🚨

Receive alerts for vulnerabilities being exploited in the wild.

⚡

Get notified instantly when a Proof of Concept (PoC) exploit is published.

🔍

Access critical info on vulnerabilities even when marked as "RESERVED".

🧠

Insights powered by decades of expertise and global intelligence sources.

🎯

Customize alerts with up to 10 keywords for your specific tech stack.

📊

Export the raw CVE database for SIEM integration and reporting.

CVE-2026-21962CVSS 10.0
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic...
CISA KEV📅 Added to KEV: Aug 24, 2026
CVE-2026-77806CVSS 9.8
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August...
Admin intel📅 Updated: Aug 21, 2026
CVE-2026-19598CVSS 9.8
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization...
Admin intel📅 Updated: Aug 21, 2026
CVE-2026-19478CVSS 9.4
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8,...
Admin intel📅 Updated: Aug 21, 2026
CVE-2026-77647CVSS 9.8
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August...
Admin intel📅 Updated: Aug 21, 2026
CVE-2026-69836CVSS 10.0
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
Admin intel📅 Updated: Aug 21, 2026
CVE-2026-73570CVSS 8.9
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is...
Admin intelCISA KEV📅 Added to KEV: Aug 21, 2026📅 Updated: Aug 20, 2026
CVE-2026-72529CVSS 9.8
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9,...
CISA KEV📅 Added to KEV: Aug 20, 2026

Critical Alert 1 Active Exploit Detected Today

CVE-2026-78265NVD

Vulnerability Summary

External References