By publication date

Exploited and new serious CVEs: August 2026

6,221 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 48 of 63

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
37Monitor	CVE-2026-39975No exploit	Combodo iTop: Remote code execution using external auth variable valuecombodo · itop · CWE-94 RCE	Critical9.4	—	0.5%	Aug 24, 2026
34Monitor	CVE-2026-40877No exploit	Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferencescombodo · itop · CWE-94 RCE	High8.7	—	0.5%	Aug 24, 2026
34Monitor	CVE-2026-71504No exploit	Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Resetdolibarr · dolibarr · CWE-862 Broken access control (IDOR)	High8.6	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-71505No exploit	Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Routedolibarr · dolibarr · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-71506No exploit	Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpointdolibarr · dolibarr · CWE-863 Broken access control (IDOR)	High7.2	—	0.5%	Aug 24, 2026
28Monitor	CVE-2026-71507No exploit	Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routesdolibarr · dolibarr · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Aug 24, 2026
28Monitor	CVE-2026-71508No exploit	Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpointdolibarr · dolibarr · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Aug 24, 2026
28Monitor	CVE-2026-71509No exploit	Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpointdolibarr · dolibarr · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Aug 24, 2026
30Monitor	CVE-2026-75371No exploit	An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Aug 24, 2026
35Monitor	CVE-2026-78541No exploit	Command Injection in Parent Control of TP-Link Archer BE3600 v1tp-link systems inc. · archer be3600 v1 · CWE-78 RCE Command injection	High8.5	—	2.2%	Aug 24, 2026
27Monitor	CVE-2020-37268Proof of concept	Coq and Rocq Prover Print Assumptions Omits Unsafe Universe Checking Inlined Through Parameter Inlinerocq-prover · rocq · CWE-778	Medium6.8	—	0.1%	Aug 24, 2026
31Monitor	CVE-2026-61419No exploit	Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability.dell · thinos · CWE-284 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	Aug 24, 2026
28Monitor	CVE-2026-71510No exploit	Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameterdolibarr · dolibarr · CWE-863 SQL injection Broken access control (IDOR)	High7.1	—	0.3%	Aug 24, 2026
28Monitor	CVE-2026-71511No exploit	Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpointsdolibarr · dolibarr · CWE-522 Info leak	High7.1	—	0.4%	Aug 24, 2026
27Monitor	CVE-2026-72703Proof of concept	Rocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Callsrocq-prover · rocq · CWE-670	Medium6.8	—	0.1%	Aug 24, 2026
27Monitor	CVE-2026-72704Proof of concept	Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transportrocq-prover · rocq · CWE-670	Medium6.8	—	0.1%	Aug 24, 2026
27Monitor	CVE-2026-72705Proof of concept	Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argumentrocq-prover · rocq · CWE-670	Medium6.8	—	0.1%	Aug 24, 2026
27Monitor	CVE-2026-72711Proof of concept	Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variableleanprover · lean4 · CWE-20	Medium6.8	—	0.1%	Aug 24, 2026
27Monitor	CVE-2026-72714Proof of concept	Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Closerocq-prover · rocq · CWE-459	Medium6.8	—	0.1%	Aug 24, 2026
30Monitor	CVE-2026-75368No exploit	A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service CWE-121 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-75369No exploit	An out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT OBC software commit CWE-125 Pre-auth Memory safety	High7.1	—	0.2%	Aug 24, 2026
30Monitor	CVE-2026-76098No exploit	Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdownlepture · mistune · CWE-674 Pre-auth Denial of service	High7.5	—	0.4%	Aug 24, 2026
35Monitor	CVE-2026-78551No exploit	RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attemptsransomlook · ransomlook · CWE-307 Pre-auth	High8.8	—	0.6%	Aug 24, 2026
28Monitor	CVE-2026-78553No exploit	Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLookransomlook · ransomlook · CWE-276	High7.0	—	0.1%	Aug 24, 2026
37Monitor	CVE-2026-78555No exploit	RansomLook API Key Disclosure Through /admin/apikeys HTML Sourceransomlook · ransomlook · CWE-200 Info leak	Critical9.4	—	0.4%	Aug 24, 2026
31Monitor	CVE-2026-16782No exploit	SVG File Parsing Out-of-Bounds Read Vulnerability in Autodesk 3ds Maxautodesk · 3ds max · CWE-125 RCE Memory safety	High7.8	—	0.3%	Aug 24, 2026
31Monitor	CVE-2026-16783No exploit	ABC File Parsing Out-of-Bounds Write Vulnerability in Autodesk 3ds Maxautodesk · 3ds max · CWE-787 RCE Memory safety	High7.8	—	0.1%	Aug 24, 2026
31Monitor	CVE-2026-19568No exploit	SVG File Parsing Memory Corruption Vulnerability in Autodesk 3ds Maxautodesk · 3ds max · CWE-120 RCE Memory safety	High7.8	—	0.1%	Aug 24, 2026
39Monitor	CVE-2026-52490No exploit	An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() funCWE-94 pre-auth RCE	Critical9.8	—	0.7%	Aug 24, 2026
31Monitor	CVE-2026-52492No exploit	An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heCWE-190 Memory safety	High7.8	—	0.1%	Aug 24, 2026
29Monitor	CVE-2026-56135No exploit	In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows tuxera · ntfs-3g · CWE-122 Memory safety	High7.4	—	0.1%	Aug 24, 2026
27Monitor	CVE-2026-5006Proof of concept	Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Pathshashicorp · vault · CWE-639 Broken access control (IDOR)	Medium6.8	—	0.2%	Aug 24, 2026
32Monitor	CVE-2026-75464No exploit	OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().CWE-552	High8.1	—	0.4%	Aug 24, 2026
33Monitor	CVE-2026-75542No exploit	OAuth token exchange grants repository scopes for organizations the principal cannot accesshexpm · hexpm · CWE-863 Broken access control (IDOR)	High8.3	—	0.4%	Aug 24, 2026
32Monitor	CVE-2026-77567No exploit	Filament: App-based MFA can be bypassed when recovery codes are enabledfilamentphp · filament · CWE-287 Auth bypass	High8.1	—	0.5%	Aug 24, 2026
32Monitor	CVE-2026-77634No exploit	CakePHP: SmtpTransport vulnerable to CRLF header injectioncakephp · cakephp · CWE-93 Pre-auth	High8.2	—	0.3%	Aug 24, 2026
36Monitor	CVE-2026-77635Proof of concept	CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDrivercakephp · cakephp · CWE-89 Pre-auth SQL injection	Critical9.2	—	0.4%	Aug 24, 2026
31Monitor	CVE-2026-7455No exploit	FLT File Parsing Out-of-Bounds Write Vulnerability in Autodesk 3ds Maxautodesk · 3ds max · CWE-787 RCE Memory safety	High7.8	—	0.1%	Aug 24, 2026
37Monitor	CVE-2026-32554No exploit	WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerabilitywbw · woobewoo product filter pro · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 24, 2026
37Monitor	CVE-2026-32555No exploit	WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerabilitypixelyoursite professional · boost · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-32556No exploit	WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilitypixelyoursite professional · boost · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
39Monitor	CVE-2026-32559No exploit	WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerabilitytophive · ultimateai · CWE-434 File upload	Critical9.9	—	0.4%	Aug 24, 2026
35Monitor	CVE-2026-32560No exploit	WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerabilityliquidthemes · magicai for wordpress - ai text, image, chat, code, and voice generator · CWE-98	High8.8	—	0.4%	Aug 24, 2026
35Monitor	CVE-2026-32561No exploit	WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerabilityliquidthemes · booking hub · CWE-266	High8.8	—	0.4%	Aug 24, 2026
39Monitor	CVE-2026-32563No exploit	WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerabilitya cpt · acpt (pro) - custom post types plugin for wordpress · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 24, 2026
36Monitor	CVE-2026-77337No exploit	CakePHP: Potential Authentication bypass with CookieAuthenticatorcakephp · authentication · CWE-290 Pre-auth Auth bypass	Critical9.1	—	0.6%	Aug 24, 2026
30Monitor	CVE-2026-77384No exploit	libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustionlibp2p · js-libp2p · CWE-400 Pre-auth Denial of service	High7.5	—	0.6%	Aug 24, 2026
29Monitor	CVE-2026-78259No exploit	WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerabilitywp legal pages · wplegalpages · CWE-288 Pre-auth Auth bypass	High7.3	—	0.3%	Aug 24, 2026
39Monitor	CVE-2026-78262No exploit	WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerabilitywedevs · wp project manager · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 24, 2026
28Monitor	CVE-2026-78263No exploit	WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerabilitynexcess · event tickets · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
28Monitor	CVE-2026-78264No exploit	WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerabilitysite building with toolset · toolset blocks · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
39Monitor	CVE-2026-78265No exploit	WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerabilitynexcess · the events calendar · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 24, 2026
39Monitor	CVE-2026-78267No exploit	WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerabilitycozmoslabs · translatepress · CWE-266 Pre-auth	Critical9.8	—	0.4%	Aug 24, 2026
30Monitor	CVE-2026-78268No exploit	WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerabilextend themes · lead generation contact widget & ai chatbot: chat button, phone call, telegram, email – siteleads · CWE-497 Pre-auth Info leak	High7.5	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-78282No exploit	WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerabilitymra13 · stripe payments · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
34Monitor	CVE-2026-78284No exploit	WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerabilitystylemix · masterstudy lms · CWE-22 Pre-auth Path traversal Denial of service	High8.6	—	0.5%	Aug 24, 2026
28Monitor	CVE-2026-53532No exploit	OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)academysoftwarefoundation · openexr · CWE-617 Pre-auth	High7.1	—	0.4%	Aug 24, 2026
30Monitor	CVE-2026-66766No exploit	Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)sap_se · sap s/4hana (manage supply protection) · CWE-1333 Pre-auth Denial of service	High7.5	—	0.5%	Aug 25, 2026
28Monitor	CVE-2026-34968No exploit	Adminer before 5.4.3 Arbitrary File Deletion via SQLite Dropvrana · adminer · CWE-22 Path traversal	High7.2	—	0.5%	Aug 25, 2026
28Monitor	CVE-2026-56702No exploit	Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUploadvrana · adminer · CWE-434 RCE File upload	High7.1	—	0.6%	Aug 25, 2026
34Monitor	CVE-2026-56703No exploit	Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTOvrana · adminer · CWE-94 RCE	High8.6	—	1.1%	Aug 25, 2026
37Monitor	CVE-2026-56705Proof of concept	Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injectionvrana · adminer · CWE-73 pre-auth RCE Path traversal	Critical9.3	—	0.8%	Aug 25, 2026
33Monitor	CVE-2026-56707No exploit	Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcodegetgrav · grav · CWE-862 Broken access control (IDOR)	High8.3	—	0.3%	Aug 25, 2026
34Monitor	CVE-2026-56709No exploit	Grav before 3.9.2 Host Header Injection via sendInvitationEmailgetgrav · grav · CWE-350 Pre-auth	High8.7	—	0.4%	Aug 25, 2026
37Monitor	CVE-2026-56710No exploit	Grav Login Plugin before 1.0.16 Privilege Escalation via Unlockgetgrav · grav · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.5%	Aug 25, 2026
28Monitor	CVE-2026-72695No exploit	Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFilegetgrav · grav · CWE-22 Path traversal	High7.1	—	0.6%	Aug 25, 2026
34Monitor	CVE-2026-72696No exploit	Grav CMS before 2.0.16 Symlink Following via createLockFilegetgrav · grav · CWE-59	High8.6	—	0.2%	Aug 25, 2026
28Monitor	CVE-2026-72697No exploit	Grav CMS before 2.0.16 Path Traversal via media_directorygetgrav · grav · CWE-22 Path traversal	High7.1	—	0.3%	Aug 25, 2026
28Monitor	CVE-2026-72698No exploit	Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypassgetgrav · grav · CWE-200 Info leak	High7.1	—	0.4%	Aug 25, 2026
37Monitor	CVE-2026-72699No exploit	Grav Login Plugin before 3.9.1 Email Enumeration via Registrationgetgrav · grav-plugin-login · CWE-203 Pre-auth	Critical9.3	—	0.2%	Aug 25, 2026
34Monitor	CVE-2026-72700No exploit	Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparisongetgrav · grav · CWE-208 Pre-auth	High8.7	—	0.4%	Aug 25, 2026
37Monitor	CVE-2026-72702No exploit	Grav CMS before 2.0.16 Origin Validation Bypass via Referergetgrav · grav · CWE-346 Pre-auth	Critical9.3	—	0.1%	Aug 25, 2026
34Monitor	CVE-2026-75574No exploit	Grav before 4.2.2 Remote Code Execution via Email Twiggetgrav · grav · CWE-1336 RCE SSTI	High8.7	—	0.6%	Aug 25, 2026
34Monitor	CVE-2026-76839No exploit	Grav before 2.0.16 Information Disclosure via offsetGetgetgrav · grav · CWE-522 Pre-auth Auth bypass Info leak	High8.7	—	0.3%	Aug 25, 2026
34Monitor	CVE-2026-76846No exploit	Grav before 2.0.16 Information Disclosure via Twig Sandboxgetgrav · grav · CWE-522 Pre-auth Info leak	High8.7	—	0.3%	Aug 25, 2026
34Monitor	CVE-2026-78675No exploit	GitPython before 3.1.59 Local File Content Disclosure via .gitmodulesgitpython project · gitpython · CWE-73 Path traversal	High8.6	—	0.1%	Aug 25, 2026
37Monitor	CVE-2026-78676No exploit	GitPython before 3.1.59 Remote Code Execution via Config Injectiongitpython project · gitpython · CWE-88 pre-auth RCE	Critical9.3	—	0.5%	Aug 25, 2026
34Monitor	CVE-2026-78677No exploit	GitPython before 3.1.59 Path Traversal via separate-git-dirgitpython project · gitpython · CWE-22 Pre-auth Path traversal	High8.7	—	0.6%	Aug 25, 2026
28Monitor	CVE-2026-78678No exploit	GitPython before 3.1.59 Arbitrary File Read via Repo.blame()gitpython project · gitpython · CWE-88	High7.1	—	0.4%	Aug 25, 2026
28Monitor	CVE-2026-78679No exploit	GitPython before 3.1.59 Arbitrary File Read via TagReference.creategitpython-developers · gitpython · CWE-73 Path traversal	High7.1	—	0.3%	Aug 25, 2026
34Monitor	CVE-2026-78680No exploit	NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binarynltk · nltk · CWE-426 RCE	High8.5	—	0.1%	Aug 25, 2026
34Monitor	CVE-2026-78681No exploit	NLTK before 3.10.3 Entity Expansion DoS via ElementTreenltk · nltk · CWE-776 Pre-auth	High8.7	—	0.5%	Aug 25, 2026
34Monitor	CVE-2026-78682No exploit	NLTK before 3.10.3 SSRF Protection Bypass via Proxynltk · nltk · CWE-918 Pre-auth SSRF	High8.7	—	0.4%	Aug 25, 2026
37Monitor	CVE-2026-78683No exploit	NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserializationnltk · nltk · CWE-502 pre-auth RCE Deserialization	Critical9.4	—	0.5%	Aug 25, 2026
34Monitor	CVE-2026-78685No exploit	Le-yan｜Medical Practice Management System - Remote Code Executionle-yan · medical practice management system · CWE-940 pre-auth RCE	High8.6	—	0.6%	Aug 25, 2026
34Monitor	CVE-2026-66109No exploit	A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager.sky co., ltd. · skysea client view · CWE-862 RCE Local privilege escalation Broken access control (IDOR)	High8.5	—	0.1%	Aug 25, 2026
34Monitor	CVE-2026-69665No exploit	SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions.sky co., ltd. · skysea client view · CWE-276 RCE Local privilege escalation	High8.5	—	0.1%	Aug 25, 2026
24Monitor	CVE-2026-17089Proof of concept	Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameternetweblogic · events manager – calendar, bookings, tickets, and more! · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Aug 25, 2026
35Monitor	CVE-2026-16601No exploit	CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Actioncreativemindssolutions · cm map locations – visualize and share your locations in a few clicks · CWE-434 RCE File upload	High8.8	—	1.1%	Aug 25, 2026
28Monitor	CVE-2026-18323No exploit	Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)wpmudev · forminator forms – contact form, payment form & custom form builder · CWE-79 Pre-auth XSS	High7.2	—	0.5%	Aug 25, 2026
28Monitor	CVE-2026-18328No exploit	Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameterwpmudev · forminator forms – contact form, payment form & custom form builder · CWE-79 Pre-auth XSS	High7.2	—	0.4%	Aug 25, 2026
30Monitor	CVE-2026-19851No exploit	Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5dassault systèmes · tuleap enterprise edition · CWE-1393 Pre-auth Hard-coded credentials	High7.7	—	0.3%	Aug 25, 2026
35Monitor	CVE-2026-59769No exploit	FA-50 all versions contain hard-coded credentials.furuno electric co., ltd. · fa-50 · CWE-798 Pre-auth Hard-coded credentials	High8.8	—	0.5%	Aug 25, 2026
30Monitor	CVE-2026-65633No exploit	Purpose-limited JWT accepted as full bearer authentication in AshAuthenticationteam-alembic · ash_authentication · CWE-287 Pre-auth Auth bypass	High7.6	—	0.5%	Aug 25, 2026
34Monitor	CVE-2026-67578No exploit	FA-50 all versions miss authentication for some configuration.furuno electric co., ltd. · fa-50 · CWE-306 Pre-auth Auth bypass	High8.7	—	0.5%	Aug 25, 2026
35Monitor	CVE-2026-19892No exploit	InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosureinfused addons · infusedwoo pro · CWE-862 Broken access control (IDOR)	High8.8	—	0.4%	Aug 25, 2026
39Monitor	CVE-2026-13214No exploit	Stack buffer overflow in OCPP GetConfiguration key parsingzephyrproject · zephyr · CWE-787 Pre-auth Memory safety	Critical9.8	—	0.9%	Aug 25, 2026
30Monitor	CVE-2026-56092No exploit	Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)typo3 · extension "apache solr for typo3 - enterprise search" · CWE-862 Broken access control (IDOR)	High7.6	—	0.2%	Aug 25, 2026
30Monitor	CVE-2026-56095No exploit	Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)typo3 · extension "apache solr for typo3 - enterprise search" · CWE-502 Deserialization	High7.7	—	0.3%	Aug 25, 2026
25Monitor	CVE-2026-56096Proof of concept	Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)typo3 · extension "apache solr for typo3 - enterprise search" · CWE-943 Pre-auth SQL injection	Medium6.3	—	0.4%	Aug 25, 2026

CVE-2026-39975
37Monitor
Combodo iTop: Remote code execution using external auth variable value
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
combodo · itopAug 24, 2026
CVE-2026-40877
34Monitor
Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences
HighCVSS 8.7No exploitEPSS 0%
- RCE
combodo · itopAug 24, 2026
CVE-2026-71504
34Monitor
Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-71505
28Monitor
Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-71506
28Monitor
Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-71507
28Monitor
Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-71508
28Monitor
Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-71509
28Monitor
Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-75371
30Monitor
An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Aug 24, 2026
CVE-2026-78541
35Monitor
Command Injection in Parent Control of TP-Link Archer BE3600 v1
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
tp-link systems inc. · archer be3600 v1Aug 24, 2026
CVE-2020-37268
27Monitor
Coq and Rocq Prover Print Assumptions Omits Unsafe Universe Checking Inlined Through Parameter Inline
MediumCVSS 6.8Proof of conceptEPSS 0%
rocq-prover · rocqAug 24, 2026
CVE-2026-61419
31Monitor
Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
dell · thinosAug 24, 2026
CVE-2026-71510
28Monitor
Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-71511
28Monitor
Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Info leak
dolibarr · dolibarrAug 24, 2026
CVE-2026-72703
27Monitor
Rocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Calls
MediumCVSS 6.8Proof of conceptEPSS 0%
rocq-prover · rocqAug 24, 2026
CVE-2026-72704
27Monitor
Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport
MediumCVSS 6.8Proof of conceptEPSS 0%
rocq-prover · rocqAug 24, 2026
CVE-2026-72705
27Monitor
Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument
MediumCVSS 6.8Proof of conceptEPSS 0%
rocq-prover · rocqAug 24, 2026
CVE-2026-72711
27Monitor
Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variable
MediumCVSS 6.8Proof of conceptEPSS 0%
leanprover · lean4Aug 24, 2026
CVE-2026-72714
27Monitor
Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close
MediumCVSS 6.8Proof of conceptEPSS 0%
rocq-prover · rocqAug 24, 2026
CVE-2026-75368
30Monitor
A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
Aug 24, 2026
CVE-2026-75369
28Monitor
An out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT OBC software commit
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
Aug 24, 2026
CVE-2026-76098
30Monitor
Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
lepture · mistuneAug 24, 2026
CVE-2026-78551
35Monitor
RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
ransomlook · ransomlookAug 24, 2026
CVE-2026-78553
28Monitor
Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook
HighCVSS 7.0No exploitEPSS 0%
ransomlook · ransomlookAug 24, 2026
CVE-2026-78555
37Monitor
RansomLook API Key Disclosure Through /admin/apikeys HTML Source
CriticalCVSS 9.4No exploitEPSS 0%
- Info leak
ransomlook · ransomlookAug 24, 2026
CVE-2026-16782
31Monitor
SVG File Parsing Out-of-Bounds Read Vulnerability in Autodesk 3ds Max
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
autodesk · 3ds maxAug 24, 2026
CVE-2026-16783
31Monitor
ABC File Parsing Out-of-Bounds Write Vulnerability in Autodesk 3ds Max
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
autodesk · 3ds maxAug 24, 2026
CVE-2026-19568
31Monitor
SVG File Parsing Memory Corruption Vulnerability in Autodesk 3ds Max
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
autodesk · 3ds maxAug 24, 2026
CVE-2026-52490
39Monitor
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() fun
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Aug 24, 2026
CVE-2026-52492
31Monitor
An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized he
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
Aug 24, 2026
CVE-2026-56135
29Monitor
In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/security.c that allows
HighCVSS 7.4No exploitEPSS 0%
- Memory safety
tuxera · ntfs-3gAug 24, 2026
CVE-2026-5006
27Monitor
Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths
MediumCVSS 6.8Proof of conceptEPSS 0%
- Broken access control (IDOR)
hashicorp · vaultAug 24, 2026
CVE-2026-75464
32Monitor
OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().
HighCVSS 8.1No exploitEPSS 0%
Aug 24, 2026
CVE-2026-75542
33Monitor
OAuth token exchange grants repository scopes for organizations the principal cannot access
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
hexpm · hexpmAug 24, 2026
CVE-2026-77567
32Monitor
Filament: App-based MFA can be bypassed when recovery codes are enabled
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
filamentphp · filamentAug 24, 2026
CVE-2026-77634
32Monitor
CakePHP: SmtpTransport vulnerable to CRLF header injection
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
cakephp · cakephpAug 24, 2026
CVE-2026-77635
36Monitor
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
CriticalCVSS 9.2Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
cakephp · cakephpAug 24, 2026
CVE-2026-7455
31Monitor
FLT File Parsing Out-of-Bounds Write Vulnerability in Autodesk 3ds Max
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
autodesk · 3ds maxAug 24, 2026
CVE-2026-32554
37Monitor
WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
wbw · woobewoo product filter proAug 24, 2026
CVE-2026-32555
37Monitor
WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
pixelyoursite professional · boostAug 24, 2026
CVE-2026-32556
28Monitor
WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
pixelyoursite professional · boostAug 24, 2026
CVE-2026-32559
39Monitor
WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- File upload
tophive · ultimateaiAug 24, 2026
CVE-2026-32560
35Monitor
WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability
HighCVSS 8.8No exploitEPSS 0%
liquidthemes · magicai for wordpress - ai text, image, chat, code, and voice generatorAug 24, 2026
CVE-2026-32561
35Monitor
WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability
HighCVSS 8.8No exploitEPSS 0%
liquidthemes · booking hubAug 24, 2026
CVE-2026-32563
39Monitor
WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
a cpt · acpt (pro) - custom post types plugin for wordpressAug 24, 2026
CVE-2026-77337
36Monitor
CakePHP: Potential Authentication bypass with CookieAuthenticator
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
cakephp · authenticationAug 24, 2026
CVE-2026-77384
30Monitor
libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
libp2p · js-libp2pAug 24, 2026
CVE-2026-78259
29Monitor
WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
wp legal pages · wplegalpagesAug 24, 2026
CVE-2026-78262
39Monitor
WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
wedevs · wp project managerAug 24, 2026
CVE-2026-78263
28Monitor
WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
nexcess · event ticketsAug 24, 2026
CVE-2026-78264
28Monitor
WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
site building with toolset · toolset blocksAug 24, 2026
CVE-2026-78265
39Monitor
WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
nexcess · the events calendarAug 24, 2026
CVE-2026-78267
39Monitor
WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
cozmoslabs · translatepressAug 24, 2026
CVE-2026-78268
30Monitor
WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerabil
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
extend themes · lead generation contact widget & ai chatbot: chat button, phone call, telegram, email – siteleadsAug 24, 2026
CVE-2026-78282
28Monitor
WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
mra13 · stripe paymentsAug 24, 2026
CVE-2026-78284
34Monitor
WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Path traversal
- Denial of service
stylemix · masterstudy lmsAug 24, 2026
CVE-2026-53532
28Monitor
OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
academysoftwarefoundation · openexrAug 24, 2026
CVE-2026-66766
30Monitor
Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
sap_se · sap s/4hana (manage supply protection)Aug 25, 2026
CVE-2026-34968
28Monitor
Adminer before 5.4.3 Arbitrary File Deletion via SQLite Drop
HighCVSS 7.2No exploitEPSS 0%
- Path traversal
vrana · adminerAug 25, 2026
CVE-2026-56702
28Monitor
Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload
HighCVSS 7.1No exploitEPSS 0%
- RCE
- File upload
vrana · adminerAug 25, 2026
CVE-2026-56703
34Monitor
Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO
HighCVSS 8.6No exploitEPSS 1%
- RCE
vrana · adminerAug 25, 2026
CVE-2026-56705
37Monitor
Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection
CriticalCVSS 9.3Proof of conceptEPSS 0%
- pre-auth RCE
- Path traversal
vrana · adminerAug 25, 2026
CVE-2026-56707
33Monitor
Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
getgrav · gravAug 25, 2026
CVE-2026-56709
34Monitor
Grav before 3.9.2 Host Header Injection via sendInvitationEmail
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
getgrav · gravAug 25, 2026
CVE-2026-56710
37Monitor
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
getgrav · gravAug 25, 2026
CVE-2026-72695
28Monitor
Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
getgrav · gravAug 25, 2026
CVE-2026-72696
34Monitor
Grav CMS before 2.0.16 Symlink Following via createLockFile
HighCVSS 8.6No exploitEPSS 0%
getgrav · gravAug 25, 2026
CVE-2026-72697
28Monitor
Grav CMS before 2.0.16 Path Traversal via media_directory
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
getgrav · gravAug 25, 2026
CVE-2026-72698
28Monitor
Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
HighCVSS 7.1No exploitEPSS 0%
- Info leak
getgrav · gravAug 25, 2026
CVE-2026-72699
37Monitor
Grav Login Plugin before 3.9.1 Email Enumeration via Registration
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
getgrav · grav-plugin-loginAug 25, 2026
CVE-2026-72700
34Monitor
Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
getgrav · gravAug 25, 2026
CVE-2026-72702
37Monitor
Grav CMS before 2.0.16 Origin Validation Bypass via Referer
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
getgrav · gravAug 25, 2026
CVE-2026-75574
34Monitor
Grav before 4.2.2 Remote Code Execution via Email Twig
HighCVSS 8.7No exploitEPSS 0%
- RCE
- SSTI
getgrav · gravAug 25, 2026
CVE-2026-76839
34Monitor
Grav before 2.0.16 Information Disclosure via offsetGet
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Info leak
getgrav · gravAug 25, 2026
CVE-2026-76846
34Monitor
Grav before 2.0.16 Information Disclosure via Twig Sandbox
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Info leak
getgrav · gravAug 25, 2026
CVE-2026-78675
34Monitor
GitPython before 3.1.59 Local File Content Disclosure via .gitmodules
HighCVSS 8.6No exploitEPSS 0%
- Path traversal
gitpython project · gitpythonAug 25, 2026
CVE-2026-78676
37Monitor
GitPython before 3.1.59 Remote Code Execution via Config Injection
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
gitpython project · gitpythonAug 25, 2026
CVE-2026-78677
34Monitor
GitPython before 3.1.59 Path Traversal via separate-git-dir
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
gitpython project · gitpythonAug 25, 2026
CVE-2026-78678
28Monitor
GitPython before 3.1.59 Arbitrary File Read via Repo.blame()
HighCVSS 7.1No exploitEPSS 0%
gitpython project · gitpythonAug 25, 2026
CVE-2026-78679
28Monitor
GitPython before 3.1.59 Arbitrary File Read via TagReference.create
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
gitpython-developers · gitpythonAug 25, 2026
CVE-2026-78680
34Monitor
NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary
HighCVSS 8.5No exploitEPSS 0%
- RCE
nltk · nltkAug 25, 2026
CVE-2026-78681
34Monitor
NLTK before 3.10.3 Entity Expansion DoS via ElementTree
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
nltk · nltkAug 25, 2026
CVE-2026-78682
34Monitor
NLTK before 3.10.3 SSRF Protection Bypass via Proxy
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SSRF
nltk · nltkAug 25, 2026
CVE-2026-78683
37Monitor
NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization
CriticalCVSS 9.4No exploitEPSS 0%
- pre-auth RCE
- Deserialization
nltk · nltkAug 25, 2026
CVE-2026-78685
34Monitor
Le-yan｜Medical Practice Management System - Remote Code Execution
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
le-yan · medical practice management systemAug 25, 2026
CVE-2026-66109
34Monitor
A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager.
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
sky co., ltd. · skysea client viewAug 25, 2026
CVE-2026-69665
34Monitor
SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions.
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
sky co., ltd. · skysea client viewAug 25, 2026
CVE-2026-17089
24Monitor
Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
netweblogic · events manager – calendar, bookings, tickets, and more!Aug 25, 2026
CVE-2026-16601
35Monitor
CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action
HighCVSS 8.8No exploitEPSS 1%
- RCE
- File upload
creativemindssolutions · cm map locations – visualize and share your locations in a few clicksAug 25, 2026
CVE-2026-18323
28Monitor
Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wpmudev · forminator forms – contact form, payment form & custom form builderAug 25, 2026
CVE-2026-18328
28Monitor
Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wpmudev · forminator forms – contact form, payment form & custom form builderAug 25, 2026
CVE-2026-19851
30Monitor
Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
dassault systèmes · tuleap enterprise editionAug 25, 2026
CVE-2026-59769
35Monitor
FA-50 all versions contain hard-coded credentials.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
furuno electric co., ltd. · fa-50Aug 25, 2026
CVE-2026-65633
30Monitor
Purpose-limited JWT accepted as full bearer authentication in AshAuthentication
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
team-alembic · ash_authenticationAug 25, 2026
CVE-2026-67578
34Monitor
FA-50 all versions miss authentication for some configuration.
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
furuno electric co., ltd. · fa-50Aug 25, 2026
CVE-2026-19892
35Monitor
InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
infused addons · infusedwoo proAug 25, 2026
CVE-2026-13214
39Monitor
Stack buffer overflow in OCPP GetConfiguration key parsing
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
zephyrproject · zephyrAug 25, 2026
CVE-2026-56092
30Monitor
Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
typo3 · extension "apache solr for typo3 - enterprise search"Aug 25, 2026
CVE-2026-56095
30Monitor
Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
HighCVSS 7.7No exploitEPSS 0%
- Deserialization
typo3 · extension "apache solr for typo3 - enterprise search"Aug 25, 2026
CVE-2026-56096
25Monitor
Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
typo3 · extension "apache solr for typo3 - enterprise search"Aug 25, 2026