By publication date

Exploited and new serious CVEs: August 2026

7,150 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 68 of 72

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
32Monitor	CVE-2026-80615No exploit	net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclonelinux · linux Pre-auth	High8.2	—	0.4%	Aug 28, 2026
31Monitor	CVE-2026-80622No exploit	char: tlclk: fix use-after-free in tlclk_cleanup()linux · linux Race condition	High7.8	—	0.1%	Aug 28, 2026
31Monitor	CVE-2026-80628No exploit	ALSA: seq: oss: Serialize readq reset state with q->locklinux · linux	High7.8	—	0.1%	Aug 28, 2026
39Monitor	CVE-2026-80630No exploit	net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlenlinux · linux Pre-auth	Critical9.8	—	0.7%	Aug 28, 2026
30Monitor	CVE-2026-80631No exploit	btrfs: lzo: reject compressed segment that overflows the compressed inputlinux · linux Pre-auth Denial of service	High7.5	—	0.4%	Aug 28, 2026
39Monitor	CVE-2026-80634No exploit	netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untaglinux · linux Pre-auth	Critical9.8	—	0.6%	Aug 28, 2026
30Monitor	CVE-2026-80637No exploit	netfilter: synproxy: fix unaligned memory access in timestamp adjustmentlinux · linux Pre-auth Denial of service	High7.5	—	0.6%	Aug 28, 2026
30Monitor	CVE-2026-80646No exploit	ipv6: guard against possible NULL deref in __in6_dev_stats_get()linux · linux Pre-auth Denial of service	High7.5	—	0.7%	Aug 28, 2026
33Monitor	CVE-2026-80653No exploit	scsi: hisi_sas: Add slave_destroy interface for v3 hwlinux · linux	High8.4	—	0.1%	Aug 28, 2026
28Monitor	CVE-2026-80662No exploit	cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability sizelinux · linux	High7.1	—	0.1%	Aug 28, 2026
28Monitor	CVE-2026-80663No exploit	tools/power/x86/intel-speed-select: Harden daemon pidfile openlinux · linux Local privilege escalation	High7.1	—	0.1%	Aug 28, 2026
29Monitor	CVE-2026-80664No exploit	netfilter: xt_nat: reject unsupported target familieslinux · linux	High7.3	—	0.1%	Aug 28, 2026
39Monitor	CVE-2026-80668No exploit	netfilter: nf_conntrack_expect: use conntrack GC to reap expectationslinux · linux Pre-auth	Critical9.8	—	0.6%	Aug 28, 2026
31Monitor	CVE-2026-80677No exploit	driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()linux · linux	High7.8	—	0.1%	Aug 28, 2026
33Monitor	CVE-2026-80678No exploit	i2c: imx: Fix slave registration race and error handlinglinux · linux	High8.4	—	0.1%	Aug 28, 2026
39Monitor	CVE-2026-80681No exploit	vxlan: re-fetch eth header after route_shortcircuit()linux · linux Pre-auth	Critical9.8	—	0.5%	Aug 28, 2026
35Monitor	CVE-2026-80683No exploit	Bluetooth: SCO: give the socket its own sco_conn referencelinux · linux Pre-auth	High8.8	—	0.3%	Aug 28, 2026
37Monitor	CVE-2026-80684No exploit	KVM: s390: pci: Fix NULL dereference on AIBV allocation failurelinux · linux	Critical9.3	—	0.1%	Aug 28, 2026
30Monitor	CVE-2026-80691No exploit	scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASElinux · linux Pre-auth Denial of service	High7.5	—	0.4%	Aug 28, 2026
35Monitor	CVE-2026-80692No exploit	Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbackslinux · linux Pre-auth	High8.8	—	0.3%	Aug 28, 2026
37Monitor	CVE-2026-80693No exploit	idpf: bound interrupt-vector register fill to the allocated arraylinux · linux	Critical9.3	—	0.1%	Aug 28, 2026
39Monitor	CVE-2026-80694No exploit	net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controllerlinux · linux Pre-auth	Critical9.8	—	0.4%	Aug 28, 2026
31Monitor	CVE-2026-80700No exploit	drm/vmwgfx: validate external BO copy bounds for both stride pathslinux · linux	High7.8	—	0.1%	Aug 28, 2026
31Monitor	CVE-2026-80702No exploit	drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as sizelinux · linux	High7.8	—	0.1%	Aug 28, 2026
31Monitor	CVE-2026-80706No exploit	can: softing: fw_parse(): validate firmware record spanslinux · linux	High7.8	—	0.1%	Aug 28, 2026
30Monitor	CVE-2026-80707No exploit	can: j1939: transport: j1939_session_fresh_new(): initialize receive bufferlinux · linux Pre-auth	High7.5	—	0.3%	Aug 28, 2026
31Monitor	CVE-2026-80709No exploit	s390/zcrypt: Fix wrong domain value verification with EP11 CPRBslinux · linux	High7.8	—	0.1%	Aug 28, 2026
31Monitor	CVE-2026-80710No exploit	s390/dasd: Fix undersized format-check bufferlinux · linux	High7.8	—	0.1%	Aug 28, 2026
39Monitor	CVE-2026-80714No exploit	ipvs: do not propagate one-packet flag to synced connslinux · linux Pre-auth	Critical9.8	—	0.4%	Aug 28, 2026
31Monitor	CVE-2026-80716No exploit	ALSA: pcm: wake linked drain waiters on unlinklinux · linux	High7.8	—	0.1%	Aug 28, 2026
30Monitor	CVE-2026-80717No exploit	sctp: validate Adaptation Indication parameter lengthlinux · linux Pre-auth	High7.5	—	0.3%	Aug 28, 2026
35Monitor	CVE-2026-80721No exploit	Bluetooth: ISO: ensure no dangling hcon references in iso_connlinux · linux Pre-auth	High8.8	—	0.3%	Aug 28, 2026
35Monitor	CVE-2026-80722No exploit	wifi: mac80211: validate individual TWT params before driver setuplinux · linux Pre-auth	High8.8	—	0.2%	Aug 28, 2026
33Monitor	CVE-2026-80723No exploit	of: reserved_mem: prevent OOB when too many dynamic regions are definedlinux · linux	High8.4	—	0.1%	Aug 28, 2026
35Monitor	CVE-2026-80724Proof of concept	ptp: vmclock: prevent read-only mappings from becoming writablelinux · linux	High8.8	—	0.1%	Aug 28, 2026
34Monitor	CVE-2026-82239No exploit	Budibase before 3.41.3 Authorization Bypass via datasources/querybudibase · server · CWE-862 Broken access control (IDOR)	High8.6	—	0.3%	Aug 28, 2026
34Monitor	CVE-2026-82240No exploit	Budibase before 3.41.3 Privilege Escalation via User Update APIbudibase · server · CWE-862 Broken access control (IDOR)	High8.6	—	0.3%	Aug 28, 2026
28Monitor	CVE-2026-82241No exploit	Budibase backend-core SSRF via incomplete default blacklistbudibase · server · CWE-918 SSRF	High7.1	—	0.3%	Aug 28, 2026
33Monitor	CVE-2026-82242No exploit	Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorizationbudibase · server · CWE-862 Broken access control (IDOR)	High8.3	—	0.3%	Aug 28, 2026
33Monitor	CVE-2026-82243No exploit	Budibase Server before 3.41.3 SSRF with Credential Leakagebudibase · server · CWE-918 SSRF	High8.3	—	0.3%	Aug 28, 2026
37Monitor	CVE-2026-82244No exploit	Budibase before 3.41.3 Remote Code Execution via Plugin eval()budibase · server · CWE-94 RCE	Critical9.4	—	0.8%	Aug 28, 2026
28Monitor	CVE-2026-82245No exploit	Budibase before 3.41.3 Missing Authorization License Managementbudibase · server · CWE-862 Broken access control (IDOR)	High7.2	—	0.4%	Aug 28, 2026
28Monitor	CVE-2026-82246No exploit	Budibase Server before 3.41.3 SSRF via Query Importbudibase · server · CWE-918 SSRF	High7.1	—	0.2%	Aug 28, 2026
30Monitor	CVE-2026-82255No exploit	gitoxide 0.25.4 HTTP Credential Leak via Redirectgitoxidelabs · gitoxide · CWE-522 Pre-auth Info leak	High7.6	—	0.3%	Aug 28, 2026
34Monitor	CVE-2026-82259No exploit	SvelteKit 2.49.0 before 2.53.3 Denial of Service via formsvelte · sveltekit · CWE-502 Pre-auth Deserialization	High8.7	—	0.5%	Aug 28, 2026
34Monitor	CVE-2026-82260No exploit	SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserializationsvelte · sveltekit · CWE-400 Pre-auth Deserialization Denial of service	High8.7	—	0.4%	Aug 28, 2026
34Monitor	CVE-2026-82261No exploit	SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserializationsvelte · sveltekit · CWE-400 Pre-auth Deserialization Denial of service	High8.7	—	0.4%	Aug 28, 2026
35Monitor	CVE-2026-13761No exploit	Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial pegasystems · pega infinity · CWE-606 Pre-auth	High8.8	—	0.4%	Aug 28, 2026
34Monitor	CVE-2026-19412No exploit	Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Routercp plus · cp-xr-de21-s router · CWE-798 Pre-auth Hard-coded credentials	High8.7	—	0.3%	Aug 28, 2026
39Monitor	CVE-2026-37236No exploit	grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control.CWE-639 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.4%	Aug 28, 2026
30Monitor	CVE-2026-37736No exploit	An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a CWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Aug 28, 2026
40Plan	CVE-2026-37751No exploit	An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attacCWE-78 pre-auth RCE Command injection	Critical9.8	—	2.9%	Aug 28, 2026
30Monitor	CVE-2026-38636No exploit	An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafteCWE-400 Pre-auth Denial of service	High7.5	—	0.6%	Aug 28, 2026
30Monitor	CVE-2026-38638No exploit	An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafteCWE-400 Pre-auth Denial of service	High7.5	—	0.6%	Aug 28, 2026
33Monitor	CVE-2026-50979Proof of concept	A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attaCWE-77 RCE Command injection	High8.1	—	1.9%	Aug 28, 2026
30Monitor	CVE-2026-56854No exploit	Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/sshgolang.org/x/crypto · golang.org/x/crypto/ssh · CWE-863 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
28Monitor	CVE-2026-5934No exploit	WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpointwp media · wp rocket · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Aug 28, 2026
28Monitor	CVE-2026-6176No exploit	Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Formivole · customer reviews for woocommerce · CWE-79 Pre-auth XSS	High7.2	—	0.4%	Aug 28, 2026
30Monitor	CVE-2026-81285No exploit	WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerabilitywpmu dev · smush image compression and optimization · CWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Aug 28, 2026
90Now	CVE-2026-81578Weaponized	PaperCut MF/NG: Authentication Bypasspapercut · papercut mf · CWE-305 Pre-auth Auth bypass	High8.8	KEV	84.7%	Aug 28, 2026
28Monitor	CVE-2026-81757No exploit	WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerabilityrank math seo · rank math seo · CWE-502 RCE Deserialization	High7.2	—	0.7%	Aug 28, 2026
28Monitor	CVE-2026-81760No exploit	WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerabilitycrocoblock · jetengine · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 28, 2026
30Monitor	CVE-2026-81767No exploit	WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerabilityyalla ya! · simple payment · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 28, 2026
86Now	CVE-2026-82078Weaponized	PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connectorpapercut · papercut mf · CWE-470	Critical9.4	KEV	63.0%	Aug 28, 2026
34Monitor	CVE-2026-82227No exploit	WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerabilityvillatheme · wpbulky · CWE-89 SQL injection	High8.5	—	0.3%	Aug 28, 2026
30Monitor	CVE-2026-37237No exploit	vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion.vllm · vllm · CWE-400 Pre-auth Denial of service	High7.5	—	0.7%	Aug 28, 2026
24Monitor	CVE-2026-50980Proof of concept	Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to executeCWE-79 pre-auth RCE XSS	Medium6.1	—	0.4%	Aug 28, 2026
26Monitor	CVE-2026-51376Proof of concept	An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesCWE-444 Pre-auth Denial of service	Medium6.5	—	0.3%	Aug 28, 2026
39Monitor	CVE-2026-51611No exploit	Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrariCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 28, 2026
30Monitor	CVE-2026-51615No exploit	Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addreCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
30Monitor	CVE-2026-51616No exploit	Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
30Monitor	CVE-2026-51617No exploit	Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain senCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 28, 2026
30Monitor	CVE-2026-51618No exploit	Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain setup CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
30Monitor	CVE-2026-51619No exploit	Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain onlCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
30Monitor	CVE-2026-51620No exploit	Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain netwoCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
30Monitor	CVE-2026-51621No exploit	Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitivCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
36Monitor	CVE-2026-51622No exploit	Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN confiCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 28, 2026
30Monitor	CVE-2026-51623No exploit	Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
30Monitor	CVE-2026-51624No exploit	Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain aCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
30Monitor	CVE-2026-51625No exploit	Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.5%	Aug 28, 2026
36Monitor	CVE-2026-51626No exploit	Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS cCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 28, 2026
30Monitor	CVE-2026-51627No exploit	Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IPTV andCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
36Monitor	CVE-2026-51628No exploit	Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to geneCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 28, 2026
36Monitor	CVE-2026-51636No exploit	Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 28, 2026
30Monitor	CVE-2026-51641No exploit	Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
30Monitor	CVE-2026-51642No exploit	Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtainCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
36Monitor	CVE-2026-51643No exploit	Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP confiCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 28, 2026
30Monitor	CVE-2026-51644No exploit	Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloudCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
39Monitor	CVE-2026-51645No exploit	Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 28, 2026
36Monitor	CVE-2026-51646No exploit	Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain paCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 28, 2026
30Monitor	CVE-2026-51647No exploit	Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud reCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
30Monitor	CVE-2026-51648No exploit	Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN infoCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
36Monitor	CVE-2026-51649No exploit	Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain diaCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 28, 2026
30Monitor	CVE-2026-51650No exploit	Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain remoteCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
36Monitor	CVE-2026-51657No exploit	Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain syslogCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 28, 2026
30Monitor	CVE-2026-51658No exploit	Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ confiCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
30Monitor	CVE-2026-51659No exploit	Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 28, 2026
36Monitor	CVE-2026-51660No exploit	Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtaiCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 28, 2026
40Plan	CVE-2026-54745No exploit	Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=truekubeflow · pipelines · CWE-284 Pre-auth SSRF Broken access control (IDOR)	Critical10.0	—	0.6%	Aug 28, 2026
38Monitor	CVE-2026-54754No exploit	Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)klever-io · klever-go · CWE-191 Memory safety	Critical9.6	—	0.4%	Aug 28, 2026

CVE-2026-80615
32Monitor
net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
linux · linuxAug 28, 2026
CVE-2026-80622
31Monitor
char: tlclk: fix use-after-free in tlclk_cleanup()
HighCVSS 7.8No exploitEPSS 0%
- Race condition
linux · linuxAug 28, 2026
CVE-2026-80628
31Monitor
ALSA: seq: oss: Serialize readq reset state with q->lock
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80630
39Monitor
net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxAug 28, 2026
CVE-2026-80631
30Monitor
btrfs: lzo: reject compressed segment that overflows the compressed input
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxAug 28, 2026
CVE-2026-80634
39Monitor
netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxAug 28, 2026
CVE-2026-80637
30Monitor
netfilter: synproxy: fix unaligned memory access in timestamp adjustment
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxAug 28, 2026
CVE-2026-80646
30Monitor
ipv6: guard against possible NULL deref in __in6_dev_stats_get()
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxAug 28, 2026
CVE-2026-80653
33Monitor
scsi: hisi_sas: Add slave_destroy interface for v3 hw
HighCVSS 8.4No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80662
28Monitor
cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
HighCVSS 7.1No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80663
28Monitor
tools/power/x86/intel-speed-select: Harden daemon pidfile open
HighCVSS 7.1No exploitEPSS 0%
- Local privilege escalation
linux · linuxAug 28, 2026
CVE-2026-80664
29Monitor
netfilter: xt_nat: reject unsupported target families
HighCVSS 7.3No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80668
39Monitor
netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxAug 28, 2026
CVE-2026-80677
31Monitor
driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80678
33Monitor
i2c: imx: Fix slave registration race and error handling
HighCVSS 8.4No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80681
39Monitor
vxlan: re-fetch eth header after route_shortcircuit()
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxAug 28, 2026
CVE-2026-80683
35Monitor
Bluetooth: SCO: give the socket its own sco_conn reference
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxAug 28, 2026
CVE-2026-80684
37Monitor
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
CriticalCVSS 9.3No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80691
30Monitor
scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxAug 28, 2026
CVE-2026-80692
35Monitor
Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxAug 28, 2026
CVE-2026-80693
37Monitor
idpf: bound interrupt-vector register fill to the allocated array
CriticalCVSS 9.3No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80694
39Monitor
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxAug 28, 2026
CVE-2026-80700
31Monitor
drm/vmwgfx: validate external BO copy bounds for both stride paths
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80702
31Monitor
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80706
31Monitor
can: softing: fw_parse(): validate firmware record spans
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80707
30Monitor
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxAug 28, 2026
CVE-2026-80709
31Monitor
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80710
31Monitor
s390/dasd: Fix undersized format-check buffer
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80714
39Monitor
ipvs: do not propagate one-packet flag to synced conns
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxAug 28, 2026
CVE-2026-80716
31Monitor
ALSA: pcm: wake linked drain waiters on unlink
HighCVSS 7.8No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80717
30Monitor
sctp: validate Adaptation Indication parameter length
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxAug 28, 2026
CVE-2026-80721
35Monitor
Bluetooth: ISO: ensure no dangling hcon references in iso_conn
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxAug 28, 2026
CVE-2026-80722
35Monitor
wifi: mac80211: validate individual TWT params before driver setup
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxAug 28, 2026
CVE-2026-80723
33Monitor
of: reserved_mem: prevent OOB when too many dynamic regions are defined
HighCVSS 8.4No exploitEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-80724
35Monitor
ptp: vmclock: prevent read-only mappings from becoming writable
HighCVSS 8.8Proof of conceptEPSS 0%
linux · linuxAug 28, 2026
CVE-2026-82239
34Monitor
Budibase before 3.41.3 Authorization Bypass via datasources/query
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
budibase · serverAug 28, 2026
CVE-2026-82240
34Monitor
Budibase before 3.41.3 Privilege Escalation via User Update API
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
budibase · serverAug 28, 2026
CVE-2026-82241
28Monitor
Budibase backend-core SSRF via incomplete default blacklist
HighCVSS 7.1No exploitEPSS 0%
- SSRF
budibase · serverAug 28, 2026
CVE-2026-82242
33Monitor
Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
budibase · serverAug 28, 2026
CVE-2026-82243
33Monitor
Budibase Server before 3.41.3 SSRF with Credential Leakage
HighCVSS 8.3No exploitEPSS 0%
- SSRF
budibase · serverAug 28, 2026
CVE-2026-82244
37Monitor
Budibase before 3.41.3 Remote Code Execution via Plugin eval()
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
budibase · serverAug 28, 2026
CVE-2026-82245
28Monitor
Budibase before 3.41.3 Missing Authorization License Management
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
budibase · serverAug 28, 2026
CVE-2026-82246
28Monitor
Budibase Server before 3.41.3 SSRF via Query Import
HighCVSS 7.1No exploitEPSS 0%
- SSRF
budibase · serverAug 28, 2026
CVE-2026-82255
30Monitor
gitoxide 0.25.4 HTTP Credential Leak via Redirect
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Info leak
gitoxidelabs · gitoxideAug 28, 2026
CVE-2026-82259
34Monitor
SvelteKit 2.49.0 before 2.53.3 Denial of Service via form
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Deserialization
svelte · sveltekitAug 28, 2026
CVE-2026-82260
34Monitor
SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Deserialization
- Denial of service
svelte · sveltekitAug 28, 2026
CVE-2026-82261
34Monitor
SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Deserialization
- Denial of service
svelte · sveltekitAug 28, 2026
CVE-2026-13761
35Monitor
Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
pegasystems · pega infinityAug 28, 2026
CVE-2026-19412
34Monitor
Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
cp plus · cp-xr-de21-s routerAug 28, 2026
CVE-2026-37236
39Monitor
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-37736
30Monitor
An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Aug 28, 2026
CVE-2026-37751
40Plan
An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attac
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- Command injection
Aug 28, 2026
CVE-2026-38636
30Monitor
An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafte
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Aug 28, 2026
CVE-2026-38638
30Monitor
An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafte
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Aug 28, 2026
CVE-2026-50979
33Monitor
A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated atta
HighCVSS 8.1Proof of conceptEPSS 1%
- RCE
- Command injection
Aug 28, 2026
CVE-2026-56854
30Monitor
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
golang.org/x/crypto · golang.org/x/crypto/sshAug 28, 2026
CVE-2026-5934
28Monitor
WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wp media · wp rocketAug 28, 2026
CVE-2026-6176
28Monitor
Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
ivole · customer reviews for woocommerceAug 28, 2026
CVE-2026-81285
30Monitor
WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
wpmu dev · smush image compression and optimizationAug 28, 2026
CVE-2026-81578
90Now
PaperCut MF/NG: Authentication Bypass
HighCVSS 8.8KEVWeaponizedEPSS 84%
- Pre-auth
- Auth bypass
papercut · papercut mfAug 28, 2026
CVE-2026-81757
28Monitor
WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability
HighCVSS 7.2No exploitEPSS 0%
- RCE
- Deserialization
rank math seo · rank math seoAug 28, 2026
CVE-2026-81760
28Monitor
WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
crocoblock · jetengineAug 28, 2026
CVE-2026-81767
30Monitor
WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
yalla ya! · simple paymentAug 28, 2026
CVE-2026-82078
86Now
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
CriticalCVSS 9.4KEVWeaponizedEPSS 63%
papercut · papercut mfAug 28, 2026
CVE-2026-82227
34Monitor
WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
villatheme · wpbulkyAug 28, 2026
CVE-2026-37237
30Monitor
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
vllm · vllmAug 28, 2026
CVE-2026-50980
24Monitor
Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute
MediumCVSS 6.1Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
Aug 28, 2026
CVE-2026-51376
26Monitor
An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mes
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
Aug 28, 2026
CVE-2026-51611
39Monitor
Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrari
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51615
30Monitor
Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addre
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51616
30Monitor
Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN add
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51617
30Monitor
Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sen
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51618
30Monitor
Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain setup
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51619
30Monitor
Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain onl
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51620
30Monitor
Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain netwo
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51621
30Monitor
Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitiv
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51622
36Monitor
Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN confi
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51623
30Monitor
Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51624
30Monitor
Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain a
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51625
30Monitor
Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sens
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51626
36Monitor
Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS c
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51627
30Monitor
Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IPTV and
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51628
36Monitor
Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to gene
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51636
36Monitor
Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51641
30Monitor
Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain m
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51642
30Monitor
Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51643
36Monitor
Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP confi
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51644
30Monitor
Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51645
39Monitor
Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51646
36Monitor
Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain pa
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51647
30Monitor
Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud re
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51648
30Monitor
Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN info
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51649
36Monitor
Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain dia
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51650
30Monitor
Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain remote
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51657
36Monitor
Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain syslog
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51658
30Monitor
Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ confi
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51659
30Monitor
Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain D
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-51660
36Monitor
Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtai
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 28, 2026
CVE-2026-54745
40Plan
Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- SSRF
- Broken access control (IDOR)
kubeflow · pipelinesAug 28, 2026
CVE-2026-54754
38Monitor
Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)
CriticalCVSS 9.6No exploitEPSS 0%
- Memory safety
klever-io · klever-goAug 28, 2026