# CVEs published 2026-08-08

62 CVEs were published on August 8, 2026: 27 critical, 8 high. Days are UTC.

- [CVE-2026-71992](https://cve.now/CVE-2026-71992.md): MSI Radix AXE6600 v781521 Command Injection via macfilter (CVSS 9.3, MSI Radix AXE6600)
- [CVE-2026-71991](https://cve.now/CVE-2026-71991.md): MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function (CVSS 9.3, MSI Radix AXE6600)
- [CVE-2026-71990](https://cve.now/CVE-2026-71990.md): MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function (CVSS 9.3, MSI Radix AXE6600)
- [CVE-2026-71989](https://cve.now/CVE-2026-71989.md): MSI Radix AXE6600 v781521 Command Injection via porTrigger function (CVSS 9.3, MSI Radix AXE6600)
- [CVE-2026-71988](https://cve.now/CVE-2026-71988.md): MSI Radix AXE6600 v781521 Command Injection via portFw function (CVSS 9.3, MSI Radix AXE6600)
- [CVE-2026-71987](https://cve.now/CVE-2026-71987.md): MSI Radix AXE6600 v781521 Command Injection via alg function (CVSS 9.3, MSI Radix AXE6600)
- [CVE-2026-71986](https://cve.now/CVE-2026-71986.md): MSI Radix AXE6600 v781521 Command Injection via dmz Function (CVSS 9.3, MSI Radix AXE6600)
- [CVE-2026-71985](https://cve.now/CVE-2026-71985.md): MSI Radix AXE6600 v781521 Command Injection via accesscontrol Function (CVSS 9.3, MSI Radix AXE6600)
- [CVE-2026-71984](https://cve.now/CVE-2026-71984.md): MSI Radix AXE6600 v781521 Command Injection via urlfilter (CVSS 9.3, MSI Radix AXE6600)
- [CVE-2026-71983](https://cve.now/CVE-2026-71983.md): MSI Radix AXE6600 v781521 Command Injection via wps.cgi (CVSS 9.3, MSI Radix AXE6600)
- [CVE-2026-71958](https://cve.now/CVE-2026-71958.md): D-Link DWR-M961 Buffer Overflow via quicksetup.cgi (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71957](https://cve.now/CVE-2026-71957.md): D-Link DWR-M961 Buffer Overflow via app.cgi (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71956](https://cve.now/CVE-2026-71956.md): D-Link DWR-M961 Command Injection via app.cgi (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71955](https://cve.now/CVE-2026-71955.md): D-Link DWR-M961 Command Injection via /boafrm/formWsc (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71954](https://cve.now/CVE-2026-71954.md): D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71953](https://cve.now/CVE-2026-71953.md): D-Link DWR-M961 Command Injection via /boafrm/formNtp (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71952](https://cve.now/CVE-2026-71952.md): D-Link DWR-M961 Command Injection via /boafrm/formPinManageSetup (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71951](https://cve.now/CVE-2026-71951.md): D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71950](https://cve.now/CVE-2026-71950.md): D-Link DWR-M961 Command Injection via /boafrm/formSmsManage (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71949](https://cve.now/CVE-2026-71949.md): D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71948](https://cve.now/CVE-2026-71948.md): D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71947](https://cve.now/CVE-2026-71947.md): D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71946](https://cve.now/CVE-2026-71946.md): D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71945](https://cve.now/CVE-2026-71945.md): D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-71944](https://cve.now/CVE-2026-71944.md): D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel (CVSS 9.3, D-Link DWR-M961)
- [CVE-2026-67620](https://cve.now/CVE-2026-67620.md): Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List (CVSS 6.3, FlowiseAI Flowise)
- [CVE-2026-42170](https://cve.now/CVE-2026-42170.md): Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load\_layer() (ddsread.c) (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-19288](https://cve.now/CVE-2026-19288.md): astralisone rive-mcp-server-core importRiveFile Flow importRiveFile.ts path traversal (CVSS 4.8, astralisone rive-mcp-server-core)
- [CVE-2026-19287](https://cve.now/CVE-2026-19287.md): abrinsmead mindpilot-mcp HistoryService path traversal (CVSS 4.8, abrinsmead mindpilot-mcp)
- [CVE-2026-19285](https://cve.now/CVE-2026-19285.md): aaronsb memory-graph memoryTools.ts JsonMemoryStorage.saveMemories path traversal (CVSS 4.8, aaronsb memory-graph)
- [CVE-2026-19284](https://cve.now/CVE-2026-19284.md): MauricioMilano coder-api Projects Endpoint projects.ts createProject command injection (CVSS 4.8, MauricioMilano coder-api)
- [CVE-2026-19282](https://cve.now/CVE-2026-19282.md): andreahaku llm\_memory\_mcp GitHooksManager.ts auto.capture command injection (CVSS 4.8, andreahaku llm\_memory\_mcp)
- [CVE-2026-19281](https://cve.now/CVE-2026-19281.md): adolfosalasgomez3011 slidev-builder-mcp generateAssets Tool generateAssets.ts generateChart command injection (CVSS 4.8, adolfosalasgomez3011 slidev-builder-mcp)
- [CVE-2026-19279](https://cve.now/CVE-2026-19279.md): MIMICLab mcp-pdf-vision index.ts load\_pdf command injection (CVSS 4.8, MIMICLab mcp-pdf-vision)
- [CVE-2026-68082](https://cve.now/CVE-2026-68082.md): libceph: fix two unsafe bare decodes in decode\_lockers() (CVSS 9.8, Linux)
- [CVE-2026-68081](https://cve.now/CVE-2026-68081.md): KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (no CVSS, Linux)
- [CVE-2026-19270](https://cve.now/CVE-2026-19270.md): Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage\_stats path traversal (CVSS 4.8, Hulupeep mcp-ui-probe)
- [CVE-2026-19268](https://cve.now/CVE-2026-19268.md): abdullah1854 MCPGateway Claude Usage Range Endpoint claude-usage.ts getUsageByDateRange command injection (CVSS 5.3, abdullah1854 MCPGateway)
- [CVE-2026-19266](https://cve.now/CVE-2026-19266.md): Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection (CVSS 5.1, Kirachon context-engine)
- [CVE-2026-19263](https://cve.now/CVE-2026-19263.md): INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection (CVSS 6.9, INQUIRELAB mcp-bridge-api)
- [CVE-2026-14526](https://cve.now/CVE-2026-14526.md): AI Copilot – Content Generator \<= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route (CVSS 9.8, wupsales AI Copilot – Content Generator)
- [CVE-2026-16955](https://cve.now/CVE-2026-16955.md): AI Engine \< 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription (CVSS 5.0, AI Engine)
- [CVE-2026-16953](https://cve.now/CVE-2026-16953.md): AI Engine \< 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie (CVSS 4.8, AI Engine)
- [CVE-2026-16948](https://cve.now/CVE-2026-16948.md): Solace Extra \< 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure (CVSS 8.1, Solace Extra)
- [CVE-2026-16608](https://cve.now/CVE-2026-16608.md): Download Monitor \< 5.2.6 - Unauthenticated Download Log Injection (CVSS 5.3, Download Monitor)
- [CVE-2026-16595](https://cve.now/CVE-2026-16595.md): WP Directory Kit \< 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure (CVSS 6.5, WP Directory Kit)
- [CVE-2026-16594](https://cve.now/CVE-2026-16594.md): WP Directory Kit \< 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure (CVSS 7.5, WP Directory Kit)
- [CVE-2026-16590](https://cve.now/CVE-2026-16590.md): WP Directory Kit \< 1.5.5 - Subscriber+ Contact Message and User Data Disclosure (CVSS 6.5, WP Directory Kit)
- [CVE-2026-16589](https://cve.now/CVE-2026-16589.md): WP Directory Kit \< 1.5.5 - Subscriber+ SQL Injection via data\_fields\_list Parameter (CVSS 7.7, WP Directory Kit)
- [CVE-2026-16578](https://cve.now/CVE-2026-16578.md): Admin Safety Guard \< 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route (CVSS 7.5, Admin Safety Guard — Login Security, Limit Logins, 2FA & Br…)
- [CVE-2026-16574](https://cve.now/CVE-2026-16574.md): Dokan \< 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint (CVSS 5.4, Dokan: AI Powered WooCommerce Multivendor Marketplace Solut…)
- [CVE-2026-16562](https://cve.now/CVE-2026-16562.md): WP Statistics \< 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers (CVSS 6.5, WP Statistics)
- [CVE-2026-16559](https://cve.now/CVE-2026-16559.md): YMC Filter \< 3.12.9 - Author+ Stored XSS via SVG Icon Upload (CVSS 6.8, YMC Filter)
- [CVE-2026-16558](https://cve.now/CVE-2026-16558.md): YMC Filter \< 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema (CVSS 5.4, YMC Filter)
- [CVE-2026-16535](https://cve.now/CVE-2026-16535.md): Link Library \< 7.9.4 - Reflected XSS via Thumbs-Rating likelabel (CVSS 6.1, Link Library)
- [CVE-2026-16282](https://cve.now/CVE-2026-16282.md): Appointment Hour Booking \< 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter (CVSS 5.3, Appointment Hour Booking)
- [CVE-2026-16269](https://cve.now/CVE-2026-16269.md): Newsletters \< 4.16 - Unauthenticated API Authentication Bypass via Type Juggling (CVSS 4.8, Newsletters)
- [CVE-2026-16267](https://cve.now/CVE-2026-16267.md): Newsletters \< 4.16 - Unauthenticated PHP Object Injection via Date Form Field (CVSS 8.1, Newsletters)
- [CVE-2026-19259](https://cve.now/CVE-2026-19259.md): MZ Automation libiec61850 MMS Protocol Workflow iec61850\_common.c MmsMapping\_varAccessSpecToObjectReference heap-based overflow (CVSS 4.8, MZ Automation libiec61850)
- [CVE-2026-18988](https://cve.now/CVE-2026-18988.md): Easy Accordion \<= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute (CVSS 6.4, shapedplugin Easy Accordion – AI-Powered FAQ & Accordion Bl…)
- [CVE-2026-13505](https://cve.now/CVE-2026-13505.md): Zeroisation of sensitive key material on garbage collection relies on finalization (CVSS 8.7, Legion of the Bouncy Castle BC-FJA · org.bouncycastle:bc-fi…)
- [CVE-2026-8798](https://cve.now/CVE-2026-8798.md): Native entropy source retries the CPU entropy instructions without limit (CVSS 8.7, Legion of the Bouncy Castle BC-FJA · org.bouncycastle:bc-fi…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.