By publication date

Exploited and new serious CVEs: August 2026

6,806 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 46 of 69

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2026-15049No exploit	Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Importunknown · depicter — popup & slider builder · CWE-434 RCE File upload	High7.2	—	0.7%	Aug 20, 2026
39Monitor	CVE-2026-75860No exploit	JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Updateunknown · json options · CWE-269 Pre-auth	Critical9.8	—	0.4%	Aug 20, 2026
30Monitor	CVE-2026-75963No exploit	Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Propertyliedekef · events made easy · CWE-98 RCE	High7.5	—	0.8%	Aug 20, 2026
28Monitor	CVE-2026-14163No exploit	In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment vaoctopus · octopus server · CWE-532 Info leak	High7.1	—	0.3%	Aug 20, 2026
34Monitor	CVE-2026-75948No exploit	Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12icagenda.com · icagenda extension for joomla · CWE-79 XSS	High8.6	—	0.3%	Aug 20, 2026
34Monitor	CVE-2026-76564Proof of concept	Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7phoca.cz · phoca cart extension for joomla · CWE-79 Pre-auth XSS	High8.6	—	0.4%	Aug 20, 2026
21Monitor	CVE-2026-76565Proof of concept	Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7phoca.cz · phoca cart extension for joomla · CWE-79 Pre-auth XSS	Medium5.3	—	0.4%	Aug 20, 2026
21Monitor	CVE-2026-76569Proof of concept	Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4phoca.cz · phoca download extension for joomla · CWE-79 Pre-auth XSS	Medium5.3	—	0.4%	Aug 20, 2026
34Monitor	CVE-2026-14946No exploit	Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious configuration file.frauscher sensortechnik · fds 102 · CWE-434 RCE File upload	High8.6	—	0.7%	Aug 20, 2026
34Monitor	CVE-2026-14947No exploit	Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious ZIP filefrauscher sensortechnik · fds 102 · CWE-24 RCE Path traversal	High8.6	—	1.4%	Aug 20, 2026
34Monitor	CVE-2026-14948No exploit	Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insertion of Sensitive Information into Log File via error log archivesfrauscher sensortechnik · fds 102 · CWE-532 Info leak	High8.7	—	0.5%	Aug 20, 2026
34Monitor	CVE-2026-14949No exploit	Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Incorrect Authorization due to improper enforcement of role-based access controlfrauscher sensortechnik · fds 102 · CWE-863 Broken access control (IDOR)	High8.5	—	0.3%	Aug 20, 2026
36Monitor	CVE-2026-14950No exploit	Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to flawed session expiration logicfrauscher sensortechnik · fds 102 · CWE-613 Pre-auth	Critical9.2	—	0.6%	Aug 20, 2026
34Monitor	CVE-2026-14951No exploit	Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headersfrauscher sensortechnik · fds 102 · CWE-352 CSRF	High8.6	—	0.2%	Aug 20, 2026
34Monitor	CVE-2026-14952No exploit	Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is offering files with sensitive information for download without requiring authenticationfrauscher sensortechnik · fds 102 · CWE-306 Pre-auth Auth bypass	High8.7	—	0.5%	Aug 20, 2026
32Monitor	CVE-2026-28150No exploit	WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerabilityuxper · golo framework · CWE-98 Pre-auth	High8.1	—	0.4%	Aug 20, 2026
28Monitor	CVE-2026-66582No exploit	WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerabilitycozmoslabs · translatepress · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
39Monitor	CVE-2026-66583No exploit	WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerabilitywpmu dev · forminator · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 20, 2026
37Monitor	CVE-2026-66593No exploit	WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerabilitycleantalk inc · security & malware scan by cleantalk · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 20, 2026
34Monitor	CVE-2026-66594No exploit	WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerabilitylukeseager · wordpress persistent login · CWE-89 SQL injection	High8.5	—	0.3%	Aug 20, 2026
28Monitor	CVE-2026-66597No exploit	WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerabilitymelograno venture studio · wpdatatables · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
28Monitor	CVE-2026-66598No exploit	WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerabilitykingtech llc. · b2bking premium · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
36Monitor	CVE-2026-66600No exploit	WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerabilitydavid lingren · media library assistant · CWE-434 File upload	Critical9.1	—	0.4%	Aug 20, 2026
28Monitor	CVE-2026-66604No exploit	WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerabilitypaolo · geodirectory · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
28Monitor	CVE-2026-66605No exploit	WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerabilityhasthemes · swatchly – woocommerce variation swatches for products · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
28Monitor	CVE-2026-66606No exploit	WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilitythemegrill · smartsmtp · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
28Monitor	CVE-2026-66607No exploit	WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilitythemehunk · advance product search · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
37Monitor	CVE-2026-66609No exploit	WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerabilitycodexthemes · thegem (elementor) · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 20, 2026
28Monitor	CVE-2026-66611No exploit	WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerabilitypaymob · paymob for woocommerce · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
28Monitor	CVE-2026-66612No exploit	WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerabilitythembay · aora · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
28Monitor	CVE-2026-66614No exploit	WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerabilityseo squirrly · seo plugin by squirrly seo · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
28Monitor	CVE-2026-66615No exploit	WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerabilityeric teubert · podlove podcast publisher · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
37Monitor	CVE-2026-66649No exploit	WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerabilitye-plugins · directory pro · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 20, 2026
39Monitor	CVE-2026-66672No exploit	WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerabilitymonkeysan · flatastic · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 20, 2026
28Monitor	CVE-2026-66673No exploit	WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilitymonkeysan · flatastic · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
30Monitor	CVE-2026-66677No exploit	WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerabilityvaultdweller · leyka · CWE-288 Auth bypass	High7.6	—	0.3%	Aug 20, 2026
37Monitor	CVE-2026-66680No exploit	WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerabilityplainware · locatoraid store locator · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 20, 2026
39Monitor	CVE-2026-66682No exploit	WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerabilitytyche softwares. · abandoned cart pro for woocommerce · CWE-266 Pre-auth	Critical9.8	—	0.4%	Aug 20, 2026
28Monitor	CVE-2026-68564No exploit	WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerabilitynotificationx · notificationx pro · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
37Monitor	CVE-2026-68566No exploit	WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerabilityrepute infosystems · bookingpress appointment booking pro · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 20, 2026
39Monitor	CVE-2026-73992No exploit	WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerabilityjonathan daggerhart · query wrangler · CWE-94 RCE	Critical9.9	—	0.7%	Aug 20, 2026
39Monitor	CVE-2026-73993No exploit	WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerabilityroxnor · fundengine · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 20, 2026
34Monitor	CVE-2026-73998No exploit	WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerabilityaxew3 · wp w3all phpbb · CWE-89 SQL injection	High8.5	—	0.3%	Aug 20, 2026
34Monitor	CVE-2026-74013No exploit	WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerabilitywordpress.com · eshipper commerce · CWE-89 SQL injection	High8.5	—	0.3%	Aug 20, 2026
39Monitor	CVE-2026-74016No exploit	WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerabilitythemagnifico52 · smart cleaning · CWE-434 File upload	Critical9.9	—	0.4%	Aug 20, 2026
39Monitor	CVE-2026-74018No exploit	WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerabilitythemagnifico52 · warehouse cargo · CWE-434 File upload	Critical9.9	—	0.4%	Aug 20, 2026
28Monitor	CVE-2026-74019No exploit	WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerabilitypaulepro2019 · eprolo dropshipping · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Aug 20, 2026
30Monitor	CVE-2026-74020No exploit	WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerabilityanders norén · koji · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 20, 2026
30Monitor	CVE-2026-74021No exploit	WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerabilityanders norén · chaplin · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 20, 2026
34Monitor	CVE-2026-77068No exploit	n8n before 2.34.1 Remote Code Execution via Path Traversaln8n · n8n · CWE-22 RCE Path traversal	High8.7	—	0.9%	Aug 20, 2026
28Monitor	CVE-2026-77070No exploit	n8n before 1.123.69 NoSQL Injection via MongoDB Noden8n · n8n · CWE-943 Pre-auth SQL injection	High7.1	—	0.5%	Aug 20, 2026
28Monitor	CVE-2026-77071No exploit	n8n before 1.123.69 PostgREST Filter Injection via Supabasen8n · n8n · CWE-89 Pre-auth SQL injection	High7.1	—	0.6%	Aug 20, 2026
33Monitor	CVE-2026-77072No exploit	n8n before 1.123.69 Stored XSS via Form Completion Pagen8n · n8n · CWE-79 XSS	High8.4	—	0.3%	Aug 20, 2026
33Monitor	CVE-2026-77075No exploit	n8n before 1.123.69 Expression Injection via Resource Locatorn8n · n8n · CWE-94 RCE	High8.4	—	0.4%	Aug 20, 2026
28Monitor	CVE-2026-77076No exploit	n8n before 1.123.69 Credential Leak via GraphQL Node Errorn8n · n8n · CWE-209 Info leak	High7.1	—	0.4%	Aug 20, 2026
28Monitor	CVE-2026-77077No exploit	n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollutionn8n · n8n · CWE-94 RCE Prototype pollution	High7.2	—	0.5%	Aug 20, 2026
34Monitor	CVE-2026-77080No exploit	n8n before 1.123.69 Arbitrary File Read and Write via Snowflaken8n · n8n · CWE-78 RCE Command injection	High8.7	—	0.5%	Aug 20, 2026
30Monitor	CVE-2026-77084No exploit	n8n before 1.123.69 Remote Code Execution via Git Node Configuration Valuesn8n · n8n · CWE-78 RCE Command injection	High7.7	—	0.6%	Aug 20, 2026
34Monitor	CVE-2025-14601No exploit	vsDesk Task Scheduler OS Command Injectionvsdesk · vsdesk · CWE-676 RCE Command injection	High8.6	—	1.0%	Aug 20, 2026
40Plan	CVE-2026-18482No exploit	Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, wklarso gmbh · neo-mjs · CWE-78 pre-auth RCE Command injection	Critical9.8	—	3.4%	Aug 20, 2026
31Monitor	CVE-2026-18917No exploit	Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflowred hat · red hat enterprise linux 10.0 extended update support · CWE-190 Local privilege escalation Memory safety	High7.8	—	0.1%	Aug 20, 2026
32Monitor	CVE-2026-11861No exploit	Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationshipsfreeipa · freeipa · CWE-266 Auth bypass	High8.1	—	0.3%	Aug 20, 2026
34Monitor	CVE-2026-13097No exploit	Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastorefreeipa · freeipa · CWE-706	High8.7	—	0.7%	Aug 20, 2026
30Monitor	CVE-2026-73197No exploit	Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body readfreeipa · freeipa · CWE-770 Pre-auth Denial of service	High7.5	—	0.5%	Aug 20, 2026
30Monitor	CVE-2026-73198No exploit	Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body readfreeipa · freeipa · CWE-770 Pre-auth Denial of service	High7.5	—	0.5%	Aug 20, 2026
32Monitor	CVE-2025-15637No exploit	WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerabilityedge themes · shuffle · CWE-98 Pre-auth	High8.1	—	0.4%	Aug 20, 2026
37Monitor	CVE-2025-15688No exploit	WordPress Capella theme <= 2.5.5 - SQL Injection vulnerabilitythemegoods · capella · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 20, 2026
39Monitor	CVE-2025-15689No exploit	WordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerabilitythemegoods · capella · CWE-266 Pre-auth	Critical9.8	—	0.4%	Aug 20, 2026
28Monitor	CVE-2026-66581No exploit	WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerabilitycrocoblock. jetimpex inc. · jetengine · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
28Monitor	CVE-2026-66590No exploit	WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerabilitytagembed · tagembed · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
37Monitor	CVE-2026-66592No exploit	WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerabilityrtcamp · rtmedia for wordpress, buddypress and bbpress · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 20, 2026
28Monitor	CVE-2026-66616No exploit	WordPress Form Maker by 10Web plugin <= 1.15.49 - Cross Site Scripting (XSS) vulnerability10web · form maker by 10web · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 20, 2026
39Monitor	CVE-2026-74001No exploit	WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerabilitywpeverest · user registration & membership pro · CWE-288 Pre-auth Auth bypass	Critical9.8	—	0.6%	Aug 20, 2026
39Monitor	CVE-2026-74014No exploit	WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerabilityindithemes · it residence · CWE-434 File upload	Critical9.9	—	0.4%	Aug 20, 2026
29Monitor	CVE-2026-77079No exploit	n8n before 2.34.1 Authorization Bypass via Custom Role Deletionn8n · n8n · CWE-639 Broken access control (IDOR)	High7.4	—	0.4%	Aug 20, 2026
38Monitor	CVE-2026-28164No exploit	WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerabilityhashthemes · easy elementor addons · CWE-352 Pre-auth CSRF	Critical9.6	—	0.2%	Aug 20, 2026
30Monitor	CVE-2026-74011No exploit	WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerabilityrevmakx · infinitewp client · CWE-89 SQL injection	High7.6	—	0.3%	Aug 20, 2026
33Monitor	CVE-2026-77118No exploit	Out-of-bounds write in GraphicsMagick PCD decodergraphicsmagick group · graphicsmagick · CWE-787 Memory safety	High8.4	—	0.1%	Aug 20, 2026
39Monitor	CVE-2026-15706Proof of concept	Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMSbaylan measuring instruments industry and trade inc. · baylan smart meter management application (bms) · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.6%	Aug 20, 2026
34Monitor	CVE-2026-64960No exploit	Remote Code Execution via Unrestricted File Upload in ATutoratutor · atutor · CWE-434 RCE File upload	High8.7	—	0.6%	Aug 20, 2026
34Monitor	CVE-2026-64966No exploit	Path Traversal leading to Remote Code Execution in ATutoratutor · atutor · CWE-22 RCE Path traversal	High8.7	—	0.7%	Aug 20, 2026
33Monitor	CVE-2026-70383No exploit	Arbitrary file overwrite vulnerability in DigiDoc4 clientestonian information system authority (ria) · digidoc4 · CWE-22 Path traversal	High8.4	—	0.1%	Aug 20, 2026
34Monitor	CVE-2026-76633No exploit	WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenhalabredescefetrj · wegia · CWE-620	High8.6	—	0.4%	Aug 20, 2026
28Monitor	CVE-2026-76634No exploit	WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.phplabredescefetrj · wegia · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	Aug 20, 2026
34Monitor	CVE-2026-76635No exploit	baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.phpbaserproject · basercms · CWE-89 RCE SQL injection	High8.6	—	0.4%	Aug 20, 2026
33Monitor	CVE-2026-76833No exploit	@cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tagcgauge · @cgauge/yaml · CWE-95 RCE	High8.4	—	0.2%	Aug 20, 2026
28Monitor	CVE-2026-16922No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-367 RCE Race condition	High7.0	—	0.1%	Aug 20, 2026
31Monitor	CVE-2026-16923No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-269 Local privilege escalation	High7.8	—	0.1%	Aug 20, 2026
30Monitor	CVE-2026-16924No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-191 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Aug 20, 2026
31Monitor	CVE-2026-16925No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-285 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	Aug 20, 2026
36Monitor	CVE-2026-16926No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-73 Pre-auth Path traversal	Critical9.1	—	0.5%	Aug 20, 2026
28Monitor	CVE-2026-16927No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-367 Local privilege escalation Race condition	High7.0	—	0.0%	Aug 20, 2026
30Monitor	CVE-2026-16928No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-122 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Aug 20, 2026
35Monitor	CVE-2026-16932No exploit	Vulnerabilities in IBM AIX and PowerVM VIOSibm · vios · CWE-78 RCE Command injection	High8.8	—	0.1%	Aug 20, 2026
32Monitor	CVE-2026-49825No exploit	lxml: javascript: URL bypass in Cleaner via xlink:hreflxml · lxml · CWE-79 Pre-auth XSS	High8.2	—	0.2%	Aug 20, 2026
31Monitor	CVE-2026-61897No exploit	accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scriptscanonical · accountsservice · CWE-273 Local privilege escalation	High7.8	—	0.1%	Aug 20, 2026
31Monitor	CVE-2026-61898No exploit	accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scriptscanonical · accountsservice · CWE-78 RCE Local privilege escalation Command injection	High7.8	—	0.1%	Aug 20, 2026
30Monitor	CVE-2026-63490No exploit	Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypassjknack · handlebars.java · CWE-22 Pre-auth Path traversal	High7.5	—	0.6%	Aug 20, 2026
34Monitor	CVE-2026-73220No exploit	CVAT: Stored XSS via annotation guides in audio taskscvat-ai · cvat · CWE-80 XSS	High8.5	—	0.4%	Aug 20, 2026
29Monitor	CVE-2026-19611No exploit	Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth foldingred hat · red hat build of apache camel 4 for quarkus 3 · CWE-173 Pre-auth	High7.4	—	0.8%	Aug 20, 2026

CVE-2026-15049
28Monitor
Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import
HighCVSS 7.2No exploitEPSS 0%
- RCE
- File upload
unknown · depicter — popup & slider builderAug 20, 2026
CVE-2026-75860
39Monitor
JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
unknown · json optionsAug 20, 2026
CVE-2026-75963
30Monitor
Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property
HighCVSS 7.5No exploitEPSS 0%
- RCE
liedekef · events made easyAug 20, 2026
CVE-2026-14163
28Monitor
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment va
HighCVSS 7.1No exploitEPSS 0%
- Info leak
octopus · octopus serverAug 20, 2026
CVE-2026-75948
34Monitor
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
HighCVSS 8.6No exploitEPSS 0%
- XSS
icagenda.com · icagenda extension for joomlaAug 20, 2026
CVE-2026-76564
34Monitor
Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7
HighCVSS 8.6Proof of conceptEPSS 0%
- Pre-auth
- XSS
phoca.cz · phoca cart extension for joomlaAug 20, 2026
CVE-2026-76565
21Monitor
Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- XSS
phoca.cz · phoca cart extension for joomlaAug 20, 2026
CVE-2026-76569
21Monitor
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- XSS
phoca.cz · phoca download extension for joomlaAug 20, 2026
CVE-2026-14946
34Monitor
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious configuration file.
HighCVSS 8.6No exploitEPSS 0%
- RCE
- File upload
frauscher sensortechnik · fds 102Aug 20, 2026
CVE-2026-14947
34Monitor
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious ZIP file
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Path traversal
frauscher sensortechnik · fds 102Aug 20, 2026
CVE-2026-14948
34Monitor
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insertion of Sensitive Information into Log File via error log archives
HighCVSS 8.7No exploitEPSS 0%
- Info leak
frauscher sensortechnik · fds 102Aug 20, 2026
CVE-2026-14949
34Monitor
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Incorrect Authorization due to improper enforcement of role-based access control
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
frauscher sensortechnik · fds 102Aug 20, 2026
CVE-2026-14950
36Monitor
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to flawed session expiration logic
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
frauscher sensortechnik · fds 102Aug 20, 2026
CVE-2026-14951
34Monitor
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headers
HighCVSS 8.6No exploitEPSS 0%
- CSRF
frauscher sensortechnik · fds 102Aug 20, 2026
CVE-2026-14952
34Monitor
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is offering files with sensitive information for download without requiring authentication
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
frauscher sensortechnik · fds 102Aug 20, 2026
CVE-2026-28150
32Monitor
WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
uxper · golo frameworkAug 20, 2026
CVE-2026-66582
28Monitor
WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
cozmoslabs · translatepressAug 20, 2026
CVE-2026-66583
39Monitor
WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
wpmu dev · forminatorAug 20, 2026
CVE-2026-66593
37Monitor
WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
cleantalk inc · security & malware scan by cleantalkAug 20, 2026
CVE-2026-66594
34Monitor
WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
lukeseager · wordpress persistent loginAug 20, 2026
CVE-2026-66597
28Monitor
WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
melograno venture studio · wpdatatablesAug 20, 2026
CVE-2026-66598
28Monitor
WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
kingtech llc. · b2bking premiumAug 20, 2026
CVE-2026-66600
36Monitor
WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability
CriticalCVSS 9.1No exploitEPSS 0%
- File upload
david lingren · media library assistantAug 20, 2026
CVE-2026-66604
28Monitor
WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
paolo · geodirectoryAug 20, 2026
CVE-2026-66605
28Monitor
WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
hasthemes · swatchly – woocommerce variation swatches for productsAug 20, 2026
CVE-2026-66606
28Monitor
WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
themegrill · smartsmtpAug 20, 2026
CVE-2026-66607
28Monitor
WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
themehunk · advance product searchAug 20, 2026
CVE-2026-66609
37Monitor
WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
codexthemes · thegem (elementor)Aug 20, 2026
CVE-2026-66611
28Monitor
WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
paymob · paymob for woocommerceAug 20, 2026
CVE-2026-66612
28Monitor
WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
thembay · aoraAug 20, 2026
CVE-2026-66614
28Monitor
WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
seo squirrly · seo plugin by squirrly seoAug 20, 2026
CVE-2026-66615
28Monitor
WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
eric teubert · podlove podcast publisherAug 20, 2026
CVE-2026-66649
37Monitor
WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
e-plugins · directory proAug 20, 2026
CVE-2026-66672
39Monitor
WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
monkeysan · flatasticAug 20, 2026
CVE-2026-66673
28Monitor
WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
monkeysan · flatasticAug 20, 2026
CVE-2026-66677
30Monitor
WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability
HighCVSS 7.6No exploitEPSS 0%
- Auth bypass
vaultdweller · leykaAug 20, 2026
CVE-2026-66680
37Monitor
WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
plainware · locatoraid store locatorAug 20, 2026
CVE-2026-66682
39Monitor
WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
tyche softwares. · abandoned cart pro for woocommerceAug 20, 2026
CVE-2026-68564
28Monitor
WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
notificationx · notificationx proAug 20, 2026
CVE-2026-68566
37Monitor
WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
repute infosystems · bookingpress appointment booking proAug 20, 2026
CVE-2026-73992
39Monitor
WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
jonathan daggerhart · query wranglerAug 20, 2026
CVE-2026-73993
39Monitor
WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
roxnor · fundengineAug 20, 2026
CVE-2026-73998
34Monitor
WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
axew3 · wp w3all phpbbAug 20, 2026
CVE-2026-74013
34Monitor
WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
wordpress.com · eshipper commerceAug 20, 2026
CVE-2026-74016
39Monitor
WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- File upload
themagnifico52 · smart cleaningAug 20, 2026
CVE-2026-74018
39Monitor
WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- File upload
themagnifico52 · warehouse cargoAug 20, 2026
CVE-2026-74019
28Monitor
WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
paulepro2019 · eprolo dropshippingAug 20, 2026
CVE-2026-74020
30Monitor
WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
anders norén · kojiAug 20, 2026
CVE-2026-74021
30Monitor
WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
anders norén · chaplinAug 20, 2026
CVE-2026-77068
34Monitor
n8n before 2.34.1 Remote Code Execution via Path Traversal
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Path traversal
n8n · n8nAug 20, 2026
CVE-2026-77070
28Monitor
n8n before 1.123.69 NoSQL Injection via MongoDB Node
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- SQL injection
n8n · n8nAug 20, 2026
CVE-2026-77071
28Monitor
n8n before 1.123.69 PostgREST Filter Injection via Supabase
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- SQL injection
n8n · n8nAug 20, 2026
CVE-2026-77072
33Monitor
n8n before 1.123.69 Stored XSS via Form Completion Page
HighCVSS 8.4No exploitEPSS 0%
- XSS
n8n · n8nAug 20, 2026
CVE-2026-77075
33Monitor
n8n before 1.123.69 Expression Injection via Resource Locator
HighCVSS 8.4No exploitEPSS 0%
- RCE
n8n · n8nAug 20, 2026
CVE-2026-77076
28Monitor
n8n before 1.123.69 Credential Leak via GraphQL Node Error
HighCVSS 7.1No exploitEPSS 0%
- Info leak
n8n · n8nAug 20, 2026
CVE-2026-77077
28Monitor
n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution
HighCVSS 7.2No exploitEPSS 0%
- RCE
- Prototype pollution
n8n · n8nAug 20, 2026
CVE-2026-77080
34Monitor
n8n before 1.123.69 Arbitrary File Read and Write via Snowflake
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Command injection
n8n · n8nAug 20, 2026
CVE-2026-77084
30Monitor
n8n before 1.123.69 Remote Code Execution via Git Node Configuration Values
HighCVSS 7.7No exploitEPSS 0%
- RCE
- Command injection
n8n · n8nAug 20, 2026
CVE-2025-14601
34Monitor
vsDesk Task Scheduler OS Command Injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
vsdesk · vsdeskAug 20, 2026
CVE-2026-18482
40Plan
Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, w
CriticalCVSS 9.8No exploitEPSS 3%
- pre-auth RCE
- Command injection
klarso gmbh · neo-mjsAug 20, 2026
CVE-2026-18917
31Monitor
Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
red hat · red hat enterprise linux 10.0 extended update supportAug 20, 2026
CVE-2026-11861
32Monitor
Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
freeipa · freeipaAug 20, 2026
CVE-2026-13097
34Monitor
Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore
HighCVSS 8.7No exploitEPSS 0%
freeipa · freeipaAug 20, 2026
CVE-2026-73197
30Monitor
Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
freeipa · freeipaAug 20, 2026
CVE-2026-73198
30Monitor
Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
freeipa · freeipaAug 20, 2026
CVE-2025-15637
32Monitor
WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
edge themes · shuffleAug 20, 2026
CVE-2025-15688
37Monitor
WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
themegoods · capellaAug 20, 2026
CVE-2025-15689
39Monitor
WordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
themegoods · capellaAug 20, 2026
CVE-2026-66581
28Monitor
WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
crocoblock. jetimpex inc. · jetengineAug 20, 2026
CVE-2026-66590
28Monitor
WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
tagembed · tagembedAug 20, 2026
CVE-2026-66592
37Monitor
WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
rtcamp · rtmedia for wordpress, buddypress and bbpressAug 20, 2026
CVE-2026-66616
28Monitor
WordPress Form Maker by 10Web plugin <= 1.15.49 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
10web · form maker by 10webAug 20, 2026
CVE-2026-74001
39Monitor
WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
wpeverest · user registration & membership proAug 20, 2026
CVE-2026-74014
39Monitor
WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- File upload
indithemes · it residenceAug 20, 2026
CVE-2026-77079
29Monitor
n8n before 2.34.1 Authorization Bypass via Custom Role Deletion
HighCVSS 7.4No exploitEPSS 0%
- Broken access control (IDOR)
n8n · n8nAug 20, 2026
CVE-2026-28164
38Monitor
WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- CSRF
hashthemes · easy elementor addonsAug 20, 2026
CVE-2026-74011
30Monitor
WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
revmakx · infinitewp clientAug 20, 2026
CVE-2026-77118
33Monitor
Out-of-bounds write in GraphicsMagick PCD decoder
HighCVSS 8.4No exploitEPSS 0%
- Memory safety
graphicsmagick group · graphicsmagickAug 20, 2026
CVE-2026-15706
39Monitor
Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
baylan measuring instruments industry and trade inc. · baylan smart meter management application (bms)Aug 20, 2026
CVE-2026-64960
34Monitor
Remote Code Execution via Unrestricted File Upload in ATutor
HighCVSS 8.7No exploitEPSS 0%
- RCE
- File upload
atutor · atutorAug 20, 2026
CVE-2026-64966
34Monitor
Path Traversal leading to Remote Code Execution in ATutor
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Path traversal
atutor · atutorAug 20, 2026
CVE-2026-70383
33Monitor
Arbitrary file overwrite vulnerability in DigiDoc4 client
HighCVSS 8.4No exploitEPSS 0%
- Path traversal
estonian information system authority (ria) · digidoc4Aug 20, 2026
CVE-2026-76633
34Monitor
WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha
HighCVSS 8.6No exploitEPSS 0%
labredescefetrj · wegiaAug 20, 2026
CVE-2026-76634
28Monitor
WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
labredescefetrj · wegiaAug 20, 2026
CVE-2026-76635
34Monitor
baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php
HighCVSS 8.6No exploitEPSS 0%
- RCE
- SQL injection
baserproject · basercmsAug 20, 2026
CVE-2026-76833
33Monitor
@cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag
HighCVSS 8.4No exploitEPSS 0%
- RCE
cgauge · @cgauge/yamlAug 20, 2026
CVE-2026-16922
28Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Race condition
ibm · viosAug 20, 2026
CVE-2026-16923
31Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
ibm · viosAug 20, 2026
CVE-2026-16924
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
ibm · viosAug 20, 2026
CVE-2026-16925
31Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
ibm · viosAug 20, 2026
CVE-2026-16926
36Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
ibm · viosAug 20, 2026
CVE-2026-16927
28Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
- Race condition
ibm · viosAug 20, 2026
CVE-2026-16928
30Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
ibm · viosAug 20, 2026
CVE-2026-16932
35Monitor
Vulnerabilities in IBM AIX and PowerVM VIOS
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
ibm · viosAug 20, 2026
CVE-2026-49825
32Monitor
lxml: javascript: URL bypass in Cleaner via xlink:href
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- XSS
lxml · lxmlAug 20, 2026
CVE-2026-61897
31Monitor
accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
canonical · accountsserviceAug 20, 2026
CVE-2026-61898
31Monitor
accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
canonical · accountsserviceAug 20, 2026
CVE-2026-63490
30Monitor
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
jknack · handlebars.javaAug 20, 2026
CVE-2026-73220
34Monitor
CVAT: Stored XSS via annotation guides in audio tasks
HighCVSS 8.5No exploitEPSS 0%
- XSS
cvat-ai · cvatAug 20, 2026
CVE-2026-19611
29Monitor
Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
red hat · red hat build of apache camel 4 for quarkus 3Aug 20, 2026