# CVEs published 2026-08-16

109 CVEs were published on August 16, 2026: 17 critical, 30 high. Days are UTC.

- [CVE-2026-19964](https://cve.now/CVE-2026-19964.md): Jij-Inc Jij-MCP-Server jm\_check python\_repr.py PythonREPL.run code injection (CVSS 5.1, Jij-Inc Jij-MCP-Server)
- [CVE-2026-19963](https://cve.now/CVE-2026-19963.md): Edimax EW-7478APC stainfo command injection (CVSS 5.3, Edimax EW-7478APC)
- [CVE-2026-19962](https://cve.now/CVE-2026-19962.md): Edimax EW-7478APC setWAN command injection (CVSS 5.3, Edimax EW-7478APC)
- [CVE-2026-19961](https://cve.now/CVE-2026-19961.md): Edimax EW-7478APC formWlSiteSurvey buffer overflow (CVSS 9.4, Edimax EW-7478APC)
- [CVE-2026-19960](https://cve.now/CVE-2026-19960.md): Edimax EW-7478APC formWlbasic command injection (CVSS 5.3, Edimax EW-7478APC)
- [CVE-2026-19959](https://cve.now/CVE-2026-19959.md): Edimax EW-7478APC formWanTcpipSetup stack-based overflow (CVSS 9.4, Edimax EW-7478APC)
- [CVE-2026-19958](https://cve.now/CVE-2026-19958.md): iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection (CVSS 5.3, iatsiuk pptr-mcp)
- [CVE-2026-19957](https://cve.now/CVE-2026-19957.md): graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fetch server-side request forgery (CVSS 5.3, graphlit-mcp-server)
- [CVE-2026-19956](https://cve.now/CVE-2026-19956.md): gomarble-ai facebook-ads-mcp-server server.py fetch\_pagination\_url server-side request forgery (CVSS 5.3, gomarble-ai facebook-ads-mcp-server)
- [CVE-2026-19955](https://cve.now/CVE-2026-19955.md): TrailDB TOC Validation tdb.c tdb\_open out-of-bounds (CVSS 5.1, TrailDB)
- [CVE-2026-72888](https://cve.now/CVE-2026-72888.md): Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart\_require (CVSS 6.5, Net-OAuth)
- [CVE-2026-72887](https://cve.now/CVE-2026-72887.md): Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in… (CVSS 9.8, Net-OAuth)
- [CVE-2026-19349](https://cve.now/CVE-2026-19349.md): Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow… (CVSS 9.8, Lemonldap-NG-Portal)
- [CVE-2026-74797](https://cve.now/CVE-2026-74797.md): OpenTofu before 1.11.4 Denial of Service via malicious zip (CVSS 2.3, opentofu · github.com/opentofu/opentofu)
- [CVE-2026-74796](https://cve.now/CVE-2026-74796.md): OpenTofu before 1.11.7 Symlink Following Path Traversal (CVSS 7.0, opentofu · github.com/opentofu/opentofu)
- [CVE-2026-74795](https://cve.now/CVE-2026-74795.md): Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74794](https://cve.now/CVE-2026-74794.md): Scriban before 6.6.0 Denial of Service via Infinite Recursion (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74792](https://cve.now/CVE-2026-74792.md): Scriban before 7.0.0 Stack Overflow via nested array initializers (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74791](https://cve.now/CVE-2026-74791.md): Scriban before 7.0.0 Authorization Bypass via Stale Include Cache (CVSS 9.2, scriban · Scriban.Signed)
- [CVE-2026-74790](https://cve.now/CVE-2026-74790.md): Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache (CVSS 9.3, scriban · Scriban.Signed)
- [CVE-2026-74789](https://cve.now/CVE-2026-74789.md): Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74788](https://cve.now/CVE-2026-74788.md): Scriban before 7.0.0 Denial of Service via string.pad\_left/pad\_right (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74787](https://cve.now/CVE-2026-74787.md): Scriban before 7.0.0 Uncontrolled Recursion via object.to\_json (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74786](https://cve.now/CVE-2026-74786.md): Scriban before 7.0.0 Denial of Service via Unbounded Template Output (CVSS 7.1, scriban · Scriban.Signed)
- [CVE-2026-74785](https://cve.now/CVE-2026-74785.md): Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption (CVSS 7.1, scriban · Scriban.Signed)
- [CVE-2026-74784](https://cve.now/CVE-2026-74784.md): Scriban before 7.2.0 Denial of Service via array.insert\_at (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74783](https://cve.now/CVE-2026-74783.md): Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-73062](https://cve.now/CVE-2026-73062.md): Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-73061](https://cve.now/CVE-2026-73061.md): Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor (CVSS 9.3, scriban)
- [CVE-2026-73060](https://cve.now/CVE-2026-73060.md): Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply (CVSS 8.7, scriban)
- [CVE-2026-73059](https://cve.now/CVE-2026-73059.md): stoatchat before 0.15.0 Permission Bypass via message\_fetch (CVSS 7.1, stoatchat)
- [CVE-2026-73058](https://cve.now/CVE-2026-73058.md): stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass (CVSS 6.9, stoatchat)
- [CVE-2026-73057](https://cve.now/CVE-2026-73057.md): stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service (CVSS 8.7, stoatchat)
- [CVE-2026-73056](https://cve.now/CVE-2026-73056.md): SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token (CVSS 9.3, siyuan-note siyuan)
- [CVE-2024-58375](https://cve.now/CVE-2024-58375.md): OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation (CVSS 8.7, opentofu · github.com/opentofu/opentofu)
- [CVE-2026-74251](https://cve.now/CVE-2026-74251.md): Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 (CVSS 9.3, phoca.cz Phoca Cart extension for Joomla)
- [CVE-2024-13784](https://cve.now/CVE-2024-13784.md): Contact Form, Survey, Quiz & Popup Form Builder – ARForms \<= 1.8.5 - Unauthenticated PHP Object Injection (CVSS 9.8, reputeinfosystems Contact Form, Survey, Quiz & Popup Form B…)
- [CVE-2026-74578](https://cve.now/CVE-2026-74578.md): crypto: algif\_skcipher - force synchronous processing on trees without ctx-\>state (CVSS 7.1, Linux)
- [CVE-2026-18347](https://cve.now/CVE-2026-18347.md): Kirki \<= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter (CVSS 4.3, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-17604](https://cve.now/CVE-2026-17604.md): Kirki \<= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter (CVSS 4.9, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-13424](https://cve.now/CVE-2026-13424.md): Online Scheduling and Appointment Booking System \<= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly\_speed\_up\_update\_addons… (CVSS 7.2, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2026-17087](https://cve.now/CVE-2026-17087.md): WP Travel Engine \<= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking\_id' Parameter (CVSS 7.5, wptravelengine WP Travel Engine – Tour Booking Plugin – Tou…)
- [CVE-2026-2497](https://cve.now/CVE-2026-2497.md): Gallery by BestWebSoft \<= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys (CVSS 7.2, Gallery by BestWebSoft – Customizable Image and Photo Galle…)
- [CVE-2026-17608](https://cve.now/CVE-2026-17608.md): WP Compress \<= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion (CVSS 6.5, aresit WP Compress – Instant Performance & Speed Optimizati…)
- [CVE-2026-2357](https://cve.now/CVE-2026-2357.md): Bold Page Builder \<= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2026-12998](https://cve.now/CVE-2026-12998.md): Forminator Forms \<= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter (CVSS 5.3, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-10734](https://cve.now/CVE-2026-10734.md): Infility Global \<= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7\_record Log Endpoint (CVSS 7.2, Infility Global)
- [CVE-2026-19728](https://cve.now/CVE-2026-19728.md): Extra Product Options Builder for WooCommerce \< 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileupload (CVSS 7.5, Extra Product Options Builder for WooCommerce)
- [CVE-2026-19726](https://cve.now/CVE-2026-19726.md): Visualizer \< 4.0.7 - Contributor+ Cross-User Chart Configuration Disclosure (CVSS 6.5, Visualizer)
- [CVE-2026-19725](https://cve.now/CVE-2026-19725.md): WPvivid Backup & Migration \< 0.9.131 - Unauthenticated Path Traversal via send\_to\_site\_connect (CVSS 9.1, WPvivid — Backup, Migration & Staging)
- [CVE-2026-19717](https://cve.now/CVE-2026-19717.md): CatFolders Document Gallery \< 2.0.7 - Unauthenticated Attachment Disclosure via REST API (CVSS 7.5, CatFolders Document Gallery & PDF Library)
- [CVE-2026-19714](https://cve.now/CVE-2026-19714.md): Simple JWT Login \< 3.6.8 - Unauthenticated Account Takeover via Missing Google id\_token Audience Validation (CVSS 9.1, Simple JWT Login)
- [CVE-2026-19712](https://cve.now/CVE-2026-19712.md): Masteriyo LMS \< 2.3.3 - Instructor+ Stored XSS via Quiz Description (CVSS 6.1, Masteriyo LMS)
- [CVE-2026-19711](https://cve.now/CVE-2026-19711.md): Premium Packages – Sell Digital Products Securely \< 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request (CVSS 6.5, Premium Packages)
- [CVE-2026-19613](https://cve.now/CVE-2026-19613.md): ECS \< 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source (CVSS 6.5, ECS)
- [CVE-2026-18653](https://cve.now/CVE-2026-18653.md): WP Directory Kit \< 1.5.7 - Admin+ SQL Injection via section Parameter (CVSS 7.2, WP Directory Kit)
- [CVE-2026-17533](https://cve.now/CVE-2026-17533.md): All-in-One WP Migration and Backup \< 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import (CVSS 7.2, All-in-One WP Migration and Backup)
- [CVE-2026-15384](https://cve.now/CVE-2026-15384.md): Manual Image Crop \< 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR (CVSS 5.7, Manual Image Crop)
- [CVE-2026-13712](https://cve.now/CVE-2026-13712.md): Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL (CVSS 5.4, Divi)
- [CVE-2026-15351](https://cve.now/CVE-2026-15351.md): WC Vendors \<= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter (CVSS 4.9, wcvendors WC Vendors – WooCommerce Multivendor, WooCommerce…)
- [CVE-2026-17581](https://cve.now/CVE-2026-17581.md): WCPOS \<= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine (CVSS 7.2, kilbot WCPOS – Point of Sale (POS) plugin for WooCommerce)
- [CVE-2026-9767](https://cve.now/CVE-2026-9767.md): The School Management \<= 5.4 - Authenticated (Custom+) SQL Injection via 'order\[0\]\[dir\]' Parameter (CVSS 6.5, weblizar The School Management – Education & Learning ERP)
- [CVE-2026-15345](https://cve.now/CVE-2026-15345.md): ShortPixel Adaptive Images \<= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via… (CVSS 4.3, ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimiz…)
- [CVE-2026-17582](https://cve.now/CVE-2026-17582.md): Slider Hero with Video Background, Animation \<= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field… (CVSS 4.9, quantumcloud Slider Hero with Video Background, Animation)
- [CVE-2026-16775](https://cve.now/CVE-2026-16775.md): Smash Balloon Social Post Feed \<= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, smub Smash Balloon Social Post Feed – Simple Social Feeds f…)
- [CVE-2026-15056](https://cve.now/CVE-2026-15056.md): StoreEngine \<= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL (CVSS 6.5, kodezen StoreEngine — Complete eCommerce Solution with Memb…)
- [CVE-2026-10035](https://cve.now/CVE-2026-10035.md): Turnkey bbPress by WeaverTheme \<= 1.7.1 - Authenticated (Administrator+) PHP Object Injection (CVSS 6.6, wpweaver Turnkey bbPress by WeaverTheme)
- [CVE-2026-16758](https://cve.now/CVE-2026-16758.md): Snippet Shortcodes \<= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, aliakro Snippet Shortcodes)
- [CVE-2026-18316](https://cve.now/CVE-2026-18316.md): Solace Extra \<= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip… (CVSS 9.1, solacewp Solace Extra)
- [CVE-2026-2283](https://cve.now/CVE-2026-2283.md): User Login History \<= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog\_id' Parameter (CVSS 4.9, faiyazalam User Login History)
- [CVE-2026-18402](https://cve.now/CVE-2026-18402.md): SureDash \<= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute (CVSS 6.4, brainstormforce SureDash – Community, Courses & Member Dash…)
- [CVE-2026-15790](https://cve.now/CVE-2026-15790.md): Video Gallery \<= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post\_title' via emd\_mb\_meta Shortcode (CVSS 6.4, emarket-design Video Gallery – YouTube Gallery, Playlist &…)
- [CVE-2026-15604](https://cve.now/CVE-2026-15604.md): Toocheke Companion \<= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series\_bg\_color' Post Meta (CVSS 6.4, Toocheke Companion)
- [CVE-2026-19934](https://cve.now/CVE-2026-19934.md): itsourcecode Hospital Management System vieworder.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-19933](https://cve.now/CVE-2026-19933.md): DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflow (CVSS 5.3, DefaultFuction Customer-Relationship-Management-In-C-Project)
- [CVE-2026-16779](https://cve.now/CVE-2026-16779.md): Kubio AI Page Builder \<= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion… (CVSS 4.3, extendthemes Kubio AI Page Builder)
- [CVE-2026-15002](https://cve.now/CVE-2026-15002.md): Autopay \<= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm\_woocommerce\_css\_editor\_content' Parameter (CVSS 7.2, bluemediapl Autopay)
- [CVE-2026-15726](https://cve.now/CVE-2026-15726.md): Serious Slider \<= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute (CVSS 6.4, cryout-creations Serious Slider)
- [CVE-2026-15963](https://cve.now/CVE-2026-15963.md): Quiz and Survey Master (QSM) \<= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon\_category' Quiz Option (CVSS 6.5, expresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…)
- [CVE-2025-10005](https://cve.now/CVE-2025-10005.md): Password Protect WordPress Lite \<= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post… (CVSS 4.3, buildwps PPWP – Password Protect Pages)
- [CVE-2026-15009](https://cve.now/CVE-2026-15009.md): Advanced File Manager \<= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter (CVSS 6.1, saadiqbal Advanced File Manager – Ultimate File Manager for…)
- [CVE-2026-15066](https://cve.now/CVE-2026-15066.md): Loco Translate \<= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments (CVSS 6.4, timwhitlock Loco Translate)
- [CVE-2026-17123](https://cve.now/CVE-2026-17123.md): Royal Addons for Elementor \<= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook\_url'… (CVSS 8.8, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2026-13167](https://cve.now/CVE-2026-13167.md): Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI \<= 3.5.2 - Missing Authorization to Authenticated… (CVSS 4.3, wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…)
- [CVE-2026-15441](https://cve.now/CVE-2026-15441.md): Product Table & List Builder For WooCommerce \<= 5.6.0 - Unauthenticated CSS Injection via 'laptop\_scroll\_offset' Parameter (CVSS 5.3, wcproducttable Product Table & List Builder For WooCommerce)
- [CVE-2026-11780](https://cve.now/CVE-2026-11780.md): Quiz and Survey Master (QSM) \<= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question\_title' Parameter (CVSS 6.4, expresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…)
- [CVE-2026-13358](https://cve.now/CVE-2026-13358.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct… (CVSS 6.5, croixhaug Simply Schedule Appointments)
- [CVE-2026-14524](https://cve.now/CVE-2026-14524.md): ProSolution WP Client \<= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters (CVSS 9.1, ProSolution WP Client)
- [CVE-2026-16079](https://cve.now/CVE-2026-16079.md): Fullscreen Galleria \<= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content (CVSS 6.5, pdamsten Fullscreen Galleria)
- [CVE-2026-12477](https://cve.now/CVE-2026-12477.md): Gravity Booster \<= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter (CVSS 4.4, wpmonks Gravity Booster – Styles & Layouts for Gravity Forms)
- [CVE-2026-16098](https://cve.now/CVE-2026-16098.md): ProSolution WP Client \<= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override (CVSS 9.8, ProSolution WP Client)
- [CVE-2026-16099](https://cve.now/CVE-2026-16099.md): Podlove Podcast Publisher \<= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl\_data'… (CVSS 8.8, eteubert Podlove Podcast Publisher)
- [CVE-2026-18385](https://cve.now/CVE-2026-18385.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \<= 4.16.19 - Authenticated… (CVSS 5.4, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2026-14498](https://cve.now/CVE-2026-14498.md): Query Wrangler \<= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter (CVSS 8.8, daggerhart Query Wrangler)
- [CVE-2026-15602](https://cve.now/CVE-2026-15602.md): NEX-Forms \<= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional\_params' Parameter (CVSS 4.9, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2026-12905](https://cve.now/CVE-2026-12905.md): Online Scheduling and Appointment Booking System – Bookly \<= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive… (CVSS 4.3, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2026-18432](https://cve.now/CVE-2026-18432.md): Frontend Admin by DynamiApps \<= 3.29.9 - Unauthenticated Privilege Escalation via 'item\_id' Parameter (CVSS 9.8, shabti Frontend Admin by DynamiApps)
- [CVE-2026-19932](https://cve.now/CVE-2026-19932.md): DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection (CVSS 5.3, DefaultFuction Notice-System-Managent)
- [CVE-2026-2487](https://cve.now/CVE-2026-2487.md): Admin Custom Login \<= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting (CVSS 4.4, weblizar Admin Custom Login)
- [CVE-2026-19930](https://cve.now/CVE-2026-19930.md): Dolibarr User Cloning card.php ldap injection (CVSS 5.3, Dolibarr)
- [CVE-2026-19929](https://cve.now/CVE-2026-19929.md): OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engine (CVSS 5.3, OpenBoxes)
- [CVE-2026-19928](https://cve.now/CVE-2026-19928.md): OpenBoxes Role Interceptor RoleInterceptor.groovy needManager privileges management (CVSS 5.3, OpenBoxes)
- [CVE-2026-19927](https://cve.now/CVE-2026-19927.md): OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery (CVSS 5.3, OpenBoxes)
- [CVE-2026-19926](https://cve.now/CVE-2026-19926.md): Evergreen open-ils.fielder OpenSRF Service osrf-gateway-v1 sql injection (CVSS 6.9, Evergreen)
- [CVE-2026-19925](https://cve.now/CVE-2026-19925.md): SourceCodester Stock Management System Master.php delete\_supplier sql injection (CVSS 5.1, SourceCodester Stock Management System)
- [CVE-2026-19924](https://cve.now/CVE-2026-19924.md): Tenda AC10 httpd R7WebsSecurityHandler improper authentication (CVSS 9.3, Tenda AC10)
- [CVE-2026-19923](https://cve.now/CVE-2026-19923.md): code-projects Online Shopping System checkout\_process.php sql injection (CVSS 5.3, code-projects Online Shopping System)
- [CVE-2026-19922](https://cve.now/CVE-2026-19922.md): code-projects Online Shopping System checkout.php cross site scripting (CVSS 5.1, code-projects Online Shopping System)
- [CVE-2026-19921](https://cve.now/CVE-2026-19921.md): code-projects Online Shopping System homeaction.php sql injection (CVSS 5.3, code-projects Online Shopping System)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-08-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.