By publication date

Exploited and new serious CVEs: August 2026

7,138 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 71 of 72

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2026-51676No exploit	Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter aCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51677No exploit	Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change UPnP serCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51679No exploit	Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51680No exploit	Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behavCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51681No exploit	Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-siCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
35Monitor	CVE-2026-78074No exploit	Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensionsminiorgange.com · miniorange oauth client (free) extension for joomla · CWE-284 Pre-auth Auth bypass Broken access control (IDOR)	High8.8	—	0.5%	Aug 31, 2026
34Monitor	CVE-2026-78077No exploit	Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10joomshaper.com · helix ultimate extension for joomla · CWE-79 XSS	High8.6	—	0.4%	Aug 31, 2026
35Monitor	CVE-2026-78078No exploit	Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10joomshaper.com · helix ultimate extension for joomla · CWE-434 File upload	High8.9	—	0.4%	Aug 31, 2026
35Monitor	CVE-2026-82217No exploit	In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContenteclipse foundation · eclipse theia · CWE-22 Pre-auth Path traversal	High8.8	—	0.6%	Aug 31, 2026
28Monitor	CVE-2026-82877No exploit	ILIAS Arbitrary File Read via SOAP addFileilias-elearning e.v. · ilias · CWE-22 Path traversal	High7.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51684No exploit	Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the stCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
39Monitor	CVE-2026-51686No exploit	Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigureCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51687No exploit	Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
30Monitor	CVE-2026-51688No exploit	Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wiCWE-284 Pre-auth Broken access control (IDOR) Denial of service	High7.5	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51689No exploit	Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmwCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51690No exploit	Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream pCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51691No exploit	Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulatCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51692No exploit	Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to establish CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51693No exploit	Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
30Monitor	CVE-2026-51694No exploit	Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to add or CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 31, 2026
30Monitor	CVE-2026-51695No exploit	Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic DCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 31, 2026
39Monitor	CVE-2026-51696No exploit	Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to exposeCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51697No exploit	Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV servCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
37Monitor	CVE-2026-59111No exploit	Command Injection vulnerability in eObčanka-Identifikaceministry of the interior (mvčr) · eobčanka-identifikace · CWE-78 pre-auth RCE Command injection	Critical9.3	—	1.3%	Aug 31, 2026
36Monitor	CVE-2026-66047No exploit	ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCEproper fraction · profilepress · CWE-306 pre-auth RCE Auth bypass	Critical9.2	—	0.9%	Aug 31, 2026
29Monitor	CVE-2026-78422No exploit	zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UIDz-galaxy · zbus_polkit · CWE-367 Local privilege escalation Race condition	High7.3	—	0.1%	Aug 31, 2026
40Plan	CVE-2026-82970No exploit	WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerabilitywp legal pages · wp cookie notice for gdpr, ccpa & eprivacy consent · CWE-434 Pre-auth File upload	Critical10.0	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51152No exploit	Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803.CWE-918 Pre-auth SSRF	Critical9.1	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51698No exploit	Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter brCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51699No exploit	Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an internCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51700No exploit	Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degradeCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51701No exploit	Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change dCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51705No exploit	Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
39Monitor	CVE-2026-51708No exploit	Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change WPS aCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
39Monitor	CVE-2026-51709No exploit	Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigurCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51710No exploit	Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51711No exploit	Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wirCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51713No exploit	Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulatCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51715No exploit	Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove MCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
30Monitor	CVE-2026-51716No exploit	Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to deleteCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 31, 2026
36Monitor	CVE-2026-51717No exploit	Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the deCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51718No exploit	Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
30Monitor	CVE-2026-51719No exploit	Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove UCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 31, 2026
37Monitor	CVE-2026-73819No exploit	Ebyte NA111-M Weak Authenticationebyte · ebyte na111-m firmware · CWE-1390 Pre-auth Auth bypass	Critical9.3	—	0.5%	Aug 31, 2026
28Monitor	CVE-2026-75132No exploit	WAPT Server SQL Injection via /api/v3/hosts Endpointtranquil_it · wapt · CWE-89 SQL injection	High7.1	—	0.4%	Aug 31, 2026
34Monitor	CVE-2026-75133No exploit	Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_processfahad mahmood · keep backup daily · CWE-306 Pre-auth Auth bypass	High8.7	—	0.5%	Aug 31, 2026
37Monitor	CVE-2026-76133No exploit	Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithmebyte · ebyte na111-m firmware · CWE-327 Pre-auth Weak crypto	Critical9.3	—	0.3%	Aug 31, 2026
34Monitor	CVE-2026-77966No exploit	Ebyte NA111-M Missing Authorizationebyte · ebyte na111-m firmware · CWE-862 Broken access control (IDOR)	High8.7	—	0.4%	Aug 31, 2026
28Monitor	CVE-2026-77975No exploit	Ebyte NA111-M Cleartext Storage of Sensitive Informationebyte · ebyte ne2-d11 firmware · CWE-312 Pre-auth	High7.1	—	0.1%	Aug 31, 2026
34Monitor	CVE-2026-82807No exploit	ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges managementieungsoft · ultra ramdisk pro · CWE-266 Local privilege escalation	High8.5	—	0.1%	Aug 31, 2026
35Monitor	CVE-2026-12894No exploit	Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template enginequarkus · quarkus-qute · CWE-1336 RCE SSTI	High8.8	—	0.9%	Aug 31, 2026
36Monitor	CVE-2026-51720No exploit	Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to removCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51721No exploit	Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the mesh CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51722No exploit	Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to repointCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51723No exploit	Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to installCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51724No exploit	Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove SmarCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51725No exploit	Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change theCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51726No exploit	Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove paCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51728No exploit	Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to upload CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51729No exploit	Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to request deletionCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51730No exploit	Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
35Monitor	CVE-2026-79744No exploit	MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configurationsamanhappy · mcphub · CWE-269	High8.8	—	0.5%	Aug 31, 2026
28Monitor	CVE-2026-79745No exploit	MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)samanhappy · mcphub · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Aug 31, 2026
32Monitor	CVE-2026-79746No exploit	MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matchingsamanhappy · mcphub · CWE-863 Broken access control (IDOR)	High8.1	—	0.4%	Aug 31, 2026
28Monitor	CVE-2026-79747No exploit	MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)samanhappy · mcphub · CWE-918 SSRF	High7.1	—	0.3%	Aug 31, 2026
39Monitor	CVE-2026-79748No exploit	MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)samanhappy · mcphub · CWE-862 RCE Broken access control (IDOR)	Critical9.9	—	0.6%	Aug 31, 2026
30Monitor	CVE-2026-79749No exploit	MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validationsamanhappy · mcphub · CWE-918 SSRF	High7.6	—	0.4%	Aug 31, 2026
30Monitor	CVE-2026-79750No exploit	MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)samanhappy · mcphub · CWE-639 SSRF Broken access control (IDOR)	High7.7	—	0.4%	Aug 31, 2026
30Monitor	CVE-2026-76763No exploit	Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literalsred hat · red hat build of quarkus · CWE-1284 Pre-auth Denial of service	High7.5	—	0.7%	Aug 31, 2026
33Monitor	CVE-2026-53507No exploit	oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runsoasdiff · oasdiff-action · CWE-200 Pre-auth SSRF Info leak	High8.3	—	0.4%	Aug 31, 2026
38Monitor	CVE-2026-53552No exploit	Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlerszhenorzz · goploy · CWE-639 RCE Broken access control (IDOR)	Critical9.6	—	0.3%	Aug 31, 2026
30Monitor	CVE-2026-53553No exploit	Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromisezhenorzz · goploy · CWE-22 Path traversal	High7.7	—	0.4%	Aug 31, 2026
34Monitor	CVE-2026-72001Proof of concept	Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpointpangolin · pangolin · CWE-639 Auth bypass Broken access control (IDOR)	High8.6	—	0.4%	Aug 31, 2026
34Monitor	CVE-2026-83497No exploit	Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Paginationopensearch · opensearch · CWE-502 RCE Deserialization	High8.7	—	0.9%	Aug 31, 2026
36Monitor	CVE-2026-51731No exploit	Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove VLAN entCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51733No exploit	Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
39Monitor	CVE-2026-51734No exploit	Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
30Monitor	CVE-2026-51735No exploit	Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve recentCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 31, 2026
36Monitor	CVE-2026-51736No exploit	Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system lCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51738No exploit	Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
39Monitor	CVE-2026-51740No exploit	Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
39Monitor	CVE-2026-38577Proof of concept	Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.CWE-798 Pre-auth Hard-coded credentials	Critical9.8	—	0.4%	Aug 31, 2026
30Monitor	CVE-2026-54598No exploit	Missing Authentication for Critical Function in wallosellite · wallos · CWE-306 Pre-auth Auth bypass	High7.5	—	0.4%	Aug 31, 2026
30Monitor	CVE-2026-54599No exploit	Wallos: OIDC state parameter never validated — login CSRF / account takeoverellite · wallos · CWE-352 Pre-auth CSRF	High7.5	—	0.2%	Aug 31, 2026
32Monitor	CVE-2026-54600No exploit	Wallos: Unauthenticated database replacement via import endpoint on fresh installellite · wallos · CWE-287 Pre-auth Auth bypass	High8.2	—	0.5%	Aug 31, 2026
32Monitor	CVE-2026-61638No exploit	Wallos: SSRF via Test Email Notification - unvalidated SMTP host/portellite · wallos · CWE-918 Pre-auth SSRF	High8.2	—	0.4%	Aug 31, 2026
34Monitor	CVE-2026-61639No exploit	Wallos: Zip Slip path traversal in database restore writes files to webrootellite · wallos · CWE-22 Path traversal	High8.5	—	0.5%	Aug 31, 2026
34Monitor	CVE-2026-61640No exploit	Wallos: SSRF via OIDC Token/UserInfo URL Configurationellite · wallos · CWE-918 SSRF	High8.5	—	0.5%	Aug 31, 2026
32Monitor	CVE-2026-61641No exploit	Wallos: OIDC account takeover via email-based account linking without `email_verified` checkellite · wallos · CWE-287 Pre-auth Auth bypass	High8.1	—	0.5%	Aug 31, 2026
30Monitor	CVE-2026-17615No exploit	Resteasy-core: resteasy sourceprovider remote unauthenticated file readred hat · red hat build of keycloak 26.6 · CWE-611 Pre-auth XXE	High7.5	—	0.8%	Aug 31, 2026
28Monitor	CVE-2026-71415No exploit	Kirby: File upload permissions are not checked during processing of chunk datagetkirby · kirby · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Aug 31, 2026
32Monitor	CVE-2026-75458No exploit	The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escaCWE-639 Broken access control (IDOR)	High8.1	—	0.3%	Aug 31, 2026
32Monitor	CVE-2026-75594No exploit	Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handlinggetkirby · kirby · CWE-22 Pre-auth Path traversal	High8.2	—	0.7%	Aug 31, 2026
30Monitor	CVE-2026-79407No exploit	A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value usedCWE-22 Pre-auth Path traversal	High7.5	—	0.5%	Aug 31, 2026
40Plan	CVE-2026-79408No exploit	An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.CWE-78 pre-auth RCE Command injection	Critical9.8	—	2.0%	Aug 31, 2026
21Monitor	CVE-2026-79483Proof of concept	FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint.CWE-943 Pre-auth SQL injection	Medium5.3	—	0.3%	Aug 31, 2026
34Monitor	CVE-2026-81287No exploit	WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerabilitysyed balkhi · charitable · CWE-89 SQL injection	High8.5	—	0.3%	Aug 31, 2026
28Monitor	CVE-2026-81290No exploit	WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerabilityicegram · email subscribers & newsletters · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 31, 2026
28Monitor	CVE-2026-81291No exploit	WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerabilityuncode · uncode · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Aug 31, 2026
37Monitor	CVE-2026-81293No exploit	WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerabilitypassionate programmer peter · wp data access · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Aug 31, 2026

CVE-2026-51676
36Monitor
Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter a
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51677
36Monitor
Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change UPnP ser
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51679
36Monitor
Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51680
36Monitor
Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behav
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51681
36Monitor
Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-si
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-78074
35Monitor
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
miniorgange.com · miniorange oauth client (free) extension for joomlaAug 31, 2026
CVE-2026-78077
34Monitor
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10
HighCVSS 8.6No exploitEPSS 0%
- XSS
joomshaper.com · helix ultimate extension for joomlaAug 31, 2026
CVE-2026-78078
35Monitor
Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10
HighCVSS 8.9No exploitEPSS 0%
- File upload
joomshaper.com · helix ultimate extension for joomlaAug 31, 2026
CVE-2026-82217
35Monitor
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Path traversal
eclipse foundation · eclipse theiaAug 31, 2026
CVE-2026-82877
28Monitor
ILIAS Arbitrary File Read via SOAP addFile
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
ilias-elearning e.v. · iliasAug 31, 2026
CVE-2026-51684
39Monitor
Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the st
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51686
39Monitor
Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51687
36Monitor
Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51688
30Monitor
Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wi
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- Denial of service
Aug 31, 2026
CVE-2026-51689
36Monitor
Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmw
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51690
36Monitor
Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream p
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51691
39Monitor
Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulat
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51692
36Monitor
Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to establish
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51693
39Monitor
Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51694
30Monitor
Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to add or
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51695
30Monitor
Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic D
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51696
39Monitor
Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51697
36Monitor
Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV serv
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-59111
37Monitor
Command Injection vulnerability in eObčanka-Identifikace
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
ministry of the interior (mvčr) · eobčanka-identifikaceAug 31, 2026
CVE-2026-66047
36Monitor
ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
proper fraction · profilepressAug 31, 2026
CVE-2026-78422
29Monitor
zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID
HighCVSS 7.3No exploitEPSS 0%
- Local privilege escalation
- Race condition
z-galaxy · zbus_polkitAug 31, 2026
CVE-2026-82970
40Plan
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- File upload
wp legal pages · wp cookie notice for gdpr, ccpa & eprivacy consentAug 31, 2026
CVE-2026-51152
36Monitor
Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SSRF
Aug 31, 2026
CVE-2026-51698
36Monitor
Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter br
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51699
39Monitor
Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an intern
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51700
36Monitor
Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51701
36Monitor
Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change d
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51705
39Monitor
Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mes
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51708
39Monitor
Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change WPS a
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51709
39Monitor
Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigur
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51710
36Monitor
Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter par
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51711
36Monitor
Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wir
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51713
36Monitor
Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulat
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51715
39Monitor
Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove M
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51716
30Monitor
Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to delete
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51717
36Monitor
Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the de
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51718
39Monitor
Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51719
30Monitor
Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove U
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-73819
37Monitor
Ebyte NA111-M Weak Authentication
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
ebyte · ebyte na111-m firmwareAug 31, 2026
CVE-2026-75132
28Monitor
WAPT Server SQL Injection via /api/v3/hosts Endpoint
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
tranquil_it · waptAug 31, 2026
CVE-2026-75133
34Monitor
Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
fahad mahmood · keep backup dailyAug 31, 2026
CVE-2026-76133
37Monitor
Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
ebyte · ebyte na111-m firmwareAug 31, 2026
CVE-2026-77966
34Monitor
Ebyte NA111-M Missing Authorization
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
ebyte · ebyte na111-m firmwareAug 31, 2026
CVE-2026-77975
28Monitor
Ebyte NA111-M Cleartext Storage of Sensitive Information
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
ebyte · ebyte ne2-d11 firmwareAug 31, 2026
CVE-2026-82807
34Monitor
ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
ieungsoft · ultra ramdisk proAug 31, 2026
CVE-2026-12894
35Monitor
Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SSTI
quarkus · quarkus-quteAug 31, 2026
CVE-2026-51720
36Monitor
Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remov
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51721
36Monitor
Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the mesh
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51722
36Monitor
Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to repoint
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51723
36Monitor
Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to install
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51724
39Monitor
Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Smar
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51725
36Monitor
Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51726
36Monitor
Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove pa
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51728
39Monitor
Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to upload
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51729
36Monitor
Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to request deletion
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51730
36Monitor
Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-79744
35Monitor
MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
HighCVSS 8.8No exploitEPSS 0%
samanhappy · mcphubAug 31, 2026
CVE-2026-79745
28Monitor
MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
samanhappy · mcphubAug 31, 2026
CVE-2026-79746
32Monitor
MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
samanhappy · mcphubAug 31, 2026
CVE-2026-79747
28Monitor
MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)
HighCVSS 7.1No exploitEPSS 0%
- SSRF
samanhappy · mcphubAug 31, 2026
CVE-2026-79748
39Monitor
MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
samanhappy · mcphubAug 31, 2026
CVE-2026-79749
30Monitor
MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation
HighCVSS 7.6No exploitEPSS 0%
- SSRF
samanhappy · mcphubAug 31, 2026
CVE-2026-79750
30Monitor
MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)
HighCVSS 7.7No exploitEPSS 0%
- SSRF
- Broken access control (IDOR)
samanhappy · mcphubAug 31, 2026
CVE-2026-76763
30Monitor
Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat build of quarkusAug 31, 2026
CVE-2026-53507
33Monitor
oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- SSRF
- Info leak
oasdiff · oasdiff-actionAug 31, 2026
CVE-2026-53552
38Monitor
Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers
CriticalCVSS 9.6No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
zhenorzz · goployAug 31, 2026
CVE-2026-53553
30Monitor
Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
zhenorzz · goployAug 31, 2026
CVE-2026-72001
34Monitor
Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint
HighCVSS 8.6Proof of conceptEPSS 0%
- Auth bypass
- Broken access control (IDOR)
pangolin · pangolinAug 31, 2026
CVE-2026-83497
34Monitor
Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Deserialization
opensearch · opensearchAug 31, 2026
CVE-2026-51731
36Monitor
Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove VLAN ent
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51733
39Monitor
Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51734
39Monitor
Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51735
30Monitor
Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve recent
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51736
36Monitor
Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system l
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51738
39Monitor
Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51740
39Monitor
Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate crit
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-38577
39Monitor
Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Hard-coded credentials
Aug 31, 2026
CVE-2026-54598
30Monitor
Missing Authentication for Critical Function in wallos
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
ellite · wallosAug 31, 2026
CVE-2026-54599
30Monitor
Wallos: OIDC state parameter never validated — login CSRF / account takeover
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- CSRF
ellite · wallosAug 31, 2026
CVE-2026-54600
32Monitor
Wallos: Unauthenticated database replacement via import endpoint on fresh install
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
ellite · wallosAug 31, 2026
CVE-2026-61638
32Monitor
Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- SSRF
ellite · wallosAug 31, 2026
CVE-2026-61639
34Monitor
Wallos: Zip Slip path traversal in database restore writes files to webroot
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
ellite · wallosAug 31, 2026
CVE-2026-61640
34Monitor
Wallos: SSRF via OIDC Token/UserInfo URL Configuration
HighCVSS 8.5No exploitEPSS 0%
- SSRF
ellite · wallosAug 31, 2026
CVE-2026-61641
32Monitor
Wallos: OIDC account takeover via email-based account linking without `email_verified` check
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
ellite · wallosAug 31, 2026
CVE-2026-17615
30Monitor
Resteasy-core: resteasy sourceprovider remote unauthenticated file read
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XXE
red hat · red hat build of keycloak 26.6Aug 31, 2026
CVE-2026-71415
28Monitor
Kirby: File upload permissions are not checked during processing of chunk data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
getkirby · kirbyAug 31, 2026
CVE-2026-75458
32Monitor
The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege esca
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-75594
32Monitor
Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
getkirby · kirbyAug 31, 2026
CVE-2026-79407
30Monitor
A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
Aug 31, 2026
CVE-2026-79408
40Plan
An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- Command injection
Aug 31, 2026
CVE-2026-79483
21Monitor
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint.
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
Aug 31, 2026
CVE-2026-81287
34Monitor
WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
syed balkhi · charitableAug 31, 2026
CVE-2026-81290
28Monitor
WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
icegram · email subscribers & newslettersAug 31, 2026
CVE-2026-81291
28Monitor
WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
uncode · uncodeAug 31, 2026
CVE-2026-81293
37Monitor
WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
passionate programmer peter · wp data accessAug 31, 2026