By publication date

Exploited and new serious CVEs: August 2026

6,848 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 44 of 69

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
37Monitor	CVE-2026-71869No exploit	Orval: Import-time RCE via array-items default -> zod module-level template literalorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.6%	Aug 19, 2026
37Monitor	CVE-2026-71871No exploit	Orval: Import-time RCE via header-parameter default -> zod module-level template literalorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.6%	Aug 19, 2026
37Monitor	CVE-2026-72716No exploit	Orval: Import-time RCE via query-parameter default -> zod module-level template literalorval-labs · orval · CWE-1336 pre-auth RCE SSTI	Critical9.3	—	0.6%	Aug 19, 2026
37Monitor	CVE-2026-72717No exploit	Orval: Import-time RCE via schema default -> zod module-level template literalorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.6%	Aug 19, 2026
32Monitor	CVE-2026-73136No exploit	Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replayzenhive · machine payments protocol · CWE-294 Pre-auth Auth bypass	High8.2	—	0.5%	Aug 19, 2026
33Monitor	CVE-2026-73541No exploit	Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drainzenhive · machine payments protocol · CWE-770 Pre-auth Denial of service	High8.3	—	0.5%	Aug 19, 2026
34Monitor	CVE-2026-75149No exploit	marimo < 0.23.15 Code Injection via MCP Server Configurationmarimo-team · marimo · CWE-94 pre-auth RCE	High8.7	—	0.9%	Aug 19, 2026
31Monitor	CVE-2026-43961No exploit	Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code executionvim · vim · CWE-94 RCE Local privilege escalation	High7.8	—	0.1%	Aug 19, 2026
30Monitor	CVE-2026-51367Proof of concept	An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoinCWE-639 Pre-auth Broken access control (IDOR)	High7.5	—	0.5%	Aug 19, 2026
29Monitor	CVE-2026-54796No exploit	Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Commdell · openmanage enterprise · CWE-78 RCE Command injection	High7.2	—	2.0%	Aug 19, 2026
37Monitor	CVE-2026-75916No exploit	SiYuan XSS-to-RCE via unescaped block metadata in hint popupsiyuan-note · siyuan · CWE-79 RCE Local privilege escalation XSS	Critical9.3	—	0.2%	Aug 19, 2026
37Monitor	CVE-2026-75917No exploit	SiYuan before v3.7.4 XSS-to-RCE via pathName.tssiyuan-note · siyuan · CWE-79 RCE Local privilege escalation XSS	Critical9.3	—	0.2%	Aug 19, 2026
35Monitor	CVE-2026-76208No exploit	phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAPphpmyfaq · phpmyfaq · CWE-778 Pre-auth Auth bypass	High8.8	—	0.4%	Aug 19, 2026
34Monitor	CVE-2026-76221No exploit	GitPython before 3.1.58 Config Injection via option-namegitpython project · gitpython · CWE-74 RCE	High8.7	—	0.4%	Aug 19, 2026
27Monitor	CVE-2026-76226No exploit	Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenancerenovatebot · renovate · CWE-78 RCE Command injection	Medium6.8	—	0.2%	Aug 19, 2026
33Monitor	CVE-2026-76228No exploit	Renovate before 42.68.5 Remote Code Execution via Gradle Wrapperrenovatebot · renovate · CWE-78 RCE Command injection	High8.4	—	0.9%	Aug 19, 2026
34Monitor	CVE-2026-76234No exploit	libcrux before 0.0.6 Cryptographic Implementation Bug Fixescelabshq · libcrux-ecdh · CWE-347 Pre-auth Weak crypto	High8.7	—	0.3%	Aug 19, 2026
30Monitor	CVE-2026-14970No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-120 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Aug 19, 2026
32Monitor	CVE-2026-15061No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-22 Pre-auth Path traversal	High8.2	—	0.5%	Aug 19, 2026
36Monitor	CVE-2026-15065No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-312 Pre-auth	Critical9.1	—	0.6%	Aug 19, 2026
39Monitor	CVE-2026-15068No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-78 RCE Command injection	Critical9.9	—	0.7%	Aug 19, 2026
32Monitor	CVE-2026-15078No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-295 Weak crypto	High8.1	—	0.3%	Aug 19, 2026
39Monitor	CVE-2026-16656No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.7%	Aug 19, 2026
32Monitor	CVE-2026-16686No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-287 Pre-auth Auth bypass	High8.2	—	0.5%	Aug 19, 2026
30Monitor	CVE-2026-16690No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Aug 19, 2026
31Monitor	CVE-2026-16703No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-269 Local privilege escalation	High7.8	—	0.1%	Aug 19, 2026
30Monitor	CVE-2026-16706No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Aug 19, 2026
35Monitor	CVE-2026-16814No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.4%	Aug 19, 2026
39Monitor	CVE-2026-16816No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-78 RCE Command injection	Critical9.9	—	0.7%	Aug 19, 2026
30Monitor	CVE-2026-16817No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Aug 19, 2026
30Monitor	CVE-2026-16818No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Aug 19, 2026
29Monitor	CVE-2026-18526No exploit	HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmationhumhub · humhub · CWE-79 XSS	High7.4	—	0.4%	Aug 19, 2026
28Monitor	CVE-2026-18756No exploit	HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button renderinghumhub · humhub · CWE-79 XSS	High7.2	—	0.4%	Aug 19, 2026
35Monitor	CVE-2026-44829No exploit	Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filenamegotenberg · gotenberg · CWE-22 Pre-auth Path traversal	High8.8	—	0.5%	Aug 19, 2026
30Monitor	CVE-2026-45741No exploit	Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixesgotenberg · gotenberg · CWE-184 Pre-auth SSRF	High7.5	—	0.3%	Aug 19, 2026
30Monitor	CVE-2026-45742No exploit	Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')gotenberg · gotenberg · CWE-362 Pre-auth Race condition Denial of service	High7.5	—	0.7%	Aug 19, 2026
28Monitor	CVE-2026-49253No exploit	electerm: Path Traversal in Zmodem and Trzsz Download Filename Handlingelecterm · electerm · CWE-22 Pre-auth Path traversal	High7.1	—	0.4%	Aug 19, 2026
35Monitor	CVE-2026-49255No exploit	electerm: Command Injection in File System Operations (rmrf, mv, cp)electerm · electerm · CWE-78 pre-auth RCE Command injection	High8.8	—	0.7%	Aug 19, 2026
29Monitor	CVE-2026-52834No exploit	jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platformstirr-c · jxl-oxide · CWE-122 Memory safety	High7.3	—	0.1%	Aug 19, 2026
38Monitor	CVE-2026-16687No exploit	Power System Buffer Overflowibm · power system e1180 \(9080-heu\) firmware · CWE-121 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Aug 19, 2026
30Monitor	CVE-2026-16828No exploit	Power System Out-of-bounds Readibm · power system e1080 \(9080-hex\) firmware · CWE-125 Pre-auth Memory safety	High7.6	—	0.2%	Aug 19, 2026
33Monitor	CVE-2026-16832No exploit	Power System Buffer Overflowibm · power system e1080 \(9080-hex\) firmware · CWE-121 RCE Memory safety	High8.4	—	0.3%	Aug 19, 2026
38Monitor	CVE-2026-16835No exploit	Power System Improper Certificate Validationibm · power system e1080 \(9080-hex\) firmware · CWE-295 Pre-auth Auth bypass Weak crypto	Critical9.6	—	0.3%	Aug 19, 2026
32Monitor	CVE-2026-16930No exploit	Power System Missing Authorizationibm · power system e1180 \(9080-heu\) firmware · CWE-862 RCE Broken access control (IDOR)	High8.2	—	0.1%	Aug 19, 2026
32Monitor	CVE-2026-17093No exploit	Power System Buffer Overflowibm · power system s1122 \(9824-22a\) firmware · CWE-121 Memory safety	High8.2	—	0.1%	Aug 19, 2026
32Monitor	CVE-2026-17100No exploit	Power System Out-of-bounds Writeibm · power system s1122 \(9824-22a\) firmware · CWE-787 RCE Memory safety	High8.2	—	0.1%	Aug 19, 2026
32Monitor	CVE-2026-17429No exploit	Power System Incorrect Authorizationibm · power system s1122 \(9824-22a\) firmware · CWE-863 Broken access control (IDOR)	High8.1	—	0.1%	Aug 19, 2026
32Monitor	CVE-2026-17494No exploit	Power System Buffer Overflowibm · power system s1122 \(9824-22a\) firmware · CWE-121 RCE Memory safety	High8.2	—	0.1%	Aug 19, 2026
40Plan	CVE-2026-18315Proof of concept	TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameterthemetechmount · truebooker – appointment booking and scheduler system · CWE-639 Pre-auth Broken access control (IDOR)	Critical9.8	—	3.0%	Aug 19, 2026
33Monitor	CVE-2026-18848No exploit	Power System Cross-Site Request Forgery (CSRF)ibm · power system e1080 \(9080-hex\) firmware · CWE-352 Pre-auth CSRF	High8.3	—	0.1%	Aug 19, 2026
37Monitor	CVE-2026-71960Proof of concept	Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTTshenzhen cudy technology co., ltd. · wr3000 2.0 · CWE-798 Pre-auth Auth bypass Hard-coded credentials	Critical9.3	—	0.5%	Aug 19, 2026
32Monitor	CVE-2026-16661No exploit	Power System Integer Overflowibm · power system s1122 \(9824-22a\) firmware · CWE-190 RCE Memory safety	High8.2	—	0.1%	Aug 19, 2026
32Monitor	CVE-2026-16707No exploit	Power System Out-of-bounds Readibm · power system s1122 \(9824-22a\) firmware · CWE-125 Memory safety	High8.2	—	0.1%	Aug 19, 2026
30Monitor	CVE-2026-16819No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-367 Race condition	High7.7	—	0.1%	Aug 19, 2026
28Monitor	CVE-2026-18430No exploit	HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reasonhumhub · humhub · CWE-79 XSS	High7.2	—	0.4%	Aug 19, 2026
30Monitor	CVE-2026-44252No exploit	Wazuh Manager dapi RBAC Bypass Allows Privilege Escalationwazuh · wazuh · CWE-863 Broken access control (IDOR)	High7.7	—	0.5%	Aug 19, 2026
32Monitor	CVE-2026-16933No exploit	Power System Integer Overflowibm · power system s1122 \(9824-22a\) firmware · CWE-190 Memory safety	High8.2	—	0.1%	Aug 19, 2026
30Monitor	CVE-2026-46343No exploit	Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file()wazuh · wazuh · CWE-22 Path traversal	High7.5	—	0.4%	Aug 19, 2026
29Monitor	CVE-2026-17042No exploit	Power System Out-of-bounds Readibm · power system s922 \(9009-22g\) firmware · CWE-125 Memory safety	High7.3	—	0.1%	Aug 19, 2026
31Monitor	CVE-2026-17063No exploit	Power System Incorrect Authorizationibm · power system s1122 \(9824-22a\) firmware · CWE-863 Broken access control (IDOR)	High7.9	—	0.1%	Aug 19, 2026
33Monitor	CVE-2026-17091No exploit	Power System Integer Overflowibm · power system s1122 \(9824-22a\) firmware · CWE-190 Memory safety	High8.4	—	0.1%	Aug 19, 2026
35Monitor	CVE-2026-17414No exploit	Power System Improper Input Validationibm · power system s1122 \(9824-22a\) firmware · CWE-20 Pre-auth	High8.8	—	0.2%	Aug 19, 2026
35Monitor	CVE-2026-18821No exploit	Power System Out-of-bounds Writeibm · power system s1122 \(9824-22a\) firmware · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.2%	Aug 19, 2026
29Monitor	CVE-2026-18871No exploit	Power System Buffer Overflowibm · power system s1122 \(9824-22a\) firmware · CWE-121 Memory safety	High7.3	—	0.1%	Aug 19, 2026
39Monitor	CVE-2026-19505No exploit	RDK-B WebUI improper cryptographic signature verification vulnerabilityrdk · rdk-b webui · CWE-347 Pre-auth Auth bypass Weak crypto	Critical9.8	—	0.5%	Aug 19, 2026
32Monitor	CVE-2026-19506No exploit	RDK-B WebUI race condition vulnerabilityrdk · rdk-b webui · CWE-362 Pre-auth Race condition	High8.1	—	0.4%	Aug 19, 2026
30Monitor	CVE-2026-19507No exploit	RDK WebUI uncontrolled resource consumptionrdk · rdk-b webui · CWE-400 Pre-auth Denial of service	High7.5	—	0.6%	Aug 19, 2026
39Monitor	CVE-2026-19508No exploit	RDK WebUI heap-based buffer overflow vulnerabilityrdk · rdk-b webui · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	0.9%	Aug 19, 2026
40Plan	CVE-2026-22306No exploit	Critical flaw impacting OZOLS ERP's automatic update channelozols grupa · ozols · CWE-319 Pre-auth Weak crypto	Critical10.0	—	0.2%	Aug 19, 2026
38Monitor	CVE-2026-55085No exploit	Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-liteether · etherpad · CWE-79 Pre-auth XSS	Critical9.6	—	0.4%	Aug 19, 2026
24Monitor	CVE-2026-55087Proof of concept	Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)ether · etherpad · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Aug 19, 2026
30Monitor	CVE-2026-62317No exploit	Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)logto-io · logto · CWE-1333 Pre-auth Denial of service	High7.5	—	0.7%	Aug 19, 2026
34Monitor	CVE-2026-63188No exploit	logto-tunnel serves files outside --experience-path via path traversallogto-io · logto · CWE-22 Pre-auth Path traversal	High8.7	—	0.5%	Aug 19, 2026
28Monitor	CVE-2026-75593No exploit	BuildKit: Malicious client can bypass destination directory validation on local sources uploadmoby · buildkit · CWE-22 Auth bypass Path traversal	High7.2	—	0.5%	Aug 19, 2026
35Monitor	CVE-2026-76647No exploit	Leantime JSON-RPC API contains a missing authorization vulnerabilityleantime · json-rpc api · CWE-200 Info leak	High8.8	—	0.5%	Aug 19, 2026
37Monitor	CVE-2026-62668No exploit	Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocolsgetgrav · grav · CWE-918 SSRF	Critical9.4	—	0.4%	Aug 19, 2026
29Monitor	CVE-2026-62669No exploit	Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challengegetgrav · grav · CWE-287 Pre-auth Auth bypass	High7.4	—	0.5%	Aug 19, 2026
35Monitor	CVE-2026-12522No exploit	Stack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fieldszephyrproject · zephyr · CWE-787 Pre-auth Memory safety	High8.8	—	0.3%	Aug 19, 2026
32Monitor	CVE-2026-12633No exploit	Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisementzephyrproject · zephyr · CWE-787 Pre-auth Memory safety	High8.1	—	0.3%	Aug 19, 2026
32Monitor	CVE-2026-17015No exploit	IBM i Denial of Serviceibm · i · CWE-125 Memory safety	High8.1	—	0.4%	Aug 19, 2026
32Monitor	CVE-2026-18544No exploit	Portieris is vulnerable to Image Policy Bypass via Unvalidated ownerReferenceibm · portieris · CWE-862 Broken access control (IDOR)	High8.1	—	0.4%	Aug 19, 2026
35Monitor	CVE-2026-53542No exploit	Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hoststermix-ssh · termix · CWE-78 RCE Command injection	High8.8	—	0.6%	Aug 19, 2026
39Monitor	CVE-2026-53545No exploit	Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injectiontermix-ssh · termix · CWE-78 pre-auth RCE Command injection	Critical9.8	—	0.7%	Aug 19, 2026
38Monitor	CVE-2026-53546No exploit	Termix: Missing authorization in SSH host credential resolution exposes stored credentialstermix-ssh · termix · CWE-639 Broken access control (IDOR)	Critical9.6	—	0.4%	Aug 19, 2026
35Monitor	CVE-2026-53547No exploit	Termix: Account Takeover via Global Settings Disclosuretermix-ssh · termix · CWE-862 Broken access control (IDOR)	High8.8	—	0.5%	Aug 19, 2026
38Monitor	CVE-2026-53548No exploit	Termix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other userstermix-ssh · termix · CWE-285 Broken access control (IDOR)	Critical9.6	—	0.4%	Aug 19, 2026
30Monitor	CVE-2026-53549No exploit	Termix: Server-Side Request Forgery via Proxy Connectivity Testtermix-ssh · termix · CWE-918 SSRF	High7.7	—	0.4%	Aug 19, 2026
34Monitor	CVE-2026-61556No exploit	LiquidJS: An infinite loop vulnerability in `strip_html` filterharttle · liquidjs · CWE-835 Pre-auth Denial of service	High8.7	—	0.5%	Aug 19, 2026
30Monitor	CVE-2026-69222No exploit	LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the processharttle · liquidjs · CWE-400 Pre-auth Denial of service	High7.5	—	0.6%	Aug 19, 2026
35Monitor	CVE-2026-75616Proof of concept	Command Injection in Router Web Management Interfacetp-link · archer c20 firmware · CWE-78 RCE Command injection	High8.5	—	2.8%	Aug 19, 2026
8Monitor	CVE-2026-76576No exploit	yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversalyangzongzhuan · ruoyi-vue · CWE-22 Path traversal	Low2.1	—	0.4%	Aug 19, 2026
34Monitor	CVE-2026-76584No exploit	TRENDnet TV-IP751WIC alphapd set_time.cgi stack-based overflowtrendnet · tv-ip751wic · CWE-119 Memory safety	High8.6	—	0.8%	Aug 19, 2026
30Monitor	CVE-2024-13942No exploit	Rockchip RK3588s Secure BootROM TOCTOU (time-of-check to time-of-use) vulnerability leading to arbitrary code execution with highest privilegesrockchip · rk3588s · CWE-367 RCE Race condition	High7.6	—	0.2%	Aug 19, 2026
32Monitor	CVE-2026-41424No exploit	Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpointwazuh · wazuh · CWE-863 Broken access control (IDOR)	High8.2	—	0.4%	Aug 19, 2026
33Monitor	CVE-2026-44901No exploit	Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerabilitywazuh · wazuh · CWE-502 RCE Deserialization	High8.4	—	0.7%	Aug 19, 2026
30Monitor	CVE-2026-45798No exploit	Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: fieldwazuh · wazuh · CWE-121 Pre-auth Memory safety Denial of service	High7.5	—	0.9%	Aug 19, 2026
36Monitor	CVE-2026-48024No exploit	Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh managerwazuh · wazuh · CWE-22 Path traversal	Critical9.1	—	0.7%	Aug 19, 2026
36Monitor	CVE-2026-48162No exploit	Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh managerwazuh · wazuh · CWE-73 Path traversal	Critical9.1	—	0.6%	Aug 19, 2026
36Monitor	CVE-2026-49441No exploit	Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh managerwazuh · wazuh · CWE-73 Path traversal	Critical9.1	—	0.7%	Aug 19, 2026
36Monitor	CVE-2026-71470No exploit	Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sared hat · red hat advanced cluster management for kubernetes 2.11 · CWE-913	Critical9.1	—	0.7%	Aug 19, 2026

CVE-2026-71869
37Monitor
Orval: Import-time RCE via array-items default -> zod module-level template literal
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalAug 19, 2026
CVE-2026-71871
37Monitor
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalAug 19, 2026
CVE-2026-72716
37Monitor
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- SSTI
orval-labs · orvalAug 19, 2026
CVE-2026-72717
37Monitor
Orval: Import-time RCE via schema default -> zod module-level template literal
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalAug 19, 2026
CVE-2026-73136
32Monitor
Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
zenhive · machine payments protocolAug 19, 2026
CVE-2026-73541
33Monitor
Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Denial of service
zenhive · machine payments protocolAug 19, 2026
CVE-2026-75149
34Monitor
marimo < 0.23.15 Code Injection via MCP Server Configuration
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
marimo-team · marimoAug 19, 2026
CVE-2026-43961
31Monitor
Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
vim · vimAug 19, 2026
CVE-2026-51367
30Monitor
An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoin
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 19, 2026
CVE-2026-54796
29Monitor
Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Comm
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
dell · openmanage enterpriseAug 19, 2026
CVE-2026-75916
37Monitor
SiYuan XSS-to-RCE via unescaped block metadata in hint popup
CriticalCVSS 9.3No exploitEPSS 0%
- RCE
- Local privilege escalation
- XSS
siyuan-note · siyuanAug 19, 2026
CVE-2026-75917
37Monitor
SiYuan before v3.7.4 XSS-to-RCE via pathName.ts
CriticalCVSS 9.3No exploitEPSS 0%
- RCE
- Local privilege escalation
- XSS
siyuan-note · siyuanAug 19, 2026
CVE-2026-76208
35Monitor
phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
phpmyfaq · phpmyfaqAug 19, 2026
CVE-2026-76221
34Monitor
GitPython before 3.1.58 Config Injection via option-name
HighCVSS 8.7No exploitEPSS 0%
- RCE
gitpython project · gitpythonAug 19, 2026
CVE-2026-76226
27Monitor
Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance
MediumCVSS 6.8No exploitEPSS 0%
- RCE
- Command injection
renovatebot · renovateAug 19, 2026
CVE-2026-76228
33Monitor
Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Command injection
renovatebot · renovateAug 19, 2026
CVE-2026-76234
34Monitor
libcrux before 0.0.6 Cryptographic Implementation Bug Fixes
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
celabshq · libcrux-ecdhAug 19, 2026
CVE-2026-14970
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
ibm · viosAug 19, 2026
CVE-2026-15061
32Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
ibm · viosAug 19, 2026
CVE-2026-15065
36Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
ibm · viosAug 19, 2026
CVE-2026-15068
39Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- Command injection
ibm · viosAug 19, 2026
CVE-2026-15078
32Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 8.1No exploitEPSS 0%
- Weak crypto
ibm · viosAug 19, 2026
CVE-2026-16656
39Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · viosAug 19, 2026
CVE-2026-16686
32Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · viosAug 19, 2026
CVE-2026-16690
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · viosAug 19, 2026
CVE-2026-16703
31Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
ibm · viosAug 19, 2026
CVE-2026-16706
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
ibm · viosAug 19, 2026
CVE-2026-16814
35Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · viosAug 19, 2026
CVE-2026-16816
39Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- Command injection
ibm · viosAug 19, 2026
CVE-2026-16817
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
ibm · viosAug 19, 2026
CVE-2026-16818
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · viosAug 19, 2026
CVE-2026-18526
29Monitor
HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation
HighCVSS 7.4No exploitEPSS 0%
- XSS
humhub · humhubAug 19, 2026
CVE-2026-18756
28Monitor
HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering
HighCVSS 7.2No exploitEPSS 0%
- XSS
humhub · humhubAug 19, 2026
CVE-2026-44829
35Monitor
Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Path traversal
gotenberg · gotenbergAug 19, 2026
CVE-2026-45741
30Monitor
Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
gotenberg · gotenbergAug 19, 2026
CVE-2026-45742
30Monitor
Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Race condition
- Denial of service
gotenberg · gotenbergAug 19, 2026
CVE-2026-49253
28Monitor
electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Path traversal
electerm · electermAug 19, 2026
CVE-2026-49255
35Monitor
electerm: Command Injection in File System Operations (rmrf, mv, cp)
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Command injection
electerm · electermAug 19, 2026
CVE-2026-52834
29Monitor
jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
tirr-c · jxl-oxideAug 19, 2026
CVE-2026-16687
38Monitor
Power System Buffer Overflow
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · power system e1180 \(9080-heu\) firmwareAug 19, 2026
CVE-2026-16828
30Monitor
Power System Out-of-bounds Read
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Memory safety
ibm · power system e1080 \(9080-hex\) firmwareAug 19, 2026
CVE-2026-16832
33Monitor
Power System Buffer Overflow
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Memory safety
ibm · power system e1080 \(9080-hex\) firmwareAug 19, 2026
CVE-2026-16835
38Monitor
Power System Improper Certificate Validation
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
ibm · power system e1080 \(9080-hex\) firmwareAug 19, 2026
CVE-2026-16930
32Monitor
Power System Missing Authorization
HighCVSS 8.2No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
ibm · power system e1180 \(9080-heu\) firmwareAug 19, 2026
CVE-2026-17093
32Monitor
Power System Buffer Overflow
HighCVSS 8.2No exploitEPSS 0%
- Memory safety
ibm · power system s1122 \(9824-22a\) firmwareAug 19, 2026
CVE-2026-17100
32Monitor
Power System Out-of-bounds Write
HighCVSS 8.2No exploitEPSS 0%
- RCE
- Memory safety
ibm · power system s1122 \(9824-22a\) firmwareAug 19, 2026
CVE-2026-17429
32Monitor
Power System Incorrect Authorization
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
ibm · power system s1122 \(9824-22a\) firmwareAug 19, 2026
CVE-2026-17494
32Monitor
Power System Buffer Overflow
HighCVSS 8.2No exploitEPSS 0%
- RCE
- Memory safety
ibm · power system s1122 \(9824-22a\) firmwareAug 19, 2026
CVE-2026-18315
40Plan
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
CriticalCVSS 9.8Proof of conceptEPSS 3%
- Pre-auth
- Broken access control (IDOR)
themetechmount · truebooker – appointment booking and scheduler systemAug 19, 2026
CVE-2026-18848
33Monitor
Power System Cross-Site Request Forgery (CSRF)
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- CSRF
ibm · power system e1080 \(9080-hex\) firmwareAug 19, 2026
CVE-2026-71960
37Monitor
Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
- Hard-coded credentials
shenzhen cudy technology co., ltd. · wr3000 2.0Aug 19, 2026
CVE-2026-16661
32Monitor
Power System Integer Overflow
HighCVSS 8.2No exploitEPSS 0%
- RCE
- Memory safety
ibm · power system s1122 \(9824-22a\) firmwareAug 19, 2026
CVE-2026-16707
32Monitor
Power System Out-of-bounds Read
HighCVSS 8.2No exploitEPSS 0%
- Memory safety
ibm · power system s1122 \(9824-22a\) firmwareAug 19, 2026
CVE-2026-16819
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.7No exploitEPSS 0%
- Race condition
ibm · viosAug 19, 2026
CVE-2026-18430
28Monitor
HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason
HighCVSS 7.2No exploitEPSS 0%
- XSS
humhub · humhubAug 19, 2026
CVE-2026-44252
30Monitor
Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
wazuh · wazuhAug 19, 2026
CVE-2026-16933
32Monitor
Power System Integer Overflow
HighCVSS 8.2No exploitEPSS 0%
- Memory safety
ibm · power system s1122 \(9824-22a\) firmwareAug 19, 2026
CVE-2026-46343
30Monitor
Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file()
HighCVSS 7.5No exploitEPSS 0%
- Path traversal
wazuh · wazuhAug 19, 2026
CVE-2026-17042
29Monitor
Power System Out-of-bounds Read
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
ibm · power system s922 \(9009-22g\) firmwareAug 19, 2026
CVE-2026-17063
31Monitor
Power System Incorrect Authorization
HighCVSS 7.9No exploitEPSS 0%
- Broken access control (IDOR)
ibm · power system s1122 \(9824-22a\) firmwareAug 19, 2026
CVE-2026-17091
33Monitor
Power System Integer Overflow
HighCVSS 8.4No exploitEPSS 0%
- Memory safety
ibm · power system s1122 \(9824-22a\) firmwareAug 19, 2026
CVE-2026-17414
35Monitor
Power System Improper Input Validation
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
ibm · power system s1122 \(9824-22a\) firmwareAug 19, 2026
CVE-2026-18821
35Monitor
Power System Out-of-bounds Write
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · power system s1122 \(9824-22a\) firmwareAug 19, 2026
CVE-2026-18871
29Monitor
Power System Buffer Overflow
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
ibm · power system s1122 \(9824-22a\) firmwareAug 19, 2026
CVE-2026-19505
39Monitor
RDK-B WebUI improper cryptographic signature verification vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
rdk · rdk-b webuiAug 19, 2026
CVE-2026-19506
32Monitor
RDK-B WebUI race condition vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Race condition
rdk · rdk-b webuiAug 19, 2026
CVE-2026-19507
30Monitor
RDK WebUI uncontrolled resource consumption
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
rdk · rdk-b webuiAug 19, 2026
CVE-2026-19508
39Monitor
RDK WebUI heap-based buffer overflow vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
rdk · rdk-b webuiAug 19, 2026
CVE-2026-22306
40Plan
Critical flaw impacting OZOLS ERP's automatic update channel
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Weak crypto
ozols grupa · ozolsAug 19, 2026
CVE-2026-55085
38Monitor
Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- XSS
ether · etherpadAug 19, 2026
CVE-2026-55087
24Monitor
Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
ether · etherpadAug 19, 2026
CVE-2026-62317
30Monitor
Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
logto-io · logtoAug 19, 2026
CVE-2026-63188
34Monitor
logto-tunnel serves files outside --experience-path via path traversal
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
logto-io · logtoAug 19, 2026
CVE-2026-75593
28Monitor
BuildKit: Malicious client can bypass destination directory validation on local sources upload
HighCVSS 7.2No exploitEPSS 0%
- Auth bypass
- Path traversal
moby · buildkitAug 19, 2026
CVE-2026-76647
35Monitor
Leantime JSON-RPC API contains a missing authorization vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Info leak
leantime · json-rpc apiAug 19, 2026
CVE-2026-62668
37Monitor
Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols
CriticalCVSS 9.4No exploitEPSS 0%
- SSRF
getgrav · gravAug 19, 2026
CVE-2026-62669
29Monitor
Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
getgrav · gravAug 19, 2026
CVE-2026-12522
35Monitor
Stack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fields
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
zephyrproject · zephyrAug 19, 2026
CVE-2026-12633
32Monitor
Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Memory safety
zephyrproject · zephyrAug 19, 2026
CVE-2026-17015
32Monitor
IBM i Denial of Service
HighCVSS 8.1No exploitEPSS 0%
- Memory safety
ibm · iAug 19, 2026
CVE-2026-18544
32Monitor
Portieris is vulnerable to Image Policy Bypass via Unvalidated ownerReference
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
ibm · portierisAug 19, 2026
CVE-2026-53542
35Monitor
Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
termix-ssh · termixAug 19, 2026
CVE-2026-53545
39Monitor
Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Command injection
termix-ssh · termixAug 19, 2026
CVE-2026-53546
38Monitor
Termix: Missing authorization in SSH host credential resolution exposes stored credentials
CriticalCVSS 9.6No exploitEPSS 0%
- Broken access control (IDOR)
termix-ssh · termixAug 19, 2026
CVE-2026-53547
35Monitor
Termix: Account Takeover via Global Settings Disclosure
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
termix-ssh · termixAug 19, 2026
CVE-2026-53548
38Monitor
Termix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users
CriticalCVSS 9.6No exploitEPSS 0%
- Broken access control (IDOR)
termix-ssh · termixAug 19, 2026
CVE-2026-53549
30Monitor
Termix: Server-Side Request Forgery via Proxy Connectivity Test
HighCVSS 7.7No exploitEPSS 0%
- SSRF
termix-ssh · termixAug 19, 2026
CVE-2026-61556
34Monitor
LiquidJS: An infinite loop vulnerability in `strip_html` filter
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
harttle · liquidjsAug 19, 2026
CVE-2026-69222
30Monitor
LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
harttle · liquidjsAug 19, 2026
CVE-2026-75616
35Monitor
Command Injection in Router Web Management Interface
HighCVSS 8.5Proof of conceptEPSS 2%
- RCE
- Command injection
tp-link · archer c20 firmwareAug 19, 2026
CVE-2026-76576
8Monitor
yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal
LowCVSS 2.1No exploitEPSS 0%
- Path traversal
yangzongzhuan · ruoyi-vueAug 19, 2026
CVE-2026-76584
34Monitor
TRENDnet TV-IP751WIC alphapd set_time.cgi stack-based overflow
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
trendnet · tv-ip751wicAug 19, 2026
CVE-2024-13942
30Monitor
Rockchip RK3588s Secure BootROM TOCTOU (time-of-check to time-of-use) vulnerability leading to arbitrary code execution with highest privileges
HighCVSS 7.6No exploitEPSS 0%
- RCE
- Race condition
rockchip · rk3588sAug 19, 2026
CVE-2026-41424
32Monitor
Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint
HighCVSS 8.2No exploitEPSS 0%
- Broken access control (IDOR)
wazuh · wazuhAug 19, 2026
CVE-2026-44901
33Monitor
Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Deserialization
wazuh · wazuhAug 19, 2026
CVE-2026-45798
30Monitor
Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
wazuh · wazuhAug 19, 2026
CVE-2026-48024
36Monitor
Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager
CriticalCVSS 9.1No exploitEPSS 0%
- Path traversal
wazuh · wazuhAug 19, 2026
CVE-2026-48162
36Monitor
Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager
CriticalCVSS 9.1No exploitEPSS 0%
- Path traversal
wazuh · wazuhAug 19, 2026
CVE-2026-49441
36Monitor
Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager
CriticalCVSS 9.1No exploitEPSS 0%
- Path traversal
wazuh · wazuhAug 19, 2026
CVE-2026-71470
36Monitor
Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa
CriticalCVSS 9.1No exploitEPSS 0%
red hat · red hat advanced cluster management for kubernetes 2.11Aug 19, 2026