CVEs published August 8, 2026
62 CVEs were published on August 8, 2026: 27 critical, 8 high.
- Published
- 62
- Critical
- 27
- High
- 8
- Medium
- 26
- Low
- 0
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 47
Most affected products
- D-Link DWR-M961
- 15
- MSI Radix AXE6600
- 10
- WP Directory Kit
- 4
- AI Engine
- 2
- Legion of the Bouncy Castle BC-FJA · org.bouncycastle:bc-fi…
- 2
- Linux
- 2
- Newsletters
- 2
- YMC Filter
- 2
- aaronsb memory-graph
- 1
- abdullah1854 MCPGateway
- 1
Critical 27
- CVE-2026-71992MSI Radix AXE6600 v781521 Command Injection via macfilterMSI Radix AXE6600
- CVE-2026-71991MSI Radix AXE6600 v781521 Command Injection via TelnetSSH FunctionMSI Radix AXE6600
- CVE-2026-71990MSI Radix AXE6600 v781521 Command Injection via TelnetSSH FunctionMSI Radix AXE6600
- CVE-2026-71989MSI Radix AXE6600 v781521 Command Injection via porTrigger functionMSI Radix AXE6600
- CVE-2026-71988MSI Radix AXE6600 v781521 Command Injection via portFw functionMSI Radix AXE6600
- CVE-2026-71987MSI Radix AXE6600 v781521 Command Injection via alg functionMSI Radix AXE6600
- CVE-2026-71986MSI Radix AXE6600 v781521 Command Injection via dmz FunctionMSI Radix AXE6600
- CVE-2026-71985MSI Radix AXE6600 v781521 Command Injection via accesscontrol FunctionMSI Radix AXE6600
- CVE-2026-71984MSI Radix AXE6600 v781521 Command Injection via urlfilterMSI Radix AXE6600
- CVE-2026-71983MSI Radix AXE6600 v781521 Command Injection via wps.cgiMSI Radix AXE6600
- CVE-2026-71958D-Link DWR-M961 Buffer Overflow via quicksetup.cgiD-Link DWR-M961
- CVE-2026-71957D-Link DWR-M961 Buffer Overflow via app.cgiD-Link DWR-M961
- CVE-2026-71956D-Link DWR-M961 Command Injection via app.cgiD-Link DWR-M961
- CVE-2026-71955D-Link DWR-M961 Command Injection via /boafrm/formWscD-Link DWR-M961
- CVE-2026-71954D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetupD-Link DWR-M961
- CVE-2026-71953D-Link DWR-M961 Command Injection via /boafrm/formNtpD-Link DWR-M961
- CVE-2026-71952D-Link DWR-M961 Command Injection via /boafrm/formPinManageSetupD-Link DWR-M961
- CVE-2026-71951D-Link DWR-M961 Command Injection via /boafrm/formIMEISetupD-Link DWR-M961
- CVE-2026-71950D-Link DWR-M961 Command Injection via /boafrm/formSmsManageD-Link DWR-M961
- CVE-2026-71949D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetupD-Link DWR-M961
- CVE-2026-71948D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRunD-Link DWR-M961
- CVE-2026-71947D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRunD-Link DWR-M961
- CVE-2026-71946D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRunD-Link DWR-M961
- CVE-2026-71945D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocomD-Link DWR-M961
- CVE-2026-71944D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectelD-Link DWR-M961
- CVE-2026-68082libceph: fix two unsafe bare decodes in decode_lockers()Linux
- CVE-2026-14526AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Routewupsales AI Copilot – Content Generator
High 8
- CVE-2026-42170Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)Red Hat Enterprise Linux
- CVE-2026-16948Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce ExposureSolace Extra
- CVE-2026-16594WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key DisclosureWP Directory Kit
- CVE-2026-16589WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list ParameterWP Directory Kit
- CVE-2026-16578Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST RouteAdmin Safety Guard — Login Security, Limit Logins, 2FA & Br…
- CVE-2026-16267Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form FieldNewsletters
- CVE-2026-13505Zeroisation of sensitive key material on garbage collection relies on finalizationLegion of the Bouncy Castle BC-FJA · org.bouncycastle:bc-fi…
- CVE-2026-8798Native entropy source retries the CPU entropy instructions without limitLegion of the Bouncy Castle BC-FJA · org.bouncycastle:bc-fi…
Medium, low and unrated 27
- CVE-2026-67620Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-ListFlowiseAI Flowise
- CVE-2026-19288astralisone rive-mcp-server-core importRiveFile Flow importRiveFile.ts path traversalastralisone rive-mcp-server-core
- CVE-2026-19287abrinsmead mindpilot-mcp HistoryService path traversalabrinsmead mindpilot-mcp
- CVE-2026-19285aaronsb memory-graph memoryTools.ts JsonMemoryStorage.saveMemories path traversalaaronsb memory-graph
- CVE-2026-19284MauricioMilano coder-api Projects Endpoint projects.ts createProject command injectionMauricioMilano coder-api
- CVE-2026-19282andreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injectionandreahaku llm_memory_mcp
- CVE-2026-19281adolfosalasgomez3011 slidev-builder-mcp generateAssets Tool generateAssets.ts generateChart command injectionadolfosalasgomez3011 slidev-builder-mcp
- CVE-2026-19279MIMICLab mcp-pdf-vision index.ts load_pdf command injectionMIMICLab mcp-pdf-vision
- CVE-2026-68081KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest stateLinux
- CVE-2026-19270Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversalHulupeep mcp-ui-probe
- CVE-2026-19268abdullah1854 MCPGateway Claude Usage Range Endpoint claude-usage.ts getUsageByDateRange command injectionabdullah1854 MCPGateway
- CVE-2026-19266Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injectionKirachon context-engine
- CVE-2026-19263INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injectionINQUIRELAB mcp-bridge-api
- CVE-2026-16955AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio TranscriptionAI Engine
- CVE-2026-16953AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session CookieAI Engine
- CVE-2026-16608Download Monitor < 5.2.6 - Unauthenticated Download Log InjectionDownload Monitor
- CVE-2026-16595WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing DisclosureWP Directory Kit
- CVE-2026-16590WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data DisclosureWP Directory Kit
- CVE-2026-16574Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST EndpointDokan: AI Powered WooCommerce Multivendor Marketplace Solut…
- CVE-2026-16562WP Statistics < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX HandlersWP Statistics
- CVE-2026-16559YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon UploadYMC Filter
- CVE-2026-16558YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder SchemaYMC Filter
- CVE-2026-16535Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabelLink Library
- CVE-2026-16282Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost ParameterAppointment Hour Booking
- CVE-2026-16269Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type JugglingNewsletters
- CVE-2026-19259MZ Automation libiec61850 MMS Protocol Workflow iec61850_common.c MmsMapping_varAccessSpecToObjectReference heap-based overflowMZ Automation libiec61850
- CVE-2026-18988Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attributeshapedplugin Easy Accordion – AI-Powered FAQ & Accordion Bl…