By publication date

Exploited and new serious CVEs: August 2026

6,577 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 52 of 66

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-32563No exploit	WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerabilitya cpt · acpt (pro) - custom post types plugin for wordpress · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 24, 2026
36Monitor	CVE-2026-77337No exploit	CakePHP: Potential Authentication bypass with CookieAuthenticatorcakephp · authentication · CWE-290 Pre-auth Auth bypass	Critical9.1	—	0.6%	Aug 24, 2026
30Monitor	CVE-2026-77384No exploit	libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustionlibp2p · js-libp2p · CWE-400 Pre-auth Denial of service	High7.5	—	0.6%	Aug 24, 2026
29Monitor	CVE-2026-78259No exploit	WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerabilitywp legal pages · wplegalpages · CWE-288 Pre-auth Auth bypass	High7.3	—	0.3%	Aug 24, 2026
39Monitor	CVE-2026-78262No exploit	WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerabilitywedevs · wp project manager · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 24, 2026
28Monitor	CVE-2026-78263No exploit	WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerabilitynexcess · event tickets · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
28Monitor	CVE-2026-78264No exploit	WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerabilitysite building with toolset · toolset blocks · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
39Monitor	CVE-2026-78265No exploit	WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerabilitynexcess · the events calendar · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 24, 2026
39Monitor	CVE-2026-78267No exploit	WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerabilitycozmoslabs · translatepress · CWE-266 Pre-auth	Critical9.8	—	0.4%	Aug 24, 2026
30Monitor	CVE-2026-78268No exploit	WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerabilextend themes · lead generation contact widget & ai chatbot: chat button, phone call, telegram, email – siteleads · CWE-497 Pre-auth Info leak	High7.5	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-78282No exploit	WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerabilitymra13 · stripe payments · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 24, 2026
34Monitor	CVE-2026-78284No exploit	WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerabilitystylemix · masterstudy lms · CWE-22 Pre-auth Path traversal Denial of service	High8.6	—	0.5%	Aug 24, 2026
28Monitor	CVE-2026-53532No exploit	OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)academysoftwarefoundation · openexr · CWE-617 Pre-auth	High7.1	—	0.4%	Aug 24, 2026
30Monitor	CVE-2026-66766No exploit	Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)sap_se · sap s/4hana (manage supply protection) · CWE-1333 Pre-auth Denial of service	High7.5	—	0.5%	Aug 25, 2026
28Monitor	CVE-2026-34968No exploit	Adminer before 5.4.3 Arbitrary File Deletion via SQLite Dropvrana · adminer · CWE-22 Path traversal	High7.2	—	0.5%	Aug 25, 2026
28Monitor	CVE-2026-56702No exploit	Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUploadvrana · adminer · CWE-434 RCE File upload	High7.1	—	0.6%	Aug 25, 2026
34Monitor	CVE-2026-56703No exploit	Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTOvrana · adminer · CWE-94 RCE	High8.6	—	1.1%	Aug 25, 2026
37Monitor	CVE-2026-56705Proof of concept	Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injectionvrana · adminer · CWE-73 pre-auth RCE Path traversal	Critical9.3	—	0.8%	Aug 25, 2026
33Monitor	CVE-2026-56707No exploit	Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcodegetgrav · grav · CWE-862 Broken access control (IDOR)	High8.3	—	0.3%	Aug 25, 2026
34Monitor	CVE-2026-56709No exploit	Grav before 3.9.2 Host Header Injection via sendInvitationEmailgetgrav · grav · CWE-350 Pre-auth	High8.7	—	0.4%	Aug 25, 2026
37Monitor	CVE-2026-56710No exploit	Grav Login Plugin before 1.0.16 Privilege Escalation via Unlockgetgrav · grav · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.5%	Aug 25, 2026
28Monitor	CVE-2026-72695No exploit	Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFilegetgrav · grav · CWE-22 Path traversal	High7.1	—	0.6%	Aug 25, 2026
34Monitor	CVE-2026-72696No exploit	Grav CMS before 2.0.16 Symlink Following via createLockFilegetgrav · grav · CWE-59	High8.6	—	0.2%	Aug 25, 2026
28Monitor	CVE-2026-72697No exploit	Grav CMS before 2.0.16 Path Traversal via media_directorygetgrav · grav · CWE-22 Path traversal	High7.1	—	0.3%	Aug 25, 2026
28Monitor	CVE-2026-72698No exploit	Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypassgetgrav · grav · CWE-200 Info leak	High7.1	—	0.4%	Aug 25, 2026
37Monitor	CVE-2026-72699No exploit	Grav Login Plugin before 3.9.1 Email Enumeration via Registrationgetgrav · grav-plugin-login · CWE-203 Pre-auth	Critical9.3	—	0.2%	Aug 25, 2026
34Monitor	CVE-2026-72700No exploit	Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparisongetgrav · grav · CWE-208 Pre-auth	High8.7	—	0.4%	Aug 25, 2026
37Monitor	CVE-2026-72702No exploit	Grav CMS before 2.0.16 Origin Validation Bypass via Referergetgrav · grav · CWE-346 Pre-auth	Critical9.3	—	0.1%	Aug 25, 2026
34Monitor	CVE-2026-75574No exploit	Grav before 4.2.2 Remote Code Execution via Email Twiggetgrav · grav · CWE-1336 RCE SSTI	High8.7	—	0.6%	Aug 25, 2026
34Monitor	CVE-2026-76839No exploit	Grav before 2.0.16 Information Disclosure via offsetGetgetgrav · grav · CWE-522 Pre-auth Auth bypass Info leak	High8.7	—	0.3%	Aug 25, 2026
34Monitor	CVE-2026-76846No exploit	Grav before 2.0.16 Information Disclosure via Twig Sandboxgetgrav · grav · CWE-522 Pre-auth Info leak	High8.7	—	0.3%	Aug 25, 2026
34Monitor	CVE-2026-78675No exploit	GitPython before 3.1.59 Local File Content Disclosure via .gitmodulesgitpython project · gitpython · CWE-73 Path traversal	High8.6	—	0.1%	Aug 25, 2026
37Monitor	CVE-2026-78676No exploit	GitPython before 3.1.59 Remote Code Execution via Config Injectiongitpython project · gitpython · CWE-88 pre-auth RCE	Critical9.3	—	0.5%	Aug 25, 2026
34Monitor	CVE-2026-78677No exploit	GitPython before 3.1.59 Path Traversal via separate-git-dirgitpython project · gitpython · CWE-22 Pre-auth Path traversal	High8.7	—	0.6%	Aug 25, 2026
28Monitor	CVE-2026-78678No exploit	GitPython before 3.1.59 Arbitrary File Read via Repo.blame()gitpython project · gitpython · CWE-88	High7.1	—	0.4%	Aug 25, 2026
28Monitor	CVE-2026-78679No exploit	GitPython before 3.1.59 Arbitrary File Read via TagReference.creategitpython-developers · gitpython · CWE-73 Path traversal	High7.1	—	0.3%	Aug 25, 2026
34Monitor	CVE-2026-78680No exploit	NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binarynltk · nltk · CWE-426 RCE	High8.5	—	0.1%	Aug 25, 2026
34Monitor	CVE-2026-78681No exploit	NLTK before 3.10.3 Entity Expansion DoS via ElementTreenltk · nltk · CWE-776 Pre-auth	High8.7	—	0.5%	Aug 25, 2026
34Monitor	CVE-2026-78682No exploit	NLTK before 3.10.3 SSRF Protection Bypass via Proxynltk · nltk · CWE-918 Pre-auth SSRF	High8.7	—	0.4%	Aug 25, 2026
37Monitor	CVE-2026-78683No exploit	NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserializationnltk · nltk · CWE-502 pre-auth RCE Deserialization	Critical9.4	—	0.5%	Aug 25, 2026
34Monitor	CVE-2026-78685No exploit	Le-yan｜Medical Practice Management System - Remote Code Executionle-yan · medical practice management system · CWE-940 pre-auth RCE	High8.6	—	0.6%	Aug 25, 2026
34Monitor	CVE-2026-66109No exploit	A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager.sky co., ltd. · skysea client view · CWE-862 RCE Local privilege escalation Broken access control (IDOR)	High8.5	—	0.1%	Aug 25, 2026
34Monitor	CVE-2026-69665No exploit	SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions.sky co., ltd. · skysea client view · CWE-276 RCE Local privilege escalation	High8.5	—	0.1%	Aug 25, 2026
24Monitor	CVE-2026-17089Proof of concept	Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameternetweblogic · events manager – calendar, bookings, tickets, and more! · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Aug 25, 2026
35Monitor	CVE-2026-16601No exploit	CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Actioncreativemindssolutions · cm map locations – visualize and share your locations in a few clicks · CWE-434 RCE File upload	High8.8	—	1.1%	Aug 25, 2026
28Monitor	CVE-2026-18323No exploit	Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)wpmudev · forminator forms – contact form, payment form & custom form builder · CWE-79 Pre-auth XSS	High7.2	—	0.5%	Aug 25, 2026
28Monitor	CVE-2026-18328No exploit	Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameterwpmudev · forminator forms – contact form, payment form & custom form builder · CWE-79 Pre-auth XSS	High7.2	—	0.4%	Aug 25, 2026
30Monitor	CVE-2026-19851No exploit	Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5dassault systèmes · tuleap enterprise edition · CWE-1393 Pre-auth Hard-coded credentials	High7.7	—	0.3%	Aug 25, 2026
35Monitor	CVE-2026-59769No exploit	FA-50 all versions contain hard-coded credentials.furuno electric co., ltd. · fa-50 · CWE-798 Pre-auth Hard-coded credentials	High8.8	—	0.5%	Aug 25, 2026
30Monitor	CVE-2026-65633No exploit	Purpose-limited JWT accepted as full bearer authentication in AshAuthenticationteam-alembic · ash_authentication · CWE-287 Pre-auth Auth bypass	High7.6	—	0.5%	Aug 25, 2026
34Monitor	CVE-2026-67578No exploit	FA-50 all versions miss authentication for some configuration.furuno electric co., ltd. · fa-50 · CWE-306 Pre-auth Auth bypass	High8.7	—	0.5%	Aug 25, 2026
35Monitor	CVE-2026-19892No exploit	InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosureinfused addons · infusedwoo pro · CWE-862 Broken access control (IDOR)	High8.8	—	0.4%	Aug 25, 2026
39Monitor	CVE-2026-13214No exploit	Stack buffer overflow in OCPP GetConfiguration key parsingzephyrproject · zephyr · CWE-787 Pre-auth Memory safety	Critical9.8	—	0.9%	Aug 25, 2026
30Monitor	CVE-2026-56092No exploit	Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)typo3 · extension "apache solr for typo3 - enterprise search" · CWE-862 Broken access control (IDOR)	High7.6	—	0.2%	Aug 25, 2026
30Monitor	CVE-2026-56095No exploit	Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)typo3 · extension "apache solr for typo3 - enterprise search" · CWE-502 Deserialization	High7.7	—	0.3%	Aug 25, 2026
25Monitor	CVE-2026-56096Proof of concept	Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)typo3 · extension "apache solr for typo3 - enterprise search" · CWE-943 Pre-auth SQL injection	Medium6.3	—	0.4%	Aug 25, 2026
37Monitor	CVE-2026-63586No exploit	Unauthenticated Remote Code Execution via Shell Injection in Web Management Interfaceweidmueller interface · ie-sr-2tx-wl · CWE-78 pre-auth RCE Command injection	Critical9.3	—	0.9%	Aug 25, 2026
35Monitor	CVE-2026-63587No exploit	SMS Password Authorization Bypass via Failed Attempt Counterweidmueller interface · ie-sr-2tx-wl-4g-eu · CWE-288 Pre-auth Auth bypass	High8.8	—	0.4%	Aug 25, 2026
30Monitor	CVE-2026-77129No exploit	Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)typo3 · extension "event management and registration" · CWE-1336 RCE SSTI	High7.7	—	0.3%	Aug 25, 2026
33Monitor	CVE-2026-77134No exploit	Broken Access Control in extension "femanager" (femanager)typo3 · extension "femanager" · CWE-863 Pre-auth Broken access control (IDOR)	High8.3	—	0.4%	Aug 25, 2026
32Monitor	CVE-2026-78478No exploit	Måne <= 1.7 - Unauthenticated Local File Inclusionelated-themes · mane · CWE-98 pre-auth RCE	High8.1	—	0.7%	Aug 25, 2026
30Monitor	CVE-2026-77996No exploit	Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41yootheme.com · yootheme pro extension for joomla · CWE-79 XSS	High7.5	—	0.4%	Aug 25, 2026
34Monitor	CVE-2026-79658No exploit	Ech0 before 5.0.1 Denial of Service via Accept-Languagelin-snow · ech0 · CWE-400 Pre-auth Denial of service	High8.7	—	0.5%	Aug 25, 2026
35Monitor	CVE-2026-79662No exploit	Ech0 before 4.7.3 OAuth Redirect URI Validation Bypasslin-snow · ech0 · CWE-601 Pre-auth Open redirect	High8.8	—	0.3%	Aug 25, 2026
36Monitor	CVE-2026-79664No exploit	Ech0 before 4.7.3 Access Token Revocation Bypasslin-snow · ech0 · CWE-613 Pre-auth	Critical9.1	—	0.3%	Aug 25, 2026
34Monitor	CVE-2026-79665No exploit	Ech0 before 4.5.1 Authorization Bypass via Session Tokenslin-snow · ech0 · CWE-862 Broken access control (IDOR)	High8.7	—	0.5%	Aug 25, 2026
28Monitor	CVE-2026-79666No exploit	Ech0 before 4.4.3 Missing Authorization via dashboard log endpointslin-snow · ech0 · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Aug 25, 2026
28Monitor	CVE-2026-79667No exploit	Ech0 before 4.4.3 Authentication Bypass via Scope Enforcementlin-snow · ech0 · CWE-285 Auth bypass Broken access control (IDOR)	High7.2	—	0.3%	Aug 25, 2026
28Monitor	CVE-2026-79672No exploit	Ech0 before 4.4.3 Authentication Bypass via Comment Panellin-snow · ech0 · CWE-862 Auth bypass Broken access control (IDOR)	High7.0	—	0.3%	Aug 25, 2026
34Monitor	CVE-2026-79673No exploit	Ech0 before 4.4.3 Scope Bypass via profile:read Tokenlin-snow · ech0 · CWE-863 Broken access control (IDOR)	High8.5	—	0.4%	Aug 25, 2026
32Monitor	CVE-2026-77135No exploit	Information Disclosure in extension "femanager" (femanager)typo3 · extension "femanager" · CWE-639 Pre-auth Broken access control (IDOR)	High8.2	—	0.4%	Aug 25, 2026
38Monitor	CVE-2026-77136No exploit	Server-Side Template Injection in extension "powermail" (powermail)typo3 · extension "powermail" · CWE-1336 pre-auth RCE SSTI	Critical9.5	—	0.9%	Aug 25, 2026
30Monitor	CVE-2026-77137No exploit	SQL Injection in extension "Forms Export" (frp_form_answers)typo3 · extension "forms export" · CWE-89 SQL injection	High7.7	—	0.3%	Aug 25, 2026
37Monitor	CVE-2026-77138No exploit	Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)typo3 · extension "html5 video player vs. powermail" · CWE-502 pre-auth RCE Deserialization	Critical9.3	—	0.7%	Aug 25, 2026
34Monitor	CVE-2026-77140No exploit	Broken Access Control in extension "Telephone Directory" (telephonedirectory)typo3 · extension "telephone directory" · CWE-639 Pre-auth Broken access control (IDOR)	High8.7	—	0.4%	Aug 25, 2026
35Monitor	CVE-2026-77141No exploit	Broken Access Control in extension "Club Directory" (clubdirectory)typo3 · extension "club directory" · CWE-639 Pre-auth Broken access control (IDOR)	High8.8	—	0.4%	Aug 25, 2026
35Monitor	CVE-2026-77142No exploit	Broken Access Control in extension "Industry Directory" (yellowpages2)typo3 · extension "industry directory" · CWE-639 Pre-auth Broken access control (IDOR)	High8.8	—	0.4%	Aug 25, 2026
35Monitor	CVE-2026-77143No exploit	Broken Access Control in extension "Forum" (pforum)typo3 · extension "forum" · CWE-639 Pre-auth Broken access control (IDOR)	High8.8	—	0.4%	Aug 25, 2026
28Monitor	CVE-2026-77144No exploit	Broken Access Control in extension "Events 2" (events2)typo3 · extension "events 2" · CWE-915 Broken access control (IDOR)	High7.1	—	0.4%	Aug 25, 2026
28Monitor	CVE-2026-77145No exploit	Broken Access Control in extension "Events 2" (events2)typo3 · extension "events 2" · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Aug 25, 2026
33Monitor	CVE-2026-77146No exploit	Broken Access Control in extension "femanager" (femanager)typo3 · extension "femanager" · CWE-862 Pre-auth Broken access control (IDOR)	High8.3	—	0.4%	Aug 25, 2026
30Monitor	CVE-2026-14457No exploit	RPK Server Signature Algorithm Selection Can Dereference a Missing Certificateopenssl · openssl · CWE-476 pre-auth RCE Memory safety Denial of service	High7.5	—	1.1%	Aug 25, 2026
31Monitor	CVE-2026-18798No exploit	QUIC Server May Trigger Double Free When Processing INITIAL Packetopenssl · openssl · CWE-415 pre-auth RCE Memory safety Denial of service	High7.5	—	1.6%	Aug 25, 2026
30Monitor	CVE-2026-54874No exploit	Excessive Memory Use Buffering DTLS Records for a Future Epochopenssl · openssl · CWE-405 Pre-auth Denial of service	High7.5	—	0.6%	Aug 25, 2026
34Monitor	CVE-2026-57863No exploit	Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpointcrater-invoice-inc · crater · CWE-22 RCE Path traversal	High8.7	—	0.8%	Aug 25, 2026
30Monitor	CVE-2026-63072Proof of concept	Heap Buffer Overflow in CMS Key Unwrappingopenssl · openssl · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.9%	Aug 25, 2026
39Monitor	CVE-2026-63073No exploit	Untrusted Sender DN Used as Format String in CMP Response Validationopenssl · openssl · CWE-134 Pre-auth	Critical9.8	—	1.1%	Aug 25, 2026
30Monitor	CVE-2026-63075No exploit	QUIC ACK-only Packet Retention Can Cause Memory Exhaustionopenssl · openssl · CWE-770 Pre-auth Denial of service	High7.5	—	0.5%	Aug 25, 2026
30Monitor	CVE-2026-63076No exploit	Invalid Pointer Dereference in CMP Server via Crafted protectionAlgopenssl · openssl · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	1.6%	Aug 25, 2026
36Monitor	CVE-2026-75803No exploit	AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()openssl · openssl · CWE-354 Pre-auth	Critical9.1	—	0.2%	Aug 25, 2026
40Plan	CVE-2026-77998No exploit	Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Lminiorange.com · saml sso free for joomla extension for joomla · CWE-639 Pre-auth Auth bypass Broken access control (IDOR)	Critical10.0	—	0.5%	Aug 25, 2026
30Monitor	CVE-2026-55525No exploit	PraisonAI: SSRF via redirect-following in praisonaiagents web_crawlmervinpraison · praisonai · CWE-918 Pre-auth SSRF	High7.5	—	0.5%	Aug 25, 2026
34Monitor	CVE-2026-12878No exploit	In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.octopus · codefresh · CWE-269	High8.6	—	0.4%	Aug 25, 2026
32Monitor	CVE-2026-16231No exploit	hbs vulnerable to XSS via registerAsyncHelper output-escaping bypasshbs project · hbs · CWE-79 Pre-auth XSS	High8.1	—	0.4%	Aug 25, 2026
35Monitor	CVE-2026-49050No exploit	Apache DolphinScheduler: General user can mint admin access tokens via /access-tokensapache · dolphinscheduler · CWE-863 Broken access control (IDOR)	High8.8	—	0.5%	Aug 25, 2026
29Monitor	CVE-2026-75037No exploit	Polkit authentication bypass in LACTilya-zlobintsev · lact · CWE-290 Auth bypass	High7.3	—	0.1%	Aug 25, 2026
39Monitor	CVE-2026-16286No exploit	File Upload in TRTEK Software's Software Repository Managementtrtek technological products computer software hardware industry and trade limited company · software repository management · CWE-434 Pre-auth File upload	Critical9.8	—	0.5%	Aug 25, 2026
34Monitor	CVE-2026-55526No exploit	PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)mervinpraison · praisonai · CWE-350 SSRF	High8.5	—	0.3%	Aug 25, 2026
28Monitor	CVE-2026-55527No exploit	PraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable locationmervinpraison · praisonai · CWE-22 Path traversal	High7.1	—	0.4%	Aug 25, 2026
32Monitor	CVE-2026-55528No exploit	praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)mervinpraison · praisonai · CWE-306 Pre-auth Auth bypass	High8.2	—	0.4%	Aug 25, 2026

CVE-2026-32563
39Monitor
WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
a cpt · acpt (pro) - custom post types plugin for wordpressAug 24, 2026
CVE-2026-77337
36Monitor
CakePHP: Potential Authentication bypass with CookieAuthenticator
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
cakephp · authenticationAug 24, 2026
CVE-2026-77384
30Monitor
libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
libp2p · js-libp2pAug 24, 2026
CVE-2026-78259
29Monitor
WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
wp legal pages · wplegalpagesAug 24, 2026
CVE-2026-78262
39Monitor
WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
wedevs · wp project managerAug 24, 2026
CVE-2026-78263
28Monitor
WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
nexcess · event ticketsAug 24, 2026
CVE-2026-78264
28Monitor
WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
site building with toolset · toolset blocksAug 24, 2026
CVE-2026-78265
39Monitor
WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
nexcess · the events calendarAug 24, 2026
CVE-2026-78267
39Monitor
WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
cozmoslabs · translatepressAug 24, 2026
CVE-2026-78268
30Monitor
WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerabil
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
extend themes · lead generation contact widget & ai chatbot: chat button, phone call, telegram, email – siteleadsAug 24, 2026
CVE-2026-78282
28Monitor
WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
mra13 · stripe paymentsAug 24, 2026
CVE-2026-78284
34Monitor
WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Path traversal
- Denial of service
stylemix · masterstudy lmsAug 24, 2026
CVE-2026-53532
28Monitor
OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
academysoftwarefoundation · openexrAug 24, 2026
CVE-2026-66766
30Monitor
Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
sap_se · sap s/4hana (manage supply protection)Aug 25, 2026
CVE-2026-34968
28Monitor
Adminer before 5.4.3 Arbitrary File Deletion via SQLite Drop
HighCVSS 7.2No exploitEPSS 0%
- Path traversal
vrana · adminerAug 25, 2026
CVE-2026-56702
28Monitor
Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload
HighCVSS 7.1No exploitEPSS 0%
- RCE
- File upload
vrana · adminerAug 25, 2026
CVE-2026-56703
34Monitor
Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO
HighCVSS 8.6No exploitEPSS 1%
- RCE
vrana · adminerAug 25, 2026
CVE-2026-56705
37Monitor
Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection
CriticalCVSS 9.3Proof of conceptEPSS 0%
- pre-auth RCE
- Path traversal
vrana · adminerAug 25, 2026
CVE-2026-56707
33Monitor
Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
getgrav · gravAug 25, 2026
CVE-2026-56709
34Monitor
Grav before 3.9.2 Host Header Injection via sendInvitationEmail
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
getgrav · gravAug 25, 2026
CVE-2026-56710
37Monitor
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
getgrav · gravAug 25, 2026
CVE-2026-72695
28Monitor
Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
getgrav · gravAug 25, 2026
CVE-2026-72696
34Monitor
Grav CMS before 2.0.16 Symlink Following via createLockFile
HighCVSS 8.6No exploitEPSS 0%
getgrav · gravAug 25, 2026
CVE-2026-72697
28Monitor
Grav CMS before 2.0.16 Path Traversal via media_directory
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
getgrav · gravAug 25, 2026
CVE-2026-72698
28Monitor
Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
HighCVSS 7.1No exploitEPSS 0%
- Info leak
getgrav · gravAug 25, 2026
CVE-2026-72699
37Monitor
Grav Login Plugin before 3.9.1 Email Enumeration via Registration
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
getgrav · grav-plugin-loginAug 25, 2026
CVE-2026-72700
34Monitor
Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
getgrav · gravAug 25, 2026
CVE-2026-72702
37Monitor
Grav CMS before 2.0.16 Origin Validation Bypass via Referer
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
getgrav · gravAug 25, 2026
CVE-2026-75574
34Monitor
Grav before 4.2.2 Remote Code Execution via Email Twig
HighCVSS 8.7No exploitEPSS 0%
- RCE
- SSTI
getgrav · gravAug 25, 2026
CVE-2026-76839
34Monitor
Grav before 2.0.16 Information Disclosure via offsetGet
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Info leak
getgrav · gravAug 25, 2026
CVE-2026-76846
34Monitor
Grav before 2.0.16 Information Disclosure via Twig Sandbox
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Info leak
getgrav · gravAug 25, 2026
CVE-2026-78675
34Monitor
GitPython before 3.1.59 Local File Content Disclosure via .gitmodules
HighCVSS 8.6No exploitEPSS 0%
- Path traversal
gitpython project · gitpythonAug 25, 2026
CVE-2026-78676
37Monitor
GitPython before 3.1.59 Remote Code Execution via Config Injection
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
gitpython project · gitpythonAug 25, 2026
CVE-2026-78677
34Monitor
GitPython before 3.1.59 Path Traversal via separate-git-dir
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
gitpython project · gitpythonAug 25, 2026
CVE-2026-78678
28Monitor
GitPython before 3.1.59 Arbitrary File Read via Repo.blame()
HighCVSS 7.1No exploitEPSS 0%
gitpython project · gitpythonAug 25, 2026
CVE-2026-78679
28Monitor
GitPython before 3.1.59 Arbitrary File Read via TagReference.create
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
gitpython-developers · gitpythonAug 25, 2026
CVE-2026-78680
34Monitor
NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary
HighCVSS 8.5No exploitEPSS 0%
- RCE
nltk · nltkAug 25, 2026
CVE-2026-78681
34Monitor
NLTK before 3.10.3 Entity Expansion DoS via ElementTree
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
nltk · nltkAug 25, 2026
CVE-2026-78682
34Monitor
NLTK before 3.10.3 SSRF Protection Bypass via Proxy
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SSRF
nltk · nltkAug 25, 2026
CVE-2026-78683
37Monitor
NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization
CriticalCVSS 9.4No exploitEPSS 0%
- pre-auth RCE
- Deserialization
nltk · nltkAug 25, 2026
CVE-2026-78685
34Monitor
Le-yan｜Medical Practice Management System - Remote Code Execution
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
le-yan · medical practice management systemAug 25, 2026
CVE-2026-66109
34Monitor
A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager.
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
sky co., ltd. · skysea client viewAug 25, 2026
CVE-2026-69665
34Monitor
SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions.
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
sky co., ltd. · skysea client viewAug 25, 2026
CVE-2026-17089
24Monitor
Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
netweblogic · events manager – calendar, bookings, tickets, and more!Aug 25, 2026
CVE-2026-16601
35Monitor
CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action
HighCVSS 8.8No exploitEPSS 1%
- RCE
- File upload
creativemindssolutions · cm map locations – visualize and share your locations in a few clicksAug 25, 2026
CVE-2026-18323
28Monitor
Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wpmudev · forminator forms – contact form, payment form & custom form builderAug 25, 2026
CVE-2026-18328
28Monitor
Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wpmudev · forminator forms – contact form, payment form & custom form builderAug 25, 2026
CVE-2026-19851
30Monitor
Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
dassault systèmes · tuleap enterprise editionAug 25, 2026
CVE-2026-59769
35Monitor
FA-50 all versions contain hard-coded credentials.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
furuno electric co., ltd. · fa-50Aug 25, 2026
CVE-2026-65633
30Monitor
Purpose-limited JWT accepted as full bearer authentication in AshAuthentication
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
team-alembic · ash_authenticationAug 25, 2026
CVE-2026-67578
34Monitor
FA-50 all versions miss authentication for some configuration.
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
furuno electric co., ltd. · fa-50Aug 25, 2026
CVE-2026-19892
35Monitor
InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
infused addons · infusedwoo proAug 25, 2026
CVE-2026-13214
39Monitor
Stack buffer overflow in OCPP GetConfiguration key parsing
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
zephyrproject · zephyrAug 25, 2026
CVE-2026-56092
30Monitor
Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
typo3 · extension "apache solr for typo3 - enterprise search"Aug 25, 2026
CVE-2026-56095
30Monitor
Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
HighCVSS 7.7No exploitEPSS 0%
- Deserialization
typo3 · extension "apache solr for typo3 - enterprise search"Aug 25, 2026
CVE-2026-56096
25Monitor
Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
typo3 · extension "apache solr for typo3 - enterprise search"Aug 25, 2026
CVE-2026-63586
37Monitor
Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Command injection
weidmueller interface · ie-sr-2tx-wlAug 25, 2026
CVE-2026-63587
35Monitor
SMS Password Authorization Bypass via Failed Attempt Counter
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
weidmueller interface · ie-sr-2tx-wl-4g-euAug 25, 2026
CVE-2026-77129
30Monitor
Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)
HighCVSS 7.7No exploitEPSS 0%
- RCE
- SSTI
typo3 · extension "event management and registration"Aug 25, 2026
CVE-2026-77134
33Monitor
Broken Access Control in extension "femanager" (femanager)
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
typo3 · extension "femanager"Aug 25, 2026
CVE-2026-78478
32Monitor
Måne <= 1.7 - Unauthenticated Local File Inclusion
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
elated-themes · maneAug 25, 2026
CVE-2026-77996
30Monitor
Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41
HighCVSS 7.5No exploitEPSS 0%
- XSS
yootheme.com · yootheme pro extension for joomlaAug 25, 2026
CVE-2026-79658
34Monitor
Ech0 before 5.0.1 Denial of Service via Accept-Language
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
lin-snow · ech0Aug 25, 2026
CVE-2026-79662
35Monitor
Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Open redirect
lin-snow · ech0Aug 25, 2026
CVE-2026-79664
36Monitor
Ech0 before 4.7.3 Access Token Revocation Bypass
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
lin-snow · ech0Aug 25, 2026
CVE-2026-79665
34Monitor
Ech0 before 4.5.1 Authorization Bypass via Session Tokens
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
lin-snow · ech0Aug 25, 2026
CVE-2026-79666
28Monitor
Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
lin-snow · ech0Aug 25, 2026
CVE-2026-79667
28Monitor
Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement
HighCVSS 7.2No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
lin-snow · ech0Aug 25, 2026
CVE-2026-79672
28Monitor
Ech0 before 4.4.3 Authentication Bypass via Comment Panel
HighCVSS 7.0No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
lin-snow · ech0Aug 25, 2026
CVE-2026-79673
34Monitor
Ech0 before 4.4.3 Scope Bypass via profile:read Token
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
lin-snow · ech0Aug 25, 2026
CVE-2026-77135
32Monitor
Information Disclosure in extension "femanager" (femanager)
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
typo3 · extension "femanager"Aug 25, 2026
CVE-2026-77136
38Monitor
Server-Side Template Injection in extension "powermail" (powermail)
CriticalCVSS 9.5No exploitEPSS 0%
- pre-auth RCE
- SSTI
typo3 · extension "powermail"Aug 25, 2026
CVE-2026-77137
30Monitor
SQL Injection in extension "Forms Export" (frp_form_answers)
HighCVSS 7.7No exploitEPSS 0%
- SQL injection
typo3 · extension "forms export"Aug 25, 2026
CVE-2026-77138
37Monitor
Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Deserialization
typo3 · extension "html5 video player vs. powermail"Aug 25, 2026
CVE-2026-77140
34Monitor
Broken Access Control in extension "Telephone Directory" (telephonedirectory)
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
typo3 · extension "telephone directory"Aug 25, 2026
CVE-2026-77141
35Monitor
Broken Access Control in extension "Club Directory" (clubdirectory)
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
typo3 · extension "club directory"Aug 25, 2026
CVE-2026-77142
35Monitor
Broken Access Control in extension "Industry Directory" (yellowpages2)
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
typo3 · extension "industry directory"Aug 25, 2026
CVE-2026-77143
35Monitor
Broken Access Control in extension "Forum" (pforum)
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
typo3 · extension "forum"Aug 25, 2026
CVE-2026-77144
28Monitor
Broken Access Control in extension "Events 2" (events2)
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
typo3 · extension "events 2"Aug 25, 2026
CVE-2026-77145
28Monitor
Broken Access Control in extension "Events 2" (events2)
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
typo3 · extension "events 2"Aug 25, 2026
CVE-2026-77146
33Monitor
Broken Access Control in extension "femanager" (femanager)
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
typo3 · extension "femanager"Aug 25, 2026
CVE-2026-14457
30Monitor
RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate
HighCVSS 7.5No exploitEPSS 1%
- pre-auth RCE
- Memory safety
- Denial of service
openssl · opensslAug 25, 2026
CVE-2026-18798
31Monitor
QUIC Server May Trigger Double Free When Processing INITIAL Packet
HighCVSS 7.5No exploitEPSS 1%
- pre-auth RCE
- Memory safety
- Denial of service
openssl · opensslAug 25, 2026
CVE-2026-54874
30Monitor
Excessive Memory Use Buffering DTLS Records for a Future Epoch
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
openssl · opensslAug 25, 2026
CVE-2026-57863
34Monitor
Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Path traversal
crater-invoice-inc · craterAug 25, 2026
CVE-2026-63072
30Monitor
Heap Buffer Overflow in CMS Key Unwrapping
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
openssl · opensslAug 25, 2026
CVE-2026-63073
39Monitor
Untrusted Sender DN Used as Format String in CMP Response Validation
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
openssl · opensslAug 25, 2026
CVE-2026-63075
30Monitor
QUIC ACK-only Packet Retention Can Cause Memory Exhaustion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
openssl · opensslAug 25, 2026
CVE-2026-63076
30Monitor
Invalid Pointer Dereference in CMP Server via Crafted protectionAlg
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Memory safety
- Denial of service
openssl · opensslAug 25, 2026
CVE-2026-75803
36Monitor
AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
openssl · opensslAug 25, 2026
CVE-2026-77998
40Plan
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – L
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
miniorange.com · saml sso free for joomla extension for joomlaAug 25, 2026
CVE-2026-55525
30Monitor
PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
mervinpraison · praisonaiAug 25, 2026
CVE-2026-12878
34Monitor
In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.
HighCVSS 8.6No exploitEPSS 0%
octopus · codefreshAug 25, 2026
CVE-2026-16231
32Monitor
hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- XSS
hbs project · hbsAug 25, 2026
CVE-2026-49050
35Monitor
Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
apache · dolphinschedulerAug 25, 2026
CVE-2026-75037
29Monitor
Polkit authentication bypass in LACT
HighCVSS 7.3No exploitEPSS 0%
- Auth bypass
ilya-zlobintsev · lactAug 25, 2026
CVE-2026-16286
39Monitor
File Upload in TRTEK Software's Software Repository Management
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- File upload
trtek technological products computer software hardware industry and trade limited company · software repository managementAug 25, 2026
CVE-2026-55526
34Monitor
PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
HighCVSS 8.5No exploitEPSS 0%
- SSRF
mervinpraison · praisonaiAug 25, 2026
CVE-2026-55527
28Monitor
PraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
mervinpraison · praisonaiAug 25, 2026
CVE-2026-55528
32Monitor
praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
mervinpraison · praisonaiAug 25, 2026