CVEs published August 2, 2026
50 CVEs were published on August 2, 2026: 4 critical, 21 high. 1 is now in CISA KEV.
- Published
- 50
- Critical
- 4
- High
- 21
- Medium
- 23
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 37
Most affected products
- Red Hat build of Keycloak · Red Hat Data Grid +2
- 4
- ArcadeData arcadedb
- 3
- Event Booking Manager for WooCommerce
- 3
- better-auth
- 2
- FreeRDP
- 2
- go-vikunja vikunja · code.vikunja.io/api
- 2
- zephyrproject zephyr
- 2
- AcyMailing
- 1
- AI ChatBot for WooCommerce
- 1
- better-auth passkey · @better-auth/passkey
- 1
Critical 4
- CVE-2026-65321PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTASlaughingman7743 PyAthena
- CVE-2026-68582Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Tokengo-vikunja vikunja · code.vikunja.io/api
- CVE-2025-71401better-auth before 1.4.2 basePath Modification DoSbetter-auth
- CVE-2026-16256Pouco Import Users <= 1.0.0 - Unauthenticated Privilege EscalationPOUCO Import Users
High 21
- CVE-2026-3245A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution.Canon Production Printing PRISMAproduction
- CVE-2026-18577Incomplete patch leads to administrative account takeoverN-able N-central
- CVE-2026-10848Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)zephyrproject zephyr
- CVE-2026-9856Path Traversal in huggingface/transformershuggingface/transformers · transformers
- CVE-2026-68581Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collisiongo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-68580FreeRDP before 3.29.0 Integer Overflow via Audio Input ChannelFreeRDP
- CVE-2026-68579FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_ReadFreeRDP
- CVE-2026-68578ArcadeDB before 26.7.3 Authentication Bypass via MCP TransportArcadeData arcadedb
- CVE-2026-67357ArcadeDB before 26.7.3 Information Disclosure via get_server_settingsArcadeData arcadedb
- CVE-2026-67356ArcadeDB before 26.7.3 Privilege Escalation via JavaScript TriggerArcadeData arcadedb
- CVE-2025-71400better-auth passkey before 1.4.0 IDOR via delete-passkeybetter-auth passkey · @better-auth/passkey
- CVE-2025-71399Better Auth before 1.4.5 Path Normalization Bypass via rou3better-auth
- CVE-2026-15236Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token DisclosureGallery for Google Photos
- CVE-2026-16540Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge EndpointSimply Schedule Appointments
- CVE-2026-16285WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media DownloadProduct Attachment for WooCommerce
- CVE-2026-16261Huge IT Login <= 1.0.4 - Unauthenticated Account Takeoverlogin-social
- CVE-2026-12586Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password ResetLenxel WP
- CVE-2026-15241ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_responseAI ChatBot for WooCommerce
- CVE-2026-15206SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-MobileSMS Alert
- CVE-2026-15151Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notificationsFive Star Restaurant Reservations
- CVE-2026-14920AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] ParameterAcyMailing
Medium, low and unrated 25
- CVE-2026-10774PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoSzephyrproject zephyr
- CVE-2026-68583luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.nameopenwrt luci
- CVE-2026-12231Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'timstrifler Exclusive Addons for Elementor
- CVE-2026-13389WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routeswebtoffee-cookie-consent
- CVE-2025-15675Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT TextCharitable
- CVE-2026-16064Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_eventEvent Booking Manager for WooCommerce
- CVE-2026-16063Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline ContentEvent Booking Manager for WooCommerce
- CVE-2026-16062Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ ContentEvent Booking Manager for WooCommerce
- CVE-2026-16292Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRFFrontend File Manager Plugin
- CVE-2026-16291ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDORProfileGrid
- CVE-2026-16273Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post MetaNarrative Publisher
- CVE-2026-16042LWS Optimize < 3.4 - Subscriber+ Cache DeletionLWS Optimize
- CVE-2026-14817Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data AttributesElement Pack Addons for Elementor
- CVE-2026-11872Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_itemClever Mega Menu for Visual Composer
- CVE-2026-15939Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST APISimple Restrict
- CVE-2026-15385RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSSRT Mega Menu
- CVE-2026-15248Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDORMeta Box
- CVE-2026-14938FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDORFluentBoards
- CVE-2026-14864JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine ShortcodeJetEngine
- CVE-2026-14841King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid WidgetKing Addons for Elementor
- CVE-2026-18573Keycloak-services: keycloak-services: client access-type policy condition bypass during client updateRed Hat build of Keycloak · Red Hat Data Grid +2
- CVE-2026-18572Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributesRed Hat build of Keycloak · Red Hat Data Grid +2
- CVE-2026-18571Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creationRed Hat build of Keycloak · Red Hat Data Grid +2
- CVE-2026-18570Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowedRed Hat build of Keycloak · Red Hat Data Grid +2
- CVE-2026-9335Improper Handling of HDF5 ExternalLinks in keras-team/keraskeras-team/keras · keras