By publication date

Exploited and new serious CVEs: August 2026

5,321 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 19 of 54

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
32Monitor	CVE-2026-73356No exploit	WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerabilitycloudways · breeze · CWE-862 Pre-auth Broken access control (IDOR)	High8.2	—	0.3%	Aug 18, 2026
28Monitor	CVE-2026-73358No exploit	WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerabilitywp.insider · affiliates manager · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
28Monitor	CVE-2026-73360No exploit	WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerabilitypremio · chaty pro · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
28Monitor	CVE-2026-73361No exploit	WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18 - Cross Site Scripting (XSS) vulnerabilitywpzoom · recipe card blocks for gutenberg & elementor · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
28Monitor	CVE-2026-73362No exploit	WordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilitykaizencoders · url shortify · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
37Monitor	CVE-2026-73365No exploit	WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerabilitycrocoblock. jetimpex inc. · jetappointment · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 18, 2026
39Monitor	CVE-2026-73366No exploit	WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerabilitysupsystic · easy google maps · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 18, 2026
28Monitor	CVE-2026-73367No exploit	WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerabilitysupsystic · easy google maps · CWE-829 Pre-auth	High7.2	—	0.3%	Aug 18, 2026
28Monitor	CVE-2026-73375No exploit	WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerabilitysupsystic · ultimate maps by supsystic · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
39Monitor	CVE-2026-73376No exploit	WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerabilitysupsystic · ultimate maps by supsystic · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 18, 2026
30Monitor	CVE-2026-73377No exploit	WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerabilitysupsystic · ultimate maps by supsystic · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 18, 2026
28Monitor	CVE-2026-73378No exploit	WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerabilitysupsystic · contact form by supsystic · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
39Monitor	CVE-2026-73380No exploit	WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerabilitysupsystic · popup by supsystic · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 18, 2026
36Monitor	CVE-2026-73381No exploit	WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerabilitysupsystic · popup by supsystic · CWE-288 Pre-auth Auth bypass	Critical9.1	—	0.5%	Aug 18, 2026
28Monitor	CVE-2026-73382No exploit	WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerabilitygemini labs · site reviews · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
28Monitor	CVE-2026-73393No exploit	WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerabilitywedevs · subscribe2 · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
28Monitor	CVE-2026-73396No exploit	WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerabilitymakewebbetter · mwb hubspot for woocommerce · CWE-288 Auth bypass	High7.1	—	0.4%	Aug 18, 2026
39Monitor	CVE-2026-73397No exploit	WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerabilityyouzify · youzify · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 18, 2026
32Monitor	CVE-2026-73400No exploit	WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerabilityjetmonsters · restaurant menu by motopress · CWE-98 Pre-auth	High8.1	—	0.4%	Aug 18, 2026
30Monitor	CVE-2026-73994No exploit	WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerabilitysyed balkhi · charitable · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 18, 2026
39Monitor	CVE-2026-73996No exploit	WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerabilitymasteriyo · masteriyo - lms · CWE-434 Pre-auth File upload	Critical9.8	—	0.5%	Aug 18, 2026
30Monitor	CVE-2026-73997No exploit	WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerabilitynexcess · starter templates by kadence wp · CWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Aug 18, 2026
35Monitor	CVE-2026-74012No exploit	WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerabilitytaxopress · taxopress · CWE-502 Deserialization	High8.8	—	0.5%	Aug 18, 2026
37Monitor	CVE-2026-74015No exploit	WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerabilitymerkulove · readabler · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 18, 2026
37Monitor	CVE-2026-75784No exploit	TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflowtrendnet · tew-wlc100 · CWE-119 Pre-auth Memory safety	Critical9.3	—	1.0%	Aug 18, 2026
33Monitor	CVE-2026-75898Proof of concept	RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Componentinfiniflow · ragflow · CWE-918 SSRF	High8.4	—	0.3%	Aug 18, 2026
38Monitor	CVE-2026-12564No exploit	Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrfred hat · red hat ansible automation platform 2.4 for rhel 8 · CWE-918 SSRF	Critical9.6	—	0.3%	Aug 18, 2026
35Monitor	CVE-2026-49221No exploit	Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assetsgivanz · vvveb · CWE-639 Broken access control (IDOR)	High8.8	—	0.5%	Aug 18, 2026
33Monitor	CVE-2026-49226No exploit	Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' postsgivanz · vvveb · CWE-639 Broken access control (IDOR)	High8.3	—	0.4%	Aug 18, 2026
30Monitor	CVE-2026-49227No exploit	Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' postsgivanz · vvveb · CWE-639 Broken access control (IDOR)	High7.6	—	0.4%	Aug 18, 2026
28Monitor	CVE-2026-19671No exploit	Improper handling of highly compressed data (data amplification) in CISA Malcolmcisagov · malcolm · CWE-409	High7.1	—	0.4%	Aug 18, 2026
34Monitor	CVE-2026-55839No exploit	Kestra: Stored XSS via custom Markdown [[link]] attribute injectionkestra-io · kestra · CWE-79 XSS	High8.7	—	0.4%	Aug 18, 2026
35Monitor	CVE-2026-62357No exploit	DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds writedragonflydb · dragonfly · CWE-190 Pre-auth Memory safety	High8.8	—	0.5%	Aug 18, 2026
30Monitor	CVE-2026-71365No exploit	Awx: webhook status callback ssrf leaks the git patred hat · red hat ansible automation platform 2.5 for rhel 8 · CWE-918 SSRF	High7.7	—	0.4%	Aug 18, 2026
34Monitor	CVE-2026-71574No exploit	Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2joomla · joomla! · CWE-284 Broken access control (IDOR)	High8.5	—	0.3%	Aug 18, 2026
28Monitor	CVE-2026-73073No exploit	Vim: Arbitrary Ex Command Execution in C Omni-Completionvim · vim · CWE-94 RCE	High7.1	—	0.1%	Aug 18, 2026
32Monitor	CVE-2026-73337No exploit	Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2joomla · joomla! · CWE-287 Pre-auth Auth bypass	High8.2	—	0.4%	Aug 18, 2026
35Monitor	CVE-2026-73373No exploit	Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2joomla · joomla! · CWE-434 File upload	High8.9	—	0.6%	Aug 18, 2026
36Monitor	CVE-2026-75856No exploit	CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOUhmbown · codewhale · CWE-918 Pre-auth SSRF Race condition	Critical9.2	—	0.4%	Aug 18, 2026
29Monitor	CVE-2026-75857No exploit	CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interacthmbown · codewhale · CWE-269 Local privilege escalation	High7.3	—	0.1%	Aug 18, 2026
34Monitor	CVE-2026-75858No exploit	CodeWhale rlm_eval before 0.8.64 Remote Code Executionhmbown · codewhale · CWE-94 RCE Local privilege escalation	High8.5	—	0.3%	Aug 18, 2026
34Monitor	CVE-2026-75859No exploit	CodeWhale before 0.8.64 Arbitrary File Read via instructionshmbown · codewhale · CWE-22 Pre-auth Path traversal	High8.7	—	0.5%	Aug 18, 2026
34Monitor	CVE-2026-75911No exploit	CodeWhale before 0.8.64 Remote Code Execution via allow_shellhmbown · codewhale · CWE-94 RCE	High8.5	—	0.2%	Aug 18, 2026
33Monitor	CVE-2026-75912No exploit	CodeWhale before 0.8.64 Argument Injection via git_blamehmbown · codewhale · CWE-88 Pre-auth	High8.3	—	0.4%	Aug 18, 2026
34Monitor	CVE-2026-75913No exploit	CodeWhale before 0.8.64 Argument Injection via git_showhmbown · codewhale · CWE-73 Pre-auth Path traversal	High8.5	—	0.4%	Aug 18, 2026
34Monitor	CVE-2026-75914No exploit	CodeWhale before 0.8.64 Path Traversal via image_analyze symlinkhmbown · codewhale · CWE-22 Pre-auth Path traversal	High8.7	—	0.5%	Aug 18, 2026
34Monitor	CVE-2026-75915No exploit	CodeWhale before 0.8.64 Environment Variable Leak via js_executionhmbown · codewhale · CWE-200 Pre-auth Info leak	High8.7	—	0.6%	Aug 18, 2026
37Monitor	CVE-2026-75926No exploit	Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grantgohugo · hugo · CWE-1188 Local privilege escalation	Critical9.3	—	0.2%	Aug 18, 2026
30Monitor	GHSA-2mf3-mr2r-r4vfNo exploit	@rhinostone/swig: arbitrary local file read via include/extends path traversalnpm · @rhinostone/swig · CWE-22 Pre-auth Path traversal	High7.5	—	—	Aug 18, 2026
29Monitor	CVE-2026-15571No exploit	Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc clientred hat · red hat build of keycloak 26.6 · CWE-341	High7.3	—	0.4%	Aug 18, 2026
21Monitor	CVE-2026-18504Proof of concept	fastify vulnerable to schema validation bypass via root primitive coercion mismatchfastify · fastify · CWE-20 Pre-auth	Medium5.3	—	0.2%	Aug 18, 2026
31Monitor	CVE-2026-55426No exploit	linuxfabrik-lib: Local privilege escalation using embedded commandlinuxfabrik · monitoring-plugins · CWE-78 RCE Local privilege escalation Command injection	High7.8	—	0.2%	Aug 18, 2026
29Monitor	CVE-2026-60856No exploit	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Install and Packaging).oracle · peoplesoft enterprise peopletools · CWE-284 Pre-auth Broken access control (IDOR)	High7.4	—	0.3%	Aug 18, 2026
38Monitor	CVE-2026-18963Proof of concept	Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassred hat · red hat build of keycloak 26.4 · CWE-640 Pre-auth	Critical9.1	—	6.5%	Aug 18, 2026
30Monitor	CVE-2026-19869No exploit	Privilege Escalation via Dropped Field-Level @authenticationneo4j · graphql · CWE-639 Broken access control (IDOR)	High7.6	—	0.4%	Aug 18, 2026
30Monitor	CVE-2026-49222No exploit	Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' productsgivanz · vvveb · CWE-639 Broken access control (IDOR)	High7.6	—	0.4%	Aug 18, 2026
30Monitor	CVE-2026-49223No exploit	Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' productsgivanz · vvveb · CWE-639 Broken access control (IDOR)	High7.6	—	0.4%	Aug 18, 2026
33Monitor	CVE-2026-49224No exploit	Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisionsgivanz · vvveb · CWE-639 Broken access control (IDOR)	High8.3	—	0.4%	Aug 18, 2026
33Monitor	CVE-2026-49225No exploit	Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisionsgivanz · vvveb · CWE-639 Broken access control (IDOR)	High8.3	—	0.4%	Aug 18, 2026
35Monitor	CVE-2026-49228No exploit	Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' productsgivanz · vvveb · CWE-639 Broken access control (IDOR)	High8.8	—	0.5%	Aug 18, 2026
29Monitor	CVE-2026-50577No exploit	ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counterfbeta-gmbh · epa3-service-opensource · CWE-323 Pre-auth	High7.4	—	0.5%	Aug 18, 2026
30Monitor	CVE-2026-50578No exploit	ePA 3.x Integration: TLS Certificate Verification Universally Disabledfbeta-gmbh · epa3-service-opensource · CWE-295 Pre-auth Weak crypto	High7.5	—	0.3%	Aug 18, 2026
36Monitor	CVE-2026-52723No exploit	ePA 3.x Integration: VAU Server Authentication Bypass via Circular Certificate Trustfbeta-gmbh · epa3-service-opensource · CWE-295 Pre-auth Auth bypass Weak crypto	Critical9.1	—	0.3%	Aug 18, 2026
34Monitor	CVE-2026-54730No exploit	authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageViewgoauthentik · authentik · CWE-284 Broken access control (IDOR)	High8.6	—	0.6%	Aug 18, 2026
37Monitor	CVE-2026-57580No exploit	authentik: Account Takeover via SAML NameID Comment Truncationgoauthentik · authentik · CWE-436 Pre-auth	Critical9.4	—	0.5%	Aug 18, 2026
35Monitor	CVE-2026-61574No exploit	authentik RAC: access any endpoint via an unrelated applicationgoauthentik · authentik · CWE-639 Broken access control (IDOR)	High8.8	—	0.6%	Aug 18, 2026
30Monitor	CVE-2026-63337No exploit	RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loadingrabbitmq · rabbitmq-java-client · CWE-470	High7.5	—	0.5%	Aug 18, 2026
34Monitor	CVE-2026-69219No exploit	RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocationrabbitmq · rabbitmq-java-client · CWE-789 Pre-auth	High8.7	—	0.7%	Aug 18, 2026
34Monitor	CVE-2026-69220No exploit	RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoSrabbitmq · rabbitmq-java-client · CWE-674 Pre-auth Denial of service	High8.7	—	0.7%	Aug 18, 2026
32Monitor	CVE-2026-62491No exploit	Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).oracle · purchasing · CWE-284 Broken access control (IDOR)	High8.1	—	0.3%	Aug 18, 2026
35Monitor	CVE-2026-70710No exploit	Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).oracle · sales foundation · CWE-284 Broken access control (IDOR)	High8.8	—	0.4%	Aug 18, 2026
30Monitor	CVE-2026-70713No exploit	Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).oracle · isetup · CWE-284 Broken access control (IDOR)	High7.5	—	0.3%	Aug 18, 2026
34Monitor	CVE-2026-70718No exploit	Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).oracle · bills of material · CWE-284 Broken access control (IDOR)	High8.5	—	0.3%	Aug 18, 2026
34Monitor	CVE-2026-70721No exploit	Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).oracle · hyperion profitability and cost management · CWE-284 Pre-auth Broken access control (IDOR)	High8.6	—	0.4%	Aug 18, 2026
32Monitor	CVE-2026-70722No exploit	Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Internal Operations).oracle · advanced inbound telephony · CWE-284 Pre-auth Broken access control (IDOR)	High8.2	—	0.4%	Aug 18, 2026
30Monitor	CVE-2026-70723No exploit	Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).oracle · hyperion profitability and cost management · CWE-284 Broken access control (IDOR)	High7.7	—	0.3%	Aug 18, 2026
30Monitor	CVE-2026-70724No exploit	Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).oracle · mysql cluster · CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 18, 2026
30Monitor	CVE-2026-70725No exploit	Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Internal Operations).oracle · advanced inbound telephony · CWE-284 Broken access control (IDOR)	High7.6	—	0.3%	Aug 18, 2026
34Monitor	CVE-2026-70728No exploit	Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).oracle · autonomous health framework · CWE-284 Broken access control (IDOR)	High8.5	—	0.3%	Aug 18, 2026
35Monitor	CVE-2026-70729No exploit	Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component: Service Request Form).oracle · teleservice · CWE-284 Broken access control (IDOR)	High8.8	—	0.4%	Aug 18, 2026
36Monitor	CVE-2026-70730No exploit	Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).oracle · hyperion profitability and cost management · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.4%	Aug 18, 2026
33Monitor	CVE-2026-70731No exploit	Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).oracle · autonomous health framework · CWE-284 Local privilege escalation Broken access control (IDOR)	High8.4	—	0.1%	Aug 18, 2026
28Monitor	CVE-2026-70733No exploit	Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).oracle · hyperion profitability and cost management · CWE-284 Broken access control (IDOR)	High7.1	—	0.3%	Aug 18, 2026
29Monitor	CVE-2026-70734No exploit	Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).oracle · autonomous health framework · CWE-284 Local privilege escalation Broken access control (IDOR)	High7.4	—	0.1%	Aug 18, 2026
34Monitor	CVE-2026-70882No exploit	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).oracle · hyperion data relationship management · CWE-284 Broken access control (IDOR)	High8.7	—	0.3%	Aug 18, 2026
36Monitor	CVE-2026-70883No exploit	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).oracle · hyperion data relationship management · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.4%	Aug 18, 2026
36Monitor	CVE-2026-70884No exploit	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).oracle · hyperion data relationship management · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.4%	Aug 18, 2026
34Monitor	CVE-2026-70885No exploit	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).oracle · hyperion data relationship management · CWE-284 Broken access control (IDOR)	High8.5	—	0.3%	Aug 18, 2026
32Monitor	CVE-2026-70931No exploit	Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).oracle · workflow · CWE-284 Broken access control (IDOR)	High8.1	—	0.3%	Aug 18, 2026
28Monitor	CVE-2026-70932No exploit	Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).oracle · order management · CWE-284 Local privilege escalation Broken access control (IDOR)	High7.2	—	0.1%	Aug 18, 2026
30Monitor	CVE-2026-71038No exploit	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Maoracle · commerce guided search · CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 18, 2026
35Monitor	CVE-2026-71039No exploit	Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).oracle · agile product lifecycle management · CWE-284 Broken access control (IDOR)	High8.8	—	0.4%	Aug 18, 2026
39Monitor	CVE-2026-71040No exploit	Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security).oracle · agile product lifecycle management · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.5%	Aug 18, 2026
35Monitor	CVE-2026-71044No exploit	Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export).oracle · agile product lifecycle management · CWE-284 Broken access control (IDOR)	High8.8	—	0.4%	Aug 18, 2026
35Monitor	CVE-2026-71045No exploit	Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security).oracle · agile product lifecycle management · CWE-284 Pre-auth Broken access control (IDOR)	High8.8	—	0.4%	Aug 18, 2026
34Monitor	CVE-2026-15315Proof of concept	Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200tp-link · tapo c120 firmware · CWE-287 Pre-auth Auth bypass	High8.7	—	0.4%	Aug 18, 2026
35Monitor	CVE-2026-48508No exploit	Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermissionnetflix · lemur · CWE-863 Broken access control (IDOR)	High8.8	—	0.3%	Aug 18, 2026
32Monitor	CVE-2026-50143No exploit	Actor MCP path authority injection leaks Apify tokenapify · apify-mcp-server · CWE-918 Pre-auth SSRF	High8.1	—	0.4%	Aug 18, 2026
37Monitor	CVE-2026-50161No exploit	libre: Integer overflow in websock_decode() masked frame length check leads to heap buffer overflowbaresip · re · CWE-190 Pre-auth Memory safety	Critical9.3	—	0.7%	Aug 18, 2026
31Monitor	CVE-2026-54552No exploit	sh _uid does not drop supplementary groups (incomplete privilege drop)amoffat · sh · CWE-273 Local privilege escalation	High7.9	—	0.1%	Aug 18, 2026

CVE-2026-73356
32Monitor
WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
cloudways · breezeAug 18, 2026
CVE-2026-73358
28Monitor
WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wp.insider · affiliates managerAug 18, 2026
CVE-2026-73360
28Monitor
WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
premio · chaty proAug 18, 2026
CVE-2026-73361
28Monitor
WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wpzoom · recipe card blocks for gutenberg & elementorAug 18, 2026
CVE-2026-73362
28Monitor
WordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
kaizencoders · url shortifyAug 18, 2026
CVE-2026-73365
37Monitor
WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
crocoblock. jetimpex inc. · jetappointmentAug 18, 2026
CVE-2026-73366
39Monitor
WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
supsystic · easy google mapsAug 18, 2026
CVE-2026-73367
28Monitor
WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
supsystic · easy google mapsAug 18, 2026
CVE-2026-73375
28Monitor
WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
supsystic · ultimate maps by supsysticAug 18, 2026
CVE-2026-73376
39Monitor
WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
supsystic · ultimate maps by supsysticAug 18, 2026
CVE-2026-73377
30Monitor
WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
supsystic · ultimate maps by supsysticAug 18, 2026
CVE-2026-73378
28Monitor
WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
supsystic · contact form by supsysticAug 18, 2026
CVE-2026-73380
39Monitor
WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
supsystic · popup by supsysticAug 18, 2026
CVE-2026-73381
36Monitor
WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
supsystic · popup by supsysticAug 18, 2026
CVE-2026-73382
28Monitor
WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
gemini labs · site reviewsAug 18, 2026
CVE-2026-73393
28Monitor
WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wedevs · subscribe2Aug 18, 2026
CVE-2026-73396
28Monitor
WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Auth bypass
makewebbetter · mwb hubspot for woocommerceAug 18, 2026
CVE-2026-73397
39Monitor
WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
youzify · youzifyAug 18, 2026
CVE-2026-73400
32Monitor
WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
jetmonsters · restaurant menu by motopressAug 18, 2026
CVE-2026-73994
30Monitor
WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
syed balkhi · charitableAug 18, 2026
CVE-2026-73996
39Monitor
WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- File upload
masteriyo · masteriyo - lmsAug 18, 2026
CVE-2026-73997
30Monitor
WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
nexcess · starter templates by kadence wpAug 18, 2026
CVE-2026-74012
35Monitor
WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
taxopress · taxopressAug 18, 2026
CVE-2026-74015
37Monitor
WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
merkulove · readablerAug 18, 2026
CVE-2026-75784
37Monitor
TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflow
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Memory safety
trendnet · tew-wlc100Aug 18, 2026
CVE-2026-75898
33Monitor
RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component
HighCVSS 8.4Proof of conceptEPSS 0%
- SSRF
infiniflow · ragflowAug 18, 2026
CVE-2026-12564
38Monitor
Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf
CriticalCVSS 9.6No exploitEPSS 0%
- SSRF
red hat · red hat ansible automation platform 2.4 for rhel 8Aug 18, 2026
CVE-2026-49221
35Monitor
Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
givanz · vvvebAug 18, 2026
CVE-2026-49226
33Monitor
Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
givanz · vvvebAug 18, 2026
CVE-2026-49227
30Monitor
Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
givanz · vvvebAug 18, 2026
CVE-2026-19671
28Monitor
Improper handling of highly compressed data (data amplification) in CISA Malcolm
HighCVSS 7.1No exploitEPSS 0%
cisagov · malcolmAug 18, 2026
CVE-2026-55839
34Monitor
Kestra: Stored XSS via custom Markdown [[link]] attribute injection
HighCVSS 8.7No exploitEPSS 0%
- XSS
kestra-io · kestraAug 18, 2026
CVE-2026-62357
35Monitor
DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
dragonflydb · dragonflyAug 18, 2026
CVE-2026-71365
30Monitor
Awx: webhook status callback ssrf leaks the git pat
HighCVSS 7.7No exploitEPSS 0%
- SSRF
red hat · red hat ansible automation platform 2.5 for rhel 8Aug 18, 2026
CVE-2026-71574
34Monitor
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
joomla · joomla!Aug 18, 2026
CVE-2026-73073
28Monitor
Vim: Arbitrary Ex Command Execution in C Omni-Completion
HighCVSS 7.1No exploitEPSS 0%
- RCE
vim · vimAug 18, 2026
CVE-2026-73337
32Monitor
Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
joomla · joomla!Aug 18, 2026
CVE-2026-73373
35Monitor
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2
HighCVSS 8.9No exploitEPSS 0%
- File upload
joomla · joomla!Aug 18, 2026
CVE-2026-75856
36Monitor
CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- SSRF
- Race condition
hmbown · codewhaleAug 18, 2026
CVE-2026-75857
29Monitor
CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interact
HighCVSS 7.3No exploitEPSS 0%
- Local privilege escalation
hmbown · codewhaleAug 18, 2026
CVE-2026-75858
34Monitor
CodeWhale rlm_eval before 0.8.64 Remote Code Execution
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
hmbown · codewhaleAug 18, 2026
CVE-2026-75859
34Monitor
CodeWhale before 0.8.64 Arbitrary File Read via instructions
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
hmbown · codewhaleAug 18, 2026
CVE-2026-75911
34Monitor
CodeWhale before 0.8.64 Remote Code Execution via allow_shell
HighCVSS 8.5No exploitEPSS 0%
- RCE
hmbown · codewhaleAug 18, 2026
CVE-2026-75912
33Monitor
CodeWhale before 0.8.64 Argument Injection via git_blame
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
hmbown · codewhaleAug 18, 2026
CVE-2026-75913
34Monitor
CodeWhale before 0.8.64 Argument Injection via git_show
HighCVSS 8.5No exploitEPSS 0%
- Pre-auth
- Path traversal
hmbown · codewhaleAug 18, 2026
CVE-2026-75914
34Monitor
CodeWhale before 0.8.64 Path Traversal via image_analyze symlink
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
hmbown · codewhaleAug 18, 2026
CVE-2026-75915
34Monitor
CodeWhale before 0.8.64 Environment Variable Leak via js_execution
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Info leak
hmbown · codewhaleAug 18, 2026
CVE-2026-75926
37Monitor
Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant
CriticalCVSS 9.3No exploitEPSS 0%
- Local privilege escalation
gohugo · hugoAug 18, 2026
GHSA-2mf3-mr2r-r4vf
30Monitor
@rhinostone/swig: arbitrary local file read via include/extends path traversal
HighCVSS 7.5No exploit
- Pre-auth
- Path traversal
npm · @rhinostone/swigAug 18, 2026
CVE-2026-15571
29Monitor
Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client
HighCVSS 7.3No exploitEPSS 0%
red hat · red hat build of keycloak 26.6Aug 18, 2026
CVE-2026-18504
21Monitor
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
fastify · fastifyAug 18, 2026
CVE-2026-55426
31Monitor
linuxfabrik-lib: Local privilege escalation using embedded command
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
linuxfabrik · monitoring-pluginsAug 18, 2026
CVE-2026-60856
29Monitor
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Install and Packaging).
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle · peoplesoft enterprise peopletoolsAug 18, 2026
CVE-2026-18963
38Monitor
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
CriticalCVSS 9.1Proof of conceptEPSS 6%
- Pre-auth
red hat · red hat build of keycloak 26.4Aug 18, 2026
CVE-2026-19869
30Monitor
Privilege Escalation via Dropped Field-Level @authentication
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
neo4j · graphqlAug 18, 2026
CVE-2026-49222
30Monitor
Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
givanz · vvvebAug 18, 2026
CVE-2026-49223
30Monitor
Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
givanz · vvvebAug 18, 2026
CVE-2026-49224
33Monitor
Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
givanz · vvvebAug 18, 2026
CVE-2026-49225
33Monitor
Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
givanz · vvvebAug 18, 2026
CVE-2026-49228
35Monitor
Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
givanz · vvvebAug 18, 2026
CVE-2026-50577
29Monitor
ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
fbeta-gmbh · epa3-service-opensourceAug 18, 2026
CVE-2026-50578
30Monitor
ePA 3.x Integration: TLS Certificate Verification Universally Disabled
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
fbeta-gmbh · epa3-service-opensourceAug 18, 2026
CVE-2026-52723
36Monitor
ePA 3.x Integration: VAU Server Authentication Bypass via Circular Certificate Trust
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
fbeta-gmbh · epa3-service-opensourceAug 18, 2026
CVE-2026-54730
34Monitor
authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
goauthentik · authentikAug 18, 2026
CVE-2026-57580
37Monitor
authentik: Account Takeover via SAML NameID Comment Truncation
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
goauthentik · authentikAug 18, 2026
CVE-2026-61574
35Monitor
authentik RAC: access any endpoint via an unrelated application
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
goauthentik · authentikAug 18, 2026
CVE-2026-63337
30Monitor
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
HighCVSS 7.5No exploitEPSS 0%
rabbitmq · rabbitmq-java-clientAug 18, 2026
CVE-2026-69219
34Monitor
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
rabbitmq · rabbitmq-java-clientAug 18, 2026
CVE-2026-69220
34Monitor
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
rabbitmq · rabbitmq-java-clientAug 18, 2026
CVE-2026-62491
32Monitor
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
oracle · purchasingAug 18, 2026
CVE-2026-70710
35Monitor
Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
oracle · sales foundationAug 18, 2026
CVE-2026-70713
30Monitor
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).
HighCVSS 7.5No exploitEPSS 0%
- Broken access control (IDOR)
oracle · isetupAug 18, 2026
CVE-2026-70718
34Monitor
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
oracle · bills of materialAug 18, 2026
CVE-2026-70721
34Monitor
Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle · hyperion profitability and cost managementAug 18, 2026
CVE-2026-70722
32Monitor
Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle · advanced inbound telephonyAug 18, 2026
CVE-2026-70723
30Monitor
Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
oracle · hyperion profitability and cost managementAug 18, 2026
CVE-2026-70724
30Monitor
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle · mysql clusterAug 18, 2026
CVE-2026-70725
30Monitor
Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
oracle · advanced inbound telephonyAug 18, 2026
CVE-2026-70728
34Monitor
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
oracle · autonomous health frameworkAug 18, 2026
CVE-2026-70729
35Monitor
Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component: Service Request Form).
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
oracle · teleserviceAug 18, 2026
CVE-2026-70730
36Monitor
Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle · hyperion profitability and cost managementAug 18, 2026
CVE-2026-70731
33Monitor
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
oracle · autonomous health frameworkAug 18, 2026
CVE-2026-70733
28Monitor
Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
oracle · hyperion profitability and cost managementAug 18, 2026
CVE-2026-70734
29Monitor
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).
HighCVSS 7.4No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
oracle · autonomous health frameworkAug 18, 2026
CVE-2026-70882
34Monitor
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
oracle · hyperion data relationship managementAug 18, 2026
CVE-2026-70883
36Monitor
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle · hyperion data relationship managementAug 18, 2026
CVE-2026-70884
36Monitor
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle · hyperion data relationship managementAug 18, 2026
CVE-2026-70885
34Monitor
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
oracle · hyperion data relationship managementAug 18, 2026
CVE-2026-70931
32Monitor
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
oracle · workflowAug 18, 2026
CVE-2026-70932
28Monitor
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).
HighCVSS 7.2No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
oracle · order managementAug 18, 2026
CVE-2026-71038
30Monitor
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Ma
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle · commerce guided searchAug 18, 2026
CVE-2026-71039
35Monitor
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
oracle · agile product lifecycle managementAug 18, 2026
CVE-2026-71040
39Monitor
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security).
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle · agile product lifecycle managementAug 18, 2026
CVE-2026-71044
35Monitor
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export).
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
oracle · agile product lifecycle managementAug 18, 2026
CVE-2026-71045
35Monitor
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security).
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle · agile product lifecycle managementAug 18, 2026
CVE-2026-15315
34Monitor
Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
tp-link · tapo c120 firmwareAug 18, 2026
CVE-2026-48508
35Monitor
Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
netflix · lemurAug 18, 2026
CVE-2026-50143
32Monitor
Actor MCP path authority injection leaks Apify token
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- SSRF
apify · apify-mcp-serverAug 18, 2026
CVE-2026-50161
37Monitor
libre: Integer overflow in websock_decode() masked frame length check leads to heap buffer overflow
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
baresip · reAug 18, 2026
CVE-2026-54552
31Monitor
sh _uid does not drop supplementary groups (incomplete privilege drop)
HighCVSS 7.9No exploitEPSS 0%
- Local privilege escalation
amoffat · shAug 18, 2026