By publication date

Exploited and new serious CVEs: August 2026

4,214 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 26 of 43

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2026-74713No exploit	vhost_iotlb: bound map allocation in add_rangelinux · linux Denial of service	High7.1	—	0.1%	Aug 22, 2026
31Monitor	CVE-2026-74714No exploit	bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()linux · linux	High7.8	—	0.1%	Aug 22, 2026
31Monitor	CVE-2026-74715No exploit	bpf: Fix netns reference imbalance in conntrack kfuncslinux · linux	High7.8	—	0.1%	Aug 22, 2026
30Monitor	CVE-2026-74717No exploit	net/mlx5: fw_tracer, return NULL on create errorlinux · linux Pre-auth Denial of service	High7.5	—	0.5%	Aug 22, 2026
31Monitor	CVE-2026-74720No exploit	bpf: Preserve pointer state for commuted arithmeticlinux · linux	High7.8	—	0.1%	Aug 22, 2026
31Monitor	CVE-2026-74721No exploit	accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()linux · linux	High7.8	—	0.1%	Aug 22, 2026
39Monitor	CVE-2026-74723No exploit	btrfs: lzo: reject inline extents without valid headerslinux · linux Pre-auth	Critical9.8	—	0.4%	Aug 22, 2026
31Monitor	CVE-2026-74724No exploit	ipvs: avoid out-of-bounds write in ip_vs_nat_icmplinux · linux	High7.8	—	0.1%	Aug 22, 2026
31Monitor	CVE-2026-74725No exploit	enic: fix tx_hang_reset use-after-free on device removallinux · linux	High7.8	—	0.1%	Aug 22, 2026
29Monitor	CVE-2026-74726No exploit	bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitorlinux · linux	High7.3	—	0.1%	Aug 22, 2026
39Monitor	CVE-2026-74727Proof of concept	ovpn: skip rehash for peers already removed from by_idlinux · linux Pre-auth	Critical9.8	—	0.4%	Aug 22, 2026
39Monitor	CVE-2026-74730No exploit	NFS: Pin the 'struct nfs_server' during a FREE_STATEID calllinux · linux Pre-auth	Critical9.8	—	0.5%	Aug 22, 2026
31Monitor	CVE-2026-74731No exploit	sched_ext: Skip sub-disable teardown for never-linked sub-schedulerslinux · linux	High7.8	—	0.1%	Aug 22, 2026
31Monitor	CVE-2026-74733No exploit	gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap locklinux · linux	High7.8	—	0.1%	Aug 22, 2026
30Monitor	CVE-2026-47895No exploit	In strongSwan before 6.0.7, identity parsing/cloning is mishandled.strongswan · strongswan · CWE-415 Memory safety	High7.5	—	0.4%	Aug 22, 2026
33Monitor	CVE-2026-78122Proof of concept	docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystemstecnativa · docker-socket-proxy · CWE-1220 Pre-auth	High8.3	—	0.3%	Aug 22, 2026
35Monitor	CVE-2026-0551No exploit	PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_rolesbuildwps · ppwp – password protect pages · CWE-502 Deserialization	High8.8	—	0.7%	Aug 23, 2026
35Monitor	CVE-2026-16149No exploit	Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwritemarc4 · security hardener · CWE-269	High8.8	—	0.5%	Aug 23, 2026
34Monitor	CVE-2026-78050No exploit	Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflowcomfast · cf-n1-s · CWE-119 Memory safety	High8.6	—	0.7%	Aug 23, 2026
31Monitor	CVE-2026-78136No exploit	chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data.chirpmyradio · chirp · CWE-95 RCE	High7.8	—	0.2%	Aug 23, 2026
39Monitor	CVE-2026-13598No exploit	RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administratorunknown · restrictmate · CWE-269 Pre-auth	Critical9.8	—	0.4%	Aug 23, 2026
28Monitor	CVE-2026-77115No exploit	Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parametersunknown · brave · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 23, 2026
35Monitor	CVE-2026-10053Proof of concept	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabgitlab · gitlab · CWE-22 RCE Path traversal	High8.8	—	0.9%	Aug 23, 2026
39Monitor	CVE-2026-78155No exploit	Untrusted Search Path in StackGresongres · stackgres · CWE-426	Critical9.9	—	0.5%	Aug 23, 2026
34Monitor	CVE-2026-4671No exploit	justhtml before 1.18.0 Denial of Service via CSS Selectoremilstenstrom · justhtml · CWE-400 Pre-auth Denial of service	High8.7	—	0.6%	Aug 23, 2026
37Monitor	CVE-2026-5388No exploit	justhtml before 1.15.0 Multiple Security Issuesemilstenstrom · justhtml · CWE-20 Pre-auth	Critical9.3	—	0.5%	Aug 23, 2026
37Monitor	CVE-2026-7808No exploit	justhtml before 1.16.0 Multiple Security Issues via Sanitizationemilstenstrom · justhtml · CWE-20 Pre-auth XSS	Critical9.3	—	0.5%	Aug 23, 2026
37Monitor	CVE-2026-8445No exploit	justhtml before 1.12.0 Sanitizer Bypass via Markdownemilstenstrom · justhtml · CWE-79 Pre-auth XSS	Critical9.3	—	0.6%	Aug 23, 2026
34Monitor	CVE-2026-9769No exploit	justhtml before 1.10.0 Denial of Service via deeply nested HTMLemilstenstrom · justhtml · CWE-674 Pre-auth Denial of service	High8.7	—	0.3%	Aug 23, 2026
39Monitor	CVE-2026-78183No exploit	DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_floatCWE-787 Pre-auth Memory safety	Critical9.8	—	0.6%	Aug 23, 2026
28Monitor	CVE-2026-78203No exploit	Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swapghostmanager · ghostwriter · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Aug 24, 2026
34Monitor	CVE-2026-78206No exploit	exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompressionexceljs · exceljs · CWE-409 Pre-auth	High8.7	—	0.6%	Aug 24, 2026
37Monitor	CVE-2026-78207No exploit	exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serializationexceljs · exceljs · CWE-1321 Pre-auth Prototype pollution	Critical9.3	—	0.6%	Aug 24, 2026
34Monitor	CVE-2026-78208No exploit	exceljs through 4.4.0 Path Traversal via Unvalidated addImage filenameexceljs · exceljs · CWE-73 Pre-auth Path traversal	High8.7	—	0.5%	Aug 24, 2026
33Monitor	CVE-2026-78209No exploit	exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Valuesexceljs · exceljs · CWE-1236 Pre-auth	High8.4	—	0.4%	Aug 24, 2026
37Monitor	CVE-2026-78167No exploit	EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authenticationefm · iptime t16000m · CWE-287 Pre-auth Auth bypass	Critical9.3	—	1.4%	Aug 24, 2026
35Monitor	CVE-2026-78168No exploit	EFM ipTIME T24000M Session Validation httpcon_check_session_url improper authenticationefm · iptime t24000m · CWE-287 Pre-auth Auth bypass	High8.9	—	1.3%	Aug 24, 2026
34Monitor	CVE-2026-78169No exploit	UTT HiPER 1250GW HTTP Request aspRemoteApConfTempSend strcpy stack-based overflowutt · hiper 1250gw · CWE-119 Memory safety	High8.6	—	0.7%	Aug 24, 2026
29Monitor	CVE-2026-78170No exploit	UTT HiPER 1200GW formConfigFastDirectionW strcpy buffer overflowutt · hiper 1200gw · CWE-119 Memory safety	High7.4	—	0.7%	Aug 24, 2026
35Monitor	CVE-2026-19200No exploit	Velociraptor Analyst overwrites live built-in artifacts through verify()rapid7 · velociraptor · CWE-94 RCE	High8.9	—	0.3%	Aug 24, 2026
38Monitor	CVE-2026-78211No exploit	4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command Injection4mosan security technology · 4mosan gcb doctor · CWE-78 pre-auth RCE Command injection	Critical9.3	—	2.0%	Aug 24, 2026
34Monitor	CVE-2026-78212No exploit	4MOSAn Security Technology｜4MOSAn Management Center - Arbitrary File Read4mosan security technology · 4mosan management center · CWE-23 Pre-auth Path traversal	High8.7	—	0.6%	Aug 24, 2026
33Monitor	CVE-2026-59561No exploit	Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability.sakura editor development community · sakura editor · CWE-78 RCE Command injection	High8.4	—	1.0%	Aug 24, 2026
37Monitor	CVE-2026-77994No exploit	Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5joomlack.fr · page builder ck extension for joomla · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.3%	Aug 24, 2026
34Monitor	CVE-2026-78255No exploit	DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Mediadji · neo · CWE-306 Pre-auth Auth bypass	High8.7	—	0.4%	Aug 24, 2026
34Monitor	CVE-2026-78306Proof of concept	DJI Drone Bluetooth Interface Unauthenticated DUML Command Executiondji · neo · CWE-306 pre-auth RCE Auth bypass	High8.5	—	0.2%	Aug 24, 2026
39Monitor	CVE-2026-66897No exploit	Instance template path traversal allows arbitrary host file write as rootcanonical · lxd · CWE-22 Path traversal	Critical9.9	—	0.7%	Aug 24, 2026
30Monitor	CVE-2026-75899No exploit	fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingopenjsf · fast-uri · CWE-174 Pre-auth SSRF	High7.5	—	0.2%	Aug 24, 2026
30Monitor	CVE-2026-75931No exploit	fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative referencesopenjsf · fast-uri · CWE-436 Pre-auth	High7.5	—	0.3%	Aug 24, 2026
30Monitor	CVE-2026-75975No exploit	fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizationopenjsf · fast-uri · CWE-20 Pre-auth SSRF	High7.5	—	0.2%	Aug 24, 2026
35Monitor	CVE-2026-78314No exploit	DIAEnergie - SQL Injectiondeltaww · diaenergie · CWE-89 RCE SQL injection	High8.8	—	0.6%	Aug 24, 2026
35Monitor	CVE-2026-78315No exploit	DIAEnergie - SQL Injectiondeltaww · diaenergie · CWE-89 RCE SQL injection	High8.8	—	0.6%	Aug 24, 2026
35Monitor	CVE-2026-78316No exploit	DIAEnergie - SQL Injectiondeltaww · diaenergie · CWE-89 RCE SQL injection	High8.8	—	0.6%	Aug 24, 2026
35Monitor	CVE-2026-78317No exploit	DIAEnergie - SQL Injectiondeltaww · diaenergie · CWE-89 RCE SQL injection	High8.8	—	0.6%	Aug 24, 2026
33Monitor	CVE-2026-10582No exploit	Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validationgohugoio · hugo · CWE-918 Pre-auth SSRF	High8.3	—	0.4%	Aug 24, 2026
30Monitor	CVE-2026-76172No exploit	fast-uri vulnerable to host confusion via percent-encoded scheme normalizationopenjsf · fast-uri · CWE-177 Pre-auth SSRF	High7.5	—	0.2%	Aug 24, 2026
34Monitor	CVE-2025-63080No exploit	Authenticated RCE in KAON PG5298kaon · pg5298a · CWE-863 RCE Broken access control (IDOR)	High8.5	—	0.2%	Aug 24, 2026
32Monitor	CVE-2026-28151No exploit	WordPress Tonda theme < 2.6 - Local File Inclusion vulnerabilityselect-themes · tonda · CWE-98 Pre-auth	High8.1	—	0.4%	Aug 24, 2026
32Monitor	CVE-2026-28152No exploit	WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerabilityselect-themes · tonda core · CWE-98 Pre-auth	High8.1	—	0.4%	Aug 24, 2026
30Monitor	CVE-2026-28153No exploit	WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerabilitynotification master · notification master – real-time wordpress notifications with email, sms, webhooks & more · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-28162No exploit	WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerabilityfranky · events made easy · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
39Monitor	CVE-2026-28165No exploit	WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerabilityunitedover, llc · digits · CWE-266 Pre-auth	Critical9.8	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-28166No exploit	WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerabilitygoodlayers · tourmaster · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
30Monitor	CVE-2026-28167No exploit	WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerabilitysuper forms · super forms · CWE-22 Pre-auth Path traversal	High7.5	—	0.5%	Aug 24, 2026
34Monitor	CVE-2026-28171No exploit	WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerabilityvanquish · woocommerce file approval · CWE-22 Pre-auth Path traversal Denial of service	High8.6	—	0.5%	Aug 24, 2026
28Monitor	CVE-2026-28190No exploit	WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerabilitythemebing · prolancer element · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Aug 24, 2026
34Monitor	CVE-2026-32471No exploit	WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerabilitythemebing · prolancer element · CWE-89 SQL injection	High8.5	—	0.3%	Aug 24, 2026
28Monitor	CVE-2026-32476No exploit	WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerabilityamplebyte pvt limited · brave conversion engine (pro) · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
34Monitor	CVE-2026-32477No exploit	WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerabilityradiustheme, llc · shopbuilder pro – elementor woocommerce builder addons · CWE-22 Pre-auth Path traversal Denial of service	High8.6	—	0.5%	Aug 24, 2026
34Monitor	CVE-2026-32478No exploit	WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerabilitywedevs pte. ltd · wp project manager pro · CWE-89 SQL injection	High8.5	—	0.3%	Aug 24, 2026
37Monitor	CVE-2026-32551No exploit	WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerabilitydivinext · woo essential · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 24, 2026
39Monitor	CVE-2026-32558No exploit	WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerabilityredefiningtheweb · affiliate pro - affiliate program for woocommerce & wordpress · CWE-266 Pre-auth	Critical9.8	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-66584No exploit	WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerabilitycode for recovery · 12 step meeting list · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
30Monitor	CVE-2026-66585No exploit	WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerabilitywpcafe · wp cafe pro · CWE-201 Pre-auth	High7.5	—	0.4%	Aug 24, 2026
39Monitor	CVE-2026-66587No exploit	WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerabilitywpcafe · wp cafe pro · CWE-98 Pre-auth	Critical9.8	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-66599No exploit	WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerabilityliquid web / stellarwp · wpcomplete · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
28Monitor	CVE-2026-66610No exploit	WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerabilitythembay · urna · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
28Monitor	CVE-2026-66623No exploit	WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerabilityinisev · social media & share icons · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
39Monitor	CVE-2026-66648No exploit	WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerabilitymvpthemes · jawn · CWE-266 Pre-auth	Critical9.8	—	0.4%	Aug 24, 2026
39Monitor	CVE-2026-66650No exploit	WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerabilitytheme-rex · freightco · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 24, 2026
32Monitor	CVE-2026-66670No exploit	WordPress Måne theme <= 1.7 - Local File Inclusion vulnerabilityelated-themes · måne · CWE-98 Pre-auth	High8.1	—	0.4%	Aug 24, 2026
32Monitor	CVE-2026-66671No exploit	WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerabilityelated-themes · verdure core · CWE-98 Pre-auth	High8.1	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-6017No exploit	Missing Authentication for Critical Function in KAON PG5298kaon · pg5298a · CWE-306 Pre-auth Auth bypass	High7.1	—	0.2%	Aug 24, 2026
30Monitor	CVE-2026-78270No exploit	WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerabilitywp manageninja llc · fluentcrm pro · CWE-89 SQL injection	High7.6	—	0.3%	Aug 24, 2026
28Monitor	CVE-2026-21756No exploit	HCL Hive is affected by a broken access control vulnerabilityhclsoftware · hcl hive · CWE-266 Broken access control (IDOR)	High7.2	—	0.4%	Aug 24, 2026
37Monitor	CVE-2026-78365No exploit	IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modificationroskus · prospero flow crm · CWE-639 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.5%	Aug 24, 2026
29Monitor	CVE-2026-21751No exploit	HCL Hive is affected by use of a cryptographic primitive with a risky implementationhclsoftware · hcl hive · CWE-1240 Pre-auth	High7.4	—	0.2%	Aug 24, 2026
31Monitor	CVE-2026-30512No exploit	A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI priCWE-250 Local privilege escalation	High7.8	—	0.1%	Aug 24, 2026
36Monitor	CVE-2026-59564No exploit	Authentication bypass between ZCC and client connector portalzscaler · client connector · CWE-304 Pre-auth Auth bypass	Critical9.1	—	0.5%	Aug 24, 2026
35Monitor	CVE-2026-59565No exploit	Local and kernel denial-of-servicezscaler · client connector · CWE-229	High8.8	—	0.4%	Aug 24, 2026
33Monitor	CVE-2026-59566No exploit	Local denial-of-servicezscaler · client connector · CWE-229	High8.4	—	0.1%	Aug 24, 2026
35Monitor	CVE-2026-59567No exploit	Local privilege escalationzscaler · client connector · CWE-280 RCE Local privilege escalation	High8.8	—	0.1%	Aug 24, 2026
36Monitor	CVE-2026-59568No exploit	Remote Code Executionzscaler · client connector · CWE-20 pre-auth RCE	Critical9.1	—	0.6%	Aug 24, 2026
37Monitor	CVE-2026-67602No exploit	phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cachephpipam · phpipam · CWE-706 Pre-auth Auth bypass	Critical9.3	—	0.6%	Aug 24, 2026
34Monitor	CVE-2026-76840No exploit	RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Lengthrustdesk · rustdesk · CWE-20 Pre-auth	High8.5	—	0.4%	Aug 24, 2026
34Monitor	CVE-2026-76841No exploit	Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loadersxorbitsai · inference · CWE-94 RCE	High8.7	—	1.0%	Aug 24, 2026
35Monitor	CVE-2026-76842No exploit	Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clientsmercadopago · mercadopago · CWE-22 Pre-auth Path traversal	High8.8	—	0.4%	Aug 24, 2026
33Monitor	CVE-2026-76843No exploit	Flair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.loadflairnlp · flair · CWE-502 Deserialization Local privilege escalation	High8.4	—	0.3%	Aug 24, 2026
33Monitor	CVE-2026-76844Proof of concept	zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Writewebpack · webpack-dev-middleware · CWE-787 Pre-auth Memory safety	High8.3	—	0.5%	Aug 24, 2026
34Monitor	CVE-2026-76847No exploit	act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backendnektos · act · CWE-321 Pre-auth Hard-coded credentials	High8.7	—	0.3%	Aug 24, 2026

CVE-2026-74713
28Monitor
vhost_iotlb: bound map allocation in add_range
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
linux · linuxAug 22, 2026
CVE-2026-74714
31Monitor
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 22, 2026
CVE-2026-74715
31Monitor
bpf: Fix netns reference imbalance in conntrack kfuncs
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 22, 2026
CVE-2026-74717
30Monitor
net/mlx5: fw_tracer, return NULL on create error
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxAug 22, 2026
CVE-2026-74720
31Monitor
bpf: Preserve pointer state for commuted arithmetic
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 22, 2026
CVE-2026-74721
31Monitor
accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 22, 2026
CVE-2026-74723
39Monitor
btrfs: lzo: reject inline extents without valid headers
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxAug 22, 2026
CVE-2026-74724
31Monitor
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 22, 2026
CVE-2026-74725
31Monitor
enic: fix tx_hang_reset use-after-free on device removal
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 22, 2026
CVE-2026-74726
29Monitor
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
HighCVSS 7.3No exploitEPSS 0%
linux · linuxAug 22, 2026
CVE-2026-74727
39Monitor
ovpn: skip rehash for peers already removed from by_id
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
linux · linuxAug 22, 2026
CVE-2026-74730
39Monitor
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxAug 22, 2026
CVE-2026-74731
31Monitor
sched_ext: Skip sub-disable teardown for never-linked sub-schedulers
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 22, 2026
CVE-2026-74733
31Monitor
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 22, 2026
CVE-2026-47895
30Monitor
In strongSwan before 6.0.7, identity parsing/cloning is mishandled.
HighCVSS 7.5No exploitEPSS 0%
- Memory safety
strongswan · strongswanAug 22, 2026
CVE-2026-78122
33Monitor
docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems
HighCVSS 8.3Proof of conceptEPSS 0%
- Pre-auth
tecnativa · docker-socket-proxyAug 22, 2026
CVE-2026-0551
35Monitor
PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
buildwps · ppwp – password protect pagesAug 23, 2026
CVE-2026-16149
35Monitor
Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite
HighCVSS 8.8No exploitEPSS 0%
marc4 · security hardenerAug 23, 2026
CVE-2026-78050
34Monitor
Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
comfast · cf-n1-sAug 23, 2026
CVE-2026-78136
31Monitor
chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data.
HighCVSS 7.8No exploitEPSS 0%
- RCE
chirpmyradio · chirpAug 23, 2026
CVE-2026-13598
39Monitor
RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
unknown · restrictmateAug 23, 2026
CVE-2026-77115
28Monitor
Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unknown · braveAug 23, 2026
CVE-2026-10053
35Monitor
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
- Path traversal
gitlab · gitlabAug 23, 2026
CVE-2026-78155
39Monitor
Untrusted Search Path in StackGres
CriticalCVSS 9.9No exploitEPSS 0%
ongres · stackgresAug 23, 2026
CVE-2026-4671
34Monitor
justhtml before 1.18.0 Denial of Service via CSS Selector
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
emilstenstrom · justhtmlAug 23, 2026
CVE-2026-5388
37Monitor
justhtml before 1.15.0 Multiple Security Issues
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
emilstenstrom · justhtmlAug 23, 2026
CVE-2026-7808
37Monitor
justhtml before 1.16.0 Multiple Security Issues via Sanitization
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
emilstenstrom · justhtmlAug 23, 2026
CVE-2026-8445
37Monitor
justhtml before 1.12.0 Sanitizer Bypass via Markdown
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
emilstenstrom · justhtmlAug 23, 2026
CVE-2026-9769
34Monitor
justhtml before 1.10.0 Denial of Service via deeply nested HTML
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
emilstenstrom · justhtmlAug 23, 2026
CVE-2026-78183
39Monitor
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
Aug 23, 2026
CVE-2026-78203
28Monitor
Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
ghostmanager · ghostwriterAug 24, 2026
CVE-2026-78206
34Monitor
exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
exceljs · exceljsAug 24, 2026
CVE-2026-78207
37Monitor
exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Prototype pollution
exceljs · exceljsAug 24, 2026
CVE-2026-78208
34Monitor
exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
exceljs · exceljsAug 24, 2026
CVE-2026-78209
33Monitor
exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values
HighCVSS 8.4No exploitEPSS 0%
- Pre-auth
exceljs · exceljsAug 24, 2026
CVE-2026-78167
37Monitor
EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Auth bypass
efm · iptime t16000mAug 24, 2026
CVE-2026-78168
35Monitor
EFM ipTIME T24000M Session Validation httpcon_check_session_url improper authentication
HighCVSS 8.9No exploitEPSS 1%
- Pre-auth
- Auth bypass
efm · iptime t24000mAug 24, 2026
CVE-2026-78169
34Monitor
UTT HiPER 1250GW HTTP Request aspRemoteApConfTempSend strcpy stack-based overflow
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
utt · hiper 1250gwAug 24, 2026
CVE-2026-78170
29Monitor
UTT HiPER 1200GW formConfigFastDirectionW strcpy buffer overflow
HighCVSS 7.4No exploitEPSS 0%
- Memory safety
utt · hiper 1200gwAug 24, 2026
CVE-2026-19200
35Monitor
Velociraptor Analyst overwrites live built-in artifacts through verify()
HighCVSS 8.9No exploitEPSS 0%
- RCE
rapid7 · velociraptorAug 24, 2026
CVE-2026-78211
38Monitor
4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command Injection
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
4mosan security technology · 4mosan gcb doctorAug 24, 2026
CVE-2026-78212
34Monitor
4MOSAn Security Technology｜4MOSAn Management Center - Arbitrary File Read
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
4mosan security technology · 4mosan management centerAug 24, 2026
CVE-2026-59561
33Monitor
Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability.
HighCVSS 8.4No exploitEPSS 1%
- RCE
- Command injection
sakura editor development community · sakura editorAug 24, 2026
CVE-2026-77994
37Monitor
Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
joomlack.fr · page builder ck extension for joomlaAug 24, 2026
CVE-2026-78255
34Monitor
DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
dji · neoAug 24, 2026
CVE-2026-78306
34Monitor
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
HighCVSS 8.5Proof of conceptEPSS 0%
- pre-auth RCE
- Auth bypass
dji · neoAug 24, 2026
CVE-2026-66897
39Monitor
Instance template path traversal allows arbitrary host file write as root
CriticalCVSS 9.9No exploitEPSS 0%
- Path traversal
canonical · lxdAug 24, 2026
CVE-2026-75899
30Monitor
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
openjsf · fast-uriAug 24, 2026
CVE-2026-75931
30Monitor
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
openjsf · fast-uriAug 24, 2026
CVE-2026-75975
30Monitor
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
openjsf · fast-uriAug 24, 2026
CVE-2026-78314
35Monitor
DIAEnergie - SQL Injection
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SQL injection
deltaww · diaenergieAug 24, 2026
CVE-2026-78315
35Monitor
DIAEnergie - SQL Injection
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SQL injection
deltaww · diaenergieAug 24, 2026
CVE-2026-78316
35Monitor
DIAEnergie - SQL Injection
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SQL injection
deltaww · diaenergieAug 24, 2026
CVE-2026-78317
35Monitor
DIAEnergie - SQL Injection
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SQL injection
deltaww · diaenergieAug 24, 2026
CVE-2026-10582
33Monitor
Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- SSRF
gohugoio · hugoAug 24, 2026
CVE-2026-76172
30Monitor
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
openjsf · fast-uriAug 24, 2026
CVE-2025-63080
34Monitor
Authenticated RCE in KAON PG5298
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
kaon · pg5298aAug 24, 2026
CVE-2026-28151
32Monitor
WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
select-themes · tondaAug 24, 2026
CVE-2026-28152
32Monitor
WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
select-themes · tonda coreAug 24, 2026
CVE-2026-28153
30Monitor
WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
notification master · notification master – real-time wordpress notifications with email, sms, webhooks & moreAug 24, 2026
CVE-2026-28162
28Monitor
WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
franky · events made easyAug 24, 2026
CVE-2026-28165
39Monitor
WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
unitedover, llc · digitsAug 24, 2026
CVE-2026-28166
28Monitor
WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
goodlayers · tourmasterAug 24, 2026
CVE-2026-28167
30Monitor
WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
super forms · super formsAug 24, 2026
CVE-2026-28171
34Monitor
WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Path traversal
- Denial of service
vanquish · woocommerce file approvalAug 24, 2026
CVE-2026-28190
28Monitor
WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
themebing · prolancer elementAug 24, 2026
CVE-2026-32471
34Monitor
WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
themebing · prolancer elementAug 24, 2026
CVE-2026-32476
28Monitor
WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
amplebyte pvt limited · brave conversion engine (pro)Aug 24, 2026
CVE-2026-32477
34Monitor
WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Path traversal
- Denial of service
radiustheme, llc · shopbuilder pro – elementor woocommerce builder addonsAug 24, 2026
CVE-2026-32478
34Monitor
WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
wedevs pte. ltd · wp project manager proAug 24, 2026
CVE-2026-32551
37Monitor
WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
divinext · woo essentialAug 24, 2026
CVE-2026-32558
39Monitor
WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
redefiningtheweb · affiliate pro - affiliate program for woocommerce & wordpressAug 24, 2026
CVE-2026-66584
28Monitor
WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
code for recovery · 12 step meeting listAug 24, 2026
CVE-2026-66585
30Monitor
WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
wpcafe · wp cafe proAug 24, 2026
CVE-2026-66587
39Monitor
WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
wpcafe · wp cafe proAug 24, 2026
CVE-2026-66599
28Monitor
WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
liquid web / stellarwp · wpcompleteAug 24, 2026
CVE-2026-66610
28Monitor
WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
thembay · urnaAug 24, 2026
CVE-2026-66623
28Monitor
WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
inisev · social media & share iconsAug 24, 2026
CVE-2026-66648
39Monitor
WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
mvpthemes · jawnAug 24, 2026
CVE-2026-66650
39Monitor
WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
theme-rex · freightcoAug 24, 2026
CVE-2026-66670
32Monitor
WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
elated-themes · måneAug 24, 2026
CVE-2026-66671
32Monitor
WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
elated-themes · verdure coreAug 24, 2026
CVE-2026-6017
28Monitor
Missing Authentication for Critical Function in KAON PG5298
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
kaon · pg5298aAug 24, 2026
CVE-2026-78270
30Monitor
WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
wp manageninja llc · fluentcrm proAug 24, 2026
CVE-2026-21756
28Monitor
HCL Hive is affected by a broken access control vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
hclsoftware · hcl hiveAug 24, 2026
CVE-2026-78365
37Monitor
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
roskus · prospero flow crmAug 24, 2026
CVE-2026-21751
29Monitor
HCL Hive is affected by use of a cryptographic primitive with a risky implementation
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
hclsoftware · hcl hiveAug 24, 2026
CVE-2026-30512
31Monitor
A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI pri
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
Aug 24, 2026
CVE-2026-59564
36Monitor
Authentication bypass between ZCC and client connector portal
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
zscaler · client connectorAug 24, 2026
CVE-2026-59565
35Monitor
Local and kernel denial-of-service
HighCVSS 8.8No exploitEPSS 0%
zscaler · client connectorAug 24, 2026
CVE-2026-59566
33Monitor
Local denial-of-service
HighCVSS 8.4No exploitEPSS 0%
zscaler · client connectorAug 24, 2026
CVE-2026-59567
35Monitor
Local privilege escalation
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Local privilege escalation
zscaler · client connectorAug 24, 2026
CVE-2026-59568
36Monitor
Remote Code Execution
CriticalCVSS 9.1No exploitEPSS 0%
- pre-auth RCE
zscaler · client connectorAug 24, 2026
CVE-2026-67602
37Monitor
phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
phpipam · phpipamAug 24, 2026
CVE-2026-76840
34Monitor
RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length
HighCVSS 8.5No exploitEPSS 0%
- Pre-auth
rustdesk · rustdeskAug 24, 2026
CVE-2026-76841
34Monitor
Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders
HighCVSS 8.7No exploitEPSS 1%
- RCE
xorbitsai · inferenceAug 24, 2026
CVE-2026-76842
35Monitor
Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Path traversal
mercadopago · mercadopagoAug 24, 2026
CVE-2026-76843
33Monitor
Flair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load
HighCVSS 8.4No exploitEPSS 0%
- Deserialization
- Local privilege escalation
flairnlp · flairAug 24, 2026
CVE-2026-76844
33Monitor
zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write
HighCVSS 8.3Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
webpack · webpack-dev-middlewareAug 24, 2026
CVE-2026-76847
34Monitor
act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
nektos · actAug 24, 2026