By publication date

Exploited and new serious CVEs: August 2026

7,294 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 73

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2026-3141No exploit	FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameterwpwax · formgent – next-gen ai form builder for wordpress with multi-step, quizzes, payments & more · CWE-862 Pre-auth Path traversal Broken access control (IDOR)	Critical9.1	—	0.9%	Aug 1, 2026
28Monitor	CVE-2026-13157Proof of concept	Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Uploadunknown · theme demo import · CWE-434 File upload	High7.2	—	0.4%	Aug 1, 2026
28Monitor	CVE-2026-13158Proof of concept	Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Uploadunknown · everest toolkit · CWE-434 File upload	High7.2	—	0.4%	Aug 1, 2026
36Monitor	CVE-2026-13596No exploit	Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Searchunknown · participants database · CWE-89 Pre-auth SQL injection	Critical9.1	—	0.4%	Aug 1, 2026
28Monitor	CVE-2026-13725No exploit	Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjaxunknown · dynamic pricing with discount rules for woocommerce · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 1, 2026
32Monitor	CVE-2026-14309No exploit	Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypassunknown · chat on desk order notifications · CWE-287 Pre-auth Auth bypass	High8.1	—	0.3%	Aug 1, 2026
35Monitor	CVE-2026-14596No exploit	DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injectionunknown · dynamickit for elementor · CWE-287 Pre-auth Auth bypass	High8.8	—	0.4%	Aug 1, 2026
32Monitor	CVE-2026-14836No exploit	Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypassunknown · login & register forms · CWE-287 Pre-auth Auth bypass	High8.1	—	0.3%	Aug 1, 2026
30Monitor	CVE-2026-14839No exploit	Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosureunknown · mapster wp maps · CWE-200 Pre-auth Info leak	High7.5	—	0.4%	Aug 1, 2026
21Monitor	CVE-2026-14840Proof of concept	YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofingunknown · yop poll · CWE-290 Pre-auth Auth bypass	Medium5.3	—	0.3%	Aug 1, 2026
28Monitor	CVE-2026-15244No exploit	HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_viewunknown · husky · CWE-22 Path traversal	High7.2	—	1.1%	Aug 1, 2026
32Monitor	CVE-2026-15368No exploit	Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registrationunknown · user profile builder · CWE-269 Pre-auth	High8.1	—	0.3%	Aug 1, 2026
35Monitor	CVE-2026-15988No exploit	AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Matchtigroumeow · ai engine – the chatbot, ai framework & mcp for wordpress · CWE-352 Pre-auth Auth bypass CSRF	High8.8	—	0.3%	Aug 1, 2026
28Monitor	CVE-2026-15052No exploit	MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Valuesumarbajwa · mailchimp subscribe form, optin builder, popup builder, form builder · CWE-79 Pre-auth XSS	High7.2	—	0.4%	Aug 1, 2026
32Monitor	CVE-2026-15450No exploit	NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameterwebaways · nex-forms – ultimate forms plugin for wordpress · CWE-22 Path traversal	High8.1	—	0.5%	Aug 1, 2026
39Monitor	CVE-2026-15964Proof of concept	Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Changebritcoder · single sign on for tng · CWE-620 Pre-auth Auth bypass	Critical9.8	—	0.8%	Aug 1, 2026
32Monitor	CVE-2026-16144No exploit	Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameterwpchill · kali forms — contact form & drag-and-drop builder · CWE-94 pre-auth RCE	High8.1	—	1.1%	Aug 1, 2026
35Monitor	CVE-2026-16635No exploit	Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Fieldpronamic · pronamic pay · CWE-269	High8.8	—	0.5%	Aug 1, 2026
30Monitor	CVE-2026-18536No exploit	Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTPrrwo · data\ · CWE-319 Pre-auth Weak crypto	High7.5	—	0.1%	Aug 1, 2026
34Monitor	CVE-2026-67288No exploit	FreeRDP before 3.29.0 Denial of Service via smartcard cachefreerdp · freerdp · CWE-476 Pre-auth Memory safety	High8.7	—	0.4%	Aug 1, 2026
34Monitor	CVE-2026-67291No exploit	FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADDfreerdp · freerdp · CWE-125 Pre-auth Memory safety	High8.7	—	0.4%	Aug 1, 2026
37Monitor	CVE-2026-67292No exploit	FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosurefreerdp · freerdp · CWE-130 Pre-auth	Critical9.3	—	0.4%	Aug 1, 2026
37Monitor	CVE-2026-67294No exploit	FreeRDP before 3.29.0 TLS Certificate EKU Bypassfreerdp · freerdp · CWE-295 Pre-auth Weak crypto	Critical9.3	—	0.3%	Aug 1, 2026
34Monitor	CVE-2026-67296No exploit	FreeRDP before 3.29.0 Denial of Service via RDPEI PDUfreerdp · freerdp · CWE-20 Pre-auth	High8.7	—	0.5%	Aug 1, 2026
34Monitor	CVE-2026-67297No exploit	FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP responsefreerdp · freerdp · CWE-770 Pre-auth Denial of service	High8.7	—	0.5%	Aug 1, 2026
34Monitor	CVE-2026-67298No exploit	FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflowfreerdp · freerdp · CWE-191 Pre-auth Memory safety	High8.7	—	0.6%	Aug 1, 2026
34Monitor	CVE-2026-67299No exploit	FreeRDP before 3.29.0 Use-After-Free via WindowIcon async messagefreerdp · freerdp · CWE-416 Pre-auth Memory safety	High8.7	—	0.3%	Aug 1, 2026
34Monitor	CVE-2026-67300No exploit	FreeRDP before 3.29.0 Use-After-Free via async message proxyfreerdp · freerdp · CWE-416 Pre-auth Memory safety	High8.7	—	0.5%	Aug 1, 2026
34Monitor	CVE-2026-67301No exploit	FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxyfreerdp · freerdp · CWE-125 Pre-auth Memory safety	High8.7	—	0.6%	Aug 1, 2026
34Monitor	CVE-2026-67304No exploit	FreeRDP before 3.29.0 NULL Dereference via smartcard cleanupfreerdp · freerdp · CWE-476 Pre-auth Memory safety	High8.7	—	0.6%	Aug 1, 2026
37Monitor	CVE-2026-67305No exploit	FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdrfreerdp · freerdp · CWE-122 pre-auth RCE Memory safety	Critical9.4	—	0.7%	Aug 1, 2026
28Monitor	CVE-2026-67307No exploit	Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Syncwazuh · wazuh · CWE-345	High7.0	—	0.2%	Aug 1, 2026
37Monitor	CVE-2026-67308No exploit	Wazuh GitHub Actions Shell Injection via Fork Pull Requestwazuh · wazuh · CWE-78 pre-auth RCE Command injection	Critical9.3	—	0.7%	Aug 1, 2026
32Monitor	CVE-2026-67311No exploit	Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirectbudibase · budibase · CWE-918 SSRF	High8.2	—	0.4%	Aug 1, 2026
33Monitor	CVE-2026-67320No exploit	axios before 0.33.0 Prototype Pollution via Node HTTP adapteraxios · axios · CWE-200 Pre-auth Prototype pollution Info leak	High8.3	—	0.5%	Aug 1, 2026
34Monitor	CVE-2026-67322No exploit	GitPython before 3.1.52 Environment Variable Exfiltration via clone_fromgitpython project · gitpython · CWE-200 Pre-auth Info leak	High8.7	—	0.3%	Aug 1, 2026
34Monitor	CVE-2026-67323No exploit	GitPython before 3.1.51 Command Injection via unguarded Git optionsgitpython project · gitpython · CWE-77 RCE Command injection	High8.6	—	1.2%	Aug 1, 2026
37Monitor	CVE-2026-67324No exploit	GitPython 3.1.50 Authentication Bypass via Joined Short Optionsgitpython project · gitpython · CWE-78 pre-auth RCE Auth bypass Command injection	Critical9.3	—	0.6%	Aug 1, 2026
35Monitor	CVE-2026-67325No exploit	GitPython before 3.1.51 Command Injection via option prefix abbreviationgitpython project · gitpython · CWE-78 RCE Command injection	High8.7	—	2.2%	Aug 1, 2026
29Monitor	CVE-2026-67326No exploit	GitPython before 3.1.50 Newline Injection via config_writer sectiongitpython project · gitpython · CWE-20 RCE	High7.3	—	0.2%	Aug 1, 2026
34Monitor	CVE-2026-67327No exploit	better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTPbetter-auth · better-auth · CWE-287 Pre-auth Auth bypass	High8.7	—	0.4%	Aug 1, 2026
37Monitor	CVE-2026-67336No exploit	better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProviderbetter-auth · better-auth · CWE-327 Pre-auth Weak crypto	Critical9.4	—	0.2%	Aug 1, 2026
28Monitor	CVE-2026-67337No exploit	better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCachebetter-auth · better-auth · CWE-288 Auth bypass	High7.1	—	0.4%	Aug 1, 2026
34Monitor	CVE-2026-67340Proof of concept	ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scriptsarcadedata · arcadedb · CWE-94 RCE	High8.6	—	0.9%	Aug 1, 2026
37Monitor	CVE-2026-67341No exploit	ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTIONarcadedata · arcadedb · CWE-863 pre-auth RCE Broken access control (IDOR)	Critical9.3	—	0.5%	Aug 1, 2026
37Monitor	CVE-2026-67342No exploit	ArcadeDB before 26.7.2 Authorization Bypass via Database Handlersarcadedata · arcadedb · CWE-639 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.5%	Aug 1, 2026
34Monitor	CVE-2026-67343No exploit	ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/serverarcadedata · arcadedb · CWE-200 Info leak	High8.7	—	0.5%	Aug 1, 2026
34Monitor	CVE-2026-67344No exploit	ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPEarcadedata · arcadedb · CWE-862 Auth bypass Broken access control (IDOR)	High8.5	—	0.2%	Aug 1, 2026
30Monitor	RUSTSEC-2026-0224No exploit	Verification cache poisoning allows forged Nostr events to bypass signature validationcrates.io · nostr-relay-pool Pre-auth	High7.5	—	—	Aug 1, 2026
30Monitor	RUSTSEC-2026-0226No exploit	Wallet event parsers accept unauthenticated eventscrates.io · nostr Pre-auth	High7.5	—	—	Aug 1, 2026
30Monitor	RUSTSEC-2026-0227No exploit	NIP-44 v2 decryption permits resource exhaustioncrates.io · nostr Pre-auth Denial of service	High7.5	—	—	Aug 1, 2026
30Monitor	RUSTSEC-2026-0229No exploit	NIP-98 authorization parsing permits resource exhaustioncrates.io · nostr Pre-auth Denial of service	High7.5	—	—	Aug 1, 2026
30Monitor	RUSTSEC-2026-0230No exploit	Empty NIP-50 search filters can paniccrates.io · nostr Pre-auth Denial of service	High7.5	—	—	Aug 1, 2026
30Monitor	RUSTSEC-2026-0231No exploit	Relay authentication challenges can exhaust memorycrates.io · nostr-relay-pool Pre-auth Denial of service	High7.5	—	—	Aug 1, 2026
30Monitor	RUSTSEC-2026-0232No exploit	Processing of unverified relay eventscrates.io · nostr-relay-pool Pre-auth	High7.5	—	—	Aug 1, 2026
28Monitor	CVE-2025-71403No exploit	better-auth before 1.1.20 Open Redirect via trustedOrigins Bypassbetter-auth · better-auth · CWE-601 Pre-auth Open redirect	High7.1	—	0.3%	Aug 1, 2026
37Monitor	CVE-2026-66402No exploit	FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypassfreerdp · freerdp · CWE-295 Pre-auth Weak crypto	Critical9.3	—	0.5%	Aug 1, 2026
37Monitor	CVE-2026-67289No exploit	FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirectionfreerdp · freerdp · CWE-113 Pre-auth	Critical9.3	—	0.4%	Aug 1, 2026
34Monitor	CVE-2026-67290No exploit	FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMFfreerdp · freerdp · CWE-125 Pre-auth Memory safety	High8.7	—	0.6%	Aug 1, 2026
37Monitor	CVE-2026-67293No exploit	FreeRDP before 3.29.0 Improper Certificate Hostname Validationfreerdp · freerdp · CWE-295 Pre-auth Weak crypto	Critical9.3	—	0.2%	Aug 1, 2026
31Monitor	CVE-2026-67309No exploit	Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypasstraefik · traefik · CWE-22 Pre-auth Auth bypass Path traversal	High7.8	—	0.6%	Aug 1, 2026
34Monitor	CVE-2026-67328No exploit	@better-auth/sso before 1.6.21 Account Takeover via SSObetter-auth · sso · CWE-79 Auth bypass XSS	High8.6	—	0.4%	Aug 1, 2026
28Monitor	CVE-2026-67329No exploit	@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscriptionbetter-auth · stripe · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Aug 1, 2026
37Monitor	CVE-2026-67330No exploit	better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collisionbetter-auth · scim · CWE-20	Critical9.4	—	0.5%	Aug 1, 2026
34Monitor	CVE-2026-67331No exploit	better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypassbetter-auth · scim · CWE-639 Broken access control (IDOR)	High8.7	—	0.3%	Aug 1, 2026
32Monitor	CVE-2026-67354No exploit	guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Refererguzzle · guzzle · CWE-201 Pre-auth	High8.2	—	0.3%	Aug 1, 2026
32Monitor	CVE-2026-67355No exploit	guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scopeguzzle · guzzle · CWE-201 Pre-auth	High8.2	—	0.3%	Aug 1, 2026
32Monitor	CVE-2026-55735No exploit	Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocationueberauth · guardian · CWE-347 Pre-auth Weak crypto	High8.2	—	0.4%	Aug 1, 2026
30Monitor	GHSA-39j5-w47m-2gmvNo exploit	Duplicate Advisory: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`npm · axios · CWE-770 Pre-auth Denial of service	High7.5	—	—	Aug 1, 2026
30Monitor	GHSA-6hqm-hm2v-3p2pNo exploit	Duplicate Advisory: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axiosnpm · axios · CWE-183 Pre-auth	High7.5	—	—	Aug 1, 2026
32Monitor	GHSA-7qf5-7ppr-87v8No exploit	Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication BypassGo · github.com/traefik/traefik/v3 · CWE-22 Pre-auth Auth bypass Path traversal	High8.0	—	—	Aug 1, 2026
30Monitor	GHSA-fq2j-3j99-rx65No exploit	Duplicate Advisory: Axios: Excessive recursion in formDataToJSON can cause denial of servicenpm · axios · CWE-400 Pre-auth Denial of service	High7.5	—	—	Aug 1, 2026
30Monitor	GHSA-3mcp-22mf-vrw3No exploit	Duplicate Advisory: Axios form serializer maxDepth bypass via {} metatokennpm · axios · CWE-674 Pre-auth Denial of service	High7.5	—	—	Aug 1, 2026
33Monitor	GHSA-4vpg-pfj8-m33qNo exploit	Duplicate Advisory: GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrPyPI · gitpython · CWE-77 RCE Command injection	High8.4	—	—	Aug 1, 2026
30Monitor	GHSA-68jp-44vc-2x5hNo exploit	Duplicate Advisory: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloningnpm · axios · CWE-200 Pre-auth Info leak	High7.5	—	—	Aug 1, 2026
35Monitor	GHSA-6r2r-ww24-7h52No exploit	Duplicate Advisory: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklistPyPI · gitpython · CWE-78 RCE Command injection	High8.8	—	—	Aug 1, 2026
39Monitor	GHSA-cw2r-r7mw-j3hcNo exploit	Duplicate Advisory: GitPython unsafe clone option gate bypass through joined short optionsPyPI · gitpython · CWE-78 pre-auth RCE Command injection	Critical9.8	—	—	Aug 1, 2026
30Monitor	GHSA-m4f3-g4cq-hqrxNo exploit	Duplicate Advisory: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URLPyPI · gitpython · CWE-200 Pre-auth Info leak	High7.5	—	—	Aug 1, 2026
64This week	CVE-2026-18556Weaponized	Unauthenticated administrative account takeovern-able · n-central · CWE-288 Pre-auth Auth bypass	High8.2	KEV	7.8%	Aug 1, 2026
30Monitor	CVE-2026-13339No exploit	CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parametercubewp1211 · cubewp framework · CWE-22 Pre-auth Path traversal	High7.5	—	0.9%	Aug 1, 2026
30Monitor	CVE-2026-18352No exploit	User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parametergm_alex · user access manager · CWE-22 Pre-auth Path traversal	High7.5	—	1.0%	Aug 1, 2026
39Monitor	CVE-2026-8457No exploit	WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWTwpweb · woocommerce - social login · CWE-289 Pre-auth Auth bypass	Critical9.8	—	0.7%	Aug 1, 2026
26Monitor	CVE-2026-9335Proof of concept	Improper Handling of HDF5 ExternalLinks in keras-team/keraskeras-team · keras-team/keras · CWE-22 Pre-auth Path traversal	Medium6.5	—	0.7%	Aug 2, 2026
32Monitor	CVE-2026-12586No exploit	Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Resetunknown · lenxel wp · CWE-287 Pre-auth Auth bypass CSRF	High8.1	—	0.2%	Aug 2, 2026
32Monitor	CVE-2026-14920No exploit	AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameterunknown · acymailing · CWE-89 Pre-auth SQL injection	High8.2	—	0.3%	Aug 2, 2026
30Monitor	CVE-2026-15151No exploit	Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notificationsunknown · five star restaurant reservations · CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 2, 2026
30Monitor	CVE-2026-15206No exploit	SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobileunknown · sms alert · CWE-287 Pre-auth Auth bypass	High7.5	—	0.4%	Aug 2, 2026
30Monitor	CVE-2026-15236No exploit	Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosureunknown · gallery for google photos · CWE-200 Pre-auth Info leak	High7.5	—	0.4%	Aug 2, 2026
30Monitor	CVE-2026-15241No exploit	ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_responseunknown · ai chatbot for woocommerce · CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 2, 2026
39Monitor	CVE-2026-16256No exploit	Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalationunknown · pouco import users · CWE-269 Pre-auth	Critical9.8	—	0.4%	Aug 2, 2026
30Monitor	CVE-2026-16261No exploit	Huge IT Login <= 1.0.4 - Unauthenticated Account Takeoverunknown · login-social · CWE-287 Pre-auth Auth bypass Denial of service	High7.5	—	0.5%	Aug 2, 2026
30Monitor	CVE-2026-16285No exploit	WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Downloadunknown · product attachment for woocommerce · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 2, 2026
30Monitor	CVE-2026-16540Proof of concept	Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpointunknown · simply schedule appointments · CWE-863 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 2, 2026
28Monitor	CVE-2026-18571No exploit	Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creationredhat · build of keycloak · CWE-862 Broken access control (IDOR)	High7.2	—	0.5%	Aug 2, 2026
34Monitor	CVE-2026-67356No exploit	ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Triggerarcadedata · arcadedb · CWE-269	High8.7	—	0.4%	Aug 2, 2026
30Monitor	CVE-2026-67357No exploit	ArcadeDB before 26.7.3 Information Disclosure via get_server_settingsarcadedata · arcadedb · CWE-200 Info leak	High7.7	—	0.4%	Aug 2, 2026
30Monitor	CVE-2026-68578No exploit	ArcadeDB before 26.7.3 Authentication Bypass via MCP Transportarcadedata · arcadedb · CWE-306 RCE Auth bypass	High7.7	—	0.3%	Aug 2, 2026
34Monitor	CVE-2026-68581No exploit	Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collisiongo-vikunja · vikunja · CWE-863 Auth bypass Broken access control (IDOR)	High8.6	—	0.4%	Aug 2, 2026
37Monitor	CVE-2026-68582Proof of concept	Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Tokengo-vikunja · vikunja · CWE-639 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.2%	Aug 2, 2026
37Monitor	CVE-2026-65321Proof of concept	PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTASlaughingman7743 · pyathena · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.7%	Aug 2, 2026

CVE-2026-3141
36Monitor
FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
- Broken access control (IDOR)
wpwax · formgent – next-gen ai form builder for wordpress with multi-step, quizzes, payments & moreAug 1, 2026
CVE-2026-13157
28Monitor
Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload
HighCVSS 7.2Proof of conceptEPSS 0%
- File upload
unknown · theme demo importAug 1, 2026
CVE-2026-13158
28Monitor
Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload
HighCVSS 7.2Proof of conceptEPSS 0%
- File upload
unknown · everest toolkitAug 1, 2026
CVE-2026-13596
36Monitor
Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · participants databaseAug 1, 2026
CVE-2026-13725
28Monitor
Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unknown · dynamic pricing with discount rules for woocommerceAug 1, 2026
CVE-2026-14309
32Monitor
Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · chat on desk order notificationsAug 1, 2026
CVE-2026-14596
35Monitor
DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · dynamickit for elementorAug 1, 2026
CVE-2026-14836
32Monitor
Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypass
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · login & register formsAug 1, 2026
CVE-2026-14839
30Monitor
Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
unknown · mapster wp mapsAug 1, 2026
CVE-2026-14840
21Monitor
YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
unknown · yop pollAug 1, 2026
CVE-2026-15244
28Monitor
HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view
HighCVSS 7.2No exploitEPSS 1%
- Path traversal
unknown · huskyAug 1, 2026
CVE-2026-15368
32Monitor
Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
unknown · user profile builderAug 1, 2026
CVE-2026-15988
35Monitor
AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- CSRF
tigroumeow · ai engine – the chatbot, ai framework & mcp for wordpressAug 1, 2026
CVE-2026-15052
28Monitor
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
umarbajwa · mailchimp subscribe form, optin builder, popup builder, form builderAug 1, 2026
CVE-2026-15450
32Monitor
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
HighCVSS 8.1No exploitEPSS 0%
- Path traversal
webaways · nex-forms – ultimate forms plugin for wordpressAug 1, 2026
CVE-2026-15964
39Monitor
Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
britcoder · single sign on for tngAug 1, 2026
CVE-2026-16144
32Monitor
Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
HighCVSS 8.1No exploitEPSS 1%
- pre-auth RCE
wpchill · kali forms — contact form & drag-and-drop builderAug 1, 2026
CVE-2026-16635
35Monitor
Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
HighCVSS 8.8No exploitEPSS 0%
pronamic · pronamic payAug 1, 2026
CVE-2026-18536
30Monitor
Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
rrwo · data\Aug 1, 2026
CVE-2026-67288
34Monitor
FreeRDP before 3.29.0 Denial of Service via smartcard cache
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpAug 1, 2026
CVE-2026-67291
34Monitor
FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpAug 1, 2026
CVE-2026-67292
37Monitor
FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
freerdp · freerdpAug 1, 2026
CVE-2026-67294
37Monitor
FreeRDP before 3.29.0 TLS Certificate EKU Bypass
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
freerdp · freerdpAug 1, 2026
CVE-2026-67296
34Monitor
FreeRDP before 3.29.0 Denial of Service via RDPEI PDU
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
freerdp · freerdpAug 1, 2026
CVE-2026-67297
34Monitor
FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
freerdp · freerdpAug 1, 2026
CVE-2026-67298
34Monitor
FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpAug 1, 2026
CVE-2026-67299
34Monitor
FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpAug 1, 2026
CVE-2026-67300
34Monitor
FreeRDP before 3.29.0 Use-After-Free via async message proxy
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpAug 1, 2026
CVE-2026-67301
34Monitor
FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpAug 1, 2026
CVE-2026-67304
34Monitor
FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpAug 1, 2026
CVE-2026-67305
37Monitor
FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
CriticalCVSS 9.4No exploitEPSS 0%
- pre-auth RCE
- Memory safety
freerdp · freerdpAug 1, 2026
CVE-2026-67307
28Monitor
Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync
HighCVSS 7.0No exploitEPSS 0%
wazuh · wazuhAug 1, 2026
CVE-2026-67308
37Monitor
Wazuh GitHub Actions Shell Injection via Fork Pull Request
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Command injection
wazuh · wazuhAug 1, 2026
CVE-2026-67311
32Monitor
Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect
HighCVSS 8.2No exploitEPSS 0%
- SSRF
budibase · budibaseAug 1, 2026
CVE-2026-67320
33Monitor
axios before 0.33.0 Prototype Pollution via Node HTTP adapter
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Prototype pollution
- Info leak
axios · axiosAug 1, 2026
CVE-2026-67322
34Monitor
GitPython before 3.1.52 Environment Variable Exfiltration via clone_from
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Info leak
gitpython project · gitpythonAug 1, 2026
CVE-2026-67323
34Monitor
GitPython before 3.1.51 Command Injection via unguarded Git options
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
gitpython project · gitpythonAug 1, 2026
CVE-2026-67324
37Monitor
GitPython 3.1.50 Authentication Bypass via Joined Short Options
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
- Command injection
gitpython project · gitpythonAug 1, 2026
CVE-2026-67325
35Monitor
GitPython before 3.1.51 Command Injection via option prefix abbreviation
HighCVSS 8.7No exploitEPSS 2%
- RCE
- Command injection
gitpython project · gitpythonAug 1, 2026
CVE-2026-67326
29Monitor
GitPython before 3.1.50 Newline Injection via config_writer section
HighCVSS 7.3No exploitEPSS 0%
- RCE
gitpython project · gitpythonAug 1, 2026
CVE-2026-67327
34Monitor
better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
better-auth · better-authAug 1, 2026
CVE-2026-67336
37Monitor
better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
better-auth · better-authAug 1, 2026
CVE-2026-67337
28Monitor
better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache
HighCVSS 7.1No exploitEPSS 0%
- Auth bypass
better-auth · better-authAug 1, 2026
CVE-2026-67340
34Monitor
ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts
HighCVSS 8.6Proof of conceptEPSS 0%
- RCE
arcadedata · arcadedbAug 1, 2026
CVE-2026-67341
37Monitor
ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
arcadedata · arcadedbAug 1, 2026
CVE-2026-67342
37Monitor
ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
arcadedata · arcadedbAug 1, 2026
CVE-2026-67343
34Monitor
ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server
HighCVSS 8.7No exploitEPSS 0%
- Info leak
arcadedata · arcadedbAug 1, 2026
CVE-2026-67344
34Monitor
ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE
HighCVSS 8.5No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
arcadedata · arcadedbAug 1, 2026
RUSTSEC-2026-0224
30Monitor
Verification cache poisoning allows forged Nostr events to bypass signature validation
HighCVSS 7.5No exploit
- Pre-auth
crates.io · nostr-relay-poolAug 1, 2026
RUSTSEC-2026-0226
30Monitor
Wallet event parsers accept unauthenticated events
HighCVSS 7.5No exploit
- Pre-auth
crates.io · nostrAug 1, 2026
RUSTSEC-2026-0227
30Monitor
NIP-44 v2 decryption permits resource exhaustion
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
crates.io · nostrAug 1, 2026
RUSTSEC-2026-0229
30Monitor
NIP-98 authorization parsing permits resource exhaustion
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
crates.io · nostrAug 1, 2026
RUSTSEC-2026-0230
30Monitor
Empty NIP-50 search filters can panic
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
crates.io · nostrAug 1, 2026
RUSTSEC-2026-0231
30Monitor
Relay authentication challenges can exhaust memory
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
crates.io · nostr-relay-poolAug 1, 2026
RUSTSEC-2026-0232
30Monitor
Processing of unverified relay events
HighCVSS 7.5No exploit
- Pre-auth
crates.io · nostr-relay-poolAug 1, 2026
CVE-2025-71403
28Monitor
better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Open redirect
better-auth · better-authAug 1, 2026
CVE-2026-66402
37Monitor
FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
freerdp · freerdpAug 1, 2026
CVE-2026-67289
37Monitor
FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
freerdp · freerdpAug 1, 2026
CVE-2026-67290
34Monitor
FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpAug 1, 2026
CVE-2026-67293
37Monitor
FreeRDP before 3.29.0 Improper Certificate Hostname Validation
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
freerdp · freerdpAug 1, 2026
CVE-2026-67309
31Monitor
Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass
HighCVSS 7.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Path traversal
traefik · traefikAug 1, 2026
CVE-2026-67328
34Monitor
@better-auth/sso before 1.6.21 Account Takeover via SSO
HighCVSS 8.6No exploitEPSS 0%
- Auth bypass
- XSS
better-auth · ssoAug 1, 2026
CVE-2026-67329
28Monitor
@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
better-auth · stripeAug 1, 2026
CVE-2026-67330
37Monitor
better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision
CriticalCVSS 9.4No exploitEPSS 0%
better-auth · scimAug 1, 2026
CVE-2026-67331
34Monitor
better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
better-auth · scimAug 1, 2026
CVE-2026-67354
32Monitor
guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
guzzle · guzzleAug 1, 2026
CVE-2026-67355
32Monitor
guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
guzzle · guzzleAug 1, 2026
CVE-2026-55735
32Monitor
Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Weak crypto
ueberauth · guardianAug 1, 2026
GHSA-39j5-w47m-2gmv
30Monitor
Duplicate Advisory: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
npm · axiosAug 1, 2026
GHSA-6hqm-hm2v-3p2p
30Monitor
Duplicate Advisory: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
HighCVSS 7.5No exploit
- Pre-auth
npm · axiosAug 1, 2026
GHSA-7qf5-7ppr-87v8
32Monitor
Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass
HighCVSS 8.0No exploit
- Pre-auth
- Auth bypass
- Path traversal
Go · github.com/traefik/traefik/v3Aug 1, 2026
GHSA-fq2j-3j99-rx65
30Monitor
Duplicate Advisory: Axios: Excessive recursion in formDataToJSON can cause denial of service
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
npm · axiosAug 1, 2026
GHSA-3mcp-22mf-vrw3
30Monitor
Duplicate Advisory: Axios form serializer maxDepth bypass via {} metatoken
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
npm · axiosAug 1, 2026
GHSA-4vpg-pfj8-m33q
33Monitor
Duplicate Advisory: GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwr
HighCVSS 8.4No exploit
- RCE
- Command injection
PyPI · gitpythonAug 1, 2026
GHSA-68jp-44vc-2x5h
30Monitor
Duplicate Advisory: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
HighCVSS 7.5No exploit
- Pre-auth
- Info leak
npm · axiosAug 1, 2026
GHSA-6r2r-ww24-7h52
35Monitor
Duplicate Advisory: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
HighCVSS 8.8No exploit
- RCE
- Command injection
PyPI · gitpythonAug 1, 2026
GHSA-cw2r-r7mw-j3hc
39Monitor
Duplicate Advisory: GitPython unsafe clone option gate bypass through joined short options
CriticalCVSS 9.8No exploit
- pre-auth RCE
- Command injection
PyPI · gitpythonAug 1, 2026
GHSA-m4f3-g4cq-hqrx
30Monitor
Duplicate Advisory: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
HighCVSS 7.5No exploit
- Pre-auth
- Info leak
PyPI · gitpythonAug 1, 2026
CVE-2026-18556
64This week
Unauthenticated administrative account takeover
HighCVSS 8.2KEVWeaponizedEPSS 7%
- Pre-auth
- Auth bypass
n-able · n-centralAug 1, 2026
CVE-2026-13339
30Monitor
CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
cubewp1211 · cubewp frameworkAug 1, 2026
CVE-2026-18352
30Monitor
User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Path traversal
gm_alex · user access managerAug 1, 2026
CVE-2026-8457
39Monitor
WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
wpweb · woocommerce - social loginAug 1, 2026
CVE-2026-9335
26Monitor
Improper Handling of HDF5 ExternalLinks in keras-team/keras
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
keras-team · keras-team/kerasAug 2, 2026
CVE-2026-12586
32Monitor
Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- CSRF
unknown · lenxel wpAug 2, 2026
CVE-2026-14920
32Monitor
AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · acymailingAug 2, 2026
CVE-2026-15151
30Monitor
Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · five star restaurant reservationsAug 2, 2026
CVE-2026-15206
30Monitor
SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · sms alertAug 2, 2026
CVE-2026-15236
30Monitor
Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
unknown · gallery for google photosAug 2, 2026
CVE-2026-15241
30Monitor
ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · ai chatbot for woocommerceAug 2, 2026
CVE-2026-16256
39Monitor
Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
unknown · pouco import usersAug 2, 2026
CVE-2026-16261
30Monitor
Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Denial of service
unknown · login-socialAug 2, 2026
CVE-2026-16285
30Monitor
WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · product attachment for woocommerceAug 2, 2026
CVE-2026-16540
30Monitor
Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · simply schedule appointmentsAug 2, 2026
CVE-2026-18571
28Monitor
Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
redhat · build of keycloakAug 2, 2026
CVE-2026-67356
34Monitor
ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger
HighCVSS 8.7No exploitEPSS 0%
arcadedata · arcadedbAug 2, 2026
CVE-2026-67357
30Monitor
ArcadeDB before 26.7.3 Information Disclosure via get_server_settings
HighCVSS 7.7No exploitEPSS 0%
- Info leak
arcadedata · arcadedbAug 2, 2026
CVE-2026-68578
30Monitor
ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport
HighCVSS 7.7No exploitEPSS 0%
- RCE
- Auth bypass
arcadedata · arcadedbAug 2, 2026
CVE-2026-68581
34Monitor
Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision
HighCVSS 8.6No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
go-vikunja · vikunjaAug 2, 2026
CVE-2026-68582
37Monitor
Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
go-vikunja · vikunjaAug 2, 2026
CVE-2026-65321
37Monitor
PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
laughingman7743 · pyathenaAug 2, 2026