By publication date

Exploited and new serious CVEs: August 2026

6,986 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 45 of 70

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-75956No exploit	Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3cmsjunkie.com · j-businessdirectory extension for joomla · CWE-770 Pre-auth Denial of service	High8.7	—	0.4%	Aug 19, 2026
35Monitor	CVE-2026-62666No exploit	Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of supergetgrav · grav-plugin-api · CWE-639 Broken access control (IDOR)	High8.8	—	0.6%	Aug 19, 2026
32Monitor	CVE-2026-62667No exploit	Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACLgetgrav · grav-plugin-api · CWE-862 Broken access control (IDOR)	High8.1	—	0.4%	Aug 19, 2026
32Monitor	CVE-2026-62673No exploit	Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystemsgetgrav · grav · CWE-178 Pre-auth	High8.2	—	0.5%	Aug 19, 2026
32Monitor	CVE-2026-63407No exploit	Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responsesgetgrav · grav-plugin-api · CWE-942 Pre-auth	High8.2	—	0.3%	Aug 19, 2026
30Monitor	CVE-2026-63408No exploit	Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parametergetgrav · grav-plugin-api · CWE-598 Pre-auth	High7.5	—	0.4%	Aug 19, 2026
34Monitor	CVE-2026-64850No exploit	Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()getgrav · grav · CWE-94 RCE	High8.7	—	0.4%	Aug 19, 2026
34Monitor	CVE-2026-64851No exploit	Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlersgetgrav · grav-plugin-shortcode-core · CWE-79 XSS	High8.5	—	0.4%	Aug 19, 2026
34Monitor	CVE-2026-64852No exploit	Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any accountgetgrav · grav-plugin-api · CWE-862 Broken access control (IDOR)	High8.7	—	0.4%	Aug 19, 2026
77This week	CVE-2026-19490Weaponized	NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490citrix · netscaler application delivery controller · CWE-288 Pre-auth Auth bypass	Critical9.3	KEV	32.6%	Aug 19, 2026
30Monitor	CVE-2026-67363Proof of concept	Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2balbooa.com · balbooa forms extension for joomla · CWE-472 Pre-auth CSRF	High7.7	—	0.5%	Aug 19, 2026
40Plan	CVE-2026-67364No exploit	Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2balbooa.com · balbooa forms extension for joomla · CWE-94 pre-auth RCE CSRF	Critical10.0	—	0.4%	Aug 19, 2026
40Plan	CVE-2026-20030No exploit	Cisco Crosswork Security Hardening Release: August 2026cisco · cisco crosswork planning · CWE-89 Pre-auth SQL injection	Critical10.0	—	0.5%	Aug 19, 2026
39Monitor	CVE-2026-20231No exploit	Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Neutralization of Special Elements Vulnerabilitiescisco · cisco secure workload · CWE-74	Critical9.9	—	0.5%	Aug 19, 2026
40Plan	CVE-2026-20315No exploit	Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Access Control Vulnerabilitiescisco · cisco secure workload · CWE-284 Pre-auth Broken access control (IDOR)	Critical10.0	—	0.4%	Aug 19, 2026
40Plan	CVE-2026-20317No exploit	Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Authentication Vulnerabilitiescisco · cisco secure workload · CWE-287 Pre-auth Auth bypass	Critical10.0	—	0.5%	Aug 19, 2026
38Monitor	CVE-2026-20318No exploit	Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Input Validation Vulnerabilitiescisco · cisco secure workload · CWE-20	Critical9.6	—	0.4%	Aug 19, 2026
30Monitor	CVE-2026-20319No exploit	Cisco Secure Workload Software Security Hardening Release August 2026 - Buffer Management Vulnerabilitiescisco · cisco secure workload · CWE-119 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Aug 19, 2026
30Monitor	CVE-2026-20320No exploit	A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read secisco · cisco broadworks · CWE-611 Pre-auth XXE	High7.5	—	0.4%	Aug 19, 2026
40Plan	CVE-2026-20357No exploit	Cisco Crosswork Security Hardening Release: August 2026cisco · cisco crosswork planning · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.6%	Aug 19, 2026
40Plan	CVE-2026-20358No exploit	Cisco Crosswork Security Hardening Release: August 2026cisco · cisco crosswork planning · CWE-73 Pre-auth Path traversal	Critical10.0	—	0.4%	Aug 19, 2026
39Monitor	CVE-2026-20359No exploit	Cisco Crosswork Security Hardening Release: August 2026cisco · cisco crosswork planning · CWE-522 Info leak	Critical9.9	—	0.4%	Aug 19, 2026
28Monitor	CVE-2026-50173No exploit	Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only usersrheosoph · flow-like · CWE-863 Broken access control (IDOR)	High7.2	—	0.6%	Aug 19, 2026
67This week	CVE-2026-72529Weaponized	A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X ttrueconf · trueconf server · CWE-306 Pre-auth Auth bypass	Critical9.3	KEV	1.4%	Aug 19, 2026
69This week	CVE-2026-72530Weaponized	A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X ttrueconf · trueconf server · CWE-94 pre-auth RCE	Critical9.5	KEV	1.6%	Aug 19, 2026
32Monitor	CVE-2026-19234No exploit	Power System Buffer Overflowibm · power system s1122 $9824-22a$ firmware · CWE-121 RCE Memory safety	High8.2	—	0.1%	Aug 19, 2026
30Monitor	CVE-2026-19875No exploit	Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflowlangflow · langflow · CWE-306 Pre-auth Auth bypass	High7.5	—	0.5%	Aug 19, 2026
37Monitor	CVE-2026-32475Proof of concept	WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerabilityelementor · elementor pro · CWE-434 Pre-auth File upload	Critical9.0	—	1.9%	Aug 19, 2026
28Monitor	CVE-2026-62680No exploit	Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $reforval-labs · orval · CWE-22 Pre-auth SSRF Path traversal	High7.1	—	0.4%	Aug 19, 2026
37Monitor	CVE-2026-62681No exploit	Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)orval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.6%	Aug 19, 2026
37Monitor	CVE-2026-62682No exploit	Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)orval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.6%	Aug 19, 2026
33Monitor	CVE-2024-58376No exploit	Renovate 37.158.0 before 37.199.0 Command Injection via helmv3renovatebot · renovate · CWE-78 RCE Command injection	High8.4	—	0.6%	Aug 19, 2026
34Monitor	CVE-2026-67581No exploit	On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replayzenhive · machine payments protocol · CWE-294 Pre-auth Auth bypass	High8.7	—	0.5%	Aug 19, 2026
37Monitor	CVE-2026-71864No exploit	Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod clientorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.6%	Aug 19, 2026
37Monitor	CVE-2026-71865No exploit	Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cliorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.6%	Aug 19, 2026
37Monitor	CVE-2026-71866No exploit	Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod clientorval-labs · orval · CWE-89 pre-auth RCE SQL injection	Critical9.3	—	0.6%	Aug 19, 2026
37Monitor	CVE-2026-71867No exploit	Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generatororval-labs · orval · CWE-89 pre-auth RCE SQL injection	Critical9.3	—	0.6%	Aug 19, 2026
37Monitor	CVE-2026-71868No exploit	Orval: Import-time RCE via enum-typed default -> zod module-level template literalorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.6%	Aug 19, 2026
37Monitor	CVE-2026-71869No exploit	Orval: Import-time RCE via array-items default -> zod module-level template literalorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.6%	Aug 19, 2026
37Monitor	CVE-2026-71871No exploit	Orval: Import-time RCE via header-parameter default -> zod module-level template literalorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.6%	Aug 19, 2026
37Monitor	CVE-2026-72716No exploit	Orval: Import-time RCE via query-parameter default -> zod module-level template literalorval-labs · orval · CWE-1336 pre-auth RCE SSTI	Critical9.3	—	0.6%	Aug 19, 2026
37Monitor	CVE-2026-72717No exploit	Orval: Import-time RCE via schema default -> zod module-level template literalorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.6%	Aug 19, 2026
32Monitor	CVE-2026-73136No exploit	Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replayzenhive · machine payments protocol · CWE-294 Pre-auth Auth bypass	High8.2	—	0.5%	Aug 19, 2026
33Monitor	CVE-2026-73541No exploit	Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drainzenhive · machine payments protocol · CWE-770 Pre-auth Denial of service	High8.3	—	0.5%	Aug 19, 2026
34Monitor	CVE-2026-75149No exploit	marimo < 0.23.15 Code Injection via MCP Server Configurationmarimo-team · marimo · CWE-94 pre-auth RCE	High8.7	—	0.9%	Aug 19, 2026
31Monitor	CVE-2026-43961No exploit	Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code executionvim · vim · CWE-94 RCE Local privilege escalation	High7.8	—	0.1%	Aug 19, 2026
30Monitor	CVE-2026-51367Proof of concept	An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoinCWE-639 Pre-auth Broken access control (IDOR)	High7.5	—	0.5%	Aug 19, 2026
29Monitor	CVE-2026-54796No exploit	Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Commdell · openmanage enterprise · CWE-78 RCE Command injection	High7.2	—	2.0%	Aug 19, 2026
37Monitor	CVE-2026-75916No exploit	SiYuan XSS-to-RCE via unescaped block metadata in hint popupsiyuan-note · siyuan · CWE-79 RCE Local privilege escalation XSS	Critical9.3	—	0.2%	Aug 19, 2026
37Monitor	CVE-2026-75917No exploit	SiYuan before v3.7.4 XSS-to-RCE via pathName.tssiyuan-note · siyuan · CWE-79 RCE Local privilege escalation XSS	Critical9.3	—	0.2%	Aug 19, 2026
35Monitor	CVE-2026-76208No exploit	phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAPphpmyfaq · phpmyfaq · CWE-778 Pre-auth Auth bypass	High8.8	—	0.4%	Aug 19, 2026
34Monitor	CVE-2026-76221No exploit	GitPython before 3.1.58 Config Injection via option-namegitpython project · gitpython · CWE-74 RCE	High8.7	—	0.4%	Aug 19, 2026
27Monitor	CVE-2026-76226No exploit	Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenancerenovatebot · renovate · CWE-78 RCE Command injection	Medium6.8	—	0.2%	Aug 19, 2026
33Monitor	CVE-2026-76228No exploit	Renovate before 42.68.5 Remote Code Execution via Gradle Wrapperrenovatebot · renovate · CWE-78 RCE Command injection	High8.4	—	0.9%	Aug 19, 2026
34Monitor	CVE-2026-76234No exploit	libcrux before 0.0.6 Cryptographic Implementation Bug Fixescelabshq · libcrux-ecdh · CWE-347 Pre-auth Weak crypto	High8.7	—	0.3%	Aug 19, 2026
30Monitor	CVE-2026-14970No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-120 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Aug 19, 2026
32Monitor	CVE-2026-15061No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-22 Pre-auth Path traversal	High8.2	—	0.5%	Aug 19, 2026
36Monitor	CVE-2026-15065No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-312 Pre-auth	Critical9.1	—	0.6%	Aug 19, 2026
39Monitor	CVE-2026-15068No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-78 RCE Command injection	Critical9.9	—	0.7%	Aug 19, 2026
32Monitor	CVE-2026-15078No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-295 Weak crypto	High8.1	—	0.3%	Aug 19, 2026
39Monitor	CVE-2026-16656No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.7%	Aug 19, 2026
32Monitor	CVE-2026-16686No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-287 Pre-auth Auth bypass	High8.2	—	0.5%	Aug 19, 2026
30Monitor	CVE-2026-16690No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Aug 19, 2026
31Monitor	CVE-2026-16703No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-269 Local privilege escalation	High7.8	—	0.1%	Aug 19, 2026
30Monitor	CVE-2026-16706No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Aug 19, 2026
35Monitor	CVE-2026-16814No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.4%	Aug 19, 2026
39Monitor	CVE-2026-16816No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-78 RCE Command injection	Critical9.9	—	0.7%	Aug 19, 2026
30Monitor	CVE-2026-16817No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Aug 19, 2026
30Monitor	CVE-2026-16818No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Aug 19, 2026
29Monitor	CVE-2026-18526No exploit	HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmationhumhub · humhub · CWE-79 XSS	High7.4	—	0.4%	Aug 19, 2026
28Monitor	CVE-2026-18756No exploit	HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button renderinghumhub · humhub · CWE-79 XSS	High7.2	—	0.4%	Aug 19, 2026
35Monitor	CVE-2026-44829No exploit	Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filenamegotenberg · gotenberg · CWE-22 Pre-auth Path traversal	High8.8	—	0.5%	Aug 19, 2026
30Monitor	CVE-2026-45741No exploit	Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixesgotenberg · gotenberg · CWE-184 Pre-auth SSRF	High7.5	—	0.3%	Aug 19, 2026
30Monitor	CVE-2026-45742No exploit	Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')gotenberg · gotenberg · CWE-362 Pre-auth Race condition Denial of service	High7.5	—	0.7%	Aug 19, 2026
28Monitor	CVE-2026-49253No exploit	electerm: Path Traversal in Zmodem and Trzsz Download Filename Handlingelecterm · electerm · CWE-22 Pre-auth Path traversal	High7.1	—	0.4%	Aug 19, 2026
35Monitor	CVE-2026-49255No exploit	electerm: Command Injection in File System Operations (rmrf, mv, cp)electerm · electerm · CWE-78 pre-auth RCE Command injection	High8.8	—	0.7%	Aug 19, 2026
29Monitor	CVE-2026-52834No exploit	jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platformstirr-c · jxl-oxide · CWE-122 Memory safety	High7.3	—	0.1%	Aug 19, 2026
38Monitor	CVE-2026-16687No exploit	Power System Buffer Overflowibm · power system e1180 $9080-heu$ firmware · CWE-121 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Aug 19, 2026
30Monitor	CVE-2026-16828No exploit	Power System Out-of-bounds Readibm · power system e1080 $9080-hex$ firmware · CWE-125 Pre-auth Memory safety	High7.6	—	0.2%	Aug 19, 2026
33Monitor	CVE-2026-16832No exploit	Power System Buffer Overflowibm · power system e1080 $9080-hex$ firmware · CWE-121 RCE Memory safety	High8.4	—	0.3%	Aug 19, 2026
38Monitor	CVE-2026-16835No exploit	Power System Improper Certificate Validationibm · power system e1080 $9080-hex$ firmware · CWE-295 Pre-auth Auth bypass Weak crypto	Critical9.6	—	0.3%	Aug 19, 2026
32Monitor	CVE-2026-16930No exploit	Power System Missing Authorizationibm · power system e1180 $9080-heu$ firmware · CWE-862 RCE Broken access control (IDOR)	High8.2	—	0.1%	Aug 19, 2026
32Monitor	CVE-2026-17093No exploit	Power System Buffer Overflowibm · power system s1122 $9824-22a$ firmware · CWE-121 Memory safety	High8.2	—	0.1%	Aug 19, 2026
32Monitor	CVE-2026-17100No exploit	Power System Out-of-bounds Writeibm · power system s1122 $9824-22a$ firmware · CWE-787 RCE Memory safety	High8.2	—	0.1%	Aug 19, 2026
32Monitor	CVE-2026-17429No exploit	Power System Incorrect Authorizationibm · power system s1122 $9824-22a$ firmware · CWE-863 Broken access control (IDOR)	High8.1	—	0.1%	Aug 19, 2026
32Monitor	CVE-2026-17494No exploit	Power System Buffer Overflowibm · power system s1122 $9824-22a$ firmware · CWE-121 RCE Memory safety	High8.2	—	0.1%	Aug 19, 2026
40Plan	CVE-2026-18315Proof of concept	TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameterthemetechmount · truebooker – appointment booking and scheduler system · CWE-639 Pre-auth Broken access control (IDOR)	Critical9.8	—	3.0%	Aug 19, 2026
33Monitor	CVE-2026-18848No exploit	Power System Cross-Site Request Forgery (CSRF)ibm · power system e1080 $9080-hex$ firmware · CWE-352 Pre-auth CSRF	High8.3	—	0.1%	Aug 19, 2026
37Monitor	CVE-2026-71960Proof of concept	Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTTshenzhen cudy technology co., ltd. · wr3000 2.0 · CWE-798 Pre-auth Auth bypass Hard-coded credentials	Critical9.3	—	0.5%	Aug 19, 2026
32Monitor	CVE-2026-16661No exploit	Power System Integer Overflowibm · power system s1122 $9824-22a$ firmware · CWE-190 RCE Memory safety	High8.2	—	0.1%	Aug 19, 2026
32Monitor	CVE-2026-16707No exploit	Power System Out-of-bounds Readibm · power system s1122 $9824-22a$ firmware · CWE-125 Memory safety	High8.2	—	0.1%	Aug 19, 2026
30Monitor	CVE-2026-16819No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-367 Race condition	High7.7	—	0.1%	Aug 19, 2026
28Monitor	CVE-2026-18430No exploit	HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reasonhumhub · humhub · CWE-79 XSS	High7.2	—	0.4%	Aug 19, 2026
30Monitor	CVE-2026-44252No exploit	Wazuh Manager dapi RBAC Bypass Allows Privilege Escalationwazuh · wazuh · CWE-863 Broken access control (IDOR)	High7.7	—	0.5%	Aug 19, 2026
32Monitor	CVE-2026-16933No exploit	Power System Integer Overflowibm · power system s1122 $9824-22a$ firmware · CWE-190 Memory safety	High8.2	—	0.1%	Aug 19, 2026
30Monitor	CVE-2026-46343No exploit	Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file()wazuh · wazuh · CWE-22 Path traversal	High7.5	—	0.4%	Aug 19, 2026
29Monitor	CVE-2026-17042No exploit	Power System Out-of-bounds Readibm · power system s922 $9009-22g$ firmware · CWE-125 Memory safety	High7.3	—	0.1%	Aug 19, 2026
31Monitor	CVE-2026-17063No exploit	Power System Incorrect Authorizationibm · power system s1122 $9824-22a$ firmware · CWE-863 Broken access control (IDOR)	High7.9	—	0.1%	Aug 19, 2026
33Monitor	CVE-2026-17091No exploit	Power System Integer Overflowibm · power system s1122 $9824-22a$ firmware · CWE-190 Memory safety	High8.4	—	0.1%	Aug 19, 2026
35Monitor	CVE-2026-17414No exploit	Power System Improper Input Validationibm · power system s1122 $9824-22a$ firmware · CWE-20 Pre-auth	High8.8	—	0.2%	Aug 19, 2026

CVE-2026-75956
34Monitor
Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
cmsjunkie.com · j-businessdirectory extension for joomlaAug 19, 2026
CVE-2026-62666
35Monitor
Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
getgrav · grav-plugin-apiAug 19, 2026
CVE-2026-62667
32Monitor
Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
getgrav · grav-plugin-apiAug 19, 2026
CVE-2026-62673
32Monitor
Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
getgrav · gravAug 19, 2026
CVE-2026-63407
32Monitor
Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
getgrav · grav-plugin-apiAug 19, 2026
CVE-2026-63408
30Monitor
Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
getgrav · grav-plugin-apiAug 19, 2026
CVE-2026-64850
34Monitor
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
HighCVSS 8.7No exploitEPSS 0%
- RCE
getgrav · gravAug 19, 2026
CVE-2026-64851
34Monitor
Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers
HighCVSS 8.5No exploitEPSS 0%
- XSS
getgrav · grav-plugin-shortcode-coreAug 19, 2026
CVE-2026-64852
34Monitor
Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
getgrav · grav-plugin-apiAug 19, 2026
CVE-2026-19490
77This week
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
CriticalCVSS 9.3KEVWeaponizedEPSS 32%
- Pre-auth
- Auth bypass
citrix · netscaler application delivery controllerAug 19, 2026
CVE-2026-67363
30Monitor
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2
HighCVSS 7.7Proof of conceptEPSS 0%
- Pre-auth
- CSRF
balbooa.com · balbooa forms extension for joomlaAug 19, 2026
CVE-2026-67364
40Plan
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
- CSRF
balbooa.com · balbooa forms extension for joomlaAug 19, 2026
CVE-2026-20030
40Plan
Cisco Crosswork Security Hardening Release: August 2026
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- SQL injection
cisco · cisco crosswork planningAug 19, 2026
CVE-2026-20231
39Monitor
Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Neutralization of Special Elements Vulnerabilities
CriticalCVSS 9.9No exploitEPSS 0%
cisco · cisco secure workloadAug 19, 2026
CVE-2026-20315
40Plan
Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Access Control Vulnerabilities
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
cisco · cisco secure workloadAug 19, 2026
CVE-2026-20317
40Plan
Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Authentication Vulnerabilities
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
cisco · cisco secure workloadAug 19, 2026
CVE-2026-20318
38Monitor
Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Input Validation Vulnerabilities
CriticalCVSS 9.6No exploitEPSS 0%
cisco · cisco secure workloadAug 19, 2026
CVE-2026-20319
30Monitor
Cisco Secure Workload Software Security Hardening Release August 2026 - Buffer Management Vulnerabilities
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
cisco · cisco secure workloadAug 19, 2026
CVE-2026-20320
30Monitor
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read se
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XXE
cisco · cisco broadworksAug 19, 2026
CVE-2026-20357
40Plan
Cisco Crosswork Security Hardening Release: August 2026
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
cisco · cisco crosswork planningAug 19, 2026
CVE-2026-20358
40Plan
Cisco Crosswork Security Hardening Release: August 2026
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Path traversal
cisco · cisco crosswork planningAug 19, 2026
CVE-2026-20359
39Monitor
Cisco Crosswork Security Hardening Release: August 2026
CriticalCVSS 9.9No exploitEPSS 0%
- Info leak
cisco · cisco crosswork planningAug 19, 2026
CVE-2026-50173
28Monitor
Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
rheosoph · flow-likeAug 19, 2026
CVE-2026-72529
67This week
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X t
CriticalCVSS 9.3KEVWeaponizedEPSS 1%
- Pre-auth
- Auth bypass
trueconf · trueconf serverAug 19, 2026
CVE-2026-72530
69This week
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X t
CriticalCVSS 9.5KEVWeaponizedEPSS 1%
- pre-auth RCE
trueconf · trueconf serverAug 19, 2026
CVE-2026-19234
32Monitor
Power System Buffer Overflow
HighCVSS 8.2No exploitEPSS 0%
- RCE
- Memory safety
ibm · power system s1122 $9824-22a$ firmwareAug 19, 2026
CVE-2026-19875
30Monitor
Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
langflow · langflowAug 19, 2026
CVE-2026-32475
37Monitor
WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
CriticalCVSS 9.0Proof of conceptEPSS 1%
- Pre-auth
- File upload
elementor · elementor proAug 19, 2026
CVE-2026-62680
28Monitor
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- SSRF
- Path traversal
orval-labs · orvalAug 19, 2026
CVE-2026-62681
37Monitor
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalAug 19, 2026
CVE-2026-62682
37Monitor
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalAug 19, 2026
CVE-2024-58376
33Monitor
Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Command injection
renovatebot · renovateAug 19, 2026
CVE-2026-67581
34Monitor
On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
zenhive · machine payments protocolAug 19, 2026
CVE-2026-71864
37Monitor
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalAug 19, 2026
CVE-2026-71865
37Monitor
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalAug 19, 2026
CVE-2026-71866
37Monitor
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- SQL injection
orval-labs · orvalAug 19, 2026
CVE-2026-71867
37Monitor
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- SQL injection
orval-labs · orvalAug 19, 2026
CVE-2026-71868
37Monitor
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalAug 19, 2026
CVE-2026-71869
37Monitor
Orval: Import-time RCE via array-items default -> zod module-level template literal
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalAug 19, 2026
CVE-2026-71871
37Monitor
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalAug 19, 2026
CVE-2026-72716
37Monitor
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- SSTI
orval-labs · orvalAug 19, 2026
CVE-2026-72717
37Monitor
Orval: Import-time RCE via schema default -> zod module-level template literal
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalAug 19, 2026
CVE-2026-73136
32Monitor
Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
zenhive · machine payments protocolAug 19, 2026
CVE-2026-73541
33Monitor
Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Denial of service
zenhive · machine payments protocolAug 19, 2026
CVE-2026-75149
34Monitor
marimo < 0.23.15 Code Injection via MCP Server Configuration
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
marimo-team · marimoAug 19, 2026
CVE-2026-43961
31Monitor
Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
vim · vimAug 19, 2026
CVE-2026-51367
30Monitor
An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoin
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 19, 2026
CVE-2026-54796
29Monitor
Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Comm
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
dell · openmanage enterpriseAug 19, 2026
CVE-2026-75916
37Monitor
SiYuan XSS-to-RCE via unescaped block metadata in hint popup
CriticalCVSS 9.3No exploitEPSS 0%
- RCE
- Local privilege escalation
- XSS
siyuan-note · siyuanAug 19, 2026
CVE-2026-75917
37Monitor
SiYuan before v3.7.4 XSS-to-RCE via pathName.ts
CriticalCVSS 9.3No exploitEPSS 0%
- RCE
- Local privilege escalation
- XSS
siyuan-note · siyuanAug 19, 2026
CVE-2026-76208
35Monitor
phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
phpmyfaq · phpmyfaqAug 19, 2026
CVE-2026-76221
34Monitor
GitPython before 3.1.58 Config Injection via option-name
HighCVSS 8.7No exploitEPSS 0%
- RCE
gitpython project · gitpythonAug 19, 2026
CVE-2026-76226
27Monitor
Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance
MediumCVSS 6.8No exploitEPSS 0%
- RCE
- Command injection
renovatebot · renovateAug 19, 2026
CVE-2026-76228
33Monitor
Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Command injection
renovatebot · renovateAug 19, 2026
CVE-2026-76234
34Monitor
libcrux before 0.0.6 Cryptographic Implementation Bug Fixes
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
celabshq · libcrux-ecdhAug 19, 2026
CVE-2026-14970
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
ibm · viosAug 19, 2026
CVE-2026-15061
32Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
ibm · viosAug 19, 2026
CVE-2026-15065
36Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
ibm · viosAug 19, 2026
CVE-2026-15068
39Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- Command injection
ibm · viosAug 19, 2026
CVE-2026-15078
32Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 8.1No exploitEPSS 0%
- Weak crypto
ibm · viosAug 19, 2026
CVE-2026-16656
39Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · viosAug 19, 2026
CVE-2026-16686
32Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · viosAug 19, 2026
CVE-2026-16690
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · viosAug 19, 2026
CVE-2026-16703
31Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
ibm · viosAug 19, 2026
CVE-2026-16706
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
ibm · viosAug 19, 2026
CVE-2026-16814
35Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · viosAug 19, 2026
CVE-2026-16816
39Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- Command injection
ibm · viosAug 19, 2026
CVE-2026-16817
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
ibm · viosAug 19, 2026
CVE-2026-16818
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · viosAug 19, 2026
CVE-2026-18526
29Monitor
HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation
HighCVSS 7.4No exploitEPSS 0%
- XSS
humhub · humhubAug 19, 2026
CVE-2026-18756
28Monitor
HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering
HighCVSS 7.2No exploitEPSS 0%
- XSS
humhub · humhubAug 19, 2026
CVE-2026-44829
35Monitor
Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Path traversal
gotenberg · gotenbergAug 19, 2026
CVE-2026-45741
30Monitor
Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
gotenberg · gotenbergAug 19, 2026
CVE-2026-45742
30Monitor
Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Race condition
- Denial of service
gotenberg · gotenbergAug 19, 2026
CVE-2026-49253
28Monitor
electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Path traversal
electerm · electermAug 19, 2026
CVE-2026-49255
35Monitor
electerm: Command Injection in File System Operations (rmrf, mv, cp)
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Command injection
electerm · electermAug 19, 2026
CVE-2026-52834
29Monitor
jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
tirr-c · jxl-oxideAug 19, 2026
CVE-2026-16687
38Monitor
Power System Buffer Overflow
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · power system e1180 $9080-heu$ firmwareAug 19, 2026
CVE-2026-16828
30Monitor
Power System Out-of-bounds Read
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Memory safety
ibm · power system e1080 $9080-hex$ firmwareAug 19, 2026
CVE-2026-16832
33Monitor
Power System Buffer Overflow
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Memory safety
ibm · power system e1080 $9080-hex$ firmwareAug 19, 2026
CVE-2026-16835
38Monitor
Power System Improper Certificate Validation
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
ibm · power system e1080 $9080-hex$ firmwareAug 19, 2026
CVE-2026-16930
32Monitor
Power System Missing Authorization
HighCVSS 8.2No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
ibm · power system e1180 $9080-heu$ firmwareAug 19, 2026
CVE-2026-17093
32Monitor
Power System Buffer Overflow
HighCVSS 8.2No exploitEPSS 0%
- Memory safety
ibm · power system s1122 $9824-22a$ firmwareAug 19, 2026
CVE-2026-17100
32Monitor
Power System Out-of-bounds Write
HighCVSS 8.2No exploitEPSS 0%
- RCE
- Memory safety
ibm · power system s1122 $9824-22a$ firmwareAug 19, 2026
CVE-2026-17429
32Monitor
Power System Incorrect Authorization
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
ibm · power system s1122 $9824-22a$ firmwareAug 19, 2026
CVE-2026-17494
32Monitor
Power System Buffer Overflow
HighCVSS 8.2No exploitEPSS 0%
- RCE
- Memory safety
ibm · power system s1122 $9824-22a$ firmwareAug 19, 2026
CVE-2026-18315
40Plan
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
CriticalCVSS 9.8Proof of conceptEPSS 3%
- Pre-auth
- Broken access control (IDOR)
themetechmount · truebooker – appointment booking and scheduler systemAug 19, 2026
CVE-2026-18848
33Monitor
Power System Cross-Site Request Forgery (CSRF)
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- CSRF
ibm · power system e1080 $9080-hex$ firmwareAug 19, 2026
CVE-2026-71960
37Monitor
Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
- Hard-coded credentials
shenzhen cudy technology co., ltd. · wr3000 2.0Aug 19, 2026
CVE-2026-16661
32Monitor
Power System Integer Overflow
HighCVSS 8.2No exploitEPSS 0%
- RCE
- Memory safety
ibm · power system s1122 $9824-22a$ firmwareAug 19, 2026
CVE-2026-16707
32Monitor
Power System Out-of-bounds Read
HighCVSS 8.2No exploitEPSS 0%
- Memory safety
ibm · power system s1122 $9824-22a$ firmwareAug 19, 2026
CVE-2026-16819
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.7No exploitEPSS 0%
- Race condition
ibm · viosAug 19, 2026
CVE-2026-18430
28Monitor
HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason
HighCVSS 7.2No exploitEPSS 0%
- XSS
humhub · humhubAug 19, 2026
CVE-2026-44252
30Monitor
Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
wazuh · wazuhAug 19, 2026
CVE-2026-16933
32Monitor
Power System Integer Overflow
HighCVSS 8.2No exploitEPSS 0%
- Memory safety
ibm · power system s1122 $9824-22a$ firmwareAug 19, 2026
CVE-2026-46343
30Monitor
Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file()
HighCVSS 7.5No exploitEPSS 0%
- Path traversal
wazuh · wazuhAug 19, 2026
CVE-2026-17042
29Monitor
Power System Out-of-bounds Read
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
ibm · power system s922 $9009-22g$ firmwareAug 19, 2026
CVE-2026-17063
31Monitor
Power System Incorrect Authorization
HighCVSS 7.9No exploitEPSS 0%
- Broken access control (IDOR)
ibm · power system s1122 $9824-22a$ firmwareAug 19, 2026
CVE-2026-17091
33Monitor
Power System Integer Overflow
HighCVSS 8.4No exploitEPSS 0%
- Memory safety
ibm · power system s1122 $9824-22a$ firmwareAug 19, 2026
CVE-2026-17414
35Monitor
Power System Improper Input Validation
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
ibm · power system s1122 $9824-22a$ firmwareAug 19, 2026