CVEs published August 9, 2026
78 CVEs were published on August 9, 2026: 4 critical, 10 high.
- Published
- 78
- Critical
- 4
- High
- 10
- Medium
- 58
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- code-projects Task Management System
- 5
- MingSoft MCMS
- 3
- ash-project ash
- 2
- Create
- 2
- itsourcecode Hospital Management System
- 2
- lmammino oidc-authorizer
- 2
- NocteDefensor LudusMCP
- 2
- WP MAPS PRO
- 2
- 3CORESec Trapdoor
- 1
- abracadabra50 claude-sesh
- 1
Critical 4
- CVE-2026-19348Shenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injectionShenzhen Aitemi M300 Wi-Fi Repeater
- CVE-2026-15038InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on MultisiteInfiniteWP Client
- CVE-2026-18473WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' ParameterWP Directory Kit
- CVE-2026-71993MSI Radix AXE6600 v781521 Command Injection via openvpn functionMSI Radix AXE6600
High 10
- CVE-2026-19346Tenda CH22 CertListInfo formCertListInfo command injectionTenda CH22
- CVE-2026-19341UTT HiPER 1200GW pptpSrvGlobalConfig strcpy stack-based overflowUTT HiPER 1200GW
- CVE-2026-17017CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relationCubeWP Framework
- CVE-2026-18464WP Maps Pro < 6.1.3 - Unauthenticated Denial of ServiceWP MAPS PRO
- CVE-2026-18357WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data DisclosureWPC Order Tip for WooCommerce
- CVE-2026-18032WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization BypassWP Data Access
- CVE-2026-17044WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadidIptanus File Upload
- CVE-2026-16988GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST EndpointGeoDirectory
- CVE-2026-10595Path Traversal Vulnerability in parisneo/lollmsparisneo/lollms
- CVE-2026-17510Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attributeJONASBN Crypt::OpenSSL::PKCS12
Medium, low and unrated 64
- CVE-2026-19378code-projects Task Management System CommentSave.php cross site scriptingcode-projects Task Management System
- CVE-2026-19376Uasoft Badaso File API api.php class permissionUasoft Badaso
- CVE-2026-19375dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgerydmitriiweb article-scraper-mcp
- CVE-2026-19374adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgeryadafap api-mcp
- CVE-2026-12372Server-Side Request Forgery (SSRF) in nltk/nltknltk/nltk · nltk
- CVE-2026-19373PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgeryPhialsBasement KoboldCPP-MCP-Server
- CVE-2026-19372Handwriting-OCR handwriting-ocr-mcp-server upload_document index.ts fs.readFileSync path traversalhandwriting-ocr-mcp-server
- CVE-2026-19371Nikolaibibo claude-comfyui-mcp comfy_upload_image utils.ts copyFileSync path traversalNikolaibibo claude-comfyui-mcp
- CVE-2026-19370bartekke8it56w2 new-mcp geminithinking index.ts fs.readFileSync path traversalbartekke8it56w2 new-mcp
- CVE-2026-19369KS-GEN-AI jira-mcp-server add_attachment_from_public_url index.ts axios.get server-side request forgeryKS-GEN-AI jira-mcp-server
- CVE-2026-19368PV-Bhat gemsuite-mcp gemini_search unified-gemini.ts path traversalPV-Bhat gemsuite-mcp
- CVE-2026-19367NocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request forgeryNocteDefensor LudusMCP
- CVE-2026-19366NocteDefensor LudusMCP insert_creds_range_config insertCredsRangeConfig.ts path traversalNocteDefensor LudusMCP
- CVE-2026-70395Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ashash-project ash
- CVE-2026-19365Ichigo3766 image-gen-mcp upscale_images index.ts path traversalIchigo3766 image-gen-mcp
- CVE-2026-69659Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keysetash-project ash
- CVE-2026-19364itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql injectionitsourcecode Hospital Management System
- CVE-2026-15534Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatchperl
- CVE-2026-19363lmammino oidc-authorizer Lambda Authorizer handler.rs log filelmammino oidc-authorizer
- CVE-2026-19362lmammino oidc-authorizer Authorization Header Parsing parse_token_from_header.rs parse_token_from_header denial of servicelmammino oidc-authorizer
- CVE-2026-19361macrozheng mall mall-portal getAuthCode password recoverymacrozheng mall
- CVE-2026-19360wongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges managementwongcyrus ExcelLexBot
- CVE-2026-19359nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access controlnxp-auto-goldvip gvip
- CVE-2026-193583CORESec Trapdoor DefaultFunction access control3CORESec Trapdoor
- CVE-2026-19357MingSoft MCMS ms-mdiy get information disclosureMingSoft MCMS
- CVE-2026-19356MingSoft MCMS ms-mdiy list information disclosureMingSoft MCMS
- CVE-2026-19355MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injectionMingSoft MCMS
- CVE-2026-19354lock-upme OPMS IN Clause message.go sql injectionlock-upme OPMS
- CVE-2026-19353DedeCMS Installation Wizard index.php _4_Setup file inclusionDedeCMS
- CVE-2026-19352mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgerymifi lossless-cut
- CVE-2026-19351dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injectiondresende node-sql-query
- CVE-2026-19350Dolibarr ERP TakePOS invoice.php fail authorizationDolibarr ERP
- CVE-2026-19347itsourcecode Hospital Management System viewdoctor.php sql injectionitsourcecode Hospital Management System
- CVE-2026-19345code-projects Task Management System UpdateTaskStatus.php authorizationcode-projects Task Management System
- CVE-2026-19344code-projects Task Management System comment_count_user.php sql injectioncode-projects Task Management System
- CVE-2026-19343code-projects Task Management System AdminLogin.php sql injectioncode-projects Task Management System
- CVE-2026-19342code-projects Task Management System Login index.php improper authenticationcode-projects Task Management System
- CVE-2026-19340anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgeryanubissbe ProjectHub-Mcp
- CVE-2026-19339aliyun alibabacloud-dataworks-mcp-server initResources.ts ReadResourceRequestSchema server-side request forgeryaliyun alibabacloud-dataworks-mcp-server
- CVE-2026-19338automateyournetwork MCPyATS generate_mermaid_markdown index.ts processGenerateRequest path traversalautomateyournetwork MCPyATS
- CVE-2026-16032LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User MonitoringLWS Optimize
- CVE-2026-18603Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX ActionsPiWeb Cancel order / Refund request for WooCommerce
- CVE-2026-18465WP Maps Pro < 6.1.3 - Unauthenticated Local File InclusionWP MAPS PRO
- CVE-2026-18037Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and PublicationCreate
- CVE-2026-17014WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzipsWP Photo Album Plus
- CVE-2026-17011Nexter Blocks < 5.0.2 - Contributor+ Stored CSS InjectionNexter Blocks
- CVE-2026-16992Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and PublicationCreate
- CVE-2026-16965Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_statusSolace Extra
- CVE-2026-16957Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta DisclosureSlim SEO
- CVE-2026-19337adenot mcp-google-search read_webpage index.ts server-side request forgeryadenot mcp-google-search
- CVE-2026-19336Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path traversalPimzino spec-workflow-mcp
- CVE-2026-19335Jane-xiaoer skill-vision-control config.ts getSkillVersionsDir path traversalJane-xiaoer skill-vision-control
- CVE-2026-19334NightTrek Ollama-mcp index.ts command injectionNightTrek Ollama-mcp
- CVE-2026-19333NightTrek Supabase-MCP generate_types command injectionNightTrek Supabase-MCP
- CVE-2026-19332NellyW8 MCP4EDA run_openlane/view_waveform command injectionNellyW8 MCP4EDA
- CVE-2026-19331bazylhorsey obsidian-mcp-server CanvasService.ts writeCanvas path traversalbazylhorsey obsidian-mcp-server
- CVE-2026-19330angrysky56 advanced-reasoning-mcp index.ts switch_memory_library path traversalangrysky56 advanced-reasoning-mcp
- CVE-2026-19329andreahaku codex_mcp ask MCP Tool codex-process-simple.ts command injectionandreahaku codex_mcp
- CVE-2026-19328aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversalaktsmm skill-ninja-mcp-server
- CVE-2026-19327abracadabra50 claude-sesh enricher.ts enrichSession path traversalabracadabra50 claude-sesh
- CVE-2026-19326Jevon-Zhong Ai-doctor filemanagement.service.ts deleteImage path traversalJevon-Zhong Ai-doctor
- CVE-2026-19325IncomeStreamSurfer roo-code-memory-bank-mcp-server read_memory_bank_file/append_memory_bank_entry index.ts appendMemoryBankEntry path traversalIncomeStreamSurfer roo-code-memory-bank-mcp-server
- CVE-2026-19324HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversalHelloGGX shadcn-vue-mcp
- CVE-2026-19323azer react-analyzer-mcp analyze-projec index.ts generateProjectDocs path traversalazer react-analyzer-mcp