Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2026

5,282 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 18 of 53

  • CVE-2026-28571
    30Monitor

    WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    wppool · formychatAug 18, 2026

  • CVE-2026-32333
    28Monitor

    WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    teconcetheme · mayosis coreAug 18, 2026

  • CVE-2026-32444
    39Monitor

    WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    cwicly · cwiclyAug 18, 2026

  • CVE-2026-32463
    39Monitor

    WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    kamlesh parmar · sync post with other siteAug 18, 2026

  • CVE-2026-32464
    32Monitor

    WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    vladimir prelovac · theme test driveAug 18, 2026

  • CVE-2026-32465
    35Monitor

    WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    g5theme · essential real estateAug 18, 2026

  • CVE-2026-32466
    34Monitor

    WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    wpexperts · gravity forms bookings premiumAug 18, 2026

  • CVE-2026-32468
    30Monitor

    WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    rayhanduitku · duitku payment gatewayAug 18, 2026

  • CVE-2026-50575
    30Monitor

    BetterDesk has a replay behavior vulnerability when devices are deleted

    HighCVSS 7.7No exploitEPSS 0%

    unitronix · betterdeskAug 18, 2026

  • CVE-2021-43716
    39Monitor

    Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    Aug 18, 2026

  • CVE-2021-43717
    39Monitor

    An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    Aug 18, 2026

  • CVE-2026-32657
    29Monitor

    Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax Version

    HighCVSS 7.3No exploitEPSS 0%

    dell · appsyncAug 18, 2026

  • CVE-2026-44472
    32Monitor

    Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge

    HighCVSS 8.1No exploitEPSS 0%

    saleor · saleorAug 18, 2026

  • CVE-2026-52608
    39Monitor

    An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the

    CriticalCVSS 9.8No exploitEPSS 0%

    Aug 18, 2026

  • CVE-2026-52610
    36Monitor

    An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files any

    CriticalCVSS 9.1No exploitEPSS 1%

    Aug 18, 2026

  • CVE-2026-67262
    32Monitor

    Dell PowerStore contains a Missing Authorization vulnerability.

    HighCVSS 8.1No exploitEPSS 0%

    dell · powerstore 500tAug 18, 2026

  • CVE-2026-67846
    31Monitor

    Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment iss

    HighCVSS 7.8No exploitEPSS 0%

    Aug 18, 2026

  • CVE-2026-67921
    37Monitor

    Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    Aug 18, 2026

  • CVE-2026-71551
    31Monitor

    Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist

    HighCVSS 7.8No exploitEPSS 0%

    super-productivity · super-productivityAug 18, 2026

  • CVE-2021-43718
    21Monitor

    An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Den

    MediumCVSS 5.3Proof of conceptEPSS 0%

    Aug 18, 2026

  • CVE-2026-17106
    28Monitor

    Tar extraction in moby/go-archive can write outside the destination directory via link following

    HighCVSS 7.1Proof of conceptEPSS 0%

    moby · go-archiveAug 18, 2026

  • CVE-2026-24184
    35Monitor

    NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where an unauthenticated attacke

    HighCVSS 8.8No exploitEPSS 0%

    nvidia · cumulus linuxAug 18, 2026

  • CVE-2026-18534
    29Monitor

    Address bar spoofing risk in affected iOS versions of Arc Search

    HighCVSS 7.4No exploitEPSS 0%

    the browser company of new york · arcsearchAug 18, 2026

  • CVE-2026-32470
    39Monitor

    WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    roxnor · fundengineAug 18, 2026

  • CVE-2026-32472
    30Monitor

    WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    wbolt.com · online contact widgetAug 18, 2026

  • CVE-2026-32473
    28Monitor

    WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    deknows · pdf smart viewer for elementorAug 18, 2026

  • CVE-2026-32474
    39Monitor

    WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    wpwax · templatiqAug 18, 2026

  • CVE-2026-32547
    28Monitor

    WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wordplus · bp better messagesAug 18, 2026

  • CVE-2026-32549
    30Monitor

    WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    codexpert, inc · thumbpressAug 18, 2026

  • CVE-2026-32553
    28Monitor

    WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    brainstorm force · ottokitAug 18, 2026

  • CVE-2026-45733
    33Monitor

    Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app

    HighCVSS 8.3No exploitEPSS 0%

    triliumnext · triliumAug 18, 2026

  • CVE-2026-48798
    28Monitor

    SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

    HighCVSS 7.1No exploitEPSS 0%

    sshnet · ssh.netAug 18, 2026

  • CVE-2026-50138
    32Monitor

    goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

    HighCVSS 8.1No exploitEPSS 0%

    patrickhener · goshsAug 18, 2026

  • CVE-2026-56684
    30Monitor

    Valkey: TLS pending-data processing use-after-free may allow remote code execution

    HighCVSS 7.5No exploitEPSS 0%

    valkey-io · valkeyAug 18, 2026

  • CVE-2026-59940
    39Monitor

    Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

    CriticalCVSS 9.8No exploitEPSS 0%

    lxsmnsyc · serovalAug 18, 2026

  • CVE-2026-61407
    35Monitor

    Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability.

    HighCVSS 8.8No exploitEPSS 0%

    dell · watchdog timer driverAug 18, 2026

  • CVE-2026-63639
    35Monitor

    Valkey: UAF in stream deserialization may lead to remote code execution

    HighCVSS 8.8No exploitEPSS 0%

    valkey-io · valkeyAug 18, 2026

  • CVE-2026-66046
    34Monitor

    Expat Denial of Service via storeAtts() Quadratic Complexity

    HighCVSS 8.7No exploitEPSS 0%

    libexpat project · libexpatAug 18, 2026

  • CVE-2026-66620
    28Monitor

    WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    derek herman · optiontreeAug 18, 2026

  • CVE-2026-66621
    28Monitor

    WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    mapsteps ug · ultimate dashboard proAug 18, 2026

  • CVE-2026-66622
    30Monitor

    WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    averta · depicter sliderAug 18, 2026

  • CVE-2026-66627
    39Monitor

    WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    edge22 studios ltd. · gp premiumAug 18, 2026

  • CVE-2026-66629
    28Monitor

    WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    themeum · kirkiAug 18, 2026

  • CVE-2026-66633
    28Monitor

    WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wpmanageninja · fluent forms pro add on packAug 18, 2026

  • CVE-2026-66635
    29Monitor

    WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability

    HighCVSS 7.4No exploitEPSS 0%

    10web · slider by 10webAug 18, 2026

  • CVE-2026-55166
    39Monitor

    Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR

    CriticalCVSS 9.9No exploitEPSS 0%

    netflix · lemurAug 18, 2026

  • CVE-2026-66667
    28Monitor

    WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wpdeveloper · templatelyAug 18, 2026

  • CVE-2026-68567
    28Monitor

    WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wp grids · convert proAug 18, 2026

  • CVE-2026-71539
    35Monitor

    n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

    HighCVSS 8.9No exploitEPSS 0%

    n8n-io · n8nAug 18, 2026

  • CVE-2026-73181
    30Monitor

    WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    themecomplete · extra product options & add-ons for woocommerceAug 18, 2026

  • CVE-2026-73187
    37Monitor

    WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    gingerplugins · sticky chat widgetAug 18, 2026

  • CVE-2026-73190
    28Monitor

    WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    shahjada · wpdm – premium packagesAug 18, 2026

  • CVE-2026-73338
    28Monitor

    WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    autopay · autopayAug 18, 2026

  • CVE-2026-73339
    37Monitor

    WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    webnus inc. · modern events calendarAug 18, 2026

  • CVE-2026-73341
    39Monitor

    WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    metagauss · registrationmagicAug 18, 2026

  • CVE-2026-73342
    28Monitor

    WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    magazine3 · wp multilangAug 18, 2026

  • CVE-2026-73343
    40Plan

    WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 10.0No exploitEPSS 0%

    aresit · wp compressAug 18, 2026

  • CVE-2026-73345
    28Monitor

    WordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    saad iqbal · license manager for woocommerceAug 18, 2026

  • CVE-2026-73350
    32Monitor

    WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability

    HighCVSS 8.2No exploitEPSS 0%

    psm plugins · supportcandyAug 18, 2026

  • CVE-2026-73351
    28Monitor

    WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    miniorange · wordpress social login and registerAug 18, 2026

  • CVE-2026-73355
    37Monitor

    WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    wp.insider · affiliates managerAug 18, 2026

  • CVE-2026-73356
    32Monitor

    WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability

    HighCVSS 8.2No exploitEPSS 0%

    cloudways · breezeAug 18, 2026

  • CVE-2026-73358
    28Monitor

    WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wp.insider · affiliates managerAug 18, 2026

  • CVE-2026-73360
    28Monitor

    WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    premio · chaty proAug 18, 2026

  • CVE-2026-73361
    28Monitor

    WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wpzoom · recipe card blocks for gutenberg & elementorAug 18, 2026

  • CVE-2026-73362
    28Monitor

    WordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    kaizencoders · url shortifyAug 18, 2026

  • CVE-2026-73365
    37Monitor

    WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    crocoblock. jetimpex inc. · jetappointmentAug 18, 2026

  • CVE-2026-73366
    39Monitor

    WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    supsystic · easy google mapsAug 18, 2026

  • CVE-2026-73367
    28Monitor

    WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    supsystic · easy google mapsAug 18, 2026

  • CVE-2026-73375
    28Monitor

    WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    supsystic · ultimate maps by supsysticAug 18, 2026

  • CVE-2026-73376
    39Monitor

    WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    supsystic · ultimate maps by supsysticAug 18, 2026

  • CVE-2026-73377
    30Monitor

    WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    supsystic · ultimate maps by supsysticAug 18, 2026

  • CVE-2026-73378
    28Monitor

    WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    supsystic · contact form by supsysticAug 18, 2026

  • CVE-2026-73380
    39Monitor

    WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    supsystic · popup by supsysticAug 18, 2026

  • CVE-2026-73381
    36Monitor

    WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability

    CriticalCVSS 9.1No exploitEPSS 0%

    supsystic · popup by supsysticAug 18, 2026

  • CVE-2026-73382
    28Monitor

    WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    gemini labs · site reviewsAug 18, 2026

  • CVE-2026-73393
    28Monitor

    WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wedevs · subscribe2Aug 18, 2026

  • CVE-2026-73396
    28Monitor

    WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    makewebbetter · mwb hubspot for woocommerceAug 18, 2026

  • CVE-2026-73397
    39Monitor

    WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    youzify · youzifyAug 18, 2026

  • CVE-2026-73400
    32Monitor

    WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    jetmonsters · restaurant menu by motopressAug 18, 2026

  • CVE-2026-73994
    30Monitor

    WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    syed balkhi · charitableAug 18, 2026

  • CVE-2026-73996
    39Monitor

    WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    masteriyo · masteriyo - lmsAug 18, 2026

  • CVE-2026-73997
    30Monitor

    WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    nexcess · starter templates by kadence wpAug 18, 2026

  • CVE-2026-74012
    35Monitor

    WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    taxopress · taxopressAug 18, 2026

  • CVE-2026-74015
    37Monitor

    WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    merkulove · readablerAug 18, 2026

  • CVE-2026-75784
    37Monitor

    TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflow

    CriticalCVSS 9.3No exploitEPSS 1%

    trendnet · tew-wlc100Aug 18, 2026

  • CVE-2026-75898
    33Monitor

    RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component

    HighCVSS 8.4Proof of conceptEPSS 0%

    infiniflow · ragflowAug 18, 2026

  • CVE-2026-12564
    38Monitor

    Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf

    CriticalCVSS 9.6No exploitEPSS 0%

    red hat · red hat ansible automation platform 2.4 for rhel 8Aug 18, 2026

  • CVE-2026-49221
    35Monitor

    Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets

    HighCVSS 8.8No exploitEPSS 0%

    givanz · vvvebAug 18, 2026

  • CVE-2026-49226
    33Monitor

    Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts

    HighCVSS 8.3No exploitEPSS 0%

    givanz · vvvebAug 18, 2026

  • CVE-2026-49227
    30Monitor

    Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts

    HighCVSS 7.6No exploitEPSS 0%

    givanz · vvvebAug 18, 2026

  • CVE-2026-19671
    28Monitor

    Improper handling of highly compressed data (data amplification) in CISA Malcolm

    HighCVSS 7.1No exploitEPSS 0%

    cisagov · malcolmAug 18, 2026

  • CVE-2026-55839
    34Monitor

    Kestra: Stored XSS via custom Markdown [[link]] attribute injection

    HighCVSS 8.7No exploitEPSS 0%

    kestra-io · kestraAug 18, 2026

  • CVE-2026-62357
    35Monitor

    DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write

    HighCVSS 8.8No exploitEPSS 0%

    dragonflydb · dragonflyAug 18, 2026

  • CVE-2026-71365
    30Monitor

    Awx: webhook status callback ssrf leaks the git pat

    HighCVSS 7.7No exploitEPSS 0%

    red hat · red hat ansible automation platform 2.5 for rhel 8Aug 18, 2026

  • CVE-2026-71574
    34Monitor

    Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

    HighCVSS 8.5No exploitEPSS 0%

    joomla · joomla!Aug 18, 2026

  • CVE-2026-73073
    28Monitor

    Vim: Arbitrary Ex Command Execution in C Omni-Completion

    HighCVSS 7.1No exploitEPSS 0%

    vim · vimAug 18, 2026

  • CVE-2026-73337
    32Monitor

    Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2

    HighCVSS 8.2No exploitEPSS 0%

    joomla · joomla!Aug 18, 2026

  • CVE-2026-73373
    35Monitor

    Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2

    HighCVSS 8.9No exploitEPSS 0%

    joomla · joomla!Aug 18, 2026

  • CVE-2026-75856
    36Monitor

    CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU

    CriticalCVSS 9.2No exploitEPSS 0%

    hmbown · codewhaleAug 18, 2026