By publication date

Exploited and new serious CVEs: August 2026

5,861 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 59 of 59

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2026-51735No exploit	Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve recentCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 31, 2026
36Monitor	CVE-2026-51736No exploit	Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system lCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51738No exploit	Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
39Monitor	CVE-2026-51740No exploit	Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
39Monitor	CVE-2026-38577Proof of concept	Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.CWE-798 Pre-auth Hard-coded credentials	Critical9.8	—	0.4%	Aug 31, 2026
30Monitor	CVE-2026-54598No exploit	Missing Authentication for Critical Function in wallosellite · wallos · CWE-306 Pre-auth Auth bypass	High7.5	—	0.4%	Aug 31, 2026
30Monitor	CVE-2026-54599No exploit	Wallos: OIDC state parameter never validated — login CSRF / account takeoverellite · wallos · CWE-352 Pre-auth CSRF	High7.5	—	0.2%	Aug 31, 2026
32Monitor	CVE-2026-54600No exploit	Wallos: Unauthenticated database replacement via import endpoint on fresh installellite · wallos · CWE-287 Pre-auth Auth bypass	High8.2	—	0.5%	Aug 31, 2026
32Monitor	CVE-2026-61638No exploit	Wallos: SSRF via Test Email Notification - unvalidated SMTP host/portellite · wallos · CWE-918 Pre-auth SSRF	High8.2	—	0.4%	Aug 31, 2026
34Monitor	CVE-2026-61639No exploit	Wallos: Zip Slip path traversal in database restore writes files to webrootellite · wallos · CWE-22 Path traversal	High8.5	—	0.5%	Aug 31, 2026
34Monitor	CVE-2026-61640No exploit	Wallos: SSRF via OIDC Token/UserInfo URL Configurationellite · wallos · CWE-918 SSRF	High8.5	—	0.5%	Aug 31, 2026
32Monitor	CVE-2026-61641No exploit	Wallos: OIDC account takeover via email-based account linking without `email_verified` checkellite · wallos · CWE-287 Pre-auth Auth bypass	High8.1	—	0.5%	Aug 31, 2026
30Monitor	CVE-2026-17615No exploit	Resteasy-core: resteasy sourceprovider remote unauthenticated file readred hat · red hat build of keycloak 26.6 · CWE-611 Pre-auth XXE	High7.5	—	0.8%	Aug 31, 2026
28Monitor	CVE-2026-71415No exploit	Kirby: File upload permissions are not checked during processing of chunk datagetkirby · kirby · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Aug 31, 2026
32Monitor	CVE-2026-75458No exploit	The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escaCWE-639 Broken access control (IDOR)	High8.1	—	0.3%	Aug 31, 2026
32Monitor	CVE-2026-75594No exploit	Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handlinggetkirby · kirby · CWE-22 Pre-auth Path traversal	High8.2	—	0.7%	Aug 31, 2026
30Monitor	CVE-2026-79407No exploit	A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value usedCWE-22 Pre-auth Path traversal	High7.5	—	0.5%	Aug 31, 2026
40Plan	CVE-2026-79408No exploit	An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.CWE-78 pre-auth RCE Command injection	Critical9.8	—	2.0%	Aug 31, 2026
21Monitor	CVE-2026-79483Proof of concept	FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint.CWE-943 Pre-auth SQL injection	Medium5.3	—	0.3%	Aug 31, 2026
34Monitor	CVE-2026-81287No exploit	WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerabilitysyed balkhi · charitable · CWE-89 SQL injection	High8.5	—	0.3%	Aug 31, 2026
28Monitor	CVE-2026-81290No exploit	WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerabilityicegram · email subscribers & newsletters · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 31, 2026
28Monitor	CVE-2026-81291No exploit	WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerabilityuncode · uncode · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 31, 2026
37Monitor	CVE-2026-81293No exploit	WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerabilitypassionate programmer peter · wp data access · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 31, 2026
30Monitor	CVE-2026-81296No exploit	WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerabilitywp manage ninja · fluent forms pro add on pack · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 31, 2026
30Monitor	CVE-2026-81297No exploit	WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerabilitywp manage ninja · fluent forms pro add on pack · CWE-266	High7.5	—	0.3%	Aug 31, 2026
28Monitor	CVE-2026-81298No exploit	WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilityvarunvairavanlc · leadconnector · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 31, 2026
37Monitor	CVE-2026-81756No exploit	WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerabilityautorius e-goi · smart marketing sms and newsletters forms · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 31, 2026
37Monitor	CVE-2026-81763No exploit	WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerabilityウェブ屋のさとーさん · throws spam away · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 31, 2026
28Monitor	CVE-2026-81764No exploit	WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerabilityacato · email essentials · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 31, 2026
28Monitor	CVE-2026-81765No exploit	WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerabilitytailored media · tailored tools · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 31, 2026
28Monitor	CVE-2026-81768No exploit	WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerabilityhighwarden · super store finder · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 31, 2026
40Plan	CVE-2026-81779No exploit	WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerabilitysilk themes · newspapers x · CWE-1284 Pre-auth	Critical10.0	—	0.5%	Aug 31, 2026
40Plan	CVE-2026-81780Proof of concept	WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerabilityhashthemes · hash form · CWE-434 Pre-auth File upload	Critical10.0	—	0.5%	Aug 31, 2026
34Monitor	CVE-2026-81889No exploit	elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallbackstudio-42 · elfinder · CWE-918 Pre-auth SSRF	High8.6	—	0.5%	Aug 31, 2026
32Monitor	CVE-2026-81891No exploit	elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)studio-42 · elfinder · CWE-434 pre-auth RCE File upload	High8.1	—	0.9%	Aug 31, 2026
32Monitor	CVE-2026-81892No exploit	EasyAdmin custom-action dispatcher bypasses access_control on other routeseasycorp · easyadminbundle · CWE-639 Broken access control (IDOR)	High8.1	—	0.4%	Aug 31, 2026
28Monitor	CVE-2026-82221Proof of concept	WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerabilitymetagauss · registrationmagic · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 31, 2026
28Monitor	CVE-2026-82224No exploit	WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerabilityiova.mihai · slicewp · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 31, 2026
29Monitor	CVE-2026-82225No exploit	WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerabilitymetagauss · registrationmagic · CWE-288 Pre-auth Auth bypass	High7.4	—	0.3%	Aug 31, 2026
39Monitor	CVE-2026-82226Proof of concept	WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerabilitytickera · tickera · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Aug 31, 2026
32Monitor	CVE-2026-82228No exploit	WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerabilitysiteground · siteground security · CWE-290 Pre-auth Auth bypass	High8.1	—	0.3%	Aug 31, 2026
28Monitor	CVE-2026-82229No exploit	WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerabilityminiorange · wordpress social login and register · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 31, 2026
28Monitor	CVE-2026-82346No exploit	HP ImageDiags - Potential Escalation of Privilegehp inc · hp imagediags · CWE-379 Local privilege escalation	High7.0	—	0.1%	Aug 31, 2026
28Monitor	CVE-2026-82392No exploit	pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraphpnpm · pnpm · CWE-22 Pre-auth Path traversal	High7.1	—	0.6%	Aug 31, 2026
34Monitor	CVE-2026-82908No exploit	MSI Dragon Center MMIO Write Path NTIOLib_X64.sys MmioWritePath integer overflowmsi · dragon center · CWE-189	High8.5	—	0.1%	Aug 31, 2026
32Monitor	CVE-2026-77348No exploit	Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`ellite · wallos · CWE-441 Pre-auth SSRF	High8.2	—	0.4%	Aug 31, 2026
30Monitor	CVE-2026-82397No exploit	Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event looptornadoweb · tornado · CWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Aug 31, 2026
34Monitor	CVE-2026-82882No exploit	Devtron through 2.2.0 Missing Authorization via webhook API token endpointdevtron-labs · devtron · CWE-862 Broken access control (IDOR)	High8.7	—	0.5%	Aug 31, 2026
34Monitor	CVE-2026-82954No exploit	Dokploy Settings application.ts writeTraefikConfigInPath path traversalCWE-22 Path traversal	High8.6	—	0.9%	Aug 31, 2026
22Monitor	CVE-2026-82957Proof of concept	hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgeryhyperledger-firefly · firefly · CWE-918 Pre-auth SSRF	Medium5.5	—	0.5%	Aug 31, 2026
38Monitor	CVE-2026-82971No exploit	QVidium Opera11 CGI Script net_tr.cgi command injectionqvidium · opera11 · CWE-74 pre-auth RCE Command injection	Critical9.3	—	3.2%	Aug 31, 2026
35Monitor	CVE-2026-83524No exploit	RedPort Optimizer wXa-223 System Clock datetime.php exec command injectionredport · optimizer wxa-203 · CWE-74 RCE Command injection	High8.6	—	3.2%	Aug 31, 2026
28Monitor	CVE-2026-13732No exploit	Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elfred hat · red hat enterprise linux 10 · CWE-787 Memory safety	High7.0	—	0.1%	Aug 31, 2026
31Monitor	CVE-2026-19820No exploit	Backblaze Client for Windows Improper Link Resolution Vulnerabilitybackblaze · backblaze client · CWE-59 Pre-auth	High7.8	—	0.4%	Aug 31, 2026
35Monitor	CVE-2026-83596No exploit	Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeaturewebkit · webkit · CWE-120 Pre-auth Memory safety	High8.8	—	0.5%	Aug 31, 2026
30Monitor	CVE-2026-82393No exploit	pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on installpnpm · pnpm · CWE-22 Pre-auth Path traversal	High7.5	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-67394No exploit	A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions webpros · plesk · CWE-78 RCE Command injection	Critical9.0	—	1.2%	Aug 31, 2026
34Monitor	CVE-2026-74837No exploit	Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatterash-project · ash_typescript · CWE-770 Pre-auth Denial of service	High8.7	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-75865Proof of concept	WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpointwplegalpages · wplp cookie consent – cookie banner & consent management for gdpr, ccpa & google consent mode · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.9%	Aug 31, 2026
32Monitor	CVE-2026-77856No exploit	Unbounded atom creation from typed struct field names in AshTypescript field selectorash-project · ash_typescript · CWE-770 Pre-auth Denial of service	High8.2	—	0.5%	Aug 31, 2026
32Monitor	CVE-2026-82730No exploit	Authorization-redacted field values disclosed through AshTypescript result normalizationash-project · ash_typescript · CWE-863 Pre-auth Broken access control (IDOR)	High8.2	—	0.4%	Aug 31, 2026

CVE-2026-51735
30Monitor
Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve recent
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51736
36Monitor
Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system l
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51738
39Monitor
Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51740
39Monitor
Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate crit
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-38577
39Monitor
Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Hard-coded credentials
Aug 31, 2026
CVE-2026-54598
30Monitor
Missing Authentication for Critical Function in wallos
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
ellite · wallosAug 31, 2026
CVE-2026-54599
30Monitor
Wallos: OIDC state parameter never validated — login CSRF / account takeover
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- CSRF
ellite · wallosAug 31, 2026
CVE-2026-54600
32Monitor
Wallos: Unauthenticated database replacement via import endpoint on fresh install
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
ellite · wallosAug 31, 2026
CVE-2026-61638
32Monitor
Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- SSRF
ellite · wallosAug 31, 2026
CVE-2026-61639
34Monitor
Wallos: Zip Slip path traversal in database restore writes files to webroot
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
ellite · wallosAug 31, 2026
CVE-2026-61640
34Monitor
Wallos: SSRF via OIDC Token/UserInfo URL Configuration
HighCVSS 8.5No exploitEPSS 0%
- SSRF
ellite · wallosAug 31, 2026
CVE-2026-61641
32Monitor
Wallos: OIDC account takeover via email-based account linking without `email_verified` check
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
ellite · wallosAug 31, 2026
CVE-2026-17615
30Monitor
Resteasy-core: resteasy sourceprovider remote unauthenticated file read
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XXE
red hat · red hat build of keycloak 26.6Aug 31, 2026
CVE-2026-71415
28Monitor
Kirby: File upload permissions are not checked during processing of chunk data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
getkirby · kirbyAug 31, 2026
CVE-2026-75458
32Monitor
The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege esca
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-75594
32Monitor
Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
getkirby · kirbyAug 31, 2026
CVE-2026-79407
30Monitor
A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
Aug 31, 2026
CVE-2026-79408
40Plan
An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- Command injection
Aug 31, 2026
CVE-2026-79483
21Monitor
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint.
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
Aug 31, 2026
CVE-2026-81287
34Monitor
WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
syed balkhi · charitableAug 31, 2026
CVE-2026-81290
28Monitor
WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
icegram · email subscribers & newslettersAug 31, 2026
CVE-2026-81291
28Monitor
WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
uncode · uncodeAug 31, 2026
CVE-2026-81293
37Monitor
WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
passionate programmer peter · wp data accessAug 31, 2026
CVE-2026-81296
30Monitor
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wp manage ninja · fluent forms pro add on packAug 31, 2026
CVE-2026-81297
30Monitor
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability
HighCVSS 7.5No exploitEPSS 0%
wp manage ninja · fluent forms pro add on packAug 31, 2026
CVE-2026-81298
28Monitor
WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
varunvairavanlc · leadconnectorAug 31, 2026
CVE-2026-81756
37Monitor
WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
autorius e-goi · smart marketing sms and newsletters formsAug 31, 2026
CVE-2026-81763
37Monitor
WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
ウェブ屋のさとーさん · throws spam awayAug 31, 2026
CVE-2026-81764
28Monitor
WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
acato · email essentialsAug 31, 2026
CVE-2026-81765
28Monitor
WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
tailored media · tailored toolsAug 31, 2026
CVE-2026-81768
28Monitor
WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
highwarden · super store finderAug 31, 2026
CVE-2026-81779
40Plan
WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
silk themes · newspapers xAug 31, 2026
CVE-2026-81780
40Plan
WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
CriticalCVSS 10.0Proof of conceptEPSS 0%
- Pre-auth
- File upload
hashthemes · hash formAug 31, 2026
CVE-2026-81889
34Monitor
elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SSRF
studio-42 · elfinderAug 31, 2026
CVE-2026-81891
32Monitor
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- File upload
studio-42 · elfinderAug 31, 2026
CVE-2026-81892
32Monitor
EasyAdmin custom-action dispatcher bypasses access_control on other routes
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
easycorp · easyadminbundleAug 31, 2026
CVE-2026-82221
28Monitor
WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
metagauss · registrationmagicAug 31, 2026
CVE-2026-82224
28Monitor
WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
iova.mihai · slicewpAug 31, 2026
CVE-2026-82225
29Monitor
WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
metagauss · registrationmagicAug 31, 2026
CVE-2026-82226
39Monitor
WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Deserialization
tickera · tickeraAug 31, 2026
CVE-2026-82228
32Monitor
WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
siteground · siteground securityAug 31, 2026
CVE-2026-82229
28Monitor
WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
miniorange · wordpress social login and registerAug 31, 2026
CVE-2026-82346
28Monitor
HP ImageDiags - Potential Escalation of Privilege
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
hp inc · hp imagediagsAug 31, 2026
CVE-2026-82392
28Monitor
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Path traversal
pnpm · pnpmAug 31, 2026
CVE-2026-82908
34Monitor
MSI Dragon Center MMIO Write Path NTIOLib_X64.sys MmioWritePath integer overflow
HighCVSS 8.5No exploitEPSS 0%
msi · dragon centerAug 31, 2026
CVE-2026-77348
32Monitor
Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- SSRF
ellite · wallosAug 31, 2026
CVE-2026-82397
30Monitor
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
tornadoweb · tornadoAug 31, 2026
CVE-2026-82882
34Monitor
Devtron through 2.2.0 Missing Authorization via webhook API token endpoint
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
devtron-labs · devtronAug 31, 2026
CVE-2026-82954
34Monitor
Dokploy Settings application.ts writeTraefikConfigInPath path traversal
HighCVSS 8.6No exploitEPSS 0%
- Path traversal
Aug 31, 2026
CVE-2026-82957
22Monitor
hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery
MediumCVSS 5.5Proof of conceptEPSS 0%
- Pre-auth
- SSRF
hyperledger-firefly · fireflyAug 31, 2026
CVE-2026-82971
38Monitor
QVidium Opera11 CGI Script net_tr.cgi command injection
CriticalCVSS 9.3No exploitEPSS 3%
- pre-auth RCE
- Command injection
qvidium · opera11Aug 31, 2026
CVE-2026-83524
35Monitor
RedPort Optimizer wXa-223 System Clock datetime.php exec command injection
HighCVSS 8.6No exploitEPSS 3%
- RCE
- Command injection
redport · optimizer wxa-203Aug 31, 2026
CVE-2026-13732
28Monitor
Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf
HighCVSS 7.0No exploitEPSS 0%
- Memory safety
red hat · red hat enterprise linux 10Aug 31, 2026
CVE-2026-19820
31Monitor
Backblaze Client for Windows Improper Link Resolution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- Pre-auth
backblaze · backblaze clientAug 31, 2026
CVE-2026-83596
35Monitor
Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
webkit · webkitAug 31, 2026
CVE-2026-82393
30Monitor
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
pnpm · pnpmAug 31, 2026
CVE-2026-67394
36Monitor
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions
CriticalCVSS 9.0No exploitEPSS 1%
- RCE
- Command injection
webpros · pleskAug 31, 2026
CVE-2026-74837
34Monitor
Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
ash-project · ash_typescriptAug 31, 2026
CVE-2026-75865
39Monitor
WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- File upload
wplegalpages · wplp cookie consent – cookie banner & consent management for gdpr, ccpa & google consent modeAug 31, 2026
CVE-2026-77856
32Monitor
Unbounded atom creation from typed struct field names in AshTypescript field selector
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
ash-project · ash_typescriptAug 31, 2026
CVE-2026-82730
32Monitor
Authorization-redacted field values disclosed through AshTypescript result normalization
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
ash-project · ash_typescriptAug 31, 2026