By publication date

Exploited and new serious CVEs: August 2026

5,344 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 43 of 54

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-79215No exploit	Integer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside thgoogle · chrome · CWE-190 pre-auth RCE Memory safety	High8.8	—	0.5%	Aug 25, 2026
30Monitor	CVE-2026-79216No exploit	Buffer overflow in Blink in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execugoogle · chrome · CWE-122 pre-auth RCE Memory safety	High7.5	—	0.3%	Aug 25, 2026
33Monitor	CVE-2026-79218No exploit	Incorrect authorization in Sandbox in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procesgoogle · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.3	—	0.3%	Aug 25, 2026
35Monitor	CVE-2026-79219No exploit	Use after free in Bluetooth in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Aug 25, 2026
35Monitor	CVE-2026-79223No exploit	Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a craftgoogle · chrome · CWE-190 Pre-auth Memory safety	High8.8	—	0.3%	Aug 25, 2026
33Monitor	CVE-2026-79224No exploit	Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to egoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.4%	Aug 25, 2026
35Monitor	CVE-2026-79226No exploit	Improper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social egoogle · chrome · CWE-269 Pre-auth	High8.8	—	0.3%	Aug 25, 2026
35Monitor	CVE-2026-79227No exploit	Type confusion in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.4%	Aug 25, 2026
35Monitor	CVE-2026-79230No exploit	Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrgoogle · chrome · CWE-20 pre-auth RCE	High8.8	—	0.2%	Aug 25, 2026
35Monitor	CVE-2026-79231No exploit	Buffer overflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via google · chrome · CWE-122 pre-auth RCE Memory safety	High8.8	—	0.4%	Aug 25, 2026
38Monitor	CVE-2026-79232No exploit	Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Aug 25, 2026
38Monitor	CVE-2026-79235No exploit	Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Aug 25, 2026
35Monitor	CVE-2026-79236No exploit	Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.4%	Aug 25, 2026
35Monitor	CVE-2026-79240No exploit	Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrargoogle · chrome · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.3%	Aug 25, 2026
35Monitor	CVE-2026-79244No exploit	Use after free in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox vgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Aug 25, 2026
30Monitor	CVE-2026-79245No exploit	Use after free in UI in Google Chrome prior to 152.0.7977.65 allowed a local attacker who had compromised the renderer process to execute argoogle · chrome · CWE-416 RCE Memory safety	High7.7	—	0.1%	Aug 25, 2026
33Monitor	CVE-2026-79247No exploit	Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderegoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.3%	Aug 25, 2026
33Monitor	CVE-2026-79256No exploit	Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromisgoogle · chrome · CWE-610 pre-auth RCE	High8.3	—	0.4%	Aug 25, 2026
38Monitor	CVE-2026-79257No exploit	Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Aug 25, 2026
32Monitor	CVE-2026-79263No exploit	Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox google · chrome · CWE-367 pre-auth RCE Race condition	High8.1	—	0.3%	Aug 25, 2026
35Monitor	CVE-2026-79266Proof of concept	Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Aug 25, 2026
38Monitor	CVE-2026-79275No exploit	Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Aug 25, 2026
38Monitor	CVE-2026-79282No exploit	Use after free in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside thgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Aug 25, 2026
29Monitor	CVE-2026-79286No exploit	Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to potentially execute argoogle · chrome · CWE-862 RCE Broken access control (IDOR)	High7.4	—	0.1%	Aug 25, 2026
38Monitor	CVE-2026-79290No exploit	Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Aug 25, 2026
33Monitor	CVE-2026-79292No exploit	Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process togoogle · chrome · CWE-190 pre-auth RCE Memory safety	High8.3	—	0.4%	Aug 25, 2026
37Monitor	CVE-2026-80104No exploit	DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filenameeosphoros-ai · db-gpt · CWE-22 Pre-auth Path traversal	Critical9.3	—	1.1%	Aug 25, 2026
36Monitor	CVE-2026-62862No exploit	TypeBot: Account takeover via brute-forceable 6-digit magic-link codebaptistearno · typebot.io · CWE-307 Pre-auth Hard-coded credentials CSRF	Critical9.1	—	0.5%	Aug 25, 2026
34Monitor	CVE-2026-62865No exploit	TypeBot: Arbitrary server file read via Send Email block attachment pathbaptistearno · typebot.io · CWE-73 Pre-auth Path traversal	High8.7	—	0.3%	Aug 25, 2026
34Monitor	CVE-2026-63403No exploit	Faktory: Unrecovered panic in command handlers allows full-server denial of servicecontribsys · faktory · CWE-248 Pre-auth	High8.7	—	0.4%	Aug 25, 2026
29Monitor	CVE-2026-63404No exploit	Faktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)contribsys · faktory · CWE-377 RCE Local privilege escalation	High7.3	—	0.1%	Aug 25, 2026
36Monitor	CVE-2026-65182No exploit	Apache Tomcat: Bypass longest prefix security constraintapache · tomcat · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.6%	Aug 25, 2026
32Monitor	CVE-2026-65183No exploit	Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Socketsapache · tomcat · CWE-367 Pre-auth Race condition	High8.1	—	0.3%	Aug 25, 2026
39Monitor	CVE-2026-65637No exploit	Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteapache · tomcat · CWE-20 Pre-auth	Critical9.8	—	0.7%	Aug 25, 2026
39Monitor	CVE-2026-65905No exploit	Apache Tomcat: Limited replay attack possible with DIGEST authenticationapache · tomcat · CWE-294 Pre-auth Auth bypass	Critical9.8	—	0.7%	Aug 25, 2026
30Monitor	CVE-2026-65927No exploit	Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access controlapache · tomcat · CWE-193 Pre-auth Denial of service	High7.5	—	0.6%	Aug 25, 2026
32Monitor	CVE-2026-66422No exploit	Apache Tomcat: Servlet role references can bypass declarative role constraintsapache · tomcat · CWE-285 Broken access control (IDOR)	High8.1	—	0.4%	Aug 25, 2026
36Monitor	CVE-2026-68525No exploit	Apache Tomcat: Redirect after FORM auth may bypass method specific constraintsapache · tomcat · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.6%	Aug 25, 2026
32Monitor	CVE-2026-68569No exploit	Apache Tomcat: Principal lookup can fail open in some casesapache · tomcat · CWE-287 Auth bypass	High8.1	—	0.4%	Aug 25, 2026
30Monitor	CVE-2026-68763No exploit	Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is resetapache · tomcat · CWE-400 Pre-auth Denial of service	High7.5	—	0.7%	Aug 25, 2026
39Monitor	CVE-2026-78619No exploit	Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user idenCWE-305 Pre-auth Auth bypass	Critical9.8	—	0.6%	Aug 25, 2026
36Monitor	CVE-2026-78655No exploit	Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge CWE-307 Pre-auth	Critical9.1	—	0.4%	Aug 25, 2026
30Monitor	CVE-2026-80182No exploit	In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could copenstack · keystone · CWE-863 Broken access control (IDOR)	High7.6	—	0.5%	Aug 25, 2026
30Monitor	CVE-2026-80184No exploit	In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials,openstack · keystone · CWE-863 Broken access control (IDOR)	High7.6	—	0.6%	Aug 25, 2026
31Monitor	CVE-2026-79992No exploit	Emacs: emacs: command injection via crafted filenames in trampred hat · red hat enterprise linux 10 · CWE-78 RCE Command injection	High7.8	—	0.2%	Aug 25, 2026
18Monitor	CVE-2026-15917No exploit	Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011drupal · drupal core · CWE-79 Pre-auth XSS	Medium4.7	—	0.2%	Aug 25, 2026
39Monitor	CVE-2026-16639No exploit	Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081drupal · internationalization single sign-on · CWE-288 Pre-auth Auth bypass	Critical9.8	—	0.6%	Aug 25, 2026
39Monitor	CVE-2026-16641No exploit	Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084drupal · commerce elavon · CWE-20 Pre-auth	Critical9.8	—	0.5%	Aug 25, 2026
36Monitor	CVE-2026-16644No exploit	Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087drupal · webform rest · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.4%	Aug 25, 2026
36Monitor	CVE-2026-16645No exploit	PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088drupal · photoswipe - responsive javascript modal image gallery · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.4%	Aug 25, 2026
30Monitor	CVE-2026-18259No exploit	Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090drupal · token content access · CWE-208 Pre-auth	High7.5	—	0.4%	Aug 25, 2026
32Monitor	CVE-2026-18985No exploit	Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093drupal · edit in-place field · CWE-863 Broken access control (IDOR)	High8.1	—	0.3%	Aug 25, 2026
29Monitor	CVE-2026-41707No exploit	Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replayvmware · spring security · CWE-294 Pre-auth Auth bypass	High7.4	—	0.3%	Aug 25, 2026
31Monitor	CVE-2026-54757No exploit	Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Dataoscal-compass · compliance-trestle · CWE-94 RCE SSTI	High7.8	—	0.3%	Aug 25, 2026
37Monitor	CVE-2026-79911No exploit	TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflowtotolink · n600r · CWE-119 Pre-auth Memory safety	Critical9.3	—	1.0%	Aug 25, 2026
36Monitor	CVE-2026-80138No exploit	ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parametermacwarrior · clipbucket-v5 · CWE-78 pre-auth RCE Command injection	Critical9.2	—	1.1%	Aug 25, 2026
21Monitor	CVE-2026-77680Proof of concept	Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fixred hat · red hat enterprise linux 10 · CWE-407 Pre-auth Denial of service	Medium5.3	—	0.4%	Aug 25, 2026
30Monitor	CVE-2026-80186No exploit	Bluez: stack overflow in name2utf8 causes dos and potential code executionred hat · red hat enterprise linux 10 · CWE-120 pre-auth RCE Memory safety	High7.6	—	0.5%	Aug 25, 2026
40Plan	CVE-2026-19632Proof of concept	TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosurecozmoslabs · translatepress – translate multilingual sites with ai translation · CWE-640 Pre-auth	Critical9.8	—	4.5%	Aug 26, 2026
33Monitor	CVE-2026-29988No exploit	A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affectemilesight · am102/102l v2 · CWE-319 Weak crypto	High8.3	—	0.1%	Aug 26, 2026
34Monitor	CVE-2026-52776No exploit	Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0oscal-compass · compliance-trestle · CWE-184 SSRF	High8.6	—	0.4%	Aug 26, 2026
28Monitor	CVE-2026-54467No exploit	On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, trustedfirmware · trusted firmware-m · CWE-283	High7.0	—	0.1%	Aug 26, 2026
31Monitor	CVE-2026-57170No exploit	Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)oscal-compass · compliance-trestle · CWE-94 RCE SSTI	High7.8	—	0.2%	Aug 26, 2026
30Monitor	CVE-2026-57171No exploit	Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)oscal-compass · compliance-trestle · CWE-22 Path traversal	High7.7	—	0.2%	Aug 26, 2026
31Monitor	CVE-2026-58089No exploit	hwpmc fails to detach PMCs during exec credential transitionsfreebsd · freebsd · CWE-273 Local privilege escalation	High7.8	—	0.1%	Aug 26, 2026
31Monitor	CVE-2026-58090No exploit	Use-after-free in unix SOCK_STREAM message handlingfreebsd · freebsd · CWE-416 Local privilege escalation Memory safety	High7.8	—	0.1%	Aug 26, 2026
31Monitor	CVE-2026-58091No exploit	Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctlfreebsd · freebsd · CWE-416 Local privilege escalation Memory safety	High7.8	—	0.1%	Aug 26, 2026
32Monitor	CVE-2026-58092No exploit	Unauthorized credential switchingfreebsd · freebsd · CWE-288 Auth bypass	High8.1	—	0.3%	Aug 26, 2026
33Monitor	CVE-2026-76148No exploit	CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.sasaki nobuyuki · corvusskk · CWE-94 RCE	High8.4	—	0.2%	Aug 26, 2026
28Monitor	CVE-2026-80189No exploit	LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extractionperber · leafwiki · CWE-409	High7.1	—	0.5%	Aug 26, 2026
34Monitor	CVE-2026-80191No exploit	GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requestsgrowi, inc. · growi · CWE-862 Pre-auth Broken access control (IDOR)	High8.7	—	0.4%	Aug 26, 2026
34Monitor	CVE-2026-80193No exploit	Kimai before 2.62.0 Authorization Bypass via QuickEntrykimai · kimai · CWE-862 Broken access control (IDOR)	High8.7	—	0.4%	Aug 26, 2026
34Monitor	CVE-2026-80194No exploit	Kimai before 2.64.0 Missing Authorization via ProjectViewController exportkimai · kimai · CWE-200 Info leak	High8.7	—	0.3%	Aug 26, 2026
34Monitor	CVE-2026-80195No exploit	Kimai before 2.63.0 Team Membership Removal via APIkimai · kimai · CWE-841	High8.7	—	0.3%	Aug 26, 2026
34Monitor	CVE-2026-80214No exploit	LibreNMS Virtualisation Discovery Module RCElibrenms · librenms · CWE-78 RCE Command injection	High8.6	—	0.5%	Aug 26, 2026
37Monitor	CVE-2026-15203No exploit	Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid softwaredanfoss · ic7-automation sp · CWE-1191 Pre-auth	Critical9.3	—	0.4%	Aug 26, 2026
21Monitor	CVE-2026-19094No exploit	Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parametersunknown · tutor lms · CWE-89 Pre-auth SQL injection	Medium5.3	—	0.3%	Aug 26, 2026
32Monitor	CVE-2026-19718No exploit	BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recoveryunknown · blogvault backup & staging · CWE-287 Pre-auth Auth bypass	High8.1	—	0.3%	Aug 26, 2026
28Monitor	CVE-2026-19760No exploit	WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Headeremrevona · wp fastest cache – wordpress cache plugin · CWE-79 Pre-auth XSS	High7.2	—	0.4%	Aug 26, 2026
28Monitor	CVE-2026-58093No exploit	Kernel use-after-free via tty ioctlsfreebsd · freebsd · CWE-362 Local privilege escalation Race condition	High7.0	—	0.0%	Aug 26, 2026
31Monitor	CVE-2026-58094No exploit	TOCTOU race in POSIX shared memory large page configurationfreebsd · freebsd · CWE-367 Local privilege escalation Race condition	High7.8	—	0.1%	Aug 26, 2026
35Monitor	CVE-2026-58095No exploit	ppp(8): incorrect length calculation in mp_Enddisc()freebsd · freebsd · CWE-122 RCE Memory safety	High8.8	—	0.6%	Aug 26, 2026
35Monitor	CVE-2026-58096No exploit	ppp(8): missing length validation in LcpDecodeConfig()freebsd · freebsd · CWE-130 RCE	High8.8	—	0.6%	Aug 26, 2026
31Monitor	CVE-2026-58097No exploit	ppp(8): missing length validation in mp_SetEnddisc()freebsd · freebsd · CWE-122 RCE Memory safety	High7.8	—	0.1%	Aug 26, 2026
28Monitor	CVE-2026-74851No exploit	Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callbackunknown · pods · CWE-94 RCE	High7.2	—	0.6%	Aug 26, 2026
30Monitor	CVE-2026-74928No exploit	WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routesunknown · project manager · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 26, 2026
30Monitor	CVE-2026-75797No exploit	AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameterunknown · ai engine · CWE-22 Path traversal	High7.7	—	0.4%	Aug 26, 2026
34Monitor	CVE-2026-77693No exploit	Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajaxunknown · order tip for woocommerce · CWE-73 Path traversal	High8.7	—	0.4%	Aug 26, 2026
28Monitor	CVE-2026-18331No exploit	Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameterstrategy11team · formidable forms – wordpress form builder for contact forms, calculators, quizzes & more · CWE-79 Pre-auth XSS	High7.2	—	0.4%	Aug 26, 2026
39Monitor	CVE-2026-18431Proof of concept	Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Writethemefusion · avada (fusion) builder · CWE-862 pre-auth RCE Broken access control (IDOR)	Critical9.8	—	0.8%	Aug 26, 2026
30Monitor	CVE-2026-18884No exploit	WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameterswpgenie · woocommerce lottery · CWE-89 Pre-auth SQL injection	High7.5	—	0.5%	Aug 26, 2026
35Monitor	CVE-2026-75977No exploit	Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookiekitae-park · mang board wp · CWE-269	High8.8	—	0.8%	Aug 26, 2026
35Monitor	CVE-2026-78236No exploit	Insecure PIN derivation mechanism in Admin By Request (ABR)admin by request (abr) · admin by request (abr) · CWE-284 Local privilege escalation Broken access control (IDOR)	High8.8	—	0.1%	Aug 26, 2026
31Monitor	CVE-2026-78237No exploit	Insufficient input validation in Admin By Request (ABR)admin by request (abr) · admin by request (abr) · CWE-20 Local privilege escalation	High7.8	—	0.1%	Aug 26, 2026
32Monitor	CVE-2026-18664No exploit	Wrong interpretation of ACL rangesnlnetlabs · nsd · CWE-284 Pre-auth Broken access control (IDOR)	High8.2	—	0.4%	Aug 26, 2026
32Monitor	CVE-2026-19401No exploit	Remote UDP DoS by sending multiple DNS Cookie optionsnlnetlabs · nsd · CWE-400 Pre-auth Denial of service	High8.2	—	0.4%	Aug 26, 2026
32Monitor	CVE-2026-19538No exploit	Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLSnlnetlabs · nsd · CWE-290 Pre-auth Auth bypass	High8.2	—	0.4%	Aug 26, 2026
39Monitor	CVE-2026-77533No exploit	A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protubiquiti inc · unifi protect application · CWE-20 RCE Command injection	Critical9.9	—	1.4%	Aug 26, 2026
34Monitor	CVE-2026-80233No exploit	CAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Uploadcayin technology · cayin cms-ws · CWE-434 RCE File upload	High8.6	—	0.8%	Aug 26, 2026
37Monitor	CVE-2026-80235No exploit	Thinking Software Technology｜EFence - Arbitrary File Uploadthinking software technology · efence · CWE-434 pre-auth RCE File upload	Critical9.3	—	0.8%	Aug 26, 2026

CVE-2026-79215
35Monitor
Integer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside th
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79216
30Monitor
Buffer overflow in Blink in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execu
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79218
33Monitor
Incorrect authorization in Sandbox in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proces
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeAug 25, 2026
CVE-2026-79219
35Monitor
Use after free in Bluetooth in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbit
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79223
35Monitor
Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a craft
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79224
33Monitor
Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to e
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79226
35Monitor
Improper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social e
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeAug 25, 2026
CVE-2026-79227
35Monitor
Type confusion in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeAug 25, 2026
CVE-2026-79230
35Monitor
Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeAug 25, 2026
CVE-2026-79231
35Monitor
Buffer overflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79232
38Monitor
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the s
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79235
38Monitor
Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79236
35Monitor
Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeAug 25, 2026
CVE-2026-79240
35Monitor
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrar
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79244
35Monitor
Use after free in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox v
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79245
30Monitor
Use after free in UI in Google Chrome prior to 152.0.7977.65 allowed a local attacker who had compromised the renderer process to execute ar
HighCVSS 7.7No exploitEPSS 0%
- RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79247
33Monitor
Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the rendere
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79256
33Monitor
Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromis
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeAug 25, 2026
CVE-2026-79257
38Monitor
Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79263
32Monitor
Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeAug 25, 2026
CVE-2026-79266
35Monitor
Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitr
HighCVSS 8.8Proof of conceptEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79275
38Monitor
Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79282
38Monitor
Use after free in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside th
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79286
29Monitor
Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to potentially execute ar
HighCVSS 7.4No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
google · chromeAug 25, 2026
CVE-2026-79290
38Monitor
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-79292
33Monitor
Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeAug 25, 2026
CVE-2026-80104
37Monitor
DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Path traversal
eosphoros-ai · db-gptAug 25, 2026
CVE-2026-62862
36Monitor
TypeBot: Account takeover via brute-forceable 6-digit magic-link code
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
- CSRF
baptistearno · typebot.ioAug 25, 2026
CVE-2026-62865
34Monitor
TypeBot: Arbitrary server file read via Send Email block attachment path
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
baptistearno · typebot.ioAug 25, 2026
CVE-2026-63403
34Monitor
Faktory: Unrecovered panic in command handlers allows full-server denial of service
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
contribsys · faktoryAug 25, 2026
CVE-2026-63404
29Monitor
Faktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Local privilege escalation
contribsys · faktoryAug 25, 2026
CVE-2026-65182
36Monitor
Apache Tomcat: Bypass longest prefix security constraint
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apache · tomcatAug 25, 2026
CVE-2026-65183
32Monitor
Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Race condition
apache · tomcatAug 25, 2026
CVE-2026-65637
39Monitor
Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
apache · tomcatAug 25, 2026
CVE-2026-65905
39Monitor
Apache Tomcat: Limited replay attack possible with DIGEST authentication
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache · tomcatAug 25, 2026
CVE-2026-65927
30Monitor
Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · tomcatAug 25, 2026
CVE-2026-66422
32Monitor
Apache Tomcat: Servlet role references can bypass declarative role constraints
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
apache · tomcatAug 25, 2026
CVE-2026-68525
36Monitor
Apache Tomcat: Redirect after FORM auth may bypass method specific constraints
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apache · tomcatAug 25, 2026
CVE-2026-68569
32Monitor
Apache Tomcat: Principal lookup can fail open in some cases
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
apache · tomcatAug 25, 2026
CVE-2026-68763
30Monitor
Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · tomcatAug 25, 2026
CVE-2026-78619
39Monitor
Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user iden
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
Aug 25, 2026
CVE-2026-78655
36Monitor
Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Aug 25, 2026
CVE-2026-80182
30Monitor
In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could c
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
openstack · keystoneAug 25, 2026
CVE-2026-80184
30Monitor
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials,
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
openstack · keystoneAug 25, 2026
CVE-2026-79992
31Monitor
Emacs: emacs: command injection via crafted filenames in tramp
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Command injection
red hat · red hat enterprise linux 10Aug 25, 2026
CVE-2026-15917
18Monitor
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
MediumCVSS 4.7No exploitEPSS 0%
- Pre-auth
- XSS
drupal · drupal coreAug 25, 2026
CVE-2026-16639
39Monitor
Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
drupal · internationalization single sign-onAug 25, 2026
CVE-2026-16641
39Monitor
Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
drupal · commerce elavonAug 25, 2026
CVE-2026-16644
36Monitor
Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
drupal · webform restAug 25, 2026
CVE-2026-16645
36Monitor
PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
drupal · photoswipe - responsive javascript modal image galleryAug 25, 2026
CVE-2026-18259
30Monitor
Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
drupal · token content accessAug 25, 2026
CVE-2026-18985
32Monitor
Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
drupal · edit in-place fieldAug 25, 2026
CVE-2026-41707
29Monitor
Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
vmware · spring securityAug 25, 2026
CVE-2026-54757
31Monitor
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
HighCVSS 7.8No exploitEPSS 0%
- RCE
- SSTI
oscal-compass · compliance-trestleAug 25, 2026
CVE-2026-79911
37Monitor
TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Memory safety
totolink · n600rAug 25, 2026
CVE-2026-80138
36Monitor
ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter
CriticalCVSS 9.2No exploitEPSS 1%
- pre-auth RCE
- Command injection
macwarrior · clipbucket-v5Aug 25, 2026
CVE-2026-77680
21Monitor
Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat enterprise linux 10Aug 25, 2026
CVE-2026-80186
30Monitor
Bluez: stack overflow in name2utf8 causes dos and potential code execution
HighCVSS 7.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
red hat · red hat enterprise linux 10Aug 25, 2026
CVE-2026-19632
40Plan
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
CriticalCVSS 9.8Proof of conceptEPSS 4%
- Pre-auth
cozmoslabs · translatepress – translate multilingual sites with ai translationAug 26, 2026
CVE-2026-29988
33Monitor
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affecte
HighCVSS 8.3No exploitEPSS 0%
- Weak crypto
milesight · am102/102l v2Aug 26, 2026
CVE-2026-52776
34Monitor
Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
HighCVSS 8.6No exploitEPSS 0%
- SSRF
oscal-compass · compliance-trestleAug 26, 2026
CVE-2026-54467
28Monitor
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure,
HighCVSS 7.0No exploitEPSS 0%
trustedfirmware · trusted firmware-mAug 26, 2026
CVE-2026-57170
31Monitor
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- SSTI
oscal-compass · compliance-trestleAug 26, 2026
CVE-2026-57171
30Monitor
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
oscal-compass · compliance-trestleAug 26, 2026
CVE-2026-58089
31Monitor
hwpmc fails to detach PMCs during exec credential transitions
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
freebsd · freebsdAug 26, 2026
CVE-2026-58090
31Monitor
Use-after-free in unix SOCK_STREAM message handling
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
freebsd · freebsdAug 26, 2026
CVE-2026-58091
31Monitor
Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
freebsd · freebsdAug 26, 2026
CVE-2026-58092
32Monitor
Unauthorized credential switching
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
freebsd · freebsdAug 26, 2026
CVE-2026-76148
33Monitor
CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.
HighCVSS 8.4No exploitEPSS 0%
- RCE
sasaki nobuyuki · corvusskkAug 26, 2026
CVE-2026-80189
28Monitor
LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extraction
HighCVSS 7.1No exploitEPSS 0%
perber · leafwikiAug 26, 2026
CVE-2026-80191
34Monitor
GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
growi, inc. · growiAug 26, 2026
CVE-2026-80193
34Monitor
Kimai before 2.62.0 Authorization Bypass via QuickEntry
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
kimai · kimaiAug 26, 2026
CVE-2026-80194
34Monitor
Kimai before 2.64.0 Missing Authorization via ProjectViewController export
HighCVSS 8.7No exploitEPSS 0%
- Info leak
kimai · kimaiAug 26, 2026
CVE-2026-80195
34Monitor
Kimai before 2.63.0 Team Membership Removal via API
HighCVSS 8.7No exploitEPSS 0%
kimai · kimaiAug 26, 2026
CVE-2026-80214
34Monitor
LibreNMS Virtualisation Discovery Module RCE
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Command injection
librenms · librenmsAug 26, 2026
CVE-2026-15203
37Monitor
Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
danfoss · ic7-automation spAug 26, 2026
CVE-2026-19094
21Monitor
Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · tutor lmsAug 26, 2026
CVE-2026-19718
32Monitor
BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · blogvault backup & stagingAug 26, 2026
CVE-2026-19760
28Monitor
WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
emrevona · wp fastest cache – wordpress cache pluginAug 26, 2026
CVE-2026-58093
28Monitor
Kernel use-after-free via tty ioctls
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
- Race condition
freebsd · freebsdAug 26, 2026
CVE-2026-58094
31Monitor
TOCTOU race in POSIX shared memory large page configuration
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Race condition
freebsd · freebsdAug 26, 2026
CVE-2026-58095
35Monitor
ppp(8): incorrect length calculation in mp_Enddisc()
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Memory safety
freebsd · freebsdAug 26, 2026
CVE-2026-58096
35Monitor
ppp(8): missing length validation in LcpDecodeConfig()
HighCVSS 8.8No exploitEPSS 0%
- RCE
freebsd · freebsdAug 26, 2026
CVE-2026-58097
31Monitor
ppp(8): missing length validation in mp_SetEnddisc()
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
freebsd · freebsdAug 26, 2026
CVE-2026-74851
28Monitor
Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback
HighCVSS 7.2No exploitEPSS 0%
- RCE
unknown · podsAug 26, 2026
CVE-2026-74928
30Monitor
WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · project managerAug 26, 2026
CVE-2026-75797
30Monitor
AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
unknown · ai engineAug 26, 2026
CVE-2026-77693
34Monitor
Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax
HighCVSS 8.7No exploitEPSS 0%
- Path traversal
unknown · order tip for woocommerceAug 26, 2026
CVE-2026-18331
28Monitor
Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
strategy11team · formidable forms – wordpress form builder for contact forms, calculators, quizzes & moreAug 26, 2026
CVE-2026-18431
39Monitor
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
themefusion · avada (fusion) builderAug 26, 2026
CVE-2026-18884
30Monitor
WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
wpgenie · woocommerce lotteryAug 26, 2026
CVE-2026-75977
35Monitor
Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie
HighCVSS 8.8No exploitEPSS 0%
kitae-park · mang board wpAug 26, 2026
CVE-2026-78236
35Monitor
Insecure PIN derivation mechanism in Admin By Request (ABR)
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
admin by request (abr) · admin by request (abr)Aug 26, 2026
CVE-2026-78237
31Monitor
Insufficient input validation in Admin By Request (ABR)
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
admin by request (abr) · admin by request (abr)Aug 26, 2026
CVE-2026-18664
32Monitor
Wrong interpretation of ACL ranges
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
nlnetlabs · nsdAug 26, 2026
CVE-2026-19401
32Monitor
Remote UDP DoS by sending multiple DNS Cookie options
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
nlnetlabs · nsdAug 26, 2026
CVE-2026-19538
32Monitor
Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
nlnetlabs · nsdAug 26, 2026
CVE-2026-77533
39Monitor
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Prot
CriticalCVSS 9.9No exploitEPSS 1%
- RCE
- Command injection
ubiquiti inc · unifi protect applicationAug 26, 2026
CVE-2026-80233
34Monitor
CAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Upload
HighCVSS 8.6No exploitEPSS 0%
- RCE
- File upload
cayin technology · cayin cms-wsAug 26, 2026
CVE-2026-80235
37Monitor
Thinking Software Technology｜EFence - Arbitrary File Upload
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- File upload
thinking software technology · efenceAug 26, 2026