By publication date

Exploited and new serious CVEs: August 2026

5,838 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 23 of 59

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2026-32481No exploit	WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerabilityezoic · ezoic · CWE-288 Pre-auth Auth bypass	High7.5	—	0.4%	Aug 18, 2026
35Monitor	CVE-2026-50187No exploit	Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env filesohmyzsh · ohmyzsh · CWE-94 pre-auth RCE	High8.8	—	0.5%	Aug 18, 2026
29Monitor	CVE-2026-59825No exploit	Mastodon: Unwanted deactivation of SSL/TLS certificate verificationmastodon · mastodon · CWE-295 Pre-auth Weak crypto	High7.4	—	0.3%	Aug 18, 2026
35Monitor	CVE-2026-66793No exploit	Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spored hat · red hat advanced cluster management for kubernetes 2.11 · CWE-20 RCE	High8.8	—	0.8%	Aug 18, 2026
30Monitor	CVE-2026-69189No exploit	Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvershoppscotch · hoppscotch · CWE-200 Broken access control (IDOR) Info leak	High7.6	—	0.3%	Aug 18, 2026
30Monitor	CVE-2026-19500Proof of concept	SureForms contains an uncontrolled resource consumption vulnerabilitysureforms · sureforms · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Aug 18, 2026
35Monitor	CVE-2026-19501Proof of concept	CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controsureforms · sureforms · CWE-1236 Pre-auth	High8.8	—	0.5%	Aug 18, 2026
34Monitor	CVE-2026-45115No exploit	MyBB: Buddy/ignore list username XSSmybb · mybb · CWE-79 RCE XSS	High8.7	—	0.4%	Aug 18, 2026
34Monitor	CVE-2026-45116No exploit	MyBB: Profile field type confusion XSSmybb · mybb · CWE-79 RCE XSS	High8.7	—	0.4%	Aug 18, 2026
39Monitor	CVE-2026-45117No exploit	MyBB: Installer database configuration RCEmybb · mybb · CWE-94 pre-auth RCE	Critical9.8	—	1.1%	Aug 18, 2026
37Monitor	CVE-2026-45118No exploit	MyBB: Contact page reflected XSSmybb · mybb · CWE-83 pre-auth RCE XSS Open redirect	Critical9.3	—	0.5%	Aug 18, 2026
30Monitor	CVE-2026-15585No exploit	Path Traversal in AKIN Software's Wolvox9 ERPakin software computer import export industry and trade ltd. · akinsoft wolvox9 erp / kontrolpanel.exe · CWE-22 Pre-auth Path traversal	High7.5	—	0.5%	Aug 18, 2026
37Monitor	CVE-2026-74902No exploit	SiYuan before v3.7.4 XSS-to-RCE via malicious filename uploadsiyuan-note · siyuan · CWE-79 RCE XSS	Critical9.3	—	0.1%	Aug 18, 2026
34Monitor	CVE-2026-74904No exploit	SiYuan before v3.7.4 Missing Authorization via block APIsiyuan-note · siyuan · CWE-862 Pre-auth Broken access control (IDOR)	High8.7	—	0.4%	Aug 18, 2026
34Monitor	CVE-2026-74906No exploit	SiYuan before v3.7.4 Incorrect Authorization via Publish Accesssiyuan-note · siyuan · CWE-863 Pre-auth Broken access control (IDOR)	High8.7	—	0.3%	Aug 18, 2026
32Monitor	CVE-2026-74907No exploit	Grav before 2.0.15 Path Traversal via plugin-asset-map.phpgetgrav · grav · CWE-22 Pre-auth Path traversal	High8.2	—	0.4%	Aug 18, 2026
37Monitor	CVE-2026-75827Proof of concept	Grav before 2.0.15 Arbitrary File Write via error_loggetgrav · grav · CWE-94 pre-auth RCE	Critical9.3	—	0.8%	Aug 18, 2026
37Monitor	CVE-2026-75828No exploit	Grav before 2.0.15 Stored XSS via detectXss() Quote Bypassgetgrav · grav · CWE-79 XSS	Critical9.3	—	0.3%	Aug 18, 2026
34Monitor	CVE-2026-75829No exploit	grav-plugin-api before 1.0.15 Twig SSTI via translate endpointgetgrav · grav · CWE-1336 RCE SSTI	High8.6	—	0.4%	Aug 18, 2026
28Monitor	CVE-2026-75830No exploit	grav-plugin-api before 1.0.15 Path Traversal via batchCopygetgrav · grav · CWE-73 Path traversal	High7.1	—	0.3%	Aug 18, 2026
37Monitor	CVE-2026-75832No exploit	Grav API Plugin before 1.0.14 Authorization Bypassgetgrav · grav · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.2%	Aug 18, 2026
34Monitor	CVE-2026-75833No exploit	Grav API Plugin Open Redirect via Backslash Bypassgetgrav · grav · CWE-601 Open redirect	High8.6	—	0.2%	Aug 18, 2026
37Monitor	CVE-2026-75835No exploit	Grav API Plugin before 1.0.14 Missing Authorizationgetgrav · grav · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.3%	Aug 18, 2026
34Monitor	CVE-2026-75836No exploit	Grav API Plugin before 1.0.14 Missing Authorizationgetgrav · grav · CWE-862 Broken access control (IDOR)	High8.7	—	0.4%	Aug 18, 2026
37Monitor	CVE-2026-75837No exploit	Grav before 2.0.14 Privilege Escalation via Group Access Fieldgetgrav · grav · CWE-269 Pre-auth	Critical9.3	—	0.4%	Aug 18, 2026
34Monitor	CVE-2026-75840No exploit	ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regexarcadedata · arcadedb · CWE-1025 Pre-auth	High8.7	—	0.4%	Aug 18, 2026
33Monitor	CVE-2026-75842No exploit	ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSVarcadedata · arcadedb · CWE-22 Path traversal	High8.3	—	0.4%	Aug 18, 2026
37Monitor	CVE-2026-75843No exploit	ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transactionarcadedata · arcadedb · CWE-269	Critical9.4	—	0.3%	Aug 18, 2026
28Monitor	CVE-2026-75844No exploit	ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypassarcadedata · arcadedb · CWE-918 SSRF	High7.1	—	0.3%	Aug 18, 2026
28Monitor	CVE-2026-75846No exploit	ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTIONarcadedata · arcadedb · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Aug 18, 2026
37Monitor	CVE-2026-75851No exploit	ArcadeDB before 26.8.1 Authentication Bypass via Async Commandarcadedata · arcadedb · CWE-269 Auth bypass	Critical9.4	—	0.3%	Aug 18, 2026
37Monitor	CVE-2026-75852No exploit	ArcadeDB MongoDB wire protocol authentication bypass cross-databasearcadedata · arcadedb · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.6%	Aug 18, 2026
34Monitor	CVE-2026-75853No exploit	ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Databasearcadedata · arcadedb · CWE-862 Broken access control (IDOR)	High8.7	—	0.5%	Aug 18, 2026
37Monitor	CVE-2026-75854No exploit	ArcadeDB Redis Wire-Protocol Plugin Missing Authenticationarcadedata · arcadedb · CWE-306 pre-auth RCE Auth bypass	Critical9.3	—	0.8%	Aug 18, 2026
33Monitor	CVE-2026-75855Proof of concept	ArcadeDB before 26.8.1 Path Traversal via create/drop databasearcadedata · arcadedb · CWE-22 Path traversal	High8.4	—	0.5%	Aug 18, 2026
39Monitor	CVE-2026-67271No exploit	Dell PowerStore SDNAS, contains an Out-of-bounds Write vulnerability in SMB/CIFS.dell · powerstore 500t · CWE-787 pre-auth RCE Memory safety	Critical9.8	—	0.8%	Aug 18, 2026
32Monitor	CVE-2026-70415No exploit	Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC.dell · powerstore 500t · CWE-120 pre-auth RCE Memory safety	High8.1	—	0.6%	Aug 18, 2026
34Monitor	CVE-2026-75897No exploit	Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboardsopensearch · opensearch dashboards · CWE-1284 Pre-auth	High8.7	—	0.7%	Aug 18, 2026
34Monitor	CVE-2026-75924No exploit	Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approvalred hat · multicluster engine for kubernetes · CWE-269	High8.7	—	0.2%	Aug 18, 2026
35Monitor	CVE-2026-74946No exploit	Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL componentmozilla · firefox · CWE-119 Pre-auth Memory safety	High8.8	—	0.3%	Aug 18, 2026
35Monitor	CVE-2026-74949No exploit	Use-after-free in the Graphics: Canvas2D componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Aug 18, 2026
35Monitor	CVE-2026-74969No exploit	Race condition, use-after-free in the Layout: Text and Fonts componentmozilla · firefox · CWE-416 Pre-auth Memory safety Race condition	High8.8	—	0.3%	Aug 18, 2026
39Monitor	CVE-2026-74985No exploit	Privilege escalation in the Enterprise Policies componentmozilla · firefox · CWE-269 Pre-auth	Critical9.8	—	0.5%	Aug 18, 2026
39Monitor	CVE-2026-74987No exploit	Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154mozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.8	—	0.5%	Aug 18, 2026
39Monitor	CVE-2026-74988No exploit	Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154mozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.8	—	0.6%	Aug 18, 2026
39Monitor	CVE-2026-74989No exploit	Internally found bugs fixed in Firefox 154mozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.8	—	0.5%	Aug 18, 2026
39Monitor	CVE-2026-74990No exploit	Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154mozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.8	—	0.5%	Aug 18, 2026
34Monitor	CVE-2026-75783No exploit	TRENDnet TEW-WLC100P DHCP blobmsg netifd stack-based overflowtrendnet · tew-wlc100p · CWE-119 Pre-auth Memory safety	High8.6	—	0.5%	Aug 18, 2026
30Monitor	CVE-2026-24301Proof of concept	Microsoft Copilot Information Disclosure Vulnerabilitymicrosoft · copilot · CWE-77 pre-auth RCE Command injection	High7.5	—	1.1%	Aug 18, 2026
35Monitor	CVE-2026-28191No exploit	WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerabilitythemeone · the grid · CWE-266	High8.8	—	0.4%	Aug 18, 2026
38Monitor	CVE-2026-28192No exploit	WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerabilitypiotnet · piotnet addons for elementor pro · CWE-434 Pre-auth File upload	Critical9.6	—	0.4%	Aug 18, 2026
30Monitor	CVE-2026-28567No exploit	WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerabilityfahad mahmood · wp sort order · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 18, 2026
28Monitor	CVE-2026-28568No exploit	WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerabilitymohamed magdy · quill forms · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
28Monitor	CVE-2026-28569No exploit	WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerabilityssl zen · ssl zen · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
32Monitor	CVE-2026-28570No exploit	WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerabilityspabrice · vavo core · CWE-98 Pre-auth	High8.1	—	0.4%	Aug 18, 2026
30Monitor	CVE-2026-28571No exploit	WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerabilitywppool · formychat · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 18, 2026
28Monitor	CVE-2026-32333No exploit	WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityteconcetheme · mayosis core · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
39Monitor	CVE-2026-32444No exploit	WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerabilitycwicly · cwicly · CWE-94 RCE	Critical9.9	—	0.7%	Aug 18, 2026
39Monitor	CVE-2026-32463No exploit	WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerabilitykamlesh parmar · sync post with other site · CWE-434 File upload	Critical9.9	—	0.4%	Aug 18, 2026
32Monitor	CVE-2026-32464No exploit	WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerabilityvladimir prelovac · theme test drive · CWE-98 Pre-auth	High8.1	—	0.4%	Aug 18, 2026
35Monitor	CVE-2026-32465No exploit	WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerabilityg5theme · essential real estate · CWE-502 Deserialization	High8.8	—	0.5%	Aug 18, 2026
34Monitor	CVE-2026-32466No exploit	WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerabilitywpexperts · gravity forms bookings premium · CWE-89 SQL injection	High8.5	—	0.3%	Aug 18, 2026
30Monitor	CVE-2026-32468No exploit	WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerabilityrayhanduitku · duitku payment gateway · CWE-497 Pre-auth Info leak	High7.5	—	0.4%	Aug 18, 2026
30Monitor	CVE-2026-50575No exploit	BetterDesk has a replay behavior vulnerability when devices are deletedunitronix · betterdesk · CWE-294 Pre-auth Auth bypass	High7.7	—	0.2%	Aug 18, 2026
39Monitor	CVE-2021-43716Proof of concept	Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20.CWE-347 Pre-auth Weak crypto	Critical9.8	—	0.3%	Aug 18, 2026
39Monitor	CVE-2021-43717Proof of concept	An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6.CWE-798 Pre-auth Hard-coded credentials	Critical9.8	—	0.6%	Aug 18, 2026
29Monitor	CVE-2026-32657No exploit	Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax Versiondell · appsync · CWE-61 Local privilege escalation	High7.3	—	0.1%	Aug 18, 2026
32Monitor	CVE-2026-44472No exploit	Saleor: Account pre-hijacking vulnerability due to unverified anonymous order mergesaleor · saleor · CWE-287 Pre-auth Auth bypass	High8.1	—	0.6%	Aug 18, 2026
39Monitor	CVE-2026-52608No exploit	An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into theCWE-284 pre-auth RCE Broken access control (IDOR)	Critical9.8	—	0.8%	Aug 18, 2026
36Monitor	CVE-2026-52610No exploit	An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files anyCWE-22 Pre-auth Path traversal	Critical9.1	—	1.1%	Aug 18, 2026
32Monitor	CVE-2026-67262No exploit	Dell PowerStore contains a Missing Authorization vulnerability.dell · powerstore 500t · CWE-862 Pre-auth Broken access control (IDOR)	High8.1	—	0.3%	Aug 18, 2026
31Monitor	CVE-2026-67846No exploit	Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issCWE-266 Local privilege escalation	High7.8	—	0.1%	Aug 18, 2026
37Monitor	CVE-2026-67921Proof of concept	Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.CWE-352 pre-auth RCE CSRF	Critical9.3	—	0.2%	Aug 18, 2026
31Monitor	CVE-2026-71551No exploit	Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelistsuper-productivity · super-productivity · CWE-78 RCE Local privilege escalation Command injection	High7.8	—	0.2%	Aug 18, 2026
21Monitor	CVE-2021-43718Proof of concept	An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a DenCWE-288 Pre-auth Auth bypass Denial of service	Medium5.3	—	0.5%	Aug 18, 2026
28Monitor	CVE-2026-17106Proof of concept	Tar extraction in moby/go-archive can write outside the destination directory via link followingmoby · go-archive · CWE-59	High7.1	—	0.4%	Aug 18, 2026
35Monitor	CVE-2026-24184No exploit	NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where an unauthenticated attackenvidia · cumulus linux · CWE-120 Pre-auth Memory safety	High8.8	—	0.4%	Aug 18, 2026
29Monitor	CVE-2026-18534No exploit	Address bar spoofing risk in affected iOS versions of Arc Searchthe browser company of new york · arcsearch · CWE-1021 Pre-auth	High7.4	—	0.3%	Aug 18, 2026
39Monitor	CVE-2026-32470No exploit	WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerabilityroxnor · fundengine · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 18, 2026
30Monitor	CVE-2026-32472No exploit	WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerabilitywbolt.com · online contact widget · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 18, 2026
28Monitor	CVE-2026-32473No exploit	WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerabilitydeknows · pdf smart viewer for elementor · CWE-918 Pre-auth SSRF	High7.2	—	0.2%	Aug 18, 2026
39Monitor	CVE-2026-32474No exploit	WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerabilitywpwax · templatiq · CWE-434 File upload	Critical9.9	—	0.4%	Aug 18, 2026
28Monitor	CVE-2026-32547No exploit	WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerabilitywordplus · bp better messages · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
30Monitor	CVE-2026-32549No exploit	WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerabilitycodexpert, inc · thumbpress · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 18, 2026
28Monitor	CVE-2026-32553No exploit	WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerabilitybrainstorm force · ottokit · CWE-918 Pre-auth SSRF	High7.2	—	0.2%	Aug 18, 2026
33Monitor	CVE-2026-45733No exploit	Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop apptriliumnext · trilium · CWE-79 RCE XSS	High8.3	—	0.4%	Aug 18, 2026
28Monitor	CVE-2026-48798No exploit	SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenamessshnet · ssh.net · CWE-22 Pre-auth Path traversal	High7.1	—	0.4%	Aug 18, 2026
32Monitor	CVE-2026-50138No exploit	goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flagspatrickhener · goshs · CWE-284 Broken access control (IDOR)	High8.1	—	0.3%	Aug 18, 2026
30Monitor	CVE-2026-56684No exploit	Valkey: TLS pending-data processing use-after-free may allow remote code executionvalkey-io · valkey · CWE-416 RCE Memory safety	High7.5	—	0.5%	Aug 18, 2026
39Monitor	CVE-2026-59940No exploit	Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserializationlxsmnsyc · seroval · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	0.8%	Aug 18, 2026
35Monitor	CVE-2026-61407No exploit	Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability.dell · watchdog timer driver · CWE-698 Local privilege escalation	High8.8	—	0.1%	Aug 18, 2026
35Monitor	CVE-2026-63639No exploit	Valkey: UAF in stream deserialization may lead to remote code executionvalkey-io · valkey · CWE-416 RCE Deserialization Memory safety	High8.8	—	0.8%	Aug 18, 2026
34Monitor	CVE-2026-66046No exploit	Expat Denial of Service via storeAtts() Quadratic Complexitylibexpat project · libexpat · CWE-407 Pre-auth	High8.7	—	0.7%	Aug 18, 2026
28Monitor	CVE-2026-66620No exploit	WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerabilityderek herman · optiontree · CWE-502 Deserialization	High7.2	—	0.5%	Aug 18, 2026
28Monitor	CVE-2026-66621No exploit	WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerabilitymapsteps ug · ultimate dashboard pro · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
30Monitor	CVE-2026-66622No exploit	WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerabilityaverta · depicter slider · CWE-89 Pre-auth SQL injection	High7.5	—	0.3%	Aug 18, 2026
39Monitor	CVE-2026-66627No exploit	WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerabilityedge22 studios ltd. · gp premium · CWE-434 File upload	Critical9.9	—	0.4%	Aug 18, 2026
28Monitor	CVE-2026-66629No exploit	WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerabilitythemeum · kirki · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
28Monitor	CVE-2026-66633No exploit	WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerabilitywpmanageninja · fluent forms pro add on pack · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 18, 2026
29Monitor	CVE-2026-66635No exploit	WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability10web · slider by 10web · CWE-352 Pre-auth CSRF Denial of service	High7.4	—	0.1%	Aug 18, 2026

CVE-2026-32481
30Monitor
WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
ezoic · ezoicAug 18, 2026
CVE-2026-50187
35Monitor
Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
ohmyzsh · ohmyzshAug 18, 2026
CVE-2026-59825
29Monitor
Mastodon: Unwanted deactivation of SSL/TLS certificate verification
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
mastodon · mastodonAug 18, 2026
CVE-2026-66793
35Monitor
Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spo
HighCVSS 8.8No exploitEPSS 0%
- RCE
red hat · red hat advanced cluster management for kubernetes 2.11Aug 18, 2026
CVE-2026-69189
30Monitor
Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
- Info leak
hoppscotch · hoppscotchAug 18, 2026
CVE-2026-19500
30Monitor
SureForms contains an uncontrolled resource consumption vulnerability
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
sureforms · sureformsAug 18, 2026
CVE-2026-19501
35Monitor
CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-contro
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
sureforms · sureformsAug 18, 2026
CVE-2026-45115
34Monitor
MyBB: Buddy/ignore list username XSS
HighCVSS 8.7No exploitEPSS 0%
- RCE
- XSS
mybb · mybbAug 18, 2026
CVE-2026-45116
34Monitor
MyBB: Profile field type confusion XSS
HighCVSS 8.7No exploitEPSS 0%
- RCE
- XSS
mybb · mybbAug 18, 2026
CVE-2026-45117
39Monitor
MyBB: Installer database configuration RCE
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
mybb · mybbAug 18, 2026
CVE-2026-45118
37Monitor
MyBB: Contact page reflected XSS
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- XSS
- Open redirect
mybb · mybbAug 18, 2026
CVE-2026-15585
30Monitor
Path Traversal in AKIN Software's Wolvox9 ERP
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
akin software computer import export industry and trade ltd. · akinsoft wolvox9 erp / kontrolpanel.exeAug 18, 2026
CVE-2026-74902
37Monitor
SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload
CriticalCVSS 9.3No exploitEPSS 0%
- RCE
- XSS
siyuan-note · siyuanAug 18, 2026
CVE-2026-74904
34Monitor
SiYuan before v3.7.4 Missing Authorization via block API
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
siyuan-note · siyuanAug 18, 2026
CVE-2026-74906
34Monitor
SiYuan before v3.7.4 Incorrect Authorization via Publish Access
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
siyuan-note · siyuanAug 18, 2026
CVE-2026-74907
32Monitor
Grav before 2.0.15 Path Traversal via plugin-asset-map.php
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
getgrav · gravAug 18, 2026
CVE-2026-75827
37Monitor
Grav before 2.0.15 Arbitrary File Write via error_log
CriticalCVSS 9.3Proof of conceptEPSS 0%
- pre-auth RCE
getgrav · gravAug 18, 2026
CVE-2026-75828
37Monitor
Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass
CriticalCVSS 9.3No exploitEPSS 0%
- XSS
getgrav · gravAug 18, 2026
CVE-2026-75829
34Monitor
grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint
HighCVSS 8.6No exploitEPSS 0%
- RCE
- SSTI
getgrav · gravAug 18, 2026
CVE-2026-75830
28Monitor
grav-plugin-api before 1.0.15 Path Traversal via batchCopy
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
getgrav · gravAug 18, 2026
CVE-2026-75832
37Monitor
Grav API Plugin before 1.0.14 Authorization Bypass
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
getgrav · gravAug 18, 2026
CVE-2026-75833
34Monitor
Grav API Plugin Open Redirect via Backslash Bypass
HighCVSS 8.6No exploitEPSS 0%
- Open redirect
getgrav · gravAug 18, 2026
CVE-2026-75835
37Monitor
Grav API Plugin before 1.0.14 Missing Authorization
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
getgrav · gravAug 18, 2026
CVE-2026-75836
34Monitor
Grav API Plugin before 1.0.14 Missing Authorization
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
getgrav · gravAug 18, 2026
CVE-2026-75837
37Monitor
Grav before 2.0.14 Privilege Escalation via Group Access Field
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
getgrav · gravAug 18, 2026
CVE-2026-75840
34Monitor
ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
arcadedata · arcadedbAug 18, 2026
CVE-2026-75842
33Monitor
ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV
HighCVSS 8.3No exploitEPSS 0%
- Path traversal
arcadedata · arcadedbAug 18, 2026
CVE-2026-75843
37Monitor
ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction
CriticalCVSS 9.4No exploitEPSS 0%
arcadedata · arcadedbAug 18, 2026
CVE-2026-75844
28Monitor
ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass
HighCVSS 7.1No exploitEPSS 0%
- SSRF
arcadedata · arcadedbAug 18, 2026
CVE-2026-75846
28Monitor
ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
arcadedata · arcadedbAug 18, 2026
CVE-2026-75851
37Monitor
ArcadeDB before 26.8.1 Authentication Bypass via Async Command
CriticalCVSS 9.4No exploitEPSS 0%
- Auth bypass
arcadedata · arcadedbAug 18, 2026
CVE-2026-75852
37Monitor
ArcadeDB MongoDB wire protocol authentication bypass cross-database
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
arcadedata · arcadedbAug 18, 2026
CVE-2026-75853
34Monitor
ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
arcadedata · arcadedbAug 18, 2026
CVE-2026-75854
37Monitor
ArcadeDB Redis Wire-Protocol Plugin Missing Authentication
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
arcadedata · arcadedbAug 18, 2026
CVE-2026-75855
33Monitor
ArcadeDB before 26.8.1 Path Traversal via create/drop database
HighCVSS 8.4Proof of conceptEPSS 0%
- Path traversal
arcadedata · arcadedbAug 18, 2026
CVE-2026-67271
39Monitor
Dell PowerStore SDNAS, contains an Out-of-bounds Write vulnerability in SMB/CIFS.
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
dell · powerstore 500tAug 18, 2026
CVE-2026-70415
32Monitor
Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC.
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- Memory safety
dell · powerstore 500tAug 18, 2026
CVE-2026-75897
34Monitor
Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboards
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
opensearch · opensearch dashboardsAug 18, 2026
CVE-2026-75924
34Monitor
Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval
HighCVSS 8.7No exploitEPSS 0%
red hat · multicluster engine for kubernetesAug 18, 2026
CVE-2026-74946
35Monitor
Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxAug 18, 2026
CVE-2026-74949
35Monitor
Use-after-free in the Graphics: Canvas2D component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxAug 18, 2026
CVE-2026-74969
35Monitor
Race condition, use-after-free in the Layout: Text and Fonts component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
- Race condition
mozilla · firefoxAug 18, 2026
CVE-2026-74985
39Monitor
Privilege escalation in the Enterprise Policies component
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxAug 18, 2026
CVE-2026-74987
39Monitor
Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxAug 18, 2026
CVE-2026-74988
39Monitor
Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxAug 18, 2026
CVE-2026-74989
39Monitor
Internally found bugs fixed in Firefox 154
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxAug 18, 2026
CVE-2026-74990
39Monitor
Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxAug 18, 2026
CVE-2026-75783
34Monitor
TRENDnet TEW-WLC100P DHCP blobmsg netifd stack-based overflow
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Memory safety
trendnet · tew-wlc100pAug 18, 2026
CVE-2026-24301
30Monitor
Microsoft Copilot Information Disclosure Vulnerability
HighCVSS 7.5Proof of conceptEPSS 1%
- pre-auth RCE
- Command injection
microsoft · copilotAug 18, 2026
CVE-2026-28191
35Monitor
WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability
HighCVSS 8.8No exploitEPSS 0%
themeone · the gridAug 18, 2026
CVE-2026-28192
38Monitor
WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- File upload
piotnet · piotnet addons for elementor proAug 18, 2026
CVE-2026-28567
30Monitor
WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
fahad mahmood · wp sort orderAug 18, 2026
CVE-2026-28568
28Monitor
WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
mohamed magdy · quill formsAug 18, 2026
CVE-2026-28569
28Monitor
WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
ssl zen · ssl zenAug 18, 2026
CVE-2026-28570
32Monitor
WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
spabrice · vavo coreAug 18, 2026
CVE-2026-28571
30Monitor
WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wppool · formychatAug 18, 2026
CVE-2026-32333
28Monitor
WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
teconcetheme · mayosis coreAug 18, 2026
CVE-2026-32444
39Monitor
WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
cwicly · cwiclyAug 18, 2026
CVE-2026-32463
39Monitor
WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- File upload
kamlesh parmar · sync post with other siteAug 18, 2026
CVE-2026-32464
32Monitor
WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
vladimir prelovac · theme test driveAug 18, 2026
CVE-2026-32465
35Monitor
WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
g5theme · essential real estateAug 18, 2026
CVE-2026-32466
34Monitor
WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
wpexperts · gravity forms bookings premiumAug 18, 2026
CVE-2026-32468
30Monitor
WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
rayhanduitku · duitku payment gatewayAug 18, 2026
CVE-2026-50575
30Monitor
BetterDesk has a replay behavior vulnerability when devices are deleted
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
unitronix · betterdeskAug 18, 2026
CVE-2021-43716
39Monitor
Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
Aug 18, 2026
CVE-2021-43717
39Monitor
An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Hard-coded credentials
Aug 18, 2026
CVE-2026-32657
29Monitor
Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax Version
HighCVSS 7.3No exploitEPSS 0%
- Local privilege escalation
dell · appsyncAug 18, 2026
CVE-2026-44472
32Monitor
Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
saleor · saleorAug 18, 2026
CVE-2026-52608
39Monitor
An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
Aug 18, 2026
CVE-2026-52610
36Monitor
An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files any
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- Path traversal
Aug 18, 2026
CVE-2026-67262
32Monitor
Dell PowerStore contains a Missing Authorization vulnerability.
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
dell · powerstore 500tAug 18, 2026
CVE-2026-67846
31Monitor
Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment iss
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
Aug 18, 2026
CVE-2026-67921
37Monitor
Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.
CriticalCVSS 9.3Proof of conceptEPSS 0%
- pre-auth RCE
- CSRF
Aug 18, 2026
CVE-2026-71551
31Monitor
Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
super-productivity · super-productivityAug 18, 2026
CVE-2021-43718
21Monitor
An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Den
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
- Denial of service
Aug 18, 2026
CVE-2026-17106
28Monitor
Tar extraction in moby/go-archive can write outside the destination directory via link following
HighCVSS 7.1Proof of conceptEPSS 0%
moby · go-archiveAug 18, 2026
CVE-2026-24184
35Monitor
NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where an unauthenticated attacke
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
nvidia · cumulus linuxAug 18, 2026
CVE-2026-18534
29Monitor
Address bar spoofing risk in affected iOS versions of Arc Search
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
the browser company of new york · arcsearchAug 18, 2026
CVE-2026-32470
39Monitor
WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
roxnor · fundengineAug 18, 2026
CVE-2026-32472
30Monitor
WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wbolt.com · online contact widgetAug 18, 2026
CVE-2026-32473
28Monitor
WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- SSRF
deknows · pdf smart viewer for elementorAug 18, 2026
CVE-2026-32474
39Monitor
WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- File upload
wpwax · templatiqAug 18, 2026
CVE-2026-32547
28Monitor
WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wordplus · bp better messagesAug 18, 2026
CVE-2026-32549
30Monitor
WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
codexpert, inc · thumbpressAug 18, 2026
CVE-2026-32553
28Monitor
WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- SSRF
brainstorm force · ottokitAug 18, 2026
CVE-2026-45733
33Monitor
Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app
HighCVSS 8.3No exploitEPSS 0%
- RCE
- XSS
triliumnext · triliumAug 18, 2026
CVE-2026-48798
28Monitor
SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Path traversal
sshnet · ssh.netAug 18, 2026
CVE-2026-50138
32Monitor
goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
patrickhener · goshsAug 18, 2026
CVE-2026-56684
30Monitor
Valkey: TLS pending-data processing use-after-free may allow remote code execution
HighCVSS 7.5No exploitEPSS 0%
- RCE
- Memory safety
valkey-io · valkeyAug 18, 2026
CVE-2026-59940
39Monitor
Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
lxsmnsyc · serovalAug 18, 2026
CVE-2026-61407
35Monitor
Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability.
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
dell · watchdog timer driverAug 18, 2026
CVE-2026-63639
35Monitor
Valkey: UAF in stream deserialization may lead to remote code execution
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Deserialization
- Memory safety
valkey-io · valkeyAug 18, 2026
CVE-2026-66046
34Monitor
Expat Denial of Service via storeAtts() Quadratic Complexity
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
libexpat project · libexpatAug 18, 2026
CVE-2026-66620
28Monitor
WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
derek herman · optiontreeAug 18, 2026
CVE-2026-66621
28Monitor
WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
mapsteps ug · ultimate dashboard proAug 18, 2026
CVE-2026-66622
30Monitor
WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
averta · depicter sliderAug 18, 2026
CVE-2026-66627
39Monitor
WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- File upload
edge22 studios ltd. · gp premiumAug 18, 2026
CVE-2026-66629
28Monitor
WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
themeum · kirkiAug 18, 2026
CVE-2026-66633
28Monitor
WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wpmanageninja · fluent forms pro add on packAug 18, 2026
CVE-2026-66635
29Monitor
WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- CSRF
- Denial of service
10web · slider by 10webAug 18, 2026