ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More · 2h Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks · 5h NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 8h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 8h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 9h Vulnerability in Sparx Systems Enterprise Architect software · 9h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 9h Vulnerabilities in Slican telephone exchanges · 10h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 13h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 14h ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More · 2h Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks · 5h NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 8h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 8h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 9h Vulnerability in Sparx Systems Enterprise Architect software · 9h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 9h Vulnerabilities in Slican telephone exchanges · 10h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 13h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 14h

ACyber Sentinel Security Assessment Team

← Back to feed

⚠️ Vulnerability Report

CVE-2026-6854

HIGH CVSS 7.5 CVSS 3.1 📌 Deferred

CVE-2026-6854 - My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Published: Jul 08, 2026 12:17

Last Modified: Jul 08, 2026 14:55