# CVEs published 2026-08-16

109 CVEs were published on August 16, 2026: 17 critical, 30 high. Days are UTC.

- [CVE-2026-19964](https://cve.now/CVE-2026-19964.md): Jij-Inc Jij-MCP-Server jm\_check python\_repr.py PythonREPL.run code injection (CVSS 5.1, Jij-Inc Jij-MCP-Server)
- [CVE-2026-19963](https://cve.now/CVE-2026-19963.md): Edimax EW-7478APC stainfo command injection (CVSS 5.3, Edimax EW-7478APC)
- [CVE-2026-19962](https://cve.now/CVE-2026-19962.md): Edimax EW-7478APC setWAN command injection (CVSS 5.3, Edimax EW-7478APC)
- [CVE-2026-19961](https://cve.now/CVE-2026-19961.md): Edimax EW-7478APC formWlSiteSurvey buffer overflow (CVSS 9.4, Edimax EW-7478APC)
- [CVE-2026-19960](https://cve.now/CVE-2026-19960.md): Edimax EW-7478APC formWlbasic command injection (CVSS 5.3, Edimax EW-7478APC)
- [CVE-2026-19959](https://cve.now/CVE-2026-19959.md): Edimax EW-7478APC formWanTcpipSetup stack-based overflow (CVSS 9.4, Edimax EW-7478APC)
- [CVE-2026-19958](https://cve.now/CVE-2026-19958.md): iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection (CVSS 5.3, iatsiuk pptr-mcp)
- [CVE-2026-19957](https://cve.now/CVE-2026-19957.md): graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fetch server-side request forgery (CVSS 5.3, graphlit-mcp-server)
- [CVE-2026-19956](https://cve.now/CVE-2026-19956.md): gomarble-ai facebook-ads-mcp-server server.py fetch\_pagination\_url server-side request forgery (CVSS 5.3, gomarble-ai facebook-ads-mcp-server)
- [CVE-2026-19955](https://cve.now/CVE-2026-19955.md): TrailDB TOC Validation tdb.c tdb\_open out-of-bounds (CVSS 5.1, TrailDB)
- [CVE-2026-72888](https://cve.now/CVE-2026-72888.md): Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart\_require (CVSS 6.5, Net-OAuth)
- [CVE-2026-72887](https://cve.now/CVE-2026-72887.md): Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get\_request\_token (CVSS 9.8, Net-OAuth)
- [CVE-2026-19349](https://cve.now/CVE-2026-19349.md): Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends (CVSS 9.8, Lemonldap-NG-Portal)
- [CVE-2026-74797](https://cve.now/CVE-2026-74797.md): OpenTofu before 1.11.4 Denial of Service via malicious zip (CVSS 2.3, opentofu · github.com/opentofu/opentofu)
- [CVE-2026-74796](https://cve.now/CVE-2026-74796.md): OpenTofu before 1.11.7 Symlink Following Path Traversal (CVSS 7.0, opentofu · github.com/opentofu/opentofu)
- [CVE-2026-74795](https://cve.now/CVE-2026-74795.md): Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74794](https://cve.now/CVE-2026-74794.md): Scriban before 6.6.0 Denial of Service via Infinite Recursion (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74792](https://cve.now/CVE-2026-74792.md): Scriban before 7.0.0 Stack Overflow via nested array initializers (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74791](https://cve.now/CVE-2026-74791.md): Scriban before 7.0.0 Authorization Bypass via Stale Include Cache (CVSS 9.2, scriban · Scriban.Signed)
- [CVE-2026-74790](https://cve.now/CVE-2026-74790.md): Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache (CVSS 9.3, scriban · Scriban.Signed)
- [CVE-2026-74789](https://cve.now/CVE-2026-74789.md): Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74788](https://cve.now/CVE-2026-74788.md): Scriban before 7.0.0 Denial of Service via string.pad\_left/pad\_right (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74787](https://cve.now/CVE-2026-74787.md): Scriban before 7.0.0 Uncontrolled Recursion via object.to\_json (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74786](https://cve.now/CVE-2026-74786.md): Scriban before 7.0.0 Denial of Service via Unbounded Template Output (CVSS 7.1, scriban · Scriban.Signed)
- [CVE-2026-74785](https://cve.now/CVE-2026-74785.md): Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption (CVSS 7.1, scriban · Scriban.Signed)
- [CVE-2026-74784](https://cve.now/CVE-2026-74784.md): Scriban before 7.2.0 Denial of Service via array.insert\_at (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74783](https://cve.now/CVE-2026-74783.md): Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-73062](https://cve.now/CVE-2026-73062.md): Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-73061](https://cve.now/CVE-2026-73061.md): Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor (CVSS 9.3, scriban)
- [CVE-2026-73060](https://cve.now/CVE-2026-73060.md): Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply (CVSS 8.7, scriban)
- [CVE-2026-73059](https://cve.now/CVE-2026-73059.md): stoatchat before 0.15.0 Permission Bypass via message\_fetch (CVSS 7.1, stoatchat)
- [CVE-2026-73058](https://cve.now/CVE-2026-73058.md): stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass (CVSS 6.9, stoatchat)
- [CVE-2026-73057](https://cve.now/CVE-2026-73057.md): stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service (CVSS 8.7, stoatchat)
- [CVE-2026-73056](https://cve.now/CVE-2026-73056.md): SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token (CVSS 9.3, siyuan-note siyuan)
- [CVE-2024-58375](https://cve.now/CVE-2024-58375.md): OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation (CVSS 8.7, opentofu · github.com/opentofu/opentofu)
- [CVE-2026-74251](https://cve.now/CVE-2026-74251.md): Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 (CVSS 9.3, phoca.cz Phoca Cart extension for Joomla)
- [CVE-2024-13784](https://cve.now/CVE-2024-13784.md): Contact Form, Survey, Quiz & Popup Form Builder – ARForms \<= 1.8.5 - Unauthenticated PHP Object Injection (CVSS 9.8, reputeinfosystems Contact Form, Survey, Quiz & Popup Form B…)
- [CVE-2026-74578](https://cve.now/CVE-2026-74578.md): crypto: algif\_skcipher - force synchronous processing on trees without ctx-\>state (CVSS 7.1, Linux)
- [CVE-2026-18347](https://cve.now/CVE-2026-18347.md): Kirki \<= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter (CVSS 4.3, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-17604](https://cve.now/CVE-2026-17604.md): Kirki \<= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter (CVSS 4.9, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-13424](https://cve.now/CVE-2026-13424.md): Online Scheduling and Appointment Booking System \<= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly\_speed\_up\_update\_addons AJAX action (CVSS 7.2, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2026-17087](https://cve.now/CVE-2026-17087.md): WP Travel Engine \<= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking\_id' Parameter (CVSS 7.5, wptravelengine WP Travel Engine – Tour Booking Plugin – Tou…)
- [CVE-2026-2497](https://cve.now/CVE-2026-2497.md): Gallery by BestWebSoft \<= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys (CVSS 7.2, Gallery by BestWebSoft – Customizable Image and Photo Galle…)
- [CVE-2026-17608](https://cve.now/CVE-2026-17608.md): WP Compress \<= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion (CVSS 6.5, aresit WP Compress – Instant Performance & Speed Optimizati…)
- [CVE-2026-2357](https://cve.now/CVE-2026-2357.md): Bold Page Builder \<= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2026-12998](https://cve.now/CVE-2026-12998.md): Forminator Forms \<= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter (CVSS 5.3, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-10734](https://cve.now/CVE-2026-10734.md): Infility Global \<= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7\_record Log Endpoint (CVSS 7.2, Infility Global)
- [CVE-2026-19728](https://cve.now/CVE-2026-19728.md): Extra Product Options Builder for WooCommerce \< 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileupload (CVSS 7.5, Extra Product Options Builder for WooCommerce)
- [CVE-2026-19726](https://cve.now/CVE-2026-19726.md): Visualizer \< 4.0.7 - Contributor+ Cross-User Chart Configuration Disclosure (CVSS 6.5, Visualizer)
- [CVE-2026-19725](https://cve.now/CVE-2026-19725.md): WPvivid Backup & Migration \< 0.9.131 - Unauthenticated Path Traversal via send\_to\_site\_connect (CVSS 9.1, WPvivid — Backup, Migration & Staging)
- [CVE-2026-19717](https://cve.now/CVE-2026-19717.md): CatFolders Document Gallery \< 2.0.7 - Unauthenticated Attachment Disclosure via REST API (CVSS 7.5, CatFolders Document Gallery & PDF Library)
- [CVE-2026-19714](https://cve.now/CVE-2026-19714.md): Simple JWT Login \< 3.6.8 - Unauthenticated Account Takeover via Missing Google id\_token Audience Validation (CVSS 9.1, Simple JWT Login)
- [CVE-2026-19712](https://cve.now/CVE-2026-19712.md): Masteriyo LMS \< 2.3.3 - Instructor+ Stored XSS via Quiz Description (CVSS 6.1, Masteriyo LMS)
- [CVE-2026-19711](https://cve.now/CVE-2026-19711.md): Premium Packages – Sell Digital Products Securely \< 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request (CVSS 6.5, Premium Packages)
- [CVE-2026-19613](https://cve.now/CVE-2026-19613.md): ECS \< 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source (CVSS 6.5, ECS)
- [CVE-2026-18653](https://cve.now/CVE-2026-18653.md): WP Directory Kit \< 1.5.7 - Admin+ SQL Injection via section Parameter (CVSS 7.2, WP Directory Kit)
- [CVE-2026-17533](https://cve.now/CVE-2026-17533.md): All-in-One WP Migration and Backup \< 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import (CVSS 7.2, All-in-One WP Migration and Backup)
- [CVE-2026-15384](https://cve.now/CVE-2026-15384.md): Manual Image Crop \< 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR (CVSS 5.7, Manual Image Crop)
- [CVE-2026-13712](https://cve.now/CVE-2026-13712.md): Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL (CVSS 5.4, Divi)
- [CVE-2026-15351](https://cve.now/CVE-2026-15351.md): WC Vendors \<= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter (CVSS 4.9, wcvendors WC Vendors – WooCommerce Multivendor, WooCommerce…)
- [CVE-2026-17581](https://cve.now/CVE-2026-17581.md): WCPOS \<= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine (CVSS 7.2, kilbot WCPOS – Point of Sale (POS) plugin for WooCommerce)
- [CVE-2026-9767](https://cve.now/CVE-2026-9767.md): The School Management \<= 5.4 - Authenticated (Custom+) SQL Injection via 'order\[0\]\[dir\]' Parameter (CVSS 6.5, weblizar The School Management – Education & Learning ERP)
- [CVE-2026-15345](https://cve.now/CVE-2026-15345.md): ShortPixel Adaptive Images \<= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter (CVSS 4.3, ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimiz…)
- [CVE-2026-17582](https://cve.now/CVE-2026-17582.md): Slider Hero with Video Background, Animation \<= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate) (CVSS 4.9, quantumcloud Slider Hero with Video Background, Animation)
- [CVE-2026-16775](https://cve.now/CVE-2026-16775.md): Smash Balloon Social Post Feed \<= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, smub Smash Balloon Social Post Feed – Simple Social Feeds f…)
- [CVE-2026-15056](https://cve.now/CVE-2026-15056.md): StoreEngine \<= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL (CVSS 6.5, kodezen StoreEngine — Complete eCommerce Solution with Memb…)
- [CVE-2026-10035](https://cve.now/CVE-2026-10035.md): Turnkey bbPress by WeaverTheme \<= 1.7.1 - Authenticated (Administrator+) PHP Object Injection (CVSS 6.6, wpweaver Turnkey bbPress by WeaverTheme)
- [CVE-2026-16758](https://cve.now/CVE-2026-16758.md): Snippet Shortcodes \<= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, aliakro Snippet Shortcodes)
- [CVE-2026-18316](https://cve.now/CVE-2026-18316.md): Solace Extra \<= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action (CVSS 9.1, solacewp Solace Extra)
- [CVE-2026-2283](https://cve.now/CVE-2026-2283.md): User Login History \<= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog\_id' Parameter (CVSS 4.9, faiyazalam User Login History)
- [CVE-2026-18402](https://cve.now/CVE-2026-18402.md): SureDash \<= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute (CVSS 6.4, brainstormforce SureDash – Community, Courses & Member Dash…)
- [CVE-2026-15790](https://cve.now/CVE-2026-15790.md): Video Gallery \<= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post\_title' via emd\_mb\_meta Shortcode (CVSS 6.4, emarket-design Video Gallery – YouTube Gallery, Playlist &…)
- [CVE-2026-15604](https://cve.now/CVE-2026-15604.md): Toocheke Companion \<= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series\_bg\_color' Post Meta (CVSS 6.4, Toocheke Companion)
- [CVE-2026-19934](https://cve.now/CVE-2026-19934.md): itsourcecode Hospital Management System vieworder.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-19933](https://cve.now/CVE-2026-19933.md): DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflow (CVSS 5.3, DefaultFuction Customer-Relationship-Management-In-C-Project)
- [CVE-2026-16779](https://cve.now/CVE-2026-16779.md): Kubio AI Page Builder \<= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio\_restore\_front\_page AJAX Action (CVSS 4.3, extendthemes Kubio AI Page Builder)
- [CVE-2026-15002](https://cve.now/CVE-2026-15002.md): Autopay \<= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm\_woocommerce\_css\_editor\_content' Parameter (CVSS 7.2, bluemediapl Autopay)
- [CVE-2026-15726](https://cve.now/CVE-2026-15726.md): Serious Slider \<= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute (CVSS 6.4, cryout-creations Serious Slider)
- [CVE-2026-15963](https://cve.now/CVE-2026-15963.md): Quiz and Survey Master (QSM) \<= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon\_category' Quiz Option (CVSS 6.5, expresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…)
- [CVE-2025-10005](https://cve.now/CVE-2025-10005.md): Password Protect WordPress Lite \<= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update (CVSS 4.3, buildwps PPWP – Password Protect Pages)
- [CVE-2026-15009](https://cve.now/CVE-2026-15009.md): Advanced File Manager \<= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter (CVSS 6.1, saadiqbal Advanced File Manager – Ultimate File Manager for…)
- [CVE-2026-15066](https://cve.now/CVE-2026-15066.md): Loco Translate \<= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments (CVSS 6.4, timwhitlock Loco Translate)
- [CVE-2026-17123](https://cve.now/CVE-2026-17123.md): Royal Addons for Elementor \<= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook\_url' Setting (CVSS 8.8, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2026-13167](https://cve.now/CVE-2026-13167.md): Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI \<= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints (CVSS 4.3, wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…)
- [CVE-2026-15441](https://cve.now/CVE-2026-15441.md): Product Table & List Builder For WooCommerce \<= 5.6.0 - Unauthenticated CSS Injection via 'laptop\_scroll\_offset' Parameter (CVSS 5.3, wcproducttable Product Table & List Builder For WooCommerce)
- [CVE-2026-11780](https://cve.now/CVE-2026-11780.md): Quiz and Survey Master (QSM) \<= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question\_title' Parameter (CVSS 6.4, expresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…)
- [CVE-2026-13358](https://cve.now/CVE-2026-13358.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure (CVSS 6.5, croixhaug Simply Schedule Appointments)
- [CVE-2026-14524](https://cve.now/CVE-2026-14524.md): ProSolution WP Client \<= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters (CVSS 9.1, ProSolution WP Client)
- [CVE-2026-16079](https://cve.now/CVE-2026-16079.md): Fullscreen Galleria \<= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content (CVSS 6.5, pdamsten Fullscreen Galleria)
- [CVE-2026-12477](https://cve.now/CVE-2026-12477.md): Gravity Booster \<= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter (CVSS 4.4, wpmonks Gravity Booster – Styles & Layouts for Gravity Forms)
- [CVE-2026-16098](https://cve.now/CVE-2026-16098.md): ProSolution WP Client \<= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override (CVSS 9.8, ProSolution WP Client)
- [CVE-2026-16099](https://cve.now/CVE-2026-16099.md): Podlove Podcast Publisher \<= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl\_data' Parameter (CVSS 8.8, eteubert Podlove Podcast Publisher)
- [CVE-2026-18385](https://cve.now/CVE-2026-18385.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \<= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field (CVSS 5.4, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2026-14498](https://cve.now/CVE-2026-14498.md): Query Wrangler \<= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter (CVSS 8.8, daggerhart Query Wrangler)
- [CVE-2026-15602](https://cve.now/CVE-2026-15602.md): NEX-Forms \<= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional\_params' Parameter (CVSS 4.9, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2026-12905](https://cve.now/CVE-2026-12905.md): Online Scheduling and Appointment Booking System – Bookly \<= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params\[id\]' Parameter (CVSS 4.3, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2026-18432](https://cve.now/CVE-2026-18432.md): Frontend Admin by DynamiApps \<= 3.29.9 - Unauthenticated Privilege Escalation via 'item\_id' Parameter (CVSS 9.8, shabti Frontend Admin by DynamiApps)
- [CVE-2026-19932](https://cve.now/CVE-2026-19932.md): DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection (CVSS 5.3, DefaultFuction Notice-System-Managent)
- [CVE-2026-2487](https://cve.now/CVE-2026-2487.md): Admin Custom Login \<= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting (CVSS 4.4, weblizar Admin Custom Login)
- [CVE-2026-19930](https://cve.now/CVE-2026-19930.md): Dolibarr User Cloning card.php ldap injection (CVSS 5.3, Dolibarr)
- [CVE-2026-19929](https://cve.now/CVE-2026-19929.md): OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engine (CVSS 5.3, OpenBoxes)
- [CVE-2026-19928](https://cve.now/CVE-2026-19928.md): OpenBoxes Role Interceptor RoleInterceptor.groovy needManager privileges management (CVSS 5.3, OpenBoxes)
- [CVE-2026-19927](https://cve.now/CVE-2026-19927.md): OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery (CVSS 5.3, OpenBoxes)
- [CVE-2026-19926](https://cve.now/CVE-2026-19926.md): Evergreen open-ils.fielder OpenSRF Service osrf-gateway-v1 sql injection (CVSS 6.9, Evergreen)
- [CVE-2026-19925](https://cve.now/CVE-2026-19925.md): SourceCodester Stock Management System Master.php delete\_supplier sql injection (CVSS 5.1, SourceCodester Stock Management System)
- [CVE-2026-19924](https://cve.now/CVE-2026-19924.md): Tenda AC10 httpd R7WebsSecurityHandler improper authentication (CVSS 9.3, Tenda AC10)
- [CVE-2026-19923](https://cve.now/CVE-2026-19923.md): code-projects Online Shopping System checkout\_process.php sql injection (CVSS 5.3, code-projects Online Shopping System)
- [CVE-2026-19922](https://cve.now/CVE-2026-19922.md): code-projects Online Shopping System checkout.php cross site scripting (CVSS 5.1, code-projects Online Shopping System)
- [CVE-2026-19921](https://cve.now/CVE-2026-19921.md): code-projects Online Shopping System homeaction.php sql injection (CVSS 5.3, code-projects Online Shopping System)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.