By publication date

Exploited and new serious CVEs: August 2026

7,294 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 73

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2026-9856No exploit	Path Traversal in huggingface/transformershuggingface · huggingface/transformers · CWE-22 Pre-auth Path traversal	High7.1	—	0.4%	Aug 2, 2026
35Monitor	CVE-2025-71399No exploit	Better Auth before 1.4.5 Path Normalization Bypass via rou3better-auth · better-auth · CWE-20 Pre-auth	High8.8	—	0.5%	Aug 2, 2026
28Monitor	CVE-2025-71400No exploit	better-auth passkey before 1.4.0 IDOR via delete-passkeybetter-auth · passkey · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Aug 2, 2026
37Monitor	CVE-2025-71401No exploit	better-auth before 1.4.2 basePath Modification DoSbetter-auth · better-auth · CWE-770 Pre-auth Denial of service	Critical9.3	—	0.4%	Aug 2, 2026
34Monitor	CVE-2026-68579No exploit	FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Readfreerdp · freerdp · CWE-787 Pre-auth Memory safety	High8.7	—	0.4%	Aug 2, 2026
30Monitor	CVE-2026-68580No exploit	FreeRDP before 3.29.0 Integer Overflow via Audio Input Channelfreerdp · freerdp · CWE-122 Pre-auth Memory safety	High7.7	—	0.2%	Aug 2, 2026
34Monitor	CVE-2026-10848No exploit	Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)zephyrproject · zephyr · CWE-125 Pre-auth Memory safety	High8.6	—	0.3%	Aug 2, 2026
66This week	CVE-2026-18577Weaponized	Incomplete patch leads to administrative account takeovern-able · n-central · CWE-288 Pre-auth Auth bypass	High8.2	KEV	14.6%	Aug 2, 2026
30Monitor	CVE-2026-3245No exploit	A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution.canon production printing · prismaproduction · CWE-502 pre-auth RCE Deserialization	High7.7	—	0.7%	Aug 2, 2026
28Monitor	CVE-2026-12185No exploit	BKS/UBER keystore allocates from untrusted lengths before integrity checkbouncycastle · bc-java · CWE-789 Pre-auth	High7.1	—	0.2%	Aug 2, 2026
37Monitor	CVE-2026-59638No exploit	JSSE hostname verifier CN-fallback enabled by default despite documented opt-inbouncycastle · bc-java · CWE-297 Pre-auth Weak crypto	Critical9.3	—	0.3%	Aug 2, 2026
34Monitor	CVE-2026-59639No exploit	CMS verifySignatures returns true for SignedData with zero signersbouncycastle · bc-java · CWE-347 Pre-auth Weak crypto	High8.7	—	0.2%	Aug 2, 2026
34Monitor	CVE-2026-59640No exploit	OpenPGP CFB quick-check oracle active on symmetric/session-key pathsbouncycastle · bc-java · CWE-203 Pre-auth	High8.7	—	0.3%	Aug 2, 2026
34Monitor	CVE-2026-59641No exploit	S/MIME validator trusts signer-asserted signingTime for path validationbouncycastle · bc-java · CWE-345 Pre-auth	High8.7	—	0.2%	Aug 2, 2026
34Monitor	CVE-2026-59642No exploit	CMS AuthenticatedData content not bound to MAC when authAttrs presentbouncycastle · bc-java · CWE-354 Pre-auth	High8.7	—	0.3%	Aug 2, 2026
34Monitor	CVE-2026-59643No exploit	OpenPGP inline-signature policy failures silently ignoredbouncycastle · bc-java · CWE-347 Pre-auth Weak crypto	High8.7	—	0.2%	Aug 2, 2026
34Monitor	CVE-2026-59644No exploit	MLS hash-ratchet honours arbitrary 32-bit generation counter from senderbouncycastle · bc-java · CWE-834 Pre-auth	High8.7	—	0.4%	Aug 2, 2026
34Monitor	CVE-2026-59645No exploit	OER parser recurses without depth limit on self-referential IEEE 1609.2 schemabouncycastle · bc-java · CWE-674 Pre-auth Denial of service	High8.7	—	0.4%	Aug 2, 2026
34Monitor	CVE-2026-59646No exploit	DTLS handshake reassembler allocates buffer from unchecked 24-bit lengthbouncycastle · bc-java · CWE-789 Pre-auth	High8.7	—	0.6%	Aug 2, 2026
34Monitor	CVE-2026-59649No exploit	OpenPGP user-attribute subpacket length bounded only by JVM max memorybouncycastle · bc-java · CWE-789 Pre-auth	High8.7	—	0.4%	Aug 2, 2026
37Monitor	CVE-2026-59650No exploit	MTI/A0 DH agreement exponentiates unvalidated peer valuebouncycastle · bc-java · CWE-20 Pre-auth	Critical9.3	—	0.3%	Aug 2, 2026
28Monitor	CVE-2026-59651No exploit	BKS keystore accepts legacy version with 16-bit integrity MAC keybouncycastle · bc-java · CWE-326 Pre-auth Weak crypto	High7.1	—	0.2%	Aug 2, 2026
37Monitor	CVE-2026-8763No exploit	Name Constraints bypass via trailing dot in rfc822Name and URIbouncycastle · bc-java · CWE-295 Pre-auth Weak crypto	Critical9.3	—	0.4%	Aug 2, 2026
32Monitor	CVE-2026-20465No exploit	In wlan AP driver, there is a possible out of bounds write due to a missing bounds check.mediatek, inc. · mediatek chipset · CWE-122 Pre-auth Memory safety	High8.1	—	0.3%	Aug 2, 2026
30Monitor	CVE-2026-20479No exploit	In Modem, there is a possible out of bounds read due to a missing bounds check.mediatek · mt2735 firmware · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	0.7%	Aug 2, 2026
30Monitor	CVE-2026-20483No exploit	In Telephony, there is a possible escalation of privilege due to a missing permission check.mediatek · mt8893 firmware · CWE-862 Local privilege escalation Broken access control (IDOR)	High7.7	—	0.1%	Aug 2, 2026
31Monitor	CVE-2026-20495No exploit	In Bluetooth driver, there is a possible permission bypass due to a missing permission check.mediatek · mt7925 firmware · CWE-862 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	Aug 2, 2026
34Monitor	CVE-2026-58059No exploit	Quadratic-time escaping when stringifying X.500 distinguished namesbouncycastle · bc-java · CWE-407 Pre-auth	High8.7	—	0.4%	Aug 2, 2026
34Monitor	CVE-2026-58060No exploit	HSS public-key level count unbounded, enabling huge allocation on verifybouncycastle · bc-java · CWE-789 Pre-auth	High8.7	—	0.6%	Aug 2, 2026
34Monitor	CVE-2026-58061No exploit	CCM-family modes write plaintext to caller buffer before tag checkbouncycastle · bc-java · CWE-354 Pre-auth	High8.7	—	0.2%	Aug 2, 2026
37Monitor	CVE-2026-58062Proof of concept	Stapled OCSP response accepted without binding to the checked certificatebouncycastle · bc-java · CWE-295 Pre-auth Weak crypto	Critical9.3	—	0.2%	Aug 2, 2026
34Monitor	CVE-2026-12802No exploit	CMS AuthEnvelopedData fails to enforce tag-length on decryptionbouncycastle · bc-java · CWE-354 Pre-auth	High8.7	—	0.1%	Aug 3, 2026
34Monitor	CVE-2026-12803No exploit	KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)bouncycastle · bc-java · CWE-354 Pre-auth	High8.7	—	0.2%	Aug 3, 2026
34Monitor	CVE-2026-12816No exploit	IESEngine stream-mode MAC forgery via length-dependent KDF splitbouncycastle · bc-java · CWE-354 Pre-auth	High8.7	—	0.1%	Aug 3, 2026
34Monitor	CVE-2026-12817No exploit	OpenPGP AEAD decryption skips final tag on chunk-aligned databouncycastle · bc-java · CWE-354 Pre-auth	High8.7	—	0.1%	Aug 3, 2026
34Monitor	CVE-2026-12852No exploit	MLS wire decoder allocates attacker-declared opaque length before bounds checkbouncycastle · bc-java · CWE-789 Pre-auth	High8.7	—	0.3%	Aug 3, 2026
34Monitor	CVE-2026-12860No exploit	RSA PKCS#1 verification skips last two hash bytes in NULL-omitted pathbouncycastle · bc-java · CWE-347 Pre-auth Weak crypto	High8.7	—	0.1%	Aug 3, 2026
34Monitor	CVE-2026-13506No exploit	Lazy ASN.1 sequence forcing resets nesting-depth guardbouncycastle · bc-java · CWE-674 Pre-auth Denial of service	High8.7	—	0.4%	Aug 3, 2026
34Monitor	CVE-2026-14682No exploit	Possible OOM from unbounded up-front allocation on a definite-length readbouncycastle · bc-java · CWE-789 Pre-auth	High8.7	—	0.3%	Aug 3, 2026
39Monitor	CVE-2026-12872No exploit	Webinfos <= 1.2 - Unauthenticated Arbitrary File Uploadunknown · webinfos · CWE-434 pre-auth RCE File upload	Critical9.8	—	1.0%	Aug 3, 2026
36Monitor	CVE-2026-12965No exploit	Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_trackingunknown · super store finder wordpress · CWE-89 Pre-auth SQL injection	Critical9.1	—	0.4%	Aug 3, 2026
36Monitor	CVE-2026-14557No exploit	SoftMarket <= 1.0.0 - Unauthenticated Account Takeover via Email Verification Bypassunknown · softmarket — digital marketplace · CWE-287 Pre-auth Auth bypass	Critical9.1	—	0.5%	Aug 3, 2026
37Monitor	CVE-2026-15930No exploit	Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collisionunknown · simple membership · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.4	—	0.4%	Aug 3, 2026
39Monitor	CVE-2026-16060No exploit	Insert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File Uploadunknown · insert or embed articulate content into wordpress · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.8%	Aug 3, 2026
39Monitor	CVE-2026-16250No exploit	Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Uploadunknown · personal qr message · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.8%	Aug 3, 2026
39Monitor	CVE-2026-16300No exploit	Chama < 1.0.13 - Unauthenticated Arbitrary User Password Resetunknown · chamawp · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.4%	Aug 3, 2026
36Monitor	CVE-2026-16532No exploit	Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Formunknown · link library · CWE-89 Pre-auth SQL injection	Critical9.1	—	0.4%	Aug 3, 2026
36Monitor	CVE-2026-16534No exploit	Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Importunknown · import and export users and customers · CWE-269 Pre-auth	Critical9.1	—	0.4%	Aug 3, 2026
32Monitor	CVE-2026-16539No exploit	SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplicationunknown · sm page duplicator · CWE-89 SQL injection	High8.1	—	0.3%	Aug 3, 2026
34Monitor	CVE-2026-16572No exploit	LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookieunknown · logmytrip · CWE-89 Pre-auth SQL injection	High8.6	—	0.4%	Aug 3, 2026
37Monitor	CVE-2026-18588No exploit	Wavlink WL-NU516U1 nas.cgi fgets stack-based overflowwavlink · wl-nu516u1 · CWE-119 Pre-auth Memory safety	Critical9.3	—	1.0%	Aug 3, 2026
35Monitor	CVE-2026-18589No exploit	Wavlink WL-NU516U1 nas.cgi change_password stack-based overflowwavlink · wl-nu516u1 · CWE-119 Pre-auth Memory safety	High8.9	—	1.0%	Aug 3, 2026
29Monitor	CVE-2026-4793No exploit	An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files synology · assistant · CWE-276	High7.3	—	0.1%	Aug 3, 2026
33Monitor	CVE-2026-9593No exploit	iDTM FDI Unauthorized Debug Interface Enablementendress+hauser · fdi package library · CWE-427 Local privilege escalation	High8.4	—	0.1%	Aug 3, 2026
30Monitor	CVE-2026-21548No exploit	In nr modem, there is a possible improper input validation.unisoc (shanghai) technologies co., ltd. · t8100/t9100/t8200/t8300 · CWE-20 Pre-auth Denial of service	High7.5	—	0.7%	Aug 3, 2026
30Monitor	CVE-2026-21549No exploit	In modem, there is a possible improper input validation.unisoc (shanghai) technologies co., ltd. · t8100/t9100/t8200/t8300 · CWE-20 Pre-auth Denial of service	High7.5	—	0.7%	Aug 3, 2026
30Monitor	CVE-2026-21550No exploit	In modem, there is a possible improper input validation.unisoc (shanghai) technologies co., ltd. · t8100/t9100/t8200/t8300 · CWE-20 Pre-auth Denial of service	High7.5	—	0.7%	Aug 3, 2026
30Monitor	CVE-2026-21551No exploit	In modem, there is a possible improper input validation.unisoc (shanghai) technologies co., ltd. · t8100/t9100/t8200/t8300 · CWE-20 Pre-auth Denial of service	High7.5	—	0.7%	Aug 3, 2026
30Monitor	CVE-2026-21552No exploit	In modem, there is a possible improper input validation.unisoc (shanghai) technologies co., ltd. · t8100/t9100/t8200/t8300 · CWE-20 Pre-auth Denial of service	High7.5	—	0.7%	Aug 3, 2026
30Monitor	CVE-2026-21553No exploit	In modem, there is a possible improper input validation.unisoc (shanghai) technologies co., ltd. · t8100/t9100/t8200/t8300 · CWE-20 Pre-auth Denial of service	High7.5	—	0.7%	Aug 3, 2026
30Monitor	CVE-2026-21554No exploit	In modem, there is a possible improper input validation.unisoc (shanghai) technologies co., ltd. · udx710 · CWE-20 Pre-auth Denial of service	High7.5	—	0.7%	Aug 3, 2026
30Monitor	CVE-2026-21555No exploit	In modem, there is a possible improper input validation.unisoc (shanghai) technologies co., ltd. · udx710 · CWE-20 Pre-auth Denial of service	High7.5	—	0.7%	Aug 3, 2026
27Monitor	CVE-2026-8793Proof of concept	PaperCut NG/MF: Insufficient brute-force protectionpapercut · papercut ng/mf · CWE-307 Pre-auth	Medium6.9	—	0.6%	Aug 3, 2026
27Monitor	CVE-2026-8794Proof of concept	PaperCut NG/MF: User enumeration via timing attackpapercut · papercut ng/mf · CWE-208 Pre-auth	Medium6.9	—	0.6%	Aug 3, 2026
27Monitor	CVE-2026-63563Proof of concept	Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in sharp corporation · sharp mfps · CWE-1188 Pre-auth	Medium6.9	—	0.4%	Aug 3, 2026
29Monitor	CVE-2026-0392No exploit	eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-updatelatvijas valsts radio un televīzijas centrs (lvrtc) · eparakstītājs 3.0 · CWE-295 pre-auth RCE Weak crypto	High7.3	—	0.0%	Aug 3, 2026
40Plan	CVE-2026-33591No exploit	Authentication bypass on WaptServertranquil it systems · wapt server · CWE-288 Pre-auth Auth bypass	Critical10.0	—	0.7%	Aug 3, 2026
35Monitor	CVE-2026-69078No exploit	Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Renderingmisp · cti-transmute · CWE-918 Pre-auth SSRF	High8.8	—	0.4%	Aug 3, 2026
34Monitor	CVE-2026-69079No exploit	Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmutemisp · cti-transmute · CWE-770 Pre-auth Denial of service	High8.7	—	0.5%	Aug 3, 2026
35Monitor	CVE-2026-69082No exploit	Cross-Site Request Forgery in the Administrative User Deletion Endpointmisp · cti-transmute · CWE-352 Pre-auth CSRF	High8.8	—	0.2%	Aug 3, 2026
32Monitor	CVE-2025-15672No exploit	Chama < 1.0.13 - Unauthenticated PHP Object Injectionunknown · chamawp · CWE-502 pre-auth RCE Deserialization	High8.1	—	0.6%	Aug 3, 2026
37Monitor	CVE-2026-18574Proof of concept	Authentication Bypass in Check Point Security Management Servercheckpoint · security management server · CWE-288 pre-auth RCE Auth bypass	Critical9.3	—	0.8%	Aug 3, 2026
30Monitor	CVE-2026-18598No exploit	GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get_system_log command injectiongl.inet · gl-mt3000 · CWE-74 RCE Command injection	High7.4	—	3.2%	Aug 3, 2026
30Monitor	CVE-2026-18599No exploit	GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injectiongl.inet · gl-mt3000 · CWE-74 RCE Command injection	High7.3	—	4.4%	Aug 3, 2026
39Monitor	CVE-2026-2346No exploit	IDOR in Menulux Software's Mobile Appmenulux software inc. · mobile app · CWE-639 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.5%	Aug 3, 2026
30Monitor	CVE-2026-18089No exploit	Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when notimlegge · net\ · CWE-295 Pre-auth Auth bypass Weak crypto	High7.5	—	0.2%	Aug 3, 2026
32Monitor	CVE-2026-18092No exploit	Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with documenttimlegge · net\ · CWE-347 Pre-auth Auth bypass Weak crypto	High8.1	—	0.3%	Aug 3, 2026
39Monitor	CVE-2026-18108No exploit	Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content ctimlegge · net\ · CWE-347 Pre-auth Auth bypass Weak crypto	Critical9.8	—	0.3%	Aug 3, 2026
30Monitor	CVE-2026-18600No exploit	GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injectiongl.inet · gl-mt3000 · CWE-74 RCE Command injection	High7.4	—	3.2%	Aug 3, 2026
36Monitor	CVE-2026-18601No exploit	GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injectiongl.inet · gl-mt3000 · CWE-74 pre-auth RCE Command injection	High8.9	—	3.6%	Aug 3, 2026
31Monitor	CVE-2026-18642No exploit	Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-locktubitak bilgem software technologies research institute · eta-otp-lock · CWE-502 RCE Deserialization	High7.8	—	0.3%	Aug 3, 2026
37Monitor	CVE-2026-64827No exploit	Telenia TVox 26.5.3 Authentication Bypass via set_env.phptelenia software · tvox · CWE-807 Pre-auth Auth bypass	Critical9.3	—	0.8%	Aug 3, 2026
35Monitor	CVE-2026-67608No exploit	Telenia TVox 26.5.3 OS Command Injection via action_audio.phptelenia software · tvox · CWE-78 RCE Command injection	High8.6	—	2.4%	Aug 3, 2026
36Monitor	CVE-2026-68584No exploit	SiYuan before v3.7.3 Authentication Bypass via Content Endpointssiyuan-note · siyuan · CWE-288 Pre-auth Auth bypass	Critical9.2	—	0.5%	Aug 3, 2026
36Monitor	CVE-2026-68586No exploit	SiYuan before v3.7.3 Content Disclosure via getBacklinkDocsiyuan-note · siyuan · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.2	—	0.4%	Aug 3, 2026
36Monitor	CVE-2026-68587No exploit	SiYuan before v3.7.3 Information Disclosure via getHeading*Transactionsiyuan-note · siyuan · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.2	—	0.4%	Aug 3, 2026
39Monitor	CVE-2026-69083Proof of concept	SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContentsiyuan-note · siyuan · CWE-89 pre-auth RCE SQL injection	Critical9.9	—	0.4%	Aug 3, 2026
39Monitor	CVE-2026-69084Proof of concept	SiYuan before v3.7.3 SQL Injection via searchEmbedBlocksiyuan-note · siyuan · CWE-89 Pre-auth SQL injection	Critical9.9	—	1.5%	Aug 3, 2026
39Monitor	CVE-2026-69085Proof of concept	SiYuan before v3.7.3 SQL Injection via searchDocssiyuan-note · siyuan · CWE-89 Pre-auth SQL injection	Critical9.9	—	1.4%	Aug 3, 2026
33Monitor	CVE-2026-69086No exploit	SiYuan before v3.7.3 Path Traversal via unvalidated avIDsiyuan-note · siyuan · CWE-22 Path traversal	High8.3	—	0.5%	Aug 3, 2026
28Monitor	CVE-2026-69087No exploit	Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twiggetgrav · grav-plugin-form · CWE-601 Pre-auth Open redirect	High7.1	—	0.3%	Aug 3, 2026
34Monitor	CVE-2026-69091No exploit	Admidio before 5.0.11 Authentication Bypass via forum.phpadmidio · admidio · CWE-306 Pre-auth Auth bypass	High8.7	—	0.6%	Aug 3, 2026
28Monitor	CVE-2026-69093No exploit	Admidio before 5.0.11 CSRF via category-report preferencesadmidio · admidio · CWE-352 CSRF	High7.1	—	0.1%	Aug 3, 2026
34Monitor	CVE-2026-69095No exploit	OpenWrt luci-app-bmx7 Path Traversal via bmx7-infoopenwrt · luci · CWE-22 Pre-auth Path traversal	High8.7	—	0.9%	Aug 3, 2026
35Monitor	CVE-2026-69096No exploit	OpenWrt luci-app-dockerman Read ACL Remote Code Executionopenwrt · luci · CWE-78 RCE Command injection	High8.7	—	3.2%	Aug 3, 2026
29Monitor	CVE-2026-69097No exploit	GitPython before 3.1.53 Config Injection via Submodule Namesgitpython project · gitpython · CWE-74 RCE	High7.3	—	0.2%	Aug 3, 2026
36Monitor	CVE-2026-9390No exploit	XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookupxml\ · \ · CWE-643 Pre-auth	Critical9.1	—	0.5%	Aug 3, 2026
36Monitor	CVE-2026-9487No exploit	XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate IDxml\ · \ · CWE-347 Pre-auth Weak crypto	Critical9.1	—	0.2%	Aug 3, 2026
34Monitor	CVE-2026-67609No exploit	Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configurationtelenia software · tvox · CWE-250 RCE Local privilege escalation	High8.5	—	0.1%	Aug 3, 2026
24Monitor	CVE-2026-15430Proof of concept	Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprwellbia · xigncode3 · CWE-269 Local privilege escalation	Medium6.2	—	0.1%	Aug 3, 2026

CVE-2026-9856
28Monitor
Path Traversal in huggingface/transformers
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Path traversal
huggingface · huggingface/transformersAug 2, 2026
CVE-2025-71399
35Monitor
Better Auth before 1.4.5 Path Normalization Bypass via rou3
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
better-auth · better-authAug 2, 2026
CVE-2025-71400
28Monitor
better-auth passkey before 1.4.0 IDOR via delete-passkey
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
better-auth · passkeyAug 2, 2026
CVE-2025-71401
37Monitor
better-auth before 1.4.2 basePath Modification DoS
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Denial of service
better-auth · better-authAug 2, 2026
CVE-2026-68579
34Monitor
FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpAug 2, 2026
CVE-2026-68580
30Monitor
FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpAug 2, 2026
CVE-2026-10848
34Monitor
Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Memory safety
zephyrproject · zephyrAug 2, 2026
CVE-2026-18577
66This week
Incomplete patch leads to administrative account takeover
HighCVSS 8.2KEVWeaponizedEPSS 14%
- Pre-auth
- Auth bypass
n-able · n-centralAug 2, 2026
CVE-2026-3245
30Monitor
A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution.
HighCVSS 7.7No exploitEPSS 0%
- pre-auth RCE
- Deserialization
canon production printing · prismaproductionAug 2, 2026
CVE-2026-12185
28Monitor
BKS/UBER keystore allocates from untrusted lengths before integrity check
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-59638
37Monitor
JSSE hostname verifier CN-fallback enabled by default despite documented opt-in
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
bouncycastle · bc-javaAug 2, 2026
CVE-2026-59639
34Monitor
CMS verifySignatures returns true for SignedData with zero signers
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
bouncycastle · bc-javaAug 2, 2026
CVE-2026-59640
34Monitor
OpenPGP CFB quick-check oracle active on symmetric/session-key paths
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-59641
34Monitor
S/MIME validator trusts signer-asserted signingTime for path validation
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-59642
34Monitor
CMS AuthenticatedData content not bound to MAC when authAttrs present
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-59643
34Monitor
OpenPGP inline-signature policy failures silently ignored
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
bouncycastle · bc-javaAug 2, 2026
CVE-2026-59644
34Monitor
MLS hash-ratchet honours arbitrary 32-bit generation counter from sender
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-59645
34Monitor
OER parser recurses without depth limit on self-referential IEEE 1609.2 schema
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
bouncycastle · bc-javaAug 2, 2026
CVE-2026-59646
34Monitor
DTLS handshake reassembler allocates buffer from unchecked 24-bit length
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-59649
34Monitor
OpenPGP user-attribute subpacket length bounded only by JVM max memory
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-59650
37Monitor
MTI/A0 DH agreement exponentiates unvalidated peer value
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-59651
28Monitor
BKS keystore accepts legacy version with 16-bit integrity MAC key
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
bouncycastle · bc-javaAug 2, 2026
CVE-2026-8763
37Monitor
Name Constraints bypass via trailing dot in rfc822Name and URI
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
bouncycastle · bc-javaAug 2, 2026
CVE-2026-20465
32Monitor
In wlan AP driver, there is a possible out of bounds write due to a missing bounds check.
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Memory safety
mediatek, inc. · mediatek chipsetAug 2, 2026
CVE-2026-20479
30Monitor
In Modem, there is a possible out of bounds read due to a missing bounds check.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
mediatek · mt2735 firmwareAug 2, 2026
CVE-2026-20483
30Monitor
In Telephony, there is a possible escalation of privilege due to a missing permission check.
HighCVSS 7.7No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
mediatek · mt8893 firmwareAug 2, 2026
CVE-2026-20495
31Monitor
In Bluetooth driver, there is a possible permission bypass due to a missing permission check.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
mediatek · mt7925 firmwareAug 2, 2026
CVE-2026-58059
34Monitor
Quadratic-time escaping when stringifying X.500 distinguished names
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-58060
34Monitor
HSS public-key level count unbounded, enabling huge allocation on verify
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-58061
34Monitor
CCM-family modes write plaintext to caller buffer before tag check
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-58062
37Monitor
Stapled OCSP response accepted without binding to the checked certificate
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
bouncycastle · bc-javaAug 2, 2026
CVE-2026-12802
34Monitor
CMS AuthEnvelopedData fails to enforce tag-length on decryption
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 3, 2026
CVE-2026-12803
34Monitor
KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 3, 2026
CVE-2026-12816
34Monitor
IESEngine stream-mode MAC forgery via length-dependent KDF split
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 3, 2026
CVE-2026-12817
34Monitor
OpenPGP AEAD decryption skips final tag on chunk-aligned data
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 3, 2026
CVE-2026-12852
34Monitor
MLS wire decoder allocates attacker-declared opaque length before bounds check
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 3, 2026
CVE-2026-12860
34Monitor
RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
bouncycastle · bc-javaAug 3, 2026
CVE-2026-13506
34Monitor
Lazy ASN.1 sequence forcing resets nesting-depth guard
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
bouncycastle · bc-javaAug 3, 2026
CVE-2026-14682
34Monitor
Possible OOM from unbounded up-front allocation on a definite-length read
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 3, 2026
CVE-2026-12872
39Monitor
Webinfos <= 1.2 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- File upload
unknown · webinfosAug 3, 2026
CVE-2026-12965
36Monitor
Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · super store finder wordpressAug 3, 2026
CVE-2026-14557
36Monitor
SoftMarket <= 1.0.0 - Unauthenticated Account Takeover via Email Verification Bypass
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · softmarket — digital marketplaceAug 3, 2026
CVE-2026-15930
37Monitor
Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · simple membershipAug 3, 2026
CVE-2026-16060
39Monitor
Insert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File Upload
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
unknown · insert or embed articulate content into wordpressAug 3, 2026
CVE-2026-16250
39Monitor
Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
unknown · personal qr messageAug 3, 2026
CVE-2026-16300
39Monitor
Chama < 1.0.13 - Unauthenticated Arbitrary User Password Reset
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · chamawpAug 3, 2026
CVE-2026-16532
36Monitor
Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · link libraryAug 3, 2026
CVE-2026-16534
36Monitor
Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
unknown · import and export users and customersAug 3, 2026
CVE-2026-16539
32Monitor
SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication
HighCVSS 8.1No exploitEPSS 0%
- SQL injection
unknown · sm page duplicatorAug 3, 2026
CVE-2026-16572
34Monitor
LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · logmytripAug 3, 2026
CVE-2026-18588
37Monitor
Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Memory safety
wavlink · wl-nu516u1Aug 3, 2026
CVE-2026-18589
35Monitor
Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow
HighCVSS 8.9No exploitEPSS 1%
- Pre-auth
- Memory safety
wavlink · wl-nu516u1Aug 3, 2026
CVE-2026-4793
29Monitor
An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files
HighCVSS 7.3No exploitEPSS 0%
synology · assistantAug 3, 2026
CVE-2026-9593
33Monitor
iDTM FDI Unauthorized Debug Interface Enablement
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
endress+hauser · fdi package libraryAug 3, 2026
CVE-2026-21548
30Monitor
In nr modem, there is a possible improper input validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
unisoc (shanghai) technologies co., ltd. · t8100/t9100/t8200/t8300Aug 3, 2026
CVE-2026-21549
30Monitor
In modem, there is a possible improper input validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
unisoc (shanghai) technologies co., ltd. · t8100/t9100/t8200/t8300Aug 3, 2026
CVE-2026-21550
30Monitor
In modem, there is a possible improper input validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
unisoc (shanghai) technologies co., ltd. · t8100/t9100/t8200/t8300Aug 3, 2026
CVE-2026-21551
30Monitor
In modem, there is a possible improper input validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
unisoc (shanghai) technologies co., ltd. · t8100/t9100/t8200/t8300Aug 3, 2026
CVE-2026-21552
30Monitor
In modem, there is a possible improper input validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
unisoc (shanghai) technologies co., ltd. · t8100/t9100/t8200/t8300Aug 3, 2026
CVE-2026-21553
30Monitor
In modem, there is a possible improper input validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
unisoc (shanghai) technologies co., ltd. · t8100/t9100/t8200/t8300Aug 3, 2026
CVE-2026-21554
30Monitor
In modem, there is a possible improper input validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
unisoc (shanghai) technologies co., ltd. · udx710Aug 3, 2026
CVE-2026-21555
30Monitor
In modem, there is a possible improper input validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
unisoc (shanghai) technologies co., ltd. · udx710Aug 3, 2026
CVE-2026-8793
27Monitor
PaperCut NG/MF: Insufficient brute-force protection
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
papercut · papercut ng/mfAug 3, 2026
CVE-2026-8794
27Monitor
PaperCut NG/MF: User enumeration via timing attack
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
papercut · papercut ng/mfAug 3, 2026
CVE-2026-63563
27Monitor
Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
sharp corporation · sharp mfpsAug 3, 2026
CVE-2026-0392
29Monitor
eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update
HighCVSS 7.3No exploitEPSS 0%
- pre-auth RCE
- Weak crypto
latvijas valsts radio un televīzijas centrs (lvrtc) · eparakstītājs 3.0Aug 3, 2026
CVE-2026-33591
40Plan
Authentication bypass on WaptServer
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
tranquil it systems · wapt serverAug 3, 2026
CVE-2026-69078
35Monitor
Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- SSRF
misp · cti-transmuteAug 3, 2026
CVE-2026-69079
34Monitor
Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
misp · cti-transmuteAug 3, 2026
CVE-2026-69082
35Monitor
Cross-Site Request Forgery in the Administrative User Deletion Endpoint
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
misp · cti-transmuteAug 3, 2026
CVE-2025-15672
32Monitor
Chama < 1.0.13 - Unauthenticated PHP Object Injection
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- Deserialization
unknown · chamawpAug 3, 2026
CVE-2026-18574
37Monitor
Authentication Bypass in Check Point Security Management Server
CriticalCVSS 9.3Proof of conceptEPSS 0%
- pre-auth RCE
- Auth bypass
checkpoint · security management serverAug 3, 2026
CVE-2026-18598
30Monitor
GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get_system_log command injection
HighCVSS 7.4No exploitEPSS 3%
- RCE
- Command injection
gl.inet · gl-mt3000Aug 3, 2026
CVE-2026-18599
30Monitor
GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injection
HighCVSS 7.3No exploitEPSS 4%
- RCE
- Command injection
gl.inet · gl-mt3000Aug 3, 2026
CVE-2026-2346
39Monitor
IDOR in Menulux Software's Mobile App
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
menulux software inc. · mobile appAug 3, 2026
CVE-2026-18089
30Monitor
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
timlegge · net\Aug 3, 2026
CVE-2026-18092
32Monitor
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
timlegge · net\Aug 3, 2026
CVE-2026-18108
39Monitor
Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content c
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
timlegge · net\Aug 3, 2026
CVE-2026-18600
30Monitor
GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection
HighCVSS 7.4No exploitEPSS 3%
- RCE
- Command injection
gl.inet · gl-mt3000Aug 3, 2026
CVE-2026-18601
36Monitor
GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injection
HighCVSS 8.9No exploitEPSS 3%
- pre-auth RCE
- Command injection
gl.inet · gl-mt3000Aug 3, 2026
CVE-2026-18642
31Monitor
Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Deserialization
tubitak bilgem software technologies research institute · eta-otp-lockAug 3, 2026
CVE-2026-64827
37Monitor
Telenia TVox 26.5.3 Authentication Bypass via set_env.php
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
telenia software · tvoxAug 3, 2026
CVE-2026-67608
35Monitor
Telenia TVox 26.5.3 OS Command Injection via action_audio.php
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
telenia software · tvoxAug 3, 2026
CVE-2026-68584
36Monitor
SiYuan before v3.7.3 Authentication Bypass via Content Endpoints
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
siyuan-note · siyuanAug 3, 2026
CVE-2026-68586
36Monitor
SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
siyuan-note · siyuanAug 3, 2026
CVE-2026-68587
36Monitor
SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
siyuan-note · siyuanAug 3, 2026
CVE-2026-69083
39Monitor
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
CriticalCVSS 9.9Proof of conceptEPSS 0%
- pre-auth RCE
- SQL injection
siyuan-note · siyuanAug 3, 2026
CVE-2026-69084
39Monitor
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
CriticalCVSS 9.9Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
siyuan-note · siyuanAug 3, 2026
CVE-2026-69085
39Monitor
SiYuan before v3.7.3 SQL Injection via searchDocs
CriticalCVSS 9.9Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
siyuan-note · siyuanAug 3, 2026
CVE-2026-69086
33Monitor
SiYuan before v3.7.3 Path Traversal via unvalidated avID
HighCVSS 8.3No exploitEPSS 0%
- Path traversal
siyuan-note · siyuanAug 3, 2026
CVE-2026-69087
28Monitor
Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Open redirect
getgrav · grav-plugin-formAug 3, 2026
CVE-2026-69091
34Monitor
Admidio before 5.0.11 Authentication Bypass via forum.php
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
admidio · admidioAug 3, 2026
CVE-2026-69093
28Monitor
Admidio before 5.0.11 CSRF via category-report preferences
HighCVSS 7.1No exploitEPSS 0%
- CSRF
admidio · admidioAug 3, 2026
CVE-2026-69095
34Monitor
OpenWrt luci-app-bmx7 Path Traversal via bmx7-info
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
openwrt · luciAug 3, 2026
CVE-2026-69096
35Monitor
OpenWrt luci-app-dockerman Read ACL Remote Code Execution
HighCVSS 8.7No exploitEPSS 3%
- RCE
- Command injection
openwrt · luciAug 3, 2026
CVE-2026-69097
29Monitor
GitPython before 3.1.53 Config Injection via Submodule Names
HighCVSS 7.3No exploitEPSS 0%
- RCE
gitpython project · gitpythonAug 3, 2026
CVE-2026-9390
36Monitor
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
xml\ · \Aug 3, 2026
CVE-2026-9487
36Monitor
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
xml\ · \Aug 3, 2026
CVE-2026-67609
34Monitor
Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
telenia software · tvoxAug 3, 2026
CVE-2026-15430
24Monitor
Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unpr
MediumCVSS 6.2Proof of conceptEPSS 0%
- Local privilege escalation
wellbia · xigncode3Aug 3, 2026