# CVEs published 2026-08-09

78 CVEs were published on August 9, 2026: 4 critical, 10 high. Days are UTC.

- [CVE-2026-19378](https://cve.now/CVE-2026-19378.md): code-projects Task Management System CommentSave.php cross site scripting (CVSS 5.3, code-projects Task Management System)
- [CVE-2026-19376](https://cve.now/CVE-2026-19376.md): Uasoft Badaso File API api.php class permission (CVSS 6.9, Uasoft Badaso)
- [CVE-2026-19375](https://cve.now/CVE-2026-19375.md): dmitriiweb article-scraper-mcp server.py fetch\_article server-side request forgery (CVSS 5.3, dmitriiweb article-scraper-mcp)
- [CVE-2026-19374](https://cve.now/CVE-2026-19374.md): adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery (CVSS 6.9, adafap api-mcp)
- [CVE-2026-12372](https://cve.now/CVE-2026-12372.md): Server-Side Request Forgery (SSRF) in nltk/nltk (CVSS 3.7, nltk/nltk · nltk)
- [CVE-2026-19373](https://cve.now/CVE-2026-19373.md): PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery (CVSS 4.8, PhialsBasement KoboldCPP-MCP-Server)
- [CVE-2026-19372](https://cve.now/CVE-2026-19372.md): Handwriting-OCR handwriting-ocr-mcp-server upload\_document index.ts fs.readFileSync path traversal (CVSS 4.8, handwriting-ocr-mcp-server)
- [CVE-2026-19371](https://cve.now/CVE-2026-19371.md): Nikolaibibo claude-comfyui-mcp comfy\_upload\_image utils.ts copyFileSync path traversal (CVSS 4.8, Nikolaibibo claude-comfyui-mcp)
- [CVE-2026-19370](https://cve.now/CVE-2026-19370.md): bartekke8it56w2 new-mcp geminithinking index.ts fs.readFileSync path traversal (CVSS 4.8, bartekke8it56w2 new-mcp)
- [CVE-2026-19369](https://cve.now/CVE-2026-19369.md): KS-GEN-AI jira-mcp-server add\_attachment\_from\_public\_url index.ts axios.get server-side request forgery (CVSS 4.8, KS-GEN-AI jira-mcp-server)
- [CVE-2026-19368](https://cve.now/CVE-2026-19368.md): PV-Bhat gemsuite-mcp gemini\_search unified-gemini.ts path traversal (CVSS 4.8, PV-Bhat gemsuite-mcp)
- [CVE-2026-19367](https://cve.now/CVE-2026-19367.md): NocteDefensor LudusMCP read\_range\_config rangeConfig.ts server-side request forgery (CVSS 5.3, NocteDefensor LudusMCP)
- [CVE-2026-19366](https://cve.now/CVE-2026-19366.md): NocteDefensor LudusMCP insert\_creds\_range\_config insertCredsRangeConfig.ts path traversal (CVSS 4.8, NocteDefensor LudusMCP)
- [CVE-2026-70395](https://cve.now/CVE-2026-70395.md): Predicate injection in manage\_relationship belongs\_to lookup discloses secret lookup keys in Ash (CVSS 2.1, ash-project ash)
- [CVE-2026-19365](https://cve.now/CVE-2026-19365.md): Ichigo3766 image-gen-mcp upscale\_images index.ts path traversal (CVSS 4.8, Ichigo3766 image-gen-mcp)
- [CVE-2026-69659](https://cve.now/CVE-2026-69659.md): Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset (CVSS 5.9, ash-project ash)
- [CVE-2026-19364](https://cve.now/CVE-2026-19364.md): itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-15534](https://cve.now/CVE-2026-15534.md): Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S\_regmatch (CVSS 5.7, perl)
- [CVE-2026-19363](https://cve.now/CVE-2026-19363.md): lmammino oidc-authorizer Lambda Authorizer handler.rs log file (CVSS 6.9, lmammino oidc-authorizer)
- [CVE-2026-19362](https://cve.now/CVE-2026-19362.md): lmammino oidc-authorizer Authorization Header Parsing parse\_token\_from\_header.rs parse\_token\_from\_header denial of service (CVSS 6.9, lmammino oidc-authorizer)
- [CVE-2026-19361](https://cve.now/CVE-2026-19361.md): macrozheng mall mall-portal getAuthCode password recovery (CVSS 6.3, macrozheng mall)
- [CVE-2026-19360](https://cve.now/CVE-2026-19360.md): wongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges management (CVSS 5.1, wongcyrus ExcelLexBot)
- [CVE-2026-19359](https://cve.now/CVE-2026-19359.md): nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control (CVSS 5.1, nxp-auto-goldvip gvip)
- [CVE-2026-19358](https://cve.now/CVE-2026-19358.md): 3CORESec Trapdoor DefaultFunction access control (CVSS 5.3, 3CORESec Trapdoor)
- [CVE-2026-19357](https://cve.now/CVE-2026-19357.md): MingSoft MCMS ms-mdiy get information disclosure (CVSS 6.9, MingSoft MCMS)
- [CVE-2026-19356](https://cve.now/CVE-2026-19356.md): MingSoft MCMS ms-mdiy list information disclosure (CVSS 6.9, MingSoft MCMS)
- [CVE-2026-19355](https://cve.now/CVE-2026-19355.md): MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection (CVSS 6.9, MingSoft MCMS)
- [CVE-2026-19354](https://cve.now/CVE-2026-19354.md): lock-upme OPMS IN Clause message.go sql injection (CVSS 5.3, lock-upme OPMS)
- [CVE-2026-19353](https://cve.now/CVE-2026-19353.md): DedeCMS Installation Wizard index.php \_4\_Setup file inclusion (CVSS 2.3, DedeCMS)
- [CVE-2026-19352](https://cve.now/CVE-2026-19352.md): mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery (CVSS 2.3, mifi lossless-cut)
- [CVE-2026-19351](https://cve.now/CVE-2026-19351.md): dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection (CVSS 6.9, dresende node-sql-query)
- [CVE-2026-19350](https://cve.now/CVE-2026-19350.md): Dolibarr ERP TakePOS invoice.php fail authorization (CVSS 5.3, Dolibarr ERP)
- [CVE-2026-19348](https://cve.now/CVE-2026-19348.md): Shenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injection (CVSS 9.3, Shenzhen Aitemi M300 Wi-Fi Repeater)
- [CVE-2026-19347](https://cve.now/CVE-2026-19347.md): itsourcecode Hospital Management System viewdoctor.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-19346](https://cve.now/CVE-2026-19346.md): Tenda CH22 CertListInfo formCertListInfo command injection (CVSS 8.7, Tenda CH22)
- [CVE-2026-19345](https://cve.now/CVE-2026-19345.md): code-projects Task Management System UpdateTaskStatus.php authorization (CVSS 6.9, code-projects Task Management System)
- [CVE-2026-19344](https://cve.now/CVE-2026-19344.md): code-projects Task Management System comment\_count\_user.php sql injection (CVSS 6.9, code-projects Task Management System)
- [CVE-2026-19343](https://cve.now/CVE-2026-19343.md): code-projects Task Management System AdminLogin.php sql injection (CVSS 6.9, code-projects Task Management System)
- [CVE-2026-19342](https://cve.now/CVE-2026-19342.md): code-projects Task Management System Login index.php improper authentication (CVSS 6.9, code-projects Task Management System)
- [CVE-2026-19341](https://cve.now/CVE-2026-19341.md): UTT HiPER 1200GW pptpSrvGlobalConfig strcpy stack-based overflow (CVSS 8.7, UTT HiPER 1200GW)
- [CVE-2026-19340](https://cve.now/CVE-2026-19340.md): anubissbe ProjectHub-Mcp Webhooks API complete\_backend.js server-side request forgery (CVSS 5.3, anubissbe ProjectHub-Mcp)
- [CVE-2026-19339](https://cve.now/CVE-2026-19339.md): aliyun alibabacloud-dataworks-mcp-server initResources.ts ReadResourceRequestSchema server-side request forgery (CVSS 5.3, aliyun alibabacloud-dataworks-mcp-server)
- [CVE-2026-19338](https://cve.now/CVE-2026-19338.md): automateyournetwork MCPyATS generate\_mermaid\_markdown index.ts processGenerateRequest path traversal (CVSS 4.8, automateyournetwork MCPyATS)
- [CVE-2026-17017](https://cve.now/CVE-2026-17017.md): CubeWP Framework \< 1.1.31 - Subscriber+ SQL Injection via cubewp\_remove\_relation (CVSS 8.1, CubeWP Framework)
- [CVE-2026-16032](https://cve.now/CVE-2026-16032.md): LWS Optimize \< 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring (CVSS 6.1, LWS Optimize)
- [CVE-2026-15038](https://cve.now/CVE-2026-15038.md): InfiniteWP Client \< 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite (CVSS 9.8, InfiniteWP Client)
- [CVE-2026-18603](https://cve.now/CVE-2026-18603.md): Cancel Order & Request Woocommerce \< 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions (CVSS 6.5, PiWeb Cancel order / Refund request for WooCommerce)
- [CVE-2026-18473](https://cve.now/CVE-2026-18473.md): WP Directory Kit \< 1.5.5 - Unauthenticated SQL Injection via 'field\_search' Parameter (CVSS 9.1, WP Directory Kit)
- [CVE-2026-18465](https://cve.now/CVE-2026-18465.md): WP Maps Pro \< 6.1.3 - Unauthenticated Local File Inclusion (CVSS 6.5, WP MAPS PRO)
- [CVE-2026-18464](https://cve.now/CVE-2026-18464.md): WP Maps Pro \< 6.1.3 - Unauthenticated Denial of Service (CVSS 7.5, WP MAPS PRO)
- [CVE-2026-18357](https://cve.now/CVE-2026-18357.md): WPC Order Tip for WooCommerce \< 3.3.1 - Unauthenticated Order Data Disclosure (CVSS 7.5, WPC Order Tip for WooCommerce)
- [CVE-2026-18037](https://cve.now/CVE-2026-18037.md): Create by Mediavine \< 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication (CVSS 6.5, Create)
- [CVE-2026-18032](https://cve.now/CVE-2026-18032.md): WP Data Access \< 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass (CVSS 7.5, WP Data Access)
- [CVE-2026-17044](https://cve.now/CVE-2026-17044.md): WordPress File Upload \< 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid (CVSS 8.6, Iptanus File Upload)
- [CVE-2026-17014](https://cve.now/CVE-2026-17014.md): WP Photo Album Plus \< 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips (CVSS 5.3, WP Photo Album Plus)
- [CVE-2026-17011](https://cve.now/CVE-2026-17011.md): Nexter Blocks \< 5.0.2 - Contributor+ Stored CSS Injection (CVSS 3.8, Nexter Blocks)
- [CVE-2026-16992](https://cve.now/CVE-2026-16992.md): Create by Mediavine \< 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication (CVSS 6.5, Create)
- [CVE-2026-16988](https://cve.now/CVE-2026-16988.md): GeoDirectory \< 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint (CVSS 7.5, GeoDirectory)
- [CVE-2026-16965](https://cve.now/CVE-2026-16965.md): Solace Extra \< 1.6.1 - Subscriber+ Post Meta Update via solace\_update\_sitebuilder\_status (CVSS 4.3, Solace Extra)
- [CVE-2026-16957](https://cve.now/CVE-2026-16957.md): Slim SEO \< 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure (CVSS 2.7, Slim SEO)
- [CVE-2026-19337](https://cve.now/CVE-2026-19337.md): adenot mcp-google-search read\_webpage index.ts server-side request forgery (CVSS 4.8, adenot mcp-google-search)
- [CVE-2026-19336](https://cve.now/CVE-2026-19336.md): Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path traversal (CVSS 4.8, Pimzino spec-workflow-mcp)
- [CVE-2026-19335](https://cve.now/CVE-2026-19335.md): Jane-xiaoer skill-vision-control config.ts getSkillVersionsDir path traversal (CVSS 4.8, Jane-xiaoer skill-vision-control)
- [CVE-2026-19334](https://cve.now/CVE-2026-19334.md): NightTrek Ollama-mcp index.ts command injection (CVSS 4.8, NightTrek Ollama-mcp)
- [CVE-2026-19333](https://cve.now/CVE-2026-19333.md): NightTrek Supabase-MCP generate\_types command injection (CVSS 4.8, NightTrek Supabase-MCP)
- [CVE-2026-19332](https://cve.now/CVE-2026-19332.md): NellyW8 MCP4EDA run\_openlane/view\_waveform command injection (CVSS 4.8, NellyW8 MCP4EDA)
- [CVE-2026-19331](https://cve.now/CVE-2026-19331.md): bazylhorsey obsidian-mcp-server CanvasService.ts writeCanvas path traversal (CVSS 4.8, bazylhorsey obsidian-mcp-server)
- [CVE-2026-10595](https://cve.now/CVE-2026-10595.md): Path Traversal Vulnerability in parisneo/lollms (CVSS 7.5, parisneo/lollms)
- [CVE-2026-19330](https://cve.now/CVE-2026-19330.md): angrysky56 advanced-reasoning-mcp index.ts switch\_memory\_library path traversal (CVSS 4.8, angrysky56 advanced-reasoning-mcp)
- [CVE-2026-19329](https://cve.now/CVE-2026-19329.md): andreahaku codex\_mcp ask MCP Tool codex-process-simple.ts command injection (CVSS 4.8, andreahaku codex\_mcp)
- [CVE-2026-19328](https://cve.now/CVE-2026-19328.md): aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal (CVSS 4.8, aktsmm skill-ninja-mcp-server)
- [CVE-2026-19327](https://cve.now/CVE-2026-19327.md): abracadabra50 claude-sesh enricher.ts enrichSession path traversal (CVSS 4.8, abracadabra50 claude-sesh)
- [CVE-2026-19326](https://cve.now/CVE-2026-19326.md): Jevon-Zhong Ai-doctor filemanagement.service.ts deleteImage path traversal (CVSS 4.8, Jevon-Zhong Ai-doctor)
- [CVE-2026-19325](https://cve.now/CVE-2026-19325.md): IncomeStreamSurfer roo-code-memory-bank-mcp-server read\_memory\_bank\_file/append\_memory\_bank\_entry index.ts appendMemoryBankEntry path traversal (CVSS 4.8, IncomeStreamSurfer roo-code-memory-bank-mcp-server)
- [CVE-2026-19324](https://cve.now/CVE-2026-19324.md): HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal (CVSS 4.8, HelloGGX shadcn-vue-mcp)
- [CVE-2026-17510](https://cve.now/CVE-2026-17510.md): Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print\_attribute via a zero length BMPSTRING attribute (CVSS 7.5, JONASBN Crypt::OpenSSL::PKCS12)
- [CVE-2026-19323](https://cve.now/CVE-2026-19323.md): azer react-analyzer-mcp analyze-projec index.ts generateProjectDocs path traversal (CVSS 4.8, azer react-analyzer-mcp)
- [CVE-2026-71993](https://cve.now/CVE-2026-71993.md): MSI Radix AXE6600 v781521 Command Injection via openvpn function (CVSS 9.3, MSI Radix AXE6600)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.