CVEs published August 1, 2026
148 CVEs were published on August 1, 2026: 16 critical, 50 high. 1 is now in CISA KEV.
- Published
- 148
- Critical
- 16
- High
- 50
- Medium
- 74
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 99
Most affected products
- FreeRDP
- 21
- axios
- 10
- better-auth
- 8
- gitpython-developers GitPython · gitpython
- 5
- guzzle · guzzlehttp/guzzle
- 4
- ueberauth guardian
- 4
- codesupplyco Powerkit – Supercharge your WordPress Site
- 3
- ArcadeData arcadedb
- 2
- ArcadeData arcadedb · com.arcadedb:arcadedb-engine
- 2
- better-auth scim · @better-auth/scim
- 2
Critical 16
- CVE-2026-8457WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWTWPWeb WooCommerce - Social Login
- CVE-2026-67336better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProviderbetter-auth
- CVE-2026-67292FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosureFreeRDP
- CVE-2026-67324GitPython 3.1.50 Authentication Bypass via Joined Short Optionsgitpython-developers GitPython · gitpython
- CVE-2026-67341ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTIONArcadeData arcadedb · com.arcadedb:arcadedb-engine
- CVE-2026-67289FreeRDP before 3.29.0 HTTP Proxy Request Injection via RedirectionFreeRDP
- CVE-2026-67294FreeRDP before 3.29.0 TLS Certificate EKU BypassFreeRDP
- CVE-2026-66402FreeRDP before 3.29.0 TLS Certificate Identity Validation BypassFreeRDP
- CVE-2026-67308Wazuh GitHub Actions Shell Injection via Fork Pull Requestwazuh
- CVE-2026-67330better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collisionbetter-auth scim · @better-auth/scim
- CVE-2026-67293FreeRDP before 3.29.0 Improper Certificate Hostname ValidationFreeRDP
- CVE-2026-67342ArcadeDB before 26.7.2 Authorization Bypass via Database HandlersArcadeData arcadedb · com.arcadedb:arcadedb-server
- CVE-2026-67305FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via CliprdrFreeRDP
- CVE-2026-15964Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Changebritcoder Single Sign On For TNG
- CVE-2026-13596Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List SearchParticipants Database
- CVE-2026-3141FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameterwpwax FormGent – Next-Gen AI Form Builder for WordPress wit…
High 50
- CVE-2026-13339CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parametercubewp1211 CubeWP Framework
- CVE-2026-18352User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parametergm_alex User Access Manager
- CVE-2026-18556Unauthenticated administrative account takeoverN-able N-central
- CVE-2026-55735Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocationueberauth guardian
- CVE-2026-67354guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Refererguzzle · guzzlehttp/guzzle
- CVE-2026-67298FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength UnderflowFreeRDP
- CVE-2026-67291FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADDFreeRDP
- CVE-2026-67311Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirectbudibase
- CVE-2026-67300FreeRDP before 3.29.0 Use-After-Free via async message proxyFreeRDP
- CVE-2026-67299FreeRDP before 3.29.0 Use-After-Free via WindowIcon async messageFreeRDP
- CVE-2026-67288FreeRDP before 3.29.0 Denial of Service via smartcard cacheFreeRDP
- CVE-2026-67309Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypasstraefik · github.com/traefik/traefik/v3 +2
- CVE-2026-67326GitPython before 3.1.50 Newline Injection via config_writer sectiongitpython-developers GitPython · gitpython
- CVE-2026-67340ArcadeDB before 26.7.2 Remote Code Execution via Trigger ScriptsArcadeData arcadedb · com.arcadedb:arcadedb-engine
- CVE-2026-67344ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPEArcadeData arcadedb
- CVE-2026-67329@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscriptionbetter-auth stripe · @better-auth/stripe
- CVE-2026-67323GitPython before 3.1.51 Command Injection via unguarded Git optionsgitpython-developers GitPython · gitpython
- CVE-2025-71403better-auth before 1.1.20 Open Redirect via trustedOrigins Bypassbetter-auth
- CVE-2026-67307Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Syncwazuh
- CVE-2026-67337better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCachebetter-auth
- CVE-2026-67328@better-auth/sso before 1.6.21 Account Takeover via SSObetter-auth sso
- CVE-2026-67327better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTPbetter-auth
- CVE-2026-67343ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/serverArcadeData arcadedb
- CVE-2026-67296FreeRDP before 3.29.0 Denial of Service via RDPEI PDUFreeRDP
- CVE-2026-67355guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scopeguzzle · guzzlehttp/guzzle
- CVE-2026-67331better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypassbetter-auth scim · @better-auth/scim
- CVE-2026-67320axios before 0.33.0 Prototype Pollution via Node HTTP adapteraxios
- CVE-2026-67304FreeRDP before 3.29.0 NULL Dereference via smartcard cleanupFreeRDP
- CVE-2026-67322GitPython before 3.1.52 Environment Variable Exfiltration via clone_fromgitpython-developers GitPython · gitpython
- CVE-2026-67297FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP responseFreeRDP
- CVE-2026-67301FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxyFreeRDP
- CVE-2026-67325GitPython before 3.1.51 Command Injection via option prefix abbreviationgitpython-developers GitPython · gitpython
- CVE-2026-67290FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMFFreeRDP
- CVE-2026-18536Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTPRRWO Data::Entropy
- CVE-2026-16635Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' FieldPronamic Pay
- CVE-2026-15052MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Valuesumarbajwa MailChimp Subscribe Form, Optin Builder, PopUp Bu…
- CVE-2026-15450NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameterwebaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-16144Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameterwpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2026-15988AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Matchtigroumeow AI Engine – The Chatbot, AI Framework & MCP for…
- CVE-2026-14839Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content DisclosureMapster WP Maps
- CVE-2026-13725Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjaxDynamic Pricing With Discount Rules for WooCommerce
- CVE-2026-13157Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File UploadTheme Demo Import
- CVE-2026-13158Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File UploadEverest Toolkit
- CVE-2026-15368Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After RegistrationUser Profile Builder
- CVE-2026-15244HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_viewHUSKY
- CVE-2026-14836Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit BypassLogin & Register Forms
- CVE-2026-14596DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host InjectionDynamicKit for Elementor
- CVE-2026-14309Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP BypassChat On Desk Order Notifications
- CVE-2026-15006Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Fieldbitpressadmin Bit integrations – Form Integration, Webhook,…
- CVE-2026-15414Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Metawpswings Subscriptions for WooCommerce
Medium, low and unrated 82
- CVE-2026-55734guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1ueberauth guardian
- CVE-2026-55733Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creationueberauth guardian
- CVE-2026-54894Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keysueberauth guardian
- CVE-2026-67303FreeRDP before 3.29.0 Denial of Service via serial DeviceControlFreeRDP
- CVE-2026-67295FreeRDP before 3.29.0 Path Traversal via drive redirectionFreeRDP
- CVE-2026-67321axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassaxios
- CVE-2026-67333better-auth before 1.6.13 Stored XSS via javascript redirect_uribetter-auth
- CVE-2026-67319axios before 0.33.0 Prototype Pollution via nested option objectsaxios
- CVE-2026-67318axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2axios
- CVE-2026-67316axios before 1.18.0 Prototype Pollution via bodyless methodsaxios
- CVE-2026-67334better-auth Stale Sessions Persist After User Deletionbetter-auth · @better-auth/scim
- CVE-2026-67315axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0axios
- CVE-2026-67312axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSONaxios
- CVE-2026-66401FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264FreeRDP
- CVE-2026-67302FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of serviceFreeRDP
- CVE-2026-67306FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLEFreeRDP
- CVE-2026-67332@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypassbetter-auth oauth-provider · @better-auth/oauth-provider
- CVE-2026-67310openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinksopenremote
- CVE-2025-71404better-auth before 1.1.16 Reflected XSS via error parameterbetter-auth
- CVE-2026-67338JupyterLab before 4.5.9 Stored XSS via Extension Managerjupyterlab
- CVE-2026-67353guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Serviceguzzle · guzzlehttp/guzzle
- CVE-2026-67335better-auth before 1.6.2 OAuth State Validation Bypassbetter-auth
- CVE-2026-67339guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosureguzzle · guzzlehttp/guzzle
- CVE-2026-67317axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStreamaxios
- CVE-2025-71402better-auth before 1.4.0 Session Revocation via Forged Cookiebetter-auth
- CVE-2026-67314axios before 1.18.0 Prototype Pollution via auth subfieldsaxios
- CVE-2026-67313axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSONaxios
- CVE-2026-67352luci-app-https-dns-proxy Stored XSS via resolver_urlopenwrt luci
- CVE-2026-10773Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)zephyrproject zephyr
- CVE-2026-2411Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic valueszephyrproject zephyr
- CVE-2026-18344Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameternik00726 Responsive Thumbnail Slider
- CVE-2026-15644Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attributecodesupplyco Powerkit – Supercharge your WordPress Site
- CVE-2026-6453CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parametercubewp1211 CubeWP Framework
- CVE-2025-14073WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information DisclosureWooCommerce PayPal Payments
- CVE-2026-17555WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameterwpvividplugins WPvivid — Backup, Migration & Staging
- CVE-2026-17571Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'wpmanageninja Fluent Forms – Customizable Contact Forms, Su…
- CVE-2026-15649Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributescodesupplyco Powerkit – Supercharge your WordPress Site
- CVE-2026-16091GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcoderubengc GamiPress – Gamification plugin to reward points, a…
- CVE-2026-17580Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpointswplakeorg Advanced Views – Display Custom Fields (ACF, Pods…
- CVE-2026-15950Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attributecozythemes Cozy Blocks – Page Builder for Gutenberg Editor…
- CVE-2026-18059PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key ValidationPixelYourSite – Your smart PIXEL (TAG) & API Manager · Pixe…
- CVE-2026-17605Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Fieldstiofansisland Payment forms, Buy now buttons, and Invoicin…
- CVE-2026-15951Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' ParameterIcegram Mailer – Reliable Email Deliverability, No-code SMT…
- CVE-2026-15018Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameterdavejesch Database Collation Fix
- CVE-2026-16614GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameterwesterndeal GSheetConnector – CF7 Google Sheets Connector
- CVE-2026-11995Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()saadiqbal Gutena Forms – Contact Form, Survey Form, Feedbac…
- CVE-2026-16685Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attributecodename065 Download Manager
- CVE-2026-16090GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcoderubengc GamiPress – Gamification plugin to reward points, a…
- CVE-2026-18062Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Contentstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2026-18435Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attributestellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2026-15645Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attributecodesupplyco Powerkit – Supercharge your WordPress Site
- CVE-2026-15662Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parametermihail-barinov Advanced Woo Labels – Product Labels & Badge…
- CVE-2026-15601Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)themeum Kirki – Freeform Page Builder, Website Builder & Cu…
- CVE-2026-13458GenerateBlocks <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributesedge22 GenerateBlocks
- CVE-2026-10782RealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Actioninspirythemes RealHomes Memberships
- CVE-2026-16087Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' ParameterIcegram Engage – Popups, Optins, CTAs & Lead Generation
- CVE-2026-16684Easy Property Listings <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'facebook' User Contact Methodmervb1 Easy Property Listings
- CVE-2026-2916Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Scriptjegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…
- CVE-2025-14469Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modificationmndpsingh287 Theme Editor
- CVE-2026-14840YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header SpoofingYOP Poll
- CVE-2026-14823Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOREvent Tickets and Registration
- CVE-2026-14822Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status ManipulationEvent Tickets and Registration
- CVE-2026-14561Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP DisclosureAuthora : Easy login with mobile number
- CVE-2026-14315Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event SubmissionPixel Tag Manager for WooCommerce
- CVE-2026-14292WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package TitleDownload Manager
- CVE-2026-14214Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass AssignmentBooking for Appointments and Events Calendar
- CVE-2026-14195Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_infoBrizy
- CVE-2026-13729Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRFPodlove Podcast Publisher
- CVE-2026-13604Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAXPixelavo
- CVE-2026-13329WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order RefundBuckaroo Woocommerce Payments Plugin
- CVE-2026-12696wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location FieldwpForo Forum
- CVE-2026-11882Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST RoutesBuilderall for WordPress
- CVE-2026-10827Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block AttributesSpectra Legacy
- CVE-2026-15234Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode AttributeCodeless Page Builder
- CVE-2026-15262Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value ColumnAdmin Columns for ACF Fields
- CVE-2026-14197Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDORFluent Support
- CVE-2026-12966Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX ActionsDirect Payments for WooCommerce
- CVE-2025-15669Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress LabelBit Form
- CVE-2026-15932Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path TraversalSupport Genix
- CVE-2026-15403Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameterdotonpaper Pinpoint Booking System –
- CVE-2026-13362SendPulse Email Marketing Newsletter <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via _sp_form_code Post MetaSendPulse Email Marketing Newsletter
- CVE-2026-7623SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attributebrainstormforce SureForms – Contact Form Builder, AI Forms,…