# CVEs published 2026-08-14

201 CVEs were published on August 14, 2026: 19 critical, 85 high. Days are UTC.

- [CVE-2026-74250](https://cve.now/CVE-2026-74250.md): In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing t (CVSS 6.3, OpenStack Ironic)
- [CVE-2026-74247](https://cve.now/CVE-2026-74247.md): Quay: ssrf via build archive\_url in quay build api (CVSS 4.2, Red Hat OpenShift Update Service · Red Hat Quay)
- [CVE-2026-74245](https://cve.now/CVE-2026-74245.md): Quay: unauthenticated exported logs download in quay (CVSS 5.9, Red Hat OpenShift Update Service · Red Hat Quay)
- [CVE-2026-74244](https://cve.now/CVE-2026-74244.md): Quay: stripe webhook accepts forged events without signature verification in quay (CVSS 5.9, Red Hat OpenShift Update Service · Red Hat Quay)
- [CVE-2026-74243](https://cve.now/CVE-2026-74243.md): Quay: unauthenticated secscan notification endpoint in quay when psk is unset (CVSS 6.5, Red Hat OpenShift Update Service · Red Hat Quay)
- [CVE-2026-74242](https://cve.now/CVE-2026-74242.md): Quay: repository notification uuid idor in quay api (CVSS 5.3, Red Hat OpenShift Update Service · Red Hat Quay)
- [CVE-2026-74241](https://cve.now/CVE-2026-74241.md): Quay: ldap referral filter injection in quay external ldap authentication (CVSS 4.8, Red Hat OpenShift Update Service · Red Hat Quay)
- [CVE-2026-74240](https://cve.now/CVE-2026-74240.md): Quay: jwt claim validation bypasses in quay federated robot and sso authentication (CVSS 5.4, Red Hat OpenShift Update Service · Red Hat Quay)
- [CVE-2026-63650](https://cve.now/CVE-2026-63650.md): OpenVPN 2.7\_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 userna (CVSS 2.0, OpenVPN)
- [CVE-2026-63649](https://cve.now/CVE-2026-63649.md): The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7\_alpha1 through 2.7.5 allows local authenticated users to bypass the (CVSS 4.1, OpenVPN)
- [CVE-2026-69414](https://cve.now/CVE-2026-69414.md): Microsoft Defender Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Malware Protection Engine)
- [CVE-2026-73683](https://cve.now/CVE-2026-73683.md): Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay (CVSS 8.1, Laravel Socialite)
- [CVE-2026-50523](https://cve.now/CVE-2026-50523.md): Microsoft PowerShell Remote Code Execution Vulnerability (CVSS 7.8, Microsoft PowerShell · powershell)
- [CVE-2026-74248](https://cve.now/CVE-2026-74248.md): OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. (CVSS 4.3, OpenStack Octavia)
- [CVE-2026-67366](https://cve.now/CVE-2026-67366.md): Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda \< 2.0.0-4.0.11 (CVSS 5.3, icagenda.com iCagenda extension for Joomla)
- [CVE-2026-71570](https://cve.now/CVE-2026-71570.md): Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration \< 2.0.0-4.0.11 (CVSS 5.1, icagenda.com iCagenda extension for Joomla)
- [CVE-2026-71571](https://cve.now/CVE-2026-71571.md): Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda \< 2.0.0-4.0.11 (CVSS 8.6, icagenda.com iCagenda extension for Joomla)
- [CVE-2026-67365](https://cve.now/CVE-2026-67365.md): Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda \< 4.0.0-4.0.11 (CVSS 9.2, icagenda.com iCagenda extension for Joomla)
- [CVE-2026-19910](https://cve.now/CVE-2026-19910.md): PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability (CVSS 7.5, PAX Technology Q80)
- [CVE-2026-19908](https://cve.now/CVE-2026-19908.md): PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability (CVSS 7.1, PAX Technology Q80)
- [CVE-2026-19909](https://cve.now/CVE-2026-19909.md): PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability (CVSS 7.5, PAX Technology Q80)
- [CVE-2026-73680](https://cve.now/CVE-2026-73680.md): Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename (CVSS 8.8, Cockpit HQ Cockpit CMS)
- [CVE-2026-34492](https://cve.now/CVE-2026-34492.md): Airwall - Arbitrary file read (CVSS 7.0, Johnson Controls Airwall)
- [CVE-2026-64887](https://cve.now/CVE-2026-64887.md): Airwall - Hardcoded Secrets (CVSS 7.0, Johnson Controls Airwall)
- [CVE-2026-18554](https://cve.now/CVE-2026-18554.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 7.5, IBM Db2 Mirror for i)
- [CVE-2026-18178](https://cve.now/CVE-2026-18178.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 5.4, IBM Db2 Mirror for i)
- [CVE-2026-17227](https://cve.now/CVE-2026-17227.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 5.4, IBM Db2 Mirror for i)
- [CVE-2026-17209](https://cve.now/CVE-2026-17209.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 6.3, IBM Db2 Mirror for i)
- [CVE-2026-17186](https://cve.now/CVE-2026-17186.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 9.9, IBM Db2 Mirror for i)
- [CVE-2026-17184](https://cve.now/CVE-2026-17184.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 9.8, IBM Db2 Mirror for i)
- [CVE-2026-17182](https://cve.now/CVE-2026-17182.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 9.8, IBM Db2 Mirror for i)
- [CVE-2026-27871](https://cve.now/CVE-2026-27871.md): TL280 (CVSS 2.9, Johnson Controls TL280)
- [CVE-2026-17181](https://cve.now/CVE-2026-17181.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 9.3, IBM Db2 Mirror for i)
- [CVE-2026-17179](https://cve.now/CVE-2026-17179.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 8.5, IBM Db2 Mirror for i)
- [CVE-2026-17177](https://cve.now/CVE-2026-17177.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 7.5, IBM Db2 Mirror for i)
- [CVE-2026-17175](https://cve.now/CVE-2026-17175.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 7.5, IBM Db2 Mirror for i)
- [CVE-2026-17173](https://cve.now/CVE-2026-17173.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 6.5, IBM Db2 Mirror for i)
- [CVE-2026-17081](https://cve.now/CVE-2026-17081.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 8.2, IBM Db2 Mirror for i)
- [CVE-2026-17079](https://cve.now/CVE-2026-17079.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 6.3, IBM Db2 Mirror for i)
- [CVE-2026-16915](https://cve.now/CVE-2026-16915.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 7.5, IBM Db2 Mirror for i)
- [CVE-2026-16905](https://cve.now/CVE-2026-16905.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 5.3, IBM Db2 Mirror for i)
- [CVE-2026-16879](https://cve.now/CVE-2026-16879.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 8.8, IBM Db2 Mirror for i)
- [CVE-2026-16708](https://cve.now/CVE-2026-16708.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities (CVSS 8.3, IBM Db2 Mirror for i)
- [CVE-2026-50029](https://cve.now/CVE-2026-50029.md): js-toml has silent type confusion via falsy-primitive duplicate-key bypass (CVSS 5.3, sunnyadn js-toml · js-toml)
- [CVE-2026-45699](https://cve.now/CVE-2026-45699.md): Netatalk has Integer Underflow → Stack Buffer Overflow in copydir() (CVSS 7.5, netatalk)
- [CVE-2026-73679](https://cve.now/CVE-2026-73679.md): ImpressCMS Authenticated RCE via PHP Custom Tag eval() (CVSS 7.2, ImpressCMS)
- [CVE-2026-50027](https://cve.now/CVE-2026-50027.md): mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete (CVSS 9.8, doobidoo mcp-memory-service · mcp-memory-service)
- [CVE-2026-73678](https://cve.now/CVE-2026-73678.md): MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec() (CVSS 10.0, MindsDB Minds Platform)
- [CVE-2025-7639](https://cve.now/CVE-2025-7639.md): AVEVA Enterprise SCADA Deserialization of Untrusted Data (CVSS 6.1, AVEVA Enterprise SCADA · AVEVA Pipeline Operations for G… +3)
- [CVE-2026-18403](https://cve.now/CVE-2026-18403.md): LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB (CVSS 6.0, LimeSurvey)
- [CVE-2026-49457](https://cve.now/CVE-2026-49457.md): QUIC has Broken TLS verification (CVSS 9.1, benoitc erlang\_quic)
- [CVE-2026-19188](https://cve.now/CVE-2026-19188.md): Haiwell IoT Cloud HMI Gateway OS Command Injection (CVSS 10.0, Haiwell IoT Cloud HMI Gateway)
- [CVE-2026-72970](https://cve.now/CVE-2026-72970.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2026-48528](https://cve.now/CVE-2026-48528.md): Metacat has an unauthenticated SQL injection vulnerability (CVSS 9.8, NCEAS metacat)
- [CVE-2026-12366](https://cve.now/CVE-2026-12366.md): Use-after-free freeing an armed dynamically-allocated k\_timer in Zephyr userspace object disposal (CVSS 8.8, zephyrproject zephyr)
- [CVE-2026-12365](https://cve.now/CVE-2026-12365.md): Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race (CVSS 5.8, zephyrproject zephyr)
- [CVE-2026-12364](https://cve.now/CVE-2026-12364.md): Missing user-space pointer validation in logging syscall z\_log\_msg\_static\_create allows kernel memory disclosure and denial of service (CVSS 8.4, zephyrproject zephyr)
- [CVE-2026-12363](https://cve.now/CVE-2026-12363.md): Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0 (CVSS 4.2, zephyrproject zephyr)
- [CVE-2026-19682](https://cve.now/CVE-2026-19682.md): Command Injection (CVSS 9.9, Tenable Security Center)
- [CVE-2026-49263](https://cve.now/CVE-2026-49263.md): Capstone WASM \`br\_table\` instruction-size truncation can cause no-progress disassembly and parser desynchronization (CVSS 2.0, capstone-engine capstone)
- [CVE-2026-73850](https://cve.now/CVE-2026-73850.md): Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function (CVSS 8.6, emlog)
- [CVE-2026-19681](https://cve.now/CVE-2026-19681.md): Command Injection (CVSS 9.9, Tenable Security Center)
- [CVE-2026-49282](https://cve.now/CVE-2026-49282.md): Capstone M68K and RISCV \`cs\_insn\_name()\` invalid IDs can trigger out-of-bounds reads and process crashes (CVSS 5.1, capstone-engine capstone)
- [CVE-2026-19680](https://cve.now/CVE-2026-19680.md): SQL Injection (CVSS 7.1, Tenable Security Center)
- [CVE-2026-73849](https://cve.now/CVE-2026-73849.md): emlog allows unauthenticated reinstallation via \`install.php?action=reinstall\`. (CVSS 9.8, emlog)
- [CVE-2026-19679](https://cve.now/CVE-2026-19679.md): Improper Input Validation (CVSS 8.8, Tenable Security Center)
- [CVE-2026-73847](https://cve.now/CVE-2026-73847.md): Emlog: Missing CSRF protection in AI Assistant execute\_tool leads to full database compromise and admin account takeover (CVSS 6.8, emlog)
- [CVE-2026-19847](https://cve.now/CVE-2026-19847.md): TOTOLINK A800R wps.so cstecgi.cgi setWiFiWpsConfig stack-based overflow (CVSS 8.7, TOTOLINK A800R)
- [CVE-2026-19639](https://cve.now/CVE-2026-19639.md): Improper Access Control (CVSS 4.3, Tenable Security Center)
- [CVE-2026-19636](https://cve.now/CVE-2026-19636.md): Insuffucient Protections Lead to Brute Force (CVSS 5.3, Tenable Security Center)
- [CVE-2026-19846](https://cve.now/CVE-2026-19846.md): TOTOLINK A800R firewall.so cstecgi.cgi setUrlFilterRules stack-based overflow (CVSS 8.7, TOTOLINK A800R)
- [CVE-2026-19635](https://cve.now/CVE-2026-19635.md): Local Privilege Escalation (CVSS 8.8, Tenable Security Center)
- [CVE-2026-19631](https://cve.now/CVE-2026-19631.md): SQL Injection (CVSS 4.9, Tenable Security Center)
- [CVE-2026-19629](https://cve.now/CVE-2026-19629.md): Privilege Escalation (CVSS 8.1, Tenable Security Center)
- [CVE-2026-63361](https://cve.now/CVE-2026-63361.md): LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup (CVSS 8.5, LimeSurvey)
- [CVE-2026-19845](https://cve.now/CVE-2026-19845.md): TOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow (CVSS 8.7, TOTOLINK A800R)
- [CVE-2026-19628](https://cve.now/CVE-2026-19628.md): Remote Code Execution (CVSS 7.2, Tenable Security Center)
- [CVE-2026-73846](https://cve.now/CVE-2026-73846.md): CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning (CVSS 6.5, ondata ckan-mcp-server · @aborruso/ckan-mcp-server)
- [CVE-2026-19626](https://cve.now/CVE-2026-19626.md): Remote Code Execution (CVSS 9.9, Tenable Security Center)
- [CVE-2026-19844](https://cve.now/CVE-2026-19844.md): TOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflow (CVSS 8.7, TOTOLINK A800R)
- [CVE-2026-73845](https://cve.now/CVE-2026-73845.md): CKAN MCP Server: MQA server allowlist bypass via unanchored regex (\`isValidMqaServer\`) (CVSS 5.3, ondata ckan-mcp-server · @aborruso/ckan-mcp-server)
- [CVE-2026-73844](https://cve.now/CVE-2026-73844.md): CKAN MCP Server: Information disclosure via verbose error reflection (CVSS 3.7, ondata ckan-mcp-server · @aborruso/ckan-mcp-server)
- [CVE-2026-47192](https://cve.now/CVE-2026-47192.md): kas's late signature validation may allow unnoticed repository manipulations (CVSS 2.1, siemens kas · kas)
- [CVE-2026-46603](https://cve.now/CVE-2026-46603.md): Excessive memory allocation during VP8L decoding in golang.org/x/image (CVSS 7.5, golang.org/x/image/vp8l · golang.org/x/image)
- [CVE-2026-47191](https://cve.now/CVE-2026-47191.md): kas checks out SHA-like git branches as valid commits (CVSS 2.1, siemens kas · kas)
- [CVE-2026-19841](https://cve.now/CVE-2026-19841.md): TRENDNET TEW-813DRU vsftpd vsftpd.conf default permission (CVSS 2.3, TRENDNET TEW-813DRU)
- [CVE-2026-49989](https://cve.now/CVE-2026-49989.md): CrateDB's Blob HTTP handler bypasses authorization (CVSS 7.1, crate · io.crate:crate)
- [CVE-2026-49826](https://cve.now/CVE-2026-49826.md): Concourse login flow has an open redirect issue (CVSS 0.0, concourse · github.com/concourse/concourse)
- [CVE-2026-49986](https://cve.now/CVE-2026-49986.md): Cortex has Untrusted Project Bootstrap Code Execution via \`CLAUDE\_PROJECT\_DIR\` (CVSS 7.1, cdeust Cortex · neuro-cortex-memory)
- [CVE-2026-47766](https://cve.now/CVE-2026-47766.md): crun follows rootfs /dev symlink while creating default devices (CVSS 5.1, containers crun)
- [CVE-2026-19839](https://cve.now/CVE-2026-19839.md): SourceCodester Simple Doctors Appointment System save\_file.php save\_doctor unrestricted upload (CVSS 5.1, SourceCodester Simple Doctors Appointment System)
- [CVE-2026-46380](https://cve.now/CVE-2026-46380.md): compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem (CVSS 6.7, oscal-compass compliance-trestle · compliance-trestle)
- [CVE-2026-46439](https://cve.now/CVE-2026-46439.md): compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI) (CVSS 7.8, oscal-compass compliance-trestle · compliance-trestle)
- [CVE-2026-19838](https://cve.now/CVE-2026-19838.md): Webkul Bagisto Backend Reporting Endpoint sales authorization (CVSS 5.3, Webkul Bagisto)
- [CVE-2026-19837](https://cve.now/CVE-2026-19837.md): Webkul Bagisto Customer Search search information disclosure (CVSS 5.1, Webkul Bagisto)
- [CVE-2026-63700](https://cve.now/CVE-2026-63700.md): Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. (CVSS 7.8, Dell Wyse Management Suite)
- [CVE-2026-66271](https://cve.now/CVE-2026-66271.md): Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. (CVSS 7.2, Dell Wyse Management Suite)
- [CVE-2026-66270](https://cve.now/CVE-2026-66270.md): Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. (CVSS 7.2, Dell Wyse Management Suite)
- [CVE-2026-66272](https://cve.now/CVE-2026-66272.md): Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. (CVSS 5.3, Dell Wyse Management Suite)
- [CVE-2026-19884](https://cve.now/CVE-2026-19884.md): In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust (CVSS 8.4, Eclipse Foundation Eclipse Theia)
- [CVE-2026-53970](https://cve.now/CVE-2026-53970.md): ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb (CVSS 7.5, lucasgelfond ZeroBrew)
- [CVE-2026-63701](https://cve.now/CVE-2026-63701.md): Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. (CVSS 6.3, Dell Wyse Management Suite)
- [CVE-2026-19836](https://cve.now/CVE-2026-19836.md): Webkul Bagisto Backend Customer Detail Feature view authorization (CVSS 5.3, Webkul Bagisto)
- [CVE-2026-63702](https://cve.now/CVE-2026-63702.md): Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. (CVSS 6.3, Dell Wyse Management Suite)
- [CVE-2026-16772](https://cve.now/CVE-2026-16772.md): CVE-2026-16772 (CVSS 8.1, Akaunting)
- [CVE-2026-19835](https://cve.now/CVE-2026-19835.md): Webkul Bagisto Customer Item Deletion Endpoint access control (CVSS 5.1, Webkul Bagisto)
- [CVE-2026-57472](https://cve.now/CVE-2026-57472.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad (CVSS 6.9, KUNBUS RevPiPyLoad)
- [CVE-2026-57471](https://cve.now/CVE-2026-57471.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad (CVSS 6.8, KUNBUS RevPiPyLoad)
- [CVE-2026-57469](https://cve.now/CVE-2026-57469.md): Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory (CVSS 5.1, KUNBUS PiCtory)
- [CVE-2026-13198](https://cve.now/CVE-2026-13198.md): Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl (CVSS 5.9, KUNBUS piControl)
- [CVE-2026-13002](https://cve.now/CVE-2026-13002.md): Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing (CVSS 4.4, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-13197](https://cve.now/CVE-2026-13197.md): Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl (CVSS 7.3, KUNBUS piControl)
- [CVE-2026-13196](https://cve.now/CVE-2026-13196.md): Out-of-bounds Write in KUNBUS piControl (CVSS 7.3, KUNBUS piControl)
- [CVE-2026-19834](https://cve.now/CVE-2026-19834.md): Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization (CVSS 5.1, Webkul Bagisto)
- [CVE-2026-19879](https://cve.now/CVE-2026-19879.md): Io.undertow/undertow: undertow: http response header integrity issue due to character truncation (CVSS 5.3, Red Hat build of Apache Camel for Spring Boot · Red Hat… +2)
- [CVE-2026-58224](https://cve.now/CVE-2026-58224.md): Samba: ctdb fails to do integrity checking of received packets (CVSS 6.5, Red Hat Ceph Storage · Red Hat Enterprise Linux +1)
- [CVE-2026-69101](https://cve.now/CVE-2026-69101.md): Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint (CVSS 8.3, datavane tis)
- [CVE-2026-19880](https://cve.now/CVE-2026-19880.md): Incomplete protection against CVE-2025-11226 (CVSS 6.3, QOS.CH Sarl Logback-classic)
- [CVE-2026-1621](https://cve.now/CVE-2026-1621.md): Register Bypass in Universal Sotware's E-Municipality (CVSS 5.3, Universal Software E-Municipality)
- [CVE-2026-19871](https://cve.now/CVE-2026-19871.md): Use of hard-coded credentials in Prospero Flow CRM employee onboarding (CVSS 9.3, Roskus Prospero Flow CRM)
- [CVE-2026-53472](https://cve.now/CVE-2026-53472.md): Migration-planner: credentialurl validator accepts javascript: urls (CVSS 6.3, migration-planner)
- [CVE-2026-19830](https://cve.now/CVE-2026-19830.md): TRENDnet TEW-816DRM bftpd bftpd.conf allocation of resources (CVSS 6.9, TRENDnet TEW-816DRM)
- [CVE-2026-73633](https://cve.now/CVE-2026-73633.md): Apache Struts: Unbounded read of a JSON request body (CVSS 7.5, Apache Software Foundation Apache Struts)
- [CVE-2026-19768](https://cve.now/CVE-2026-19768.md): Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier a (CVSS 8.1, Devolutions PowerShell Universal)
- [CVE-2026-19829](https://cve.now/CVE-2026-19829.md): 648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal (CVSS 5.3, 648540858 wvp-GB28181-pro)
- [CVE-2026-19828](https://cve.now/CVE-2026-19828.md): 648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal (CVSS 5.3, 648540858 wvp-GB28181-pro)
- [CVE-2026-19827](https://cve.now/CVE-2026-19827.md): alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal (CVSS 6.9, alldatacenter alldata)
- [CVE-2026-19826](https://cve.now/CVE-2026-19826.md): alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization (CVSS 6.9, alldatacenter alldata)
- [CVE-2026-19825](https://cve.now/CVE-2026-19825.md): SourceCodester Simple Client Management System Master.php save\_service sql injection (CVSS 6.9, SourceCodester Simple Client Management System)
- [CVE-2026-19824](https://cve.now/CVE-2026-19824.md): Tenda W20E addIpMacBind ipMacBindListStore stack-based overflow (CVSS 8.7, Tenda W20E)
- [CVE-2026-73673](https://cve.now/CVE-2026-73673.md): Netis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication (CVSS 8.7, Netis Systems Co. Netis NC63 Wireless AC1200 Router)
- [CVE-2026-19823](https://cve.now/CVE-2026-19823.md): Tenda W20E QoS Rule Deletion delQos formQOSRuleDel stack-based overflow (CVSS 8.7, Tenda W20E)
- [CVE-2026-19870](https://cve.now/CVE-2026-19870.md): IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation (CVSS 8.6, Roskus Prospero Flow CRM)
- [CVE-2026-73630](https://cve.now/CVE-2026-73630.md): SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-73051](https://cve.now/CVE-2026-73051.md): actix-http before 3.12.1 HTTP Request Smuggling via CL.TE (CVSS 6.3, actix-http)
- [CVE-2026-73049](https://cve.now/CVE-2026-73049.md): SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-73048](https://cve.now/CVE-2026-73048.md): SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID (CVSS 6.9, siyuan-note siyuan)
- [CVE-2026-72859](https://cve.now/CVE-2026-72859.md): Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL (CVSS 8.3, budibase server · @budibase/server)
- [CVE-2026-72838](https://cve.now/CVE-2026-72838.md): FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload (CVSS 7.1, filebrowser)
- [CVE-2026-72837](https://cve.now/CVE-2026-72837.md): File Browser before 2.63.20 Privilege Escalation via Proxy Authentication (CVSS 8.7, filebrowser)
- [CVE-2026-72836](https://cve.now/CVE-2026-72836.md): FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass (CVSS 9.2, filebrowser)
- [CVE-2026-72835](https://cve.now/CVE-2026-72835.md): filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization (CVSS 7.6, filebrowser)
- [CVE-2026-72834](https://cve.now/CVE-2026-72834.md): filebrowser before 2.63.19 Permission Bypass via checksum (CVSS 5.3, filebrowser)
- [CVE-2026-72833](https://cve.now/CVE-2026-72833.md): Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys (CVSS 8.7, getgrav grav-plugin-api)
- [CVE-2026-72832](https://cve.now/CVE-2026-72832.md): Grav before 2.0.13 Stored XSS via quoted-attribute bypass (CVSS 5.1, getgrav grav · getgrav/grav)
- [CVE-2026-72831](https://cve.now/CVE-2026-72831.md): Grav through 2.0.11 Authentication Bypass via Flex Objects (CVSS 8.7, getgrav grav · trilbymedia grav-plugin-flex-objects)
- [CVE-2026-72830](https://cve.now/CVE-2026-72830.md): Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass (CVSS 8.7, getgrav grav)
- [CVE-2026-72829](https://cve.now/CVE-2026-72829.md): Grav before 1.0.13 API Key Scope Bypass via UsersController (CVSS 8.7, getgrav grav)
- [CVE-2026-72828](https://cve.now/CVE-2026-72828.md): Grav before 1.0.13 API Key Scope Bypass via InvitationsController (CVSS 8.6, getgrav grav)
- [CVE-2026-72827](https://cve.now/CVE-2026-72827.md): Grav CMS before 2.0.13 Remote Code Execution via Twig (CVSS 8.7, getgrav grav)
- [CVE-2026-72826](https://cve.now/CVE-2026-72826.md): Grav API Plugin before 1.0.13 Scope Bypass via createApiKey (CVSS 8.7, getgrav grav-plugin-api)
- [CVE-2026-72825](https://cve.now/CVE-2026-72825.md): Grav API Plugin before 1.0.13 API-key scope cap bypass via ReportsController (CVSS 7.2, getgrav grav-plugin-api)
- [CVE-2026-72824](https://cve.now/CVE-2026-72824.md): Grav before 1.0.13 API Key Scope Bypass via PagesController (CVSS 8.7, getgrav grav)
- [CVE-2026-72823](https://cve.now/CVE-2026-72823.md): Grav before 1.0.13 API-key scope cap bypass via DemoController (CVSS 5.3, getgrav grav)
- [CVE-2026-72822](https://cve.now/CVE-2026-72822.md): Grav before 1.0.13 Authentication Bypass via disable2fa (CVSS 8.7, getgrav grav)
- [CVE-2026-72821](https://cve.now/CVE-2026-72821.md): Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle (CVSS 5.1, getgrav grav)
- [CVE-2026-72820](https://cve.now/CVE-2026-72820.md): Grav 2.0.11 Path Traversal via Backup Profile Configuration (CVSS 6.9, getgrav grav)
- [CVE-2026-72819](https://cve.now/CVE-2026-72819.md): Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload (CVSS 8.7, getgrav grav · getgrav/grav)
- [CVE-2026-72817](https://cve.now/CVE-2026-72817.md): go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For (CVSS 6.9, go-chi chi · github.com/go-chi/chi/middleware +5)
- [CVE-2026-72816](https://cve.now/CVE-2026-72816.md): go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware (CVSS 6.9, go-chi chi · github.com/go-chi/chi/middleware +5)
- [CVE-2026-72815](https://cve.now/CVE-2026-72815.md): go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header (CVSS 6.9, go-chi chi · github.com/go-chi/chi/v5/middleware +1)
- [CVE-2026-72814](https://cve.now/CVE-2026-72814.md): actix-files before 0.6.10 Information Disclosure via Files (CVSS 6.3, actix-files)
- [CVE-2026-72813](https://cve.now/CVE-2026-72813.md): actix-files before 0.6.10 Denial of Service via empty Range header (CVSS 6.9, actix-files)
- [CVE-2026-72812](https://cve.now/CVE-2026-72812.md): SiYuan before v3.7.4 Missing Authorization via refreshBacklink (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72811](https://cve.now/CVE-2026-72811.md): SiYuan before v3.7.4 SQL Injection via backlink search (CVSS 9.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72810](https://cve.now/CVE-2026-72810.md): SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket (CVSS 9.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2025-71405](https://cve.now/CVE-2025-71405.md): go-chi chi before v5.2.2 Open Redirect via RedirectSlashes (CVSS 5.1, go-chi chi · github.com/go-chi/chi/v5)
- [CVE-2026-19822](https://cve.now/CVE-2026-19822.md): Tenda W20E QoS Edit editQos lstAdd stack-based overflow (CVSS 8.7, Tenda W20E)
- [CVE-2026-19821](https://cve.now/CVE-2026-19821.md): Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflow (CVSS 8.7, Tenda AC12)
- [CVE-2026-19815](https://cve.now/CVE-2026-19815.md): TOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflow (CVSS 8.7, TOTOLINK A800R)
- [CVE-2026-19814](https://cve.now/CVE-2026-19814.md): TOTOLINK A800R firewall.so cstecgi.cgi setMacQos stack-based overflow (CVSS 8.7, TOTOLINK A800R)
- [CVE-2026-19813](https://cve.now/CVE-2026-19813.md): TOTOLINK A800R firewall.so cstecgi.cgi setMacFilterRules stack-based overflow (CVSS 8.7, TOTOLINK A800R)
- [CVE-2026-19794](https://cve.now/CVE-2026-19794.md): WP-Stats \<= 2.56 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, gamerz WP-Stats)
- [CVE-2026-19812](https://cve.now/CVE-2026-19812.md): TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow (CVSS 8.7, TOTOLINK A800R)
- [CVE-2026-19811](https://cve.now/CVE-2026-19811.md): TOTOLINK A800R firewall.so cstecgi.cgi setIpQosRules stack-based overflow (CVSS 8.7, TOTOLINK A800R)
- [CVE-2026-18039](https://cve.now/CVE-2026-18039.md): Essential Addons for Elementor \< 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment (CVSS 8.1, Essential Addons for Elementor)
- [CVE-2026-16739](https://cve.now/CVE-2026-16739.md): Epeken All Kurir \<= 2.1.4 - Unauthenticated Order Payment Confirmation Forgery (CVSS 5.9, Epeken All Kurir for Woocommerce)
- [CVE-2026-15205](https://cve.now/CVE-2026-15205.md): Paymob for WooCommerce \< 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup (CVSS 8.6, Paymob for WooCommerce)
- [CVE-2026-14290](https://cve.now/CVE-2026-14290.md): Embed Google Photos Album Easily \<= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute (CVSS 6.8, Embed Google Photos album)
- [CVE-2026-19617](https://cve.now/CVE-2026-19617.md): Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser (CVSS 5.5, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-12743](https://cve.now/CVE-2026-12743.md): affiliate-toolkit \<= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9, cservit affiliate-toolkit – Multi-Network Affiliate & Amazo…)
- [CVE-2026-12949](https://cve.now/CVE-2026-12949.md): Wishlist Member X \<= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter (CVSS 9.8, Wishlist Member)
- [CVE-2026-16810](https://cve.now/CVE-2026-16810.md): Bit Form \<= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter (CVSS 6.5, bitpressadmin Bit Form – Contact Form, Payment Forms, Multi…)
- [CVE-2025-10308](https://cve.now/CVE-2025-10308.md): Astro Booking Engine \<= 1.4.0 - Cross-Site Request Forgery to Settings Reset (CVSS 4.3, alian Astro Booking Engine)
- [CVE-2026-19792](https://cve.now/CVE-2026-19792.md): Tenda G0 httpd web management interface module setPortMapping buffer overflow (CVSS 8.7, Tenda G0)
- [CVE-2026-19791](https://cve.now/CVE-2026-19791.md): Tenda G0 httpd web management interface module addStaticRoute stack-based overflow (CVSS 8.7, Tenda G0)
- [CVE-2026-19790](https://cve.now/CVE-2026-19790.md): Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow (CVSS 8.7, Tenda G0)
- [CVE-2026-19789](https://cve.now/CVE-2026-19789.md): Tenda AC1206 httpd web management interface WifiGuestSet set\_wl\_guest\_iplist stack-based overflow (CVSS 8.7, Tenda AC1206)
- [CVE-2026-19788](https://cve.now/CVE-2026-19788.md): Tenda AC1206 httpd web management interface SetOnlineDevName set\_device\_name stack-based overflow (CVSS 8.7, Tenda AC1206)
- [CVE-2026-19787](https://cve.now/CVE-2026-19787.md): SourceCodester Air Cargo Management System Master.php save\_cargo\_type sql injection (CVSS 5.1, SourceCodester Air Cargo Management System)
- [CVE-2026-19786](https://cve.now/CVE-2026-19786.md): francoisjacquet RosarioSIS Modules.php cross-site request forgery (CVSS 5.3, francoisjacquet RosarioSIS)
- [CVE-2026-18109](https://cve.now/CVE-2026-18109.md): W3 Total Cache \<= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name (CVSS 7.2, boldgrid W3 Total Cache)
- [CVE-2026-19785](https://cve.now/CVE-2026-19785.md): francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection (CVSS 5.3, francoisjacquet RosarioSIS)
- [CVE-2026-19784](https://cve.now/CVE-2026-19784.md): francoisjacquet RosarioSIS Referrals.php DBUpdate authorization (CVSS 5.3, francoisjacquet RosarioSIS)
- [CVE-2026-19771](https://cve.now/CVE-2026-19771.md): Baicells EG3661M LuCI Web luci os command injection (CVSS 8.6, Baicells EG3661M)
- [CVE-2026-19770](https://cve.now/CVE-2026-19770.md): feedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side request forgery (CVSS 4.8, feedmob fm-mcp-servers)
- [CVE-2026-19767](https://cve.now/CVE-2026-19767.md): itsourcecode Hospital Management System viewdoctortimings.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-19765](https://cve.now/CVE-2026-19765.md): eyaushev swagger-testcase-mcp fetch\_swagger swagger-parser.ts loadSource server-side request forgery (CVSS 5.3, eyaushev swagger-testcase-mcp)
- [CVE-2026-19764](https://cve.now/CVE-2026-19764.md): Raisecom Communication Command and Dispatch Management Platform getpwd.php sql injection (CVSS 6.9, Raisecom Communication Command and Dispatch Management Plat…)
- [CVE-2026-19763](https://cve.now/CVE-2026-19763.md): DTStack Taier Cluster Creation ClusterController.java FileUtils.deleteDirectory path traversal (CVSS 5.1, DTStack Taier)
- [CVE-2026-19762](https://cve.now/CVE-2026-19762.md): DTStack Taier Chunk-Check Endpoint FileChunkController.java Paths.ge path traversal (CVSS 6.9, DTStack Taier)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.