JavaScript is a high-level, interpreted programming language essential for creating interactive web applications, running directly in web browsers to enable dynamic content and user interface enhancements. It is integral to the web development stack, working seamlessly with HTML and CSS to build responsive and feature-rich websites.

JavaScript

Chainguard is a Linux distribution based on Alpine. It's the commercial version of the Wolfi distro.

Chainguard

MinimOS is a minimalist operating system designed for simplicity and efficiency. It aims to provide only essential functionalities, making it lightweight and suitable for resource-constrained environments. MinimOS is often used in embedded systems or as a base for custom operating system development.

MinimOS

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.

CVE-2026-45618

GitHub Advisory Database

Minimus

SAP Commerce Cloud is a robust platform that delivers multi-channel commerce solutions, enabling businesses to unify customer processes and deliver personalized experiences. It includes capabilities such as product content management, experience management, order management and personalization.

SAP Commerce Cloud

SAP Commerce Cloud allows an unauthenticated
attacker to abuse a default authentication client and submit specially crafted
input to certain functions lacking sufficient validation. Successful
exploitation could enable arbitrary code execution and compromise internal
components, resulting in high impact on confidentiality, integrity, and
availability of the application.

CVE-2026-58231

Linux

Linux Kernel

Windows

Windows Cumulative Update

NixOS is a Linux distribution built on top of the Nix package manager. It is completely declarative, its system configurations are reproducible, makes configuration changes reliable and atomic, and eliminates configuration drift.

NixOS

Metabase is an open-source business intelligence and data visualization tool designed to make data analysis accessible to non-technical users. It enables users to easily connect to various data sources, create interactive dashboards, and generate insightful visual reports without the need for complex coding or SQL queries.

Metabase

Homebrew is a free and open-source software package management system that simplifies the installation of software on Apple's macOS operating system and Linux. The name is intended to suggest the idea of building software on the Mac depending on the user's taste. Originally written by Max Howell, the package manager has gained popularity in the Ruby on Rails community and earned praise for its extensibility.

Homebrew

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

CVE-2026-72898

Docker is a set of platform-as-a-service products that use OS-level virtualization to deliver software in packages called containers.

Docker

Docker Desktop is an application for MacOS and Windows machines, aimed at developers and system administrators. It enables them to build and share containerized applications and microservices. Docker Desktop includes Docker Engine, Docker CLI, Docker Compose, and is fully integrated with the machine’s filesystem and networking.

Docker Desktop

a container-to-host arbitrary file-write vulnerability in Docker’s docker cp command.

CVE-2026-17106

WordPress is a content management system paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system, referred to within WordPress as Themes.

WordPress

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.

Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim.

This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).

CVE-2026-64638

Debian

Linux Debian

Debian Security Tracker

Echo

Ubuntu

Linux Ubuntu

Ubuntu Security Tracker

Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education.

Wireshark

Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows

CVE-2026-19696

VulnCheck NVD++

Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service

CVE-2026-19695

TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service

CVE-2026-19694

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).

CVE-2026-15413

The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it.

CVE ID	Severity	Score	Technologies	Component name	CISA KEV exploit	Has fix	Published date
CVE-2026-45618	CRITICAL	10	JavaScript	nginx-proxy-manager-2	No	Yes	Aug 11, 2026
CVE-2026-58231	CRITICAL	10	SAP Commerce Cloud	cpe:2.3:a:sap:commerce_cloud	No	No	Aug 11, 2026
CVE-2026-72898	CRITICAL	10	NixOS	metabase	Yes	Yes	Aug 10, 2026
CVE-2026-17106	HIGH	N/A	Docker	cpe:2.3:a:docker:desktop	No	Yes	Aug 10, 2026
CVE-2026-64638	HIGH	8.9	WordPress	wordpress	No	Yes	Aug 07, 2026

CVE ID	Severity	Score	Technologies	Component name	CISA KEV exploit	Has fix	Published date
CVE-2026-19696	MEDIUM	6.6	Wireshark	cpe:2.3:a:wireshark:wireshark	No	Yes	Aug 13, 2026
CVE-2026-19695	MEDIUM	4.7	Wireshark	cpe:2.3:a:wireshark:wireshark	No	Yes	Aug 13, 2026
CVE-2026-19694	MEDIUM	4.7	Wireshark	cpe:2.3:a:wireshark:wireshark	No	Yes	Aug 13, 2026
CVE-2026-15413	CRITICAL	10	WordPress	link-factory	No	No	Aug 13, 2026
CVE-2026-14332	MEDIUM	5.4	WordPress	ecwid-shopping-cart	No	Yes	Aug 13, 2026

Wiz Vulnerability Database

Explore by technology

Popular filters

High Profile

Most Recent

Vulnerabilities by the numbers

The good, the bad, and the vulnerable

Additional Wiz resources

Cloud Vulnerability DB

Cloud Threat Landscape

PEACH

Ready to see Wiz in action?