# CVEs published 2026-08-02

50 CVEs were published on August 2, 2026: 4 critical, 21 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-3245](https://cve.now/CVE-2026-3245.md): A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution. (CVSS 7.7, Canon Production Printing PRISMAproduction)
- [CVE-2026-18577](https://cve.now/CVE-2026-18577.md): Incomplete patch leads to administrative account takeover (CVSS 8.2, KEV, N-able N-central)
- [CVE-2026-10848](https://cve.now/CVE-2026-10848.md): Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse\_rpc\_msg) (CVSS 7.0, zephyrproject zephyr)
- [CVE-2026-9856](https://cve.now/CVE-2026-9856.md): Path Traversal in huggingface/transformers (CVSS 7.1, huggingface/transformers · transformers)
- [CVE-2026-65321](https://cve.now/CVE-2026-65321.md): PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS (CVSS 9.3, laughingman7743 PyAthena)
- [CVE-2026-10774](https://cve.now/CVE-2026-10774.md): PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS (CVSS 2.4, zephyrproject zephyr)
- [CVE-2026-68583](https://cve.now/CVE-2026-68583.md): luci-app-adblock-fast before 1.2.4-4 Stored XSS via file\_url.name (CVSS 5.1, openwrt luci)
- [CVE-2026-68582](https://cve.now/CVE-2026-68582.md): Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token (CVSS 9.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-68581](https://cve.now/CVE-2026-68581.md): Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision (CVSS 8.6, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-68580](https://cve.now/CVE-2026-68580.md): FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel (CVSS 7.7, FreeRDP)
- [CVE-2026-68579](https://cve.now/CVE-2026-68579.md): FreeRDP before 3.30.0 Heap Overflow via CliprdrStream\_Read (CVSS 8.7, FreeRDP)
- [CVE-2026-68578](https://cve.now/CVE-2026-68578.md): ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport (CVSS 7.7, ArcadeData arcadedb)
- [CVE-2026-67357](https://cve.now/CVE-2026-67357.md): ArcadeDB before 26.7.3 Information Disclosure via get\_server\_settings (CVSS 7.7, ArcadeData arcadedb)
- [CVE-2026-67356](https://cve.now/CVE-2026-67356.md): ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger (CVSS 8.7, ArcadeData arcadedb)
- [CVE-2025-71401](https://cve.now/CVE-2025-71401.md): better-auth before 1.4.2 basePath Modification DoS (CVSS 9.3, better-auth)
- [CVE-2025-71400](https://cve.now/CVE-2025-71400.md): better-auth passkey before 1.4.0 IDOR via delete-passkey (CVSS 7.1, better-auth passkey · @better-auth/passkey)
- [CVE-2025-71399](https://cve.now/CVE-2025-71399.md): Better Auth before 1.4.5 Path Normalization Bypass via rou3 (CVSS 8.8, better-auth)
- [CVE-2026-12231](https://cve.now/CVE-2026-12231.md): Exclusive Addons for Elementor \<= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad\_infobox\_image' (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2026-15236](https://cve.now/CVE-2026-15236.md): Gallery for Google Photos \< 1.2.1 - Unauthenticated Google OAuth Token Disclosure (CVSS 7.5, Gallery for Google Photos)
- [CVE-2026-13389](https://cve.now/CVE-2026-13389.md): WebToffee Cookie Consent \< 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes (CVSS 6.5, webtoffee-cookie-consent)
- [CVE-2025-15675](https://cve.now/CVE-2025-15675.md): Charitable \< 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text (CVSS 4.8, Charitable)
- [CVE-2026-16540](https://cve.now/CVE-2026-16540.md): Simply Schedule Appointments \< 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint (CVSS 7.5, Simply Schedule Appointments)
- [CVE-2026-16064](https://cve.now/CVE-2026-16064.md): Event Booking Manager for WooCommerce \< 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem\_quick\_edit\_event (CVSS 5.4, Event Booking Manager for WooCommerce)
- [CVE-2026-16063](https://cve.now/CVE-2026-16063.md): Event Booking Manager for WooCommerce \< 5.3.7 - Author+ Stored XSS via Event Timeline Content (CVSS 5.4, Event Booking Manager for WooCommerce)
- [CVE-2026-16062](https://cve.now/CVE-2026-16062.md): Event Booking Manager for WooCommerce \< 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content (CVSS 6.6, Event Booking Manager for WooCommerce)
- [CVE-2026-16292](https://cve.now/CVE-2026-16292.md): Frontend File Manager Plugin \<= 23.6 - File Metadata Update via CSRF (CVSS 5.4, Frontend File Manager Plugin)
- [CVE-2026-16291](https://cve.now/CVE-2026-16291.md): ProfileGrid \< 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR (CVSS 4.3, ProfileGrid)
- [CVE-2026-16285](https://cve.now/CVE-2026-16285.md): WooCommerce Product Attachment \< 2.3.3 - Unauthenticated Arbitrary Media Download (CVSS 7.5, Product Attachment for WooCommerce)
- [CVE-2026-16273](https://cve.now/CVE-2026-16273.md): Narrative Publisher \<= 1.0.7 - Contributor+ Stored XSS via narrative\_post\_script Post Meta (CVSS 4.6, Narrative Publisher)
- [CVE-2026-16261](https://cve.now/CVE-2026-16261.md): Huge IT Login \<= 1.0.4 - Unauthenticated Account Takeover (CVSS 7.5, login-social)
- [CVE-2026-16042](https://cve.now/CVE-2026-16042.md): LWS Optimize \< 3.4 - Subscriber+ Cache Deletion (CVSS 4.3, LWS Optimize)
- [CVE-2026-14817](https://cve.now/CVE-2026-14817.md): Element Pack Elementor Addons \< 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes (CVSS 6.8, Element Pack Addons for Elementor)
- [CVE-2026-12586](https://cve.now/CVE-2026-12586.md): Lenxel WP \<= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset (CVSS 8.1, Lenxel WP)
- [CVE-2026-11872](https://cve.now/CVE-2026-11872.md): Clever Mega Menu for Visual Composer \<= 1.0.1 - Subscriber+ Menu Item Meta Update via save\_clever\_menu\_item (CVSS 4.3, Clever Mega Menu for Visual Composer)
- [CVE-2026-16256](https://cve.now/CVE-2026-16256.md): Pouco Import Users \<= 1.0.0 - Unauthenticated Privilege Escalation (CVSS 9.8, POUCO Import Users)
- [CVE-2026-15939](https://cve.now/CVE-2026-15939.md): Simple Restrict \< 1.2.9 - Contributor+ Restricted Content Disclosure via REST API (CVSS 2.7, Simple Restrict)
- [CVE-2026-15385](https://cve.now/CVE-2026-15385.md): RT Mega Menu \< 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS (CVSS 5.4, RT Mega Menu)
- [CVE-2026-15248](https://cve.now/CVE-2026-15248.md): Meta Box \< 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR (CVSS 5.5, Meta Box)
- [CVE-2026-15241](https://cve.now/CVE-2026-15241.md): ChatBot for eCommerce – WoowBot \< 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld\_gemini\_response (CVSS 7.5, AI ChatBot for WooCommerce)
- [CVE-2026-15206](https://cve.now/CVE-2026-15206.md): SMS Alert Order Notifications – WooCommerce \< 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile (CVSS 7.5, SMS Alert)
- [CVE-2026-15151](https://cve.now/CVE-2026-15151.md): Five Star Restaurant Reservations \< 2.7.23 - Booking Manager+ Missing Authorization via rtb\_reset\_notifications (CVSS 7.5, Five Star Restaurant Reservations)
- [CVE-2026-14938](https://cve.now/CVE-2026-14938.md): FluentBoards \< 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR (CVSS 4.3, FluentBoards)
- [CVE-2026-14920](https://cve.now/CVE-2026-14920.md): AcyMailing \< 10.11.1 - Unauthenticated SQL Injection via subscription\[\] Parameter (CVSS 8.2, AcyMailing)
- [CVE-2026-14864](https://cve.now/CVE-2026-14864.md): JetEngine \< 3.8.12 - Contributor+ Stored XSS via jet\_engine Shortcode (CVSS 5.4, JetEngine)
- [CVE-2026-14841](https://cve.now/CVE-2026-14841.md): King Addons for Elementor \< 51.1.76 - Reflected XSS via Posts Grid Widget (CVSS 6.1, King Addons for Elementor)
- [CVE-2026-18573](https://cve.now/CVE-2026-18573.md): Keycloak-services: keycloak-services: client access-type policy condition bypass during client update (CVSS 6.5, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-18572](https://cve.now/CVE-2026-18572.md): Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes (CVSS 6.5, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-18571](https://cve.now/CVE-2026-18571.md): Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation (CVSS 6.6, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-18570](https://cve.now/CVE-2026-18570.md): Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed (CVSS 5.4, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-9335](https://cve.now/CVE-2026-9335.md): Improper Handling of HDF5 ExternalLinks in keras-team/keras (CVSS 6.5, keras-team/keras · keras)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.