By publication date

Exploited and new serious CVEs: August 2026

7,237 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 3 of 73

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2026-9487No exploit	XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate IDxml::sig project · xml::sig · CWE-347 Pre-auth Weak crypto	Critical9.1	—	0.2%	Aug 3, 2026
24Monitor	CVE-2026-38444Proof of concept	osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name.CWE-79 Pre-auth XSS	Medium6.1	—	0.3%	Aug 3, 2026
39Monitor	CVE-2026-38447No exploit	osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing.CWE-331 Pre-auth	Critical9.8	—	0.6%	Aug 3, 2026
24Monitor	CVE-2026-15430Proof of concept	Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprwellbia · xigncode3 · CWE-269 Local privilege escalation	Medium6.2	—	0.1%	Aug 3, 2026
30Monitor	CVE-2026-18568No exploit	XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryxml::sig project · xml::sig · CWE-347 Pre-auth Weak crypto	High7.5	—	0.3%	Aug 3, 2026
36Monitor	CVE-2026-67598Proof of concept	Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.phpemlog · emlog · CWE-295 Pre-auth Weak crypto	Critical9.1	—	0.2%	Aug 3, 2026
36Monitor	CVE-2026-18602No exploit	GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injectiongl.inet · gl-mt3000 · CWE-74 pre-auth RCE Command injection	High8.9	—	3.6%	Aug 3, 2026
28Monitor	CVE-2026-18606No exploit	Razer RzUpdateService Named Pipe RzUpdateService.exe privileges managementrazer · rzupdateservice · CWE-266 Local privilege escalation	High7.1	—	0.1%	Aug 3, 2026
28Monitor	CVE-2026-18718Proof of concept	Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project Statenational security agency · ghidra · CWE-427 RCE	High7.1	—	0.1%	Aug 3, 2026
38Monitor	CVE-2026-41452Proof of concept	Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setupkrayin · laravel-crm · CWE-306 Pre-auth Auth bypass	Critical9.3	—	3.7%	Aug 3, 2026
34Monitor	CVE-2026-41453No exploit	Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameterkrayin · laravel-crm · CWE-89 SQL injection	High8.7	—	0.5%	Aug 3, 2026
37Monitor	CVE-2026-48063No exploit	Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payloadwhiskeysockets · baileys · CWE-290 Pre-auth Auth bypass	Critical9.3	—	0.2%	Aug 3, 2026
30Monitor	CVE-2026-61372No exploit	Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictionsapache · jena fuseki · CWE-22 Pre-auth Path traversal	High7.5	—	0.8%	Aug 3, 2026
40Plan	CVE-2026-51190No exploit	The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: trueCWE-78 pre-auth RCE Command injection	Critical9.8	—	1.8%	Aug 3, 2026
39Monitor	CVE-2026-51775No exploit	SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controllerCWE-89 pre-auth RCE SQL injection	Critical9.8	—	0.4%	Aug 3, 2026
30Monitor	CVE-2026-67972No exploit	An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possiblyCWE-200 Pre-auth Info leak	High7.5	—	0.4%	Aug 3, 2026
30Monitor	CVE-2026-67976No exploit	The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to caCWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Aug 3, 2026
39Monitor	CVE-2026-69240No exploit	Sequelize: SQL Injection (Oracle DB)sequelize · sequelize · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.5%	Aug 3, 2026
28Monitor	CVE-2026-69246No exploit	Guzzle: Noncanonical host can bypass host-based checksguzzle · guzzle · CWE-180 Pre-auth	High7.2	—	0.3%	Aug 3, 2026
30Monitor	CVE-2026-69152No exploit	brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationjuliangruber · brace-expansion · CWE-400 Pre-auth Denial of service	High7.5	—	0.6%	Aug 3, 2026
30Monitor	CVE-2025-9291No exploit	Improper Certificate Validation in TP-Link Omada Cloud Communicationstp-link · omada fusion 2.5g firmware · CWE-295 Pre-auth Weak crypto	High7.7	—	0.2%	Aug 3, 2026
36Monitor	CVE-2026-18612No exploit	GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injectiongl-inet · gl-mt3000 · CWE-74 pre-auth RCE Command injection	High8.9	—	3.9%	Aug 3, 2026
35Monitor	CVE-2026-18613No exploit	GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injectiongl-inet · gl-mt3000 · CWE-74 Pre-auth	High8.9	—	0.9%	Aug 3, 2026
31Monitor	CVE-2026-40717No exploit	Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability.dell · monitor driver · CWE-59 Local privilege escalation	High7.8	—	0.1%	Aug 3, 2026
34Monitor	CVE-2026-61523No exploit	WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editorwebsitebaker org e.v. · websitebaker cms · CWE-94 RCE	High8.6	—	1.1%	Aug 3, 2026
34Monitor	CVE-2026-61524No exploit	WebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installationwebsitebaker org e.v. · websitebaker cms · CWE-434 RCE File upload	High8.6	—	1.0%	Aug 3, 2026
30Monitor	CVE-2026-67969No exploit	An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a craftCWE-20 Pre-auth	High7.5	—	0.3%	Aug 3, 2026
30Monitor	CVE-2026-67970No exploit	Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path CWE-284 Pre-auth Path traversal Broken access control (IDOR)	High7.5	—	0.3%	Aug 3, 2026
30Monitor	CVE-2026-67974No exploit	A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackerCWE-20 Pre-auth Denial of service	High7.5	—	0.5%	Aug 3, 2026
30Monitor	CVE-2026-67975No exploit	Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 3, 2026
30Monitor	CVE-2026-67977No exploit	An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of ServiceCWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Aug 3, 2026
32Monitor	CVE-2025-15628No exploit	Hardcoded Certificates in TP-Link Omada Device Communicationstp-link · omada oc200 v3 firmware · CWE-798 Pre-auth Hard-coded credentials	High8.2	—	0.3%	Aug 3, 2026
36Monitor	CVE-2026-18614No exploit	GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injectiongl-inet · gl-mt3000 · CWE-74 pre-auth RCE Command injection	High8.9	—	3.6%	Aug 3, 2026
36Monitor	CVE-2026-18615No exploit	GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injectiongl-inet · gl-mt3000 · CWE-74 pre-auth RCE Command injection	High8.9	—	3.6%	Aug 3, 2026
36Monitor	CVE-2026-18616No exploit	GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injectiongl-inet · gl-mt3000 · CWE-74 pre-auth RCE Command injection	High8.9	—	3.6%	Aug 3, 2026
31Monitor	CVE-2026-59912No exploit	Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability.dell · display and peripheral manager · CWE-284 RCE Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	Aug 3, 2026
31Monitor	CVE-2026-59913No exploit	Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulneradell · display and peripheral manager · CWE-306 Auth bypass Local privilege escalation	High7.8	—	0.1%	Aug 3, 2026
28Monitor	CVE-2026-18655No exploit	Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injectionaws · amazon-mq-mcp-server · CWE-923 Pre-auth	High7.1	—	0.4%	Aug 3, 2026
33Monitor	CVE-2026-47211No exploit	Ouroboros: Remote Code Execution via Untrusted Project-Directory .envq00 · ouroboros · CWE-426 RCE	High8.4	—	0.1%	Aug 3, 2026
36Monitor	CVE-2026-48031No exploit	Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgerydhax · go-base · CWE-798 Pre-auth Auth bypass Hard-coded credentials	Critical9.1	—	0.6%	Aug 3, 2026
30Monitor	CVE-2026-62354No exploit	Apache NiFi: Incorrect Authorization for Parameter Context Validation Requestsapache · nifi · CWE-863 Broken access control (IDOR)	High7.7	—	0.4%	Aug 3, 2026
35Monitor	CVE-2026-67599Proof of concept	ClearOS 7.9 OS Command Injection via Log Viewer filter parameterclearfoundation · clearos · CWE-78 RCE Command injection	High8.6	—	2.4%	Aug 3, 2026
35Monitor	CVE-2026-68981No exploit	Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requestsapache · nifi · CWE-409 Pre-auth	High8.8	—	0.7%	Aug 3, 2026
30Monitor	CVE-2026-69185No exploit	Socket.IO: Zero-attachment Memory Exhaustionsocketio · socket.io · CWE-20 Pre-auth Denial of service	High7.5	—	0.6%	Aug 3, 2026
30Monitor	CVE-2026-69192No exploit	ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypassbeaugunderson · ip-address · CWE-20 Pre-auth SSRF	High7.7	—	0.4%	Aug 3, 2026
35Monitor	CVE-2026-62870No exploit	Microsoft Excel Remote Code Execution Vulnerabilitymicrosoft · 365 apps · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.8%	Aug 3, 2026
30Monitor	CVE-2026-56845No exploit	An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem.rocket.chat · rocket.chat · CWE-22 Pre-auth Path traversal	High7.5	—	0.6%	Aug 3, 2026
30Monitor	CVE-2026-18733No exploit	Prompt injection bypasses shell tool consent gate in Strands Agents Toolsaws · strands-agents-tools · CWE-1427 pre-auth RCE	High7.5	—	0.5%	Aug 3, 2026
28Monitor	CVE-2026-18737No exploit	Shlink Blind SQL Injection via tags/stats orderBy Parametershlinkio · shlink · CWE-89 SQL injection	High7.1	—	0.3%	Aug 3, 2026
34Monitor	CVE-2026-41447No exploit	FirmaCheck < 1.3.16 DLL Hijacking via Unvalidated OpenSSL Configuration Pathzucchetti s.p.a. · firmacheck · CWE-426 RCE Local privilege escalation	High8.5	—	0.1%	Aug 3, 2026
34Monitor	CVE-2026-48113No exploit	Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injectionjpillora · chisel · CWE-863 Broken access control (IDOR)	High8.5	—	0.3%	Aug 3, 2026
40Plan	CVE-2026-52102Proof of concept	An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commaCWE-78 pre-auth RCE Command injection	Critical9.8	—	2.9%	Aug 3, 2026
32Monitor	CVE-2026-52521No exploit	A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in thCWE-89 RCE SQL injection	High8.1	—	0.4%	Aug 3, 2026
33Monitor	CVE-2026-66065No exploit	Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)q00 · ouroboros · CWE-15 RCE	High8.4	—	0.2%	Aug 3, 2026
25Monitor	CVE-2026-69243Proof of concept	AIOHTTP: HTTP request smuggling via WebSocket upgradeaio-libs · aiohttp · CWE-444 Pre-auth	Medium6.3	—	0.4%	Aug 3, 2026
28Monitor	CVE-2026-69244No exploit	AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)aio-libs · aiohttp · CWE-125 Pre-auth Memory safety	High7.1	—	0.5%	Aug 3, 2026
30Monitor	CVE-2026-10849No exploit	Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response bodyzephyrproject · zephyr · CWE-122 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Aug 3, 2026
36Monitor	CVE-2026-46713No exploit	Misskey: JSON-LD signature validation + compaction may lead to improper activity handlingmisskey-dev · misskey · CWE-347 Pre-auth Weak crypto	Critical9.2	—	0.2%	Aug 3, 2026
35Monitor	CVE-2026-47746No exploit	Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacksmisskey-dev · misskey · CWE-367 Pre-auth Race condition	High8.9	—	0.2%	Aug 3, 2026
30Monitor	CVE-2026-67973No exploit	An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs.CWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Aug 3, 2026
32Monitor	CVE-2026-69247No exploit	cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timingpyca · cryptography · CWE-208 Pre-auth	High8.2	—	0.2%	Aug 3, 2026
34Monitor	CVE-2026-69249No exploit	python-cryptography: Duplicate self-signed intermediates can cause exponential path-buildingpyca · cryptography · CWE-400 Pre-auth Denial of service	High8.7	—	0.2%	Aug 3, 2026
37Monitor	CVE-2026-18667No exploit	Sensor Proxy Version 1.4.2 Fixes One Vulnerabilitytenable, inc. · sensor proxy · CWE-94 pre-auth RCE	Critical9.3	—	0.7%	Aug 3, 2026
36Monitor	CVE-2026-18684No exploit	GL.iNet GL-MT3000 modem.so glc remove_profile command injectiongl.inet · gl-mt3000 · CWE-74 pre-auth RCE Command injection	High8.9	—	3.6%	Aug 3, 2026
38Monitor	CVE-2026-48317No exploit	Adobe Campaign Classic (ACC) \| Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)adobe · campaign · CWE-95 RCE	Critical9.6	—	0.9%	Aug 3, 2026
40Plan	CVE-2026-48323No exploit	Adobe Campaign Classic (ACC) \| Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)adobe · campaign · CWE-1336 pre-auth RCE SSTI	Critical10.0	—	1.3%	Aug 3, 2026
39Monitor	CVE-2026-48326No exploit	Adobe Campaign Classic (ACC) \| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)adobe · campaign · CWE-89 RCE SQL injection	Critical9.9	—	0.9%	Aug 3, 2026
40Plan	CVE-2026-48330No exploit	Adobe Campaign Classic (ACC) \| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)adobe · campaign · CWE-89 pre-auth RCE SQL injection	Critical10.0	—	1.0%	Aug 3, 2026
40Plan	CVE-2026-48331No exploit	Adobe Campaign Classic (ACC) \| Server-Side Request Forgery (SSRF) (CWE-918)adobe · campaign · CWE-918 Pre-auth SSRF	Critical10.0	—	0.9%	Aug 3, 2026
39Monitor	CVE-2026-48333No exploit	Adobe Campaign Classic (ACC) \| Incorrect Authorization (CWE-863)adobe · campaign · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.9%	Aug 3, 2026
30Monitor	CVE-2026-48399No exploit	Adobe Campaign Classic (ACC) \| Violation of Secure Design Principles (CWE-657)adobe · campaign · CWE-657 Pre-auth	High7.5	—	0.8%	Aug 3, 2026
30Monitor	CVE-2026-67978No exploit	An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN framCWE-20 Pre-auth Denial of service	High7.5	—	0.3%	Aug 3, 2026
28Monitor	CVE-2026-14818No exploit	A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 throuzyxel · atp series firmware · CWE-22 Path traversal	High7.2	—	0.5%	Aug 4, 2026
36Monitor	CVE-2026-18685No exploit	GL.iNet GL-MT3000 modem.so glc set_upgrade command injectiongl.inet · gl-mt3000 · CWE-74 pre-auth RCE Command injection	High8.9	—	3.6%	Aug 4, 2026
36Monitor	CVE-2026-18686No exploit	GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injectiongl.inet · gl-mt3000 · CWE-74 pre-auth RCE Command injection	High8.9	—	4.7%	Aug 4, 2026
29Monitor	CVE-2026-65802No exploit	Microsoft Edge for Android Information Disclosure Vulnerabilitymicrosoft · edge chromium · CWE-73 Pre-auth Path traversal	High7.4	—	0.9%	Aug 4, 2026
28Monitor	CVE-2026-66310No exploit	Microsoft Edge for Android Information Disclosure Vulnerabilitymicrosoft · edge · CWE-73 Path traversal	High7.1	—	0.3%	Aug 4, 2026
35Monitor	CVE-2026-66312No exploit	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerabilitymicrosoft · edge chromium · CWE-126 RCE	High8.8	—	1.0%	Aug 4, 2026
30Monitor	CVE-2026-66315No exploit	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerabilitymicrosoft · edge chromium · CWE-416 pre-auth RCE Memory safety	High7.5	—	0.6%	Aug 4, 2026
32Monitor	CVE-2026-66318No exploit	Microsoft Edge (Chromium-based) Information Disclosure Vulnerabilitymicrosoft · edge chromium · CWE-346 Pre-auth	High8.1	—	0.3%	Aug 4, 2026
38Monitor	CVE-2026-66321No exploit	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerabilitymicrosoft · edge chromium · CWE-843 pre-auth RCE	Critical9.6	—	1.0%	Aug 4, 2026
35Monitor	CVE-2026-66326No exploit	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerabilitymicrosoft · edge chromium · CWE-862 pre-auth RCE Broken access control (IDOR)	High8.8	—	0.7%	Aug 4, 2026
30Monitor	CVE-2026-56846Proof of concept	A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.nodejs · node · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Aug 4, 2026
21Monitor	CVE-2026-58041Proof of concept	A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cacnodejs · node · CWE-367 Pre-auth Race condition	Medium5.3	—	0.2%	Aug 4, 2026
23Monitor	CVE-2026-58042Proof of concept	A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.nodejs · node · CWE-400 Pre-auth Denial of service	Medium5.9	—	0.3%	Aug 4, 2026
14Monitor	CVE-2026-58044Proof of concept	A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from nodejs · node · CWE-444 Pre-auth	Low3.7	—	0.2%	Aug 4, 2026
24Monitor	CVE-2026-58045Proof of concept	A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing tnodejs · node · CWE-400 Denial of service	Medium6.2	—	0.1%	Aug 4, 2026
28Monitor	CVE-2026-6837Proof of concept	A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4zyxel · wax650s firmware · CWE-78 RCE Command injection	High7.2	—	1.5%	Aug 4, 2026
26Monitor	CVE-2026-8508Proof of concept	An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 couzyxel · wax650s firmware · CWE-287 Pre-auth Auth bypass	Medium6.5	—	0.3%	Aug 4, 2026
37Monitor	CVE-2026-15958No exploit	Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAXunknown · easy integration for dropbox · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.3%	Aug 4, 2026
39Monitor	CVE-2026-16618No exploit	ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Executionunknown · improve seo · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.8%	Aug 4, 2026
32Monitor	CVE-2026-16623No exploit	Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)unknown · create block theme · CWE-94 RCE	High8.0	—	0.4%	Aug 4, 2026
31Monitor	CVE-2026-42169No exploit	Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)redhat · enterprise linux · CWE-131	High7.8	—	0.1%	Aug 4, 2026
34Monitor	CVE-2026-18759No exploit	An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.asustor inc. · abp · CWE-269 Auth bypass Path traversal Local privilege escalation	High8.5	—	0.1%	Aug 4, 2026
34Monitor	CVE-2026-16881No exploit	A code injection vulnerability exists in the LINE Android app prior to version 26.7.2.ly corporation · line client for android · CWE-94 pre-auth RCE	High8.7	—	0.4%	Aug 4, 2026
35Monitor	CVE-2026-64561Proof of concept	KVM: x86: Check for invalid/obsolete root after making MMU pages availablelinux · linux · CWE-362 Race condition	High8.8	—	0.2%	Aug 4, 2026
35Monitor	CVE-2026-64562No exploit	KVM: nVMX: Hide shadow VMCS right after VMCLEARlinux · linux · CWE-416 Memory safety	High8.8	—	0.1%	Aug 4, 2026
31Monitor	CVE-2026-64563Proof of concept	rhashtable: clear stale iter->p on table restartlinux · linux · CWE-416 Memory safety	High7.8	—	0.1%	Aug 4, 2026
39Monitor	CVE-2026-64564Proof of concept	sctp: don't free the ASCONF's own transport in DEL-IP processinglinux · linux · CWE-416 Pre-auth Memory safety	Critical9.8	—	1.4%	Aug 4, 2026
34Monitor	CVE-2026-10050No exploit	Digest authentication lossy encodingeclipse · jetty · CWE-173 Pre-auth	High8.7	—	0.6%	Aug 4, 2026

CVE-2026-9487
36Monitor
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
xml::sig project · xml::sigAug 3, 2026
CVE-2026-38444
24Monitor
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name.
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
Aug 3, 2026
CVE-2026-38447
39Monitor
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
Aug 3, 2026
CVE-2026-15430
24Monitor
Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unpr
MediumCVSS 6.2Proof of conceptEPSS 0%
- Local privilege escalation
wellbia · xigncode3Aug 3, 2026
CVE-2026-18568
30Monitor
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cry
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
xml::sig project · xml::sigAug 3, 2026
CVE-2026-67598
36Monitor
Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
emlog · emlogAug 3, 2026
CVE-2026-18602
36Monitor
GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injection
HighCVSS 8.9No exploitEPSS 3%
- pre-auth RCE
- Command injection
gl.inet · gl-mt3000Aug 3, 2026
CVE-2026-18606
28Monitor
Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management
HighCVSS 7.1No exploitEPSS 0%
- Local privilege escalation
razer · rzupdateserviceAug 3, 2026
CVE-2026-18718
28Monitor
Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project State
HighCVSS 7.1Proof of conceptEPSS 0%
- RCE
national security agency · ghidraAug 3, 2026
CVE-2026-41452
38Monitor
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
CriticalCVSS 9.3Proof of conceptEPSS 3%
- Pre-auth
- Auth bypass
krayin · laravel-crmAug 3, 2026
CVE-2026-41453
34Monitor
Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter
HighCVSS 8.7No exploitEPSS 0%
- SQL injection
krayin · laravel-crmAug 3, 2026
CVE-2026-48063
37Monitor
Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
whiskeysockets · baileysAug 3, 2026
CVE-2026-61372
30Monitor
Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
apache · jena fusekiAug 3, 2026
CVE-2026-51190
40Plan
The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Command injection
Aug 3, 2026
CVE-2026-51775
39Monitor
SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- SQL injection
Aug 3, 2026
CVE-2026-67972
30Monitor
An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
Aug 3, 2026
CVE-2026-67976
30Monitor
The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to ca
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Aug 3, 2026
CVE-2026-69240
39Monitor
Sequelize: SQL Injection (Oracle DB)
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
sequelize · sequelizeAug 3, 2026
CVE-2026-69246
28Monitor
Guzzle: Noncanonical host can bypass host-based checks
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
guzzle · guzzleAug 3, 2026
CVE-2026-69152
30Monitor
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
juliangruber · brace-expansionAug 3, 2026
CVE-2025-9291
30Monitor
Improper Certificate Validation in TP-Link Omada Cloud Communications
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
tp-link · omada fusion 2.5g firmwareAug 3, 2026
CVE-2026-18612
36Monitor
GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection
HighCVSS 8.9No exploitEPSS 3%
- pre-auth RCE
- Command injection
gl-inet · gl-mt3000Aug 3, 2026
CVE-2026-18613
35Monitor
GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
gl-inet · gl-mt3000Aug 3, 2026
CVE-2026-40717
31Monitor
Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
dell · monitor driverAug 3, 2026
CVE-2026-61523
34Monitor
WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor
HighCVSS 8.6No exploitEPSS 1%
- RCE
websitebaker org e.v. · websitebaker cmsAug 3, 2026
CVE-2026-61524
34Monitor
WebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation
HighCVSS 8.6No exploitEPSS 1%
- RCE
- File upload
websitebaker org e.v. · websitebaker cmsAug 3, 2026
CVE-2026-67969
30Monitor
An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a craft
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
Aug 3, 2026
CVE-2026-67970
30Monitor
Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
- Broken access control (IDOR)
Aug 3, 2026
CVE-2026-67974
30Monitor
A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attacker
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Aug 3, 2026
CVE-2026-67975
30Monitor
Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending T
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 3, 2026
CVE-2026-67977
30Monitor
An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Aug 3, 2026
CVE-2025-15628
32Monitor
Hardcoded Certificates in TP-Link Omada Device Communications
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
tp-link · omada oc200 v3 firmwareAug 3, 2026
CVE-2026-18614
36Monitor
GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection
HighCVSS 8.9No exploitEPSS 3%
- pre-auth RCE
- Command injection
gl-inet · gl-mt3000Aug 3, 2026
CVE-2026-18615
36Monitor
GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection
HighCVSS 8.9No exploitEPSS 3%
- pre-auth RCE
- Command injection
gl-inet · gl-mt3000Aug 3, 2026
CVE-2026-18616
36Monitor
GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection
HighCVSS 8.9No exploitEPSS 3%
- pre-auth RCE
- Command injection
gl-inet · gl-mt3000Aug 3, 2026
CVE-2026-59912
31Monitor
Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability.
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
dell · display and peripheral managerAug 3, 2026
CVE-2026-59913
31Monitor
Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnera
HighCVSS 7.8No exploitEPSS 0%
- Auth bypass
- Local privilege escalation
dell · display and peripheral managerAug 3, 2026
CVE-2026-18655
28Monitor
Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
aws · amazon-mq-mcp-serverAug 3, 2026
CVE-2026-47211
33Monitor
Ouroboros: Remote Code Execution via Untrusted Project-Directory .env
HighCVSS 8.4No exploitEPSS 0%
- RCE
q00 · ouroborosAug 3, 2026
CVE-2026-48031
36Monitor
Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Hard-coded credentials
dhax · go-baseAug 3, 2026
CVE-2026-62354
30Monitor
Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
apache · nifiAug 3, 2026
CVE-2026-67599
35Monitor
ClearOS 7.9 OS Command Injection via Log Viewer filter parameter
HighCVSS 8.6Proof of conceptEPSS 2%
- RCE
- Command injection
clearfoundation · clearosAug 3, 2026
CVE-2026-68981
35Monitor
Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
apache · nifiAug 3, 2026
CVE-2026-69185
30Monitor
Socket.IO: Zero-attachment Memory Exhaustion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
socketio · socket.ioAug 3, 2026
CVE-2026-69192
30Monitor
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- SSRF
beaugunderson · ip-addressAug 3, 2026
CVE-2026-62870
35Monitor
Microsoft Excel Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
microsoft · 365 appsAug 3, 2026
CVE-2026-56845
30Monitor
An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
rocket.chat · rocket.chatAug 3, 2026
CVE-2026-18733
30Monitor
Prompt injection bypasses shell tool consent gate in Strands Agents Tools
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
aws · strands-agents-toolsAug 3, 2026
CVE-2026-18737
28Monitor
Shlink Blind SQL Injection via tags/stats orderBy Parameter
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
shlinkio · shlinkAug 3, 2026
CVE-2026-41447
34Monitor
FirmaCheck < 1.3.16 DLL Hijacking via Unvalidated OpenSSL Configuration Path
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
zucchetti s.p.a. · firmacheckAug 3, 2026
CVE-2026-48113
34Monitor
Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
jpillora · chiselAug 3, 2026
CVE-2026-52102
40Plan
An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary comma
CriticalCVSS 9.8Proof of conceptEPSS 2%
- pre-auth RCE
- Command injection
Aug 3, 2026
CVE-2026-52521
32Monitor
A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in th
HighCVSS 8.1No exploitEPSS 0%
- RCE
- SQL injection
Aug 3, 2026
CVE-2026-66065
33Monitor
Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)
HighCVSS 8.4No exploitEPSS 0%
- RCE
q00 · ouroborosAug 3, 2026
CVE-2026-69243
25Monitor
AIOHTTP: HTTP request smuggling via WebSocket upgrade
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
aio-libs · aiohttpAug 3, 2026
CVE-2026-69244
28Monitor
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
aio-libs · aiohttpAug 3, 2026
CVE-2026-10849
30Monitor
Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
zephyrproject · zephyrAug 3, 2026
CVE-2026-46713
36Monitor
Misskey: JSON-LD signature validation + compaction may lead to improper activity handling
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Weak crypto
misskey-dev · misskeyAug 3, 2026
CVE-2026-47746
35Monitor
Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- Race condition
misskey-dev · misskeyAug 3, 2026
CVE-2026-67973
30Monitor
An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Aug 3, 2026
CVE-2026-69247
32Monitor
cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
pyca · cryptographyAug 3, 2026
CVE-2026-69249
34Monitor
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
pyca · cryptographyAug 3, 2026
CVE-2026-18667
37Monitor
Sensor Proxy Version 1.4.2 Fixes One Vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
tenable, inc. · sensor proxyAug 3, 2026
CVE-2026-18684
36Monitor
GL.iNet GL-MT3000 modem.so glc remove_profile command injection
HighCVSS 8.9No exploitEPSS 3%
- pre-auth RCE
- Command injection
gl.inet · gl-mt3000Aug 3, 2026
CVE-2026-48317
38Monitor
Adobe Campaign Classic (ACC) | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
CriticalCVSS 9.6No exploitEPSS 0%
- RCE
adobe · campaignAug 3, 2026
CVE-2026-48323
40Plan
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
CriticalCVSS 10.0No exploitEPSS 1%
- pre-auth RCE
- SSTI
adobe · campaignAug 3, 2026
CVE-2026-48326
39Monitor
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- SQL injection
adobe · campaignAug 3, 2026
CVE-2026-48330
40Plan
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
CriticalCVSS 10.0No exploitEPSS 1%
- pre-auth RCE
- SQL injection
adobe · campaignAug 3, 2026
CVE-2026-48331
40Plan
Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- SSRF
adobe · campaignAug 3, 2026
CVE-2026-48333
39Monitor
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
adobe · campaignAug 3, 2026
CVE-2026-48399
30Monitor
Adobe Campaign Classic (ACC) | Violation of Secure Design Principles (CWE-657)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
adobe · campaignAug 3, 2026
CVE-2026-67978
30Monitor
An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN fram
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Aug 3, 2026
CVE-2026-14818
28Monitor
A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 throu
HighCVSS 7.2No exploitEPSS 0%
- Path traversal
zyxel · atp series firmwareAug 4, 2026
CVE-2026-18685
36Monitor
GL.iNet GL-MT3000 modem.so glc set_upgrade command injection
HighCVSS 8.9No exploitEPSS 3%
- pre-auth RCE
- Command injection
gl.inet · gl-mt3000Aug 4, 2026
CVE-2026-18686
36Monitor
GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection
HighCVSS 8.9No exploitEPSS 4%
- pre-auth RCE
- Command injection
gl.inet · gl-mt3000Aug 4, 2026
CVE-2026-65802
29Monitor
Microsoft Edge for Android Information Disclosure Vulnerability
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Path traversal
microsoft · edge chromiumAug 4, 2026
CVE-2026-66310
28Monitor
Microsoft Edge for Android Information Disclosure Vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
microsoft · edgeAug 4, 2026
CVE-2026-66312
35Monitor
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 1%
- RCE
microsoft · edge chromiumAug 4, 2026
CVE-2026-66315
30Monitor
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Memory safety
microsoft · edge chromiumAug 4, 2026
CVE-2026-66318
32Monitor
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
microsoft · edge chromiumAug 4, 2026
CVE-2026-66321
38Monitor
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CriticalCVSS 9.6No exploitEPSS 1%
- pre-auth RCE
microsoft · edge chromiumAug 4, 2026
CVE-2026-66326
35Monitor
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
microsoft · edge chromiumAug 4, 2026
CVE-2026-56846
30Monitor
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
nodejs · nodeAug 4, 2026
CVE-2026-58041
21Monitor
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cac
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Race condition
nodejs · nodeAug 4, 2026
CVE-2026-58042
23Monitor
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.
MediumCVSS 5.9Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
nodejs · nodeAug 4, 2026
CVE-2026-58044
14Monitor
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from
LowCVSS 3.7Proof of conceptEPSS 0%
- Pre-auth
nodejs · nodeAug 4, 2026
CVE-2026-58045
24Monitor
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing t
MediumCVSS 6.2Proof of conceptEPSS 0%
- Denial of service
nodejs · nodeAug 4, 2026
CVE-2026-6837
28Monitor
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4
HighCVSS 7.2Proof of conceptEPSS 1%
- RCE
- Command injection
zyxel · wax650s firmwareAug 4, 2026
CVE-2026-8508
26Monitor
An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 cou
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
zyxel · wax650s firmwareAug 4, 2026
CVE-2026-15958
37Monitor
Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · easy integration for dropboxAug 4, 2026
CVE-2026-16618
39Monitor
ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
unknown · improve seoAug 4, 2026
CVE-2026-16623
32Monitor
Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)
HighCVSS 8.0No exploitEPSS 0%
- RCE
unknown · create block themeAug 4, 2026
CVE-2026-42169
31Monitor
Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)
HighCVSS 7.8No exploitEPSS 0%
redhat · enterprise linuxAug 4, 2026
CVE-2026-18759
34Monitor
An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.
HighCVSS 8.5No exploitEPSS 0%
- Auth bypass
- Path traversal
- Local privilege escalation
asustor inc. · abpAug 4, 2026
CVE-2026-16881
34Monitor
A code injection vulnerability exists in the LINE Android app prior to version 26.7.2.
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
ly corporation · line client for androidAug 4, 2026
CVE-2026-64561
35Monitor
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
HighCVSS 8.8Proof of conceptEPSS 0%
- Race condition
linux · linuxAug 4, 2026
CVE-2026-64562
35Monitor
KVM: nVMX: Hide shadow VMCS right after VMCLEAR
HighCVSS 8.8No exploitEPSS 0%
- Memory safety
linux · linuxAug 4, 2026
CVE-2026-64563
31Monitor
rhashtable: clear stale iter->p on table restart
HighCVSS 7.8Proof of conceptEPSS 0%
- Memory safety
linux · linuxAug 4, 2026
CVE-2026-64564
39Monitor
sctp: don't free the ASCONF's own transport in DEL-IP processing
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- Memory safety
linux · linuxAug 4, 2026
CVE-2026-10050
34Monitor
Digest authentication lossy encoding
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
eclipse · jettyAug 4, 2026