# CVEs published 2026-08-21

258 CVEs were published on August 21, 2026: 41 critical, 104 high. Days are UTC.

- [CVE-2026-77781](https://cve.now/CVE-2026-77781.md): Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys (CVSS 7.5, Tie-Hash-Regex)
- [CVE-2026-49360](https://cve.now/CVE-2026-49360.md): Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB (CVSS 7.8, DataRecce recce · recce)
- [CVE-2026-53541](https://cve.now/CVE-2026-53541.md): OliveTin has Unvalidated \`ot\_\`-prefixed Arguments that Bypass Input Filtering (CVSS 4.3, OliveTin · github.com/OliveTin/OliveTin)
- [CVE-2026-48106](https://cve.now/CVE-2026-48106.md): Arc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peer (CVSS 8.3, Basekick-Labs arc)
- [CVE-2026-48105](https://cve.now/CVE-2026-48105.md): Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive (CVSS 8.3, Basekick-Labs arc)
- [CVE-2026-47735](https://cve.now/CVE-2026-47735.md): Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks (CVSS 7.1, Basekick-Labs arc · github.com/basekick-labs/arc)
- [CVE-2026-48050](https://cve.now/CVE-2026-48050.md): Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS (CVSS 8.8, Basekick-Labs arc · github.com/basekick-labs/arc)
- [CVE-2026-34949](https://cve.now/CVE-2026-34949.md): Combodo iTop: Unauthenticated user can delete .readonly file (CVSS 6.5, Combodo iTop)
- [CVE-2026-53499](https://cve.now/CVE-2026-53499.md): FORT-validator Vulnerable to RRDP Shared Snapshot Cache Poisoning (CVSS 7.2, NICMx FORT-validator)
- [CVE-2026-34948](https://cve.now/CVE-2026-34948.md): Combodo iTop: Access control bypass via OQL joins (CVSS 7.7, Combodo iTop)
- [CVE-2026-53525](https://cve.now/CVE-2026-53525.md): WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication (CVSS 7.4, weechat)
- [CVE-2026-53524](https://cve.now/CVE-2026-53524.md): WeeChat has a Decompression Bomb in Relay WebSocket (DoS) (CVSS 6.5, weechat)
- [CVE-2026-34836](https://cve.now/CVE-2026-34836.md): Combodo iTop: Improper access control in ajax.render.php and ajax.document.php (CVSS 6.5, Combodo iTop)
- [CVE-2026-34741](https://cve.now/CVE-2026-34741.md): Combodo iTop: Authentication bypass in exec.php allows PHP file execution (CVSS 8.6, Combodo iTop)
- [CVE-2026-33333](https://cve.now/CVE-2026-33333.md): Combodo iTop: Information disclosure in ajax.render.php (CVSS 3.5, Combodo iTop)
- [CVE-2026-53487](https://cve.now/CVE-2026-53487.md): Kite has an authenticated cluster RBAC bypass in /api/v1/overview (CVSS 4.3, kite-org kite · github.com/zxh326/kite)
- [CVE-2026-53531](https://cve.now/CVE-2026-53531.md): ratex-parser has unbounded parser recursion that leads to stack overflow (process abort) (CVSS 6.9, erweixin RaTeX · ratex-parser)
- [CVE-2026-53530](https://cve.now/CVE-2026-53530.md): ratex-parser panics on \`\\verb\` with a multibyte delimiter (UTF-8 byte-boundary slice) (CVSS 8.7, erweixin RaTeX · ratex-parser)
- [CVE-2026-53529](https://cve.now/CVE-2026-53529.md): LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML) (CVSS 4.8, perber leafwiki)
- [CVE-2026-53528](https://cve.now/CVE-2026-53528.md): FileWiki has path traversal in RenameAsset via unsanitized oldFilename parameter (CVSS 8.8, perber leafwiki)
- [CVE-2026-53527](https://cve.now/CVE-2026-53527.md): LeafWiki Vulnerable to Privilege Escalation via User Self-Service Update (CVSS 8.8, perber leafwiki)
- [CVE-2026-33240](https://cve.now/CVE-2026-33240.md): Combodo iTop: Reflected XSS in foreign key search criteria (CVSS 8.8, Combodo iTop)
- [CVE-2026-33047](https://cve.now/CVE-2026-33047.md): Combodo iTop: Object can be locked by a user without write permissions (CVSS 4.3, Combodo iTop)
- [CVE-2026-53509](https://cve.now/CVE-2026-53509.md): @aborruso/ckan-mcp-server: SSRF via base\_url allows access to internal networks (Potential fix bypass of CVE-2026-33060) (CVSS 5.7, ondata ckan-mcp-server · @aborruso/ckan-mcp-server)
- [CVE-2026-53497](https://cve.now/CVE-2026-53497.md): CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs) (CVSS 5.3, cenodude CrossWatch)
- [CVE-2026-43980](https://cve.now/CVE-2026-43980.md): Malla: Stored XSS via Meshtastic node names in multiple frontend pages (CVSS 6.3, zenitraM malla · malla)
- [CVE-2026-31936](https://cve.now/CVE-2026-31936.md): Combodo iTop: Unauthorized access to object information via search operation (CVSS 8.8, Combodo iTop)
- [CVE-2026-53468](https://cve.now/CVE-2026-53468.md): Typemill has Stored HTML Attribute Injection in Metadata Fields (CVSS 4.6, typemill)
- [CVE-2026-49849](https://cve.now/CVE-2026-49849.md): xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution (CVSS 9.1, 4xmen xshop)
- [CVE-2026-50538](https://cve.now/CVE-2026-50538.md): libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write (CVSS 8.8, libvncserver)
- [CVE-2026-77415](https://cve.now/CVE-2026-77415.md): JSONata: Arbitrary Code Execution via crafted JSONata expressions (CVSS 9.3, jsonata-js jsonata · jsonata)
- [CVE-2026-45271](https://cve.now/CVE-2026-45271.md): picotls has infinite recursion in the minicrypto ASN.1 decoder (CVSS 5.5, h2o picotls)
- [CVE-2026-31880](https://cve.now/CVE-2026-31880.md): Combodo iTop: Reflected XSS in universal search (CVSS 8.0, Combodo iTop)
- [CVE-2026-77220](https://cve.now/CVE-2026-77220.md): PDFio \< 1.6.5 Dangling Pointer via Dictionary String-Formatting (CVSS 7.1, michaelrsweet pdfio)
- [CVE-2026-69233](https://cve.now/CVE-2026-69233.md): stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 5.5, Esri Portal for ArcGIS)
- [CVE-2026-69234](https://cve.now/CVE-2026-69234.md): reflected cross site scripting vulnerability in Esri Portal for ArcGIS (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2026-69235](https://cve.now/CVE-2026-69235.md): stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2026-69236](https://cve.now/CVE-2026-69236.md): stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2026-69237](https://cve.now/CVE-2026-69237.md): HTML injection vulnerability in Esri Portal for ArcGIS (CVSS 3.8, Esri Portal for ArcGIS)
- [CVE-2026-31803](https://cve.now/CVE-2026-31803.md): Combodo iTop: Reflected XSS in tag admin (CVSS 8.0, Combodo iTop)
- [CVE-2026-77414](https://cve.now/CVE-2026-77414.md): JSONata: Arbitrary Code Execution via crafted JSONata expressions (CVSS 9.3, jsonata-js jsonata · jsonata)
- [CVE-2026-69232](https://cve.now/CVE-2026-69232.md): stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 5.5, Esri Portal for ArcGIS)
- [CVE-2026-69231](https://cve.now/CVE-2026-69231.md): stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 5.5, Esri Portal for ArcGIS)
- [CVE-2026-69230](https://cve.now/CVE-2026-69230.md): stored cross site scripting issue in Esri Portal for ArcGIS (CVSS 5.5, Esri Portal for ArcGIS)
- [CVE-2026-69229](https://cve.now/CVE-2026-69229.md): HTML injection vulnerability in Esri Portal for ArcGIS (CVSS 5.4, Esri Portal for ArcGIS)
- [CVE-2026-69228](https://cve.now/CVE-2026-69228.md): missing authentication vulnerability in Esri Portal for ArcGIS (CVSS 5.3, Esri Portal for ArcGIS)
- [CVE-2026-77413](https://cve.now/CVE-2026-77413.md): JSONata: Arbitrary Code Execution via crafted JSONata expressions (CVSS 9.3, jsonata-js jsonata · jsonata)
- [CVE-2026-69225](https://cve.now/CVE-2026-69225.md): information disclosure vulnerability in Esri Portal for ArcGIS (CVSS 5.9, Esri Portal for ArcGIS)
- [CVE-2026-69238](https://cve.now/CVE-2026-69238.md): HTML injection vulnerability in Esri Portal for ArcGIS (CVSS 3.5, Esri Portal for ArcGIS)
- [CVE-2026-69224](https://cve.now/CVE-2026-69224.md): information disclosure vulnerability in Esri Portal for ArcGIS (CVSS 5.9, Esri Portal for ArcGIS)
- [CVE-2026-77354](https://cve.now/CVE-2026-77354.md): kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding (CVSS 8.7, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-76905](https://cve.now/CVE-2026-76905.md): kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS (CVSS 7.5, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-63135](https://cve.now/CVE-2026-63135.md): YOURLS: Stored XSS in referrer statistics chart via crafted Referer header (CVSS 8.2, YOURLS · yourls/yourls)
- [CVE-2026-30890](https://cve.now/CVE-2026-30890.md): Combodo iTop: Reflected XSS in synchro/synchro\_import.php (CVSS 8.0, Combodo iTop)
- [CVE-2026-30865](https://cve.now/CVE-2026-30865.md): Combodo iTop: Reflected XSS in dashboard save (CVSS 7.1, Combodo iTop)
- [CVE-2026-61539](https://cve.now/CVE-2026-61539.md): Xinference: Remote code execution via unsafe \`eval()\` in Llama3 tool-call parsing (CVSS 10.0, xorbitsai inference · xinference)
- [CVE-2026-53656](https://cve.now/CVE-2026-53656.md): FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: \*), enabling cross-origin reads of local server data (CVSS 6.3, voxel51 fiftyone · fiftyone)
- [CVE-2026-54457](https://cve.now/CVE-2026-54457.md): TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint (CVSS 7.7, tensorzero)
- [CVE-2026-55168](https://cve.now/CVE-2026-55168.md): Runtipi: Authenticated arbitrary file write via backup restore symlink planting (CVSS 6.5, runtipi)
- [CVE-2026-64679](https://cve.now/CVE-2026-64679.md): Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation (CVSS 8.1, runatlantis atlantis · github.com/runatlantis/atlantis)
- [CVE-2026-44517](https://cve.now/CVE-2026-44517.md): Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive (CVSS 6.3, containers buildah · github.com/containers/buildah)
- [CVE-2026-59989](https://cve.now/CVE-2026-59989.md): Phalcon Volt compiler \`join\` filter compile-time PHP code injection (SSTI lead to RCE) (CVSS 9.2, cphalcon · phalcon/cphalcon)
- [CVE-2026-62283](https://cve.now/CVE-2026-62283.md): Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check (CVSS 9.9, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-77219](https://cve.now/CVE-2026-77219.md): GNU Emacs \< 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader (CVSS 6.9, GNU Emacs)
- [CVE-2026-55185](https://cve.now/CVE-2026-55185.md): Miniflux 2: Open Redirect Bypass (CVSS 5.1, miniflux · miniflux.app +1)
- [CVE-2026-62316](https://cve.now/CVE-2026-62316.md): Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution (CVSS 8.8, microsoft UFO)
- [CVE-2026-30826](https://cve.now/CVE-2026-30826.md): Combodo iTop: Reflected XSS in run\_query.php (CVSS 8.0, Combodo iTop)
- [CVE-2026-63421](https://cve.now/CVE-2026-63421.md): Keystone: \`graphql.maxTake\` bypass with negative \`take\` (CVSS 7.5, keystonejs keystone · @keystone-6/core)
- [CVE-2026-76904](https://cve.now/CVE-2026-76904.md): GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers (CVSS 9.8, geotools · org.geotools.jdbc:gt-jdbc-postgis)
- [CVE-2026-61824](https://cve.now/CVE-2026-61824.md): Defuddle: XSS via unescaped attribute interpolation in site extractors (CVSS 8.2, kepano defuddle · defuddle)
- [CVE-2026-53572](https://cve.now/CVE-2026-53572.md): KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping (CVSS 5.9, kedacore keda · github.com/kedacore/keda +1)
- [CVE-2026-68508](https://cve.now/CVE-2026-68508.md): Hydra: hydra.utils.instantiate with untrusted config can lead to code execution (CVSS 7.8, facebookresearch hydra · hydra-core)
- [CVE-2026-77811](https://cve.now/CVE-2026-77811.md): Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards (CVSS 8.7, AWS Amazon OpenSearch Service · OpenSearch Dashboards dashb…)
- [CVE-2026-45099](https://cve.now/CVE-2026-45099.md): Terragrunt: Arbitrary File Deletion via Malicious Module Manifest (CVSS 6.9, gruntwork-io terragrunt · github.com/gruntwork-io/terragrunt)
- [CVE-2026-30819](https://cve.now/CVE-2026-30819.md): Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard\_id parameter (CVSS 7.3, Combodo iTop)
- [CVE-2026-62960](https://cve.now/CVE-2026-62960.md): Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows (CVSS 7.4, git-for-windows git)
- [CVE-2026-27490](https://cve.now/CVE-2026-27490.md): Combodo iTop: Weak secret generation for inline image (CVSS 7.5, Combodo iTop)
- [CVE-2026-27463](https://cve.now/CVE-2026-27463.md): Combodo iTop: Version disclosure via login page logo (CVSS 5.3, Combodo iTop)
- [CVE-2026-50290](https://cve.now/CVE-2026-50290.md): @asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString (CVSS 5.3, asymmetric-effort specifyjs · @asymmetric-effort/specifyjs)
- [CVE-2026-27462](https://cve.now/CVE-2026-27462.md): Combodo iTop: User enumeration via password reset (CVSS 7.5, Combodo iTop)
- [CVE-2026-76876](https://cve.now/CVE-2026-76876.md): Craftplan \< 0.5.1 Broken Access Control Information Disclosure via Settings API (CVSS 8.2, puemos craftplan)
- [CVE-2026-77810](https://cve.now/CVE-2026-77810.md): Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector (CVSS 9.9, AWS Athena Federated Query Neptune Connector)
- [CVE-2026-30866](https://cve.now/CVE-2026-30866.md): Combodo iTop: Insecured access to uploaded images via sniffed url (CVSS 7.5, Combodo iTop)
- [CVE-2026-50288](https://cve.now/CVE-2026-50288.md): @asymmetric-effort/specifyjs: URL parse failure silently allows request (CVSS 8.7, asymmetric-effort specifyjs · @asymmetric-effort/specifyjs)
- [CVE-2026-67361](https://cve.now/CVE-2026-67361.md): Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 (CVSS 6.9, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-74252](https://cve.now/CVE-2026-74252.md): Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 (CVSS 8.6, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-67358](https://cve.now/CVE-2026-67358.md): Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 (CVSS 5.3, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-67362](https://cve.now/CVE-2026-67362.md): Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 (CVSS 5.1, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-67359](https://cve.now/CVE-2026-67359.md): Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 (CVSS 8.7, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-67360](https://cve.now/CVE-2026-67360.md): Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 (CVSS 6.3, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-54071](https://cve.now/CVE-2026-54071.md): BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py (CVSS 7.8, funstory-ai BabelDOC · babeldoc)
- [CVE-2026-54073](https://cve.now/CVE-2026-54073.md): VeraCrypt: Hidden volume quick format weakens plausible deniability (CVSS 4.6, VeraCrypt)
- [CVE-2026-53762](https://cve.now/CVE-2026-53762.md): VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds) (CVSS 6.2, VeraCrypt)
- [CVE-2026-54681](https://cve.now/CVE-2026-54681.md): DiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML export (CVSS 4.1, Tyrrrz DiscordChatExporter)
- [CVE-2026-54682](https://cve.now/CVE-2026-54682.md): DiscordChatExporter: Stored XSS in HTML export when markdown formatting is disabled (CVSS 8.2, Tyrrrz DiscordChatExporter)
- [CVE-2026-55850](https://cve.now/CVE-2026-55850.md): Element Web: A malicious homeserver can inject HTML in Element Web using its homepage (CVSS 5.3, element-hq element-web)
- [CVE-2026-77795](https://cve.now/CVE-2026-77795.md): Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization (CVSS 5.3, Dromara RuoYi-Vue-Plus)
- [CVE-2026-54134](https://cve.now/CVE-2026-54134.md): OctoPrint: File exfiltration possible via query parameters on upload endpoints (CVSS 7.0, OctoPrint)
- [CVE-2026-35163](https://cve.now/CVE-2026-35163.md): OctoPrint: XSS in Suppressed Command Notifications (CVSS 4.6, OctoPrint)
- [CVE-2026-63466](https://cve.now/CVE-2026-63466.md): Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username (CVSS 4.1, unleash · unleash-server)
- [CVE-2026-63462](https://cve.now/CVE-2026-63462.md): Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter (CVSS 7.5, unleash · unleash-server)
- [CVE-2026-63004](https://cve.now/CVE-2026-63004.md): Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers (CVSS 5.5, unleash · unleash-server)
- [CVE-2026-71862](https://cve.now/CVE-2026-71862.md): Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled (CVSS 7.5, bluewave-labs Checkmate)
- [CVE-2026-70656](https://cve.now/CVE-2026-70656.md): Checkmate: Regular Expression Denial of Service (ReDoS) via User-Controlled Regex in Monitor Advanced Matching (CVSS 4.9, bluewave-labs Checkmate)
- [CVE-2026-55241](https://cve.now/CVE-2026-55241.md): Checkmate: Pre-auth Denial of Service via File Upload on Registration (CVSS 7.5, bluewave-labs Checkmate)
- [CVE-2026-27875](https://cve.now/CVE-2026-27875.md): Simplex Incident Manager Clear Test (CVSS 6.9, Johnson Controls Simplex Incident Manager / Autocall Fire A…)
- [CVE-2026-71493](https://cve.now/CVE-2026-71493.md): Infracost: Arbitrary file read via config-template readFile symlink traversal (CVSS 5.9, infracost · github.com/infracost/infracost)
- [CVE-2026-77237](https://cve.now/CVE-2026-77237.md): Missing type validation in xQueueAddToSet in FreeRTOS-Kernel (CVSS 6.5, FreeRTOS-Kernel)
- [CVE-2026-71494](https://cve.now/CVE-2026-71494.md): Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname (CVSS 5.9, infracost · github.com/infracost/infracost)
- [CVE-2026-62675](https://cve.now/CVE-2026-62675.md): Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools (CVSS 8.8, omnigent-ai omnigent · omnigent)
- [CVE-2026-77236](https://cve.now/CVE-2026-77236.md): Missing size validation in SecureContext\_AllocateContext in FreeRTOS-Kernel (CVSS 7.3, FreeRTOS-Kernel)
- [CVE-2026-62674](https://cve.now/CVE-2026-62674.md): Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE (CVSS 9.0, omnigent-ai omnigent · omnigent)
- [CVE-2026-62677](https://cve.now/CVE-2026-62677.md): Omnigent: Unvalidated os\_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT\_RUNNER\_WORKSPACE (CVSS 8.8, omnigent-ai omnigent · omnigent)
- [CVE-2026-62676](https://cve.now/CVE-2026-62676.md): Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/\_shell.py (CVSS 7.1, omnigent-ai omnigent · omnigent)
- [CVE-2026-77235](https://cve.now/CVE-2026-77235.md): Missing privilege check in SecureContext\_FreeContext in FreeRTOS-Kernel (CVSS 7.3, FreeRTOS-Kernel)
- [CVE-2026-77234](https://cve.now/CVE-2026-77234.md): Improper input validation in FreeRTOS-Kernel timer command handling (CVSS 8.8, FreeRTOS-Kernel)
- [CVE-2026-41451](https://cve.now/CVE-2026-41451.md): UAC \< 3.3.0 Command Injection via User Substitution in parse\_artifact.sh (CVSS 8.5, tclahr uac)
- [CVE-2026-41450](https://cve.now/CVE-2026-41450.md): UAC \< 3.3.0 Command Injection via command\_collector.sh (CVSS 8.5, tclahr uac)
- [CVE-2026-41449](https://cve.now/CVE-2026-41449.md): UAC \< 3.3.0 Command Injection via run\_command.sh (CVSS 8.5, tclahr uac)
- [CVE-2026-17252](https://cve.now/CVE-2026-17252.md): Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface (CVSS 7.1, TP-Link Systems TL-MR6400)
- [CVE-2026-17251](https://cve.now/CVE-2026-17251.md): Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing (CVSS 7.1, TP-Link Systems TL-MR6400)
- [CVE-2026-17250](https://cve.now/CVE-2026-17250.md): Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update Handling (CVSS 8.5, TP-Link Systems TL-MR6400)
- [CVE-2026-74583](https://cve.now/CVE-2026-74583.md): net/sched: cls\_route: fix fastmap use-after-free on filter (CVSS 7.8, Linux)
- [CVE-2026-74582](https://cve.now/CVE-2026-74582.md): packet: use consistent hard\_header\_len in non-ring send paths (CVSS 7.8, Linux)
- [CVE-2026-74581](https://cve.now/CVE-2026-74581.md): net: ipv6: clear suppressed fib6 rule result (CVSS 9.8, Linux)
- [CVE-2026-74580](https://cve.now/CVE-2026-74580.md): vhost: reset the vring metadata cache on vring reconfiguration (CVSS 8.8, Linux)
- [CVE-2026-54789](https://cve.now/CVE-2026-54789.md): mod\_auth\_openidc has out-of-bounds read and write in state cookie parsing (CVSS 7.5, mod\_auth\_openidc)
- [CVE-2026-22681](https://cve.now/CVE-2026-22681.md): OpenViking \< 0.3.4 SSRF via /api/v1/resources (CVSS 8.3, Volcengine OpenViking)
- [CVE-2026-75933](https://cve.now/CVE-2026-75933.md): Jet Admin Stored XSS (CVSS 7.3, Jet Admin)
- [CVE-2026-75932](https://cve.now/CVE-2026-75932.md): Jet Admin tenant isolation failure (CVSS 9.2, Jet Admin)
- [CVE-2026-75928](https://cve.now/CVE-2026-75928.md): Brushfire unauthenticated information disclosure (CVSS 6.9, Brushfire Online Experience)
- [CVE-2026-49114](https://cve.now/CVE-2026-49114.md): ONNX symlink-following and path-traversal arbitrary file write (CVSS 7.1, ONNX)
- [CVE-2026-69502](https://cve.now/CVE-2026-69502.md): Azure SQL Database Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure SQL Database)
- [CVE-2026-77815](https://cve.now/CVE-2026-77815.md): Infinite Image Browsing Resolves Paths With normpath, Allowing Symlink Escape From Scanned Directories (CVSS 8.7, zanllp infinite-image-browsing)
- [CVE-2026-77814](https://cve.now/CVE-2026-77814.md): Infinite Image Browsing is\_path\_trusted Prefix Comparison Omits the Trailing Path Separator (CVSS 8.7, zanllp infinite-image-browsing)
- [CVE-2026-77087](https://cve.now/CVE-2026-77087.md): Paperclip before 0.3.1 Remote Code Execution via DNS Rebinding (CVSS 9.4, paperclipai paperclip)
- [CVE-2026-50278](https://cve.now/CVE-2026-50278.md): iccDEV: CIccEmbedIO::Read8() size\_t underflow (CVSS 6.5, InternationalColorConsortium iccDEV)
- [CVE-2026-63343](https://cve.now/CVE-2026-63343.md): Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root (CVSS 9.9, lxc incus)
- [CVE-2026-63125](https://cve.now/CVE-2026-63125.md): Incus vulnerable to root RCE via image backup.yaml symlink (CVSS 9.9, lxc incus)
- [CVE-2026-62941](https://cve.now/CVE-2026-62941.md): Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge (CVSS 9.9, lxc incus)
- [CVE-2026-62940](https://cve.now/CVE-2026-62940.md): Incus has a project restriction bypass via instance migration config override (CVSS 9.9, lxc incus)
- [CVE-2026-62867](https://cve.now/CVE-2026-62867.md): Incus has an argument injection in storage volume block.create\_options that leads to arbitrary command execution (CVSS 9.9, lxc incus)
- [CVE-2026-62313](https://cve.now/CVE-2026-62313.md): Incus: Project restriction \`restricted.containers.privilege=isolated\` bypassable by omitting \`security.idmap.isolated\` (CVSS 4.3, lxc incus)
- [CVE-2026-55622](https://cve.now/CVE-2026-55622.md): Incus has a project restriction bypass in instance copy across projects (CVSS 7.7, lxc incus · github.com/lxc/incus +3)
- [CVE-2026-55621](https://cve.now/CVE-2026-55621.md): Incus has a project restriction bypass for custom volume copy across projects (CVSS 7.7, lxc incus · github.com/lxc/incus/v7 +2)
- [CVE-2026-48769](https://cve.now/CVE-2026-48769.md): Incus has an arbitrary file write on its client due to trusted image hash (CVSS 9.9, lxc incus · github.com/lxc/incus +3)
- [CVE-2026-48755](https://cve.now/CVE-2026-48755.md): Incus has an argument injection in backup compression algorithm leading to AFW and ACE (CVSS 9.9, lxc incus · github.com/lxc/incus/v7/cmd/incusd +3)
- [CVE-2026-48754](https://cve.now/CVE-2026-48754.md): Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} (CVSS 2.1, lxc incus · github.com/lxc/incus/v7/cmd/incusd +3)
- [CVE-2026-48753](https://cve.now/CVE-2026-48753.md): Incus has an arbitrary file write via path traversal in S3 multipart upload (CVSS 9.9, lxc incus · github.com/lxc/incus +3)
- [CVE-2026-48752](https://cve.now/CVE-2026-48752.md): Incus has arbitrary file read+write on host via templates/ symlink in malicious image (CVSS 9.9, lxc incus · github.com/lxc/incus +3)
- [CVE-2026-48751](https://cve.now/CVE-2026-48751.md): Incus has a restricted project bypass leading to arbitrary command execution (CVSS 9.9, lxc incus · github.com/lxc/incus/v7/cmd/incusd +3)
- [CVE-2026-48750](https://cve.now/CVE-2026-48750.md): Incus has an arbitrary file write on host via \`exec-output\` symlink in crafted image (CVSS 9.9, lxc incus · github.com/lxc/incus/v7/cmd/incusd +3)
- [CVE-2026-48749](https://cve.now/CVE-2026-48749.md): Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image (CVSS 9.9, lxc incus · github.com/lxc/incus/v7/cmd/incusd +3)
- [CVE-2026-47753](https://cve.now/CVE-2026-47753.md): Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) (CVSS 4.4, lxc incus · github.com/lxc/incus +2)
- [CVE-2026-48756](https://cve.now/CVE-2026-48756.md): Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume\_snapshots\[\*\].expires\_at (sibling-field variant of GHSA-r7w7) (CVSS 2.1, lxc incus · github.com/lxc/incus +3)
- [CVE-2026-77812](https://cve.now/CVE-2026-77812.md): Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE (CVSS 9.4, DJI Neo · DJI Flip +4)
- [CVE-2026-15580](https://cve.now/CVE-2026-15580.md): PassPortal browser extension: vault token disclosure via unvalidated postMessage (CVSS 6.9, N-able PassPortal)
- [CVE-2026-75946](https://cve.now/CVE-2026-75946.md): OMEN Gaming Hub – Potential Escalation of Privilege & Information Disclosure (CVSS 8.2, HP OMEN Gaming Hub)
- [CVE-2026-77806](https://cve.now/CVE-2026-77806.md): SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. (CVSS 9.8, SPIP)
- [CVE-2026-59654](https://cve.now/CVE-2026-59654.md): Apache CloudStack: DoS caused by database connections leak (CVSS 6.8, Apache Software Foundation Apache CloudStack)
- [CVE-2026-76612](https://cve.now/CVE-2026-76612.md): Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo \< 4.1.66 (CVSS 8.6, yootheme.com Zoo extension for Joomla)
- [CVE-2026-76611](https://cve.now/CVE-2026-76611.md): Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo \< 4.1.66 (CVSS 6.9, yootheme.com Zoo extension for Joomla)
- [CVE-2026-75115](https://cve.now/CVE-2026-75115.md): Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 (CVSS 7.0, yootheme.com YOOtheme Pro extension for Joomla)
- [CVE-2026-76613](https://cve.now/CVE-2026-76613.md): Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 (CVSS 8.6, yootheme.com YOOtheme Pro extension for Joomla)
- [CVE-2026-77028](https://cve.now/CVE-2026-77028.md): Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo \< 4.1.66 (CVSS 5.3, yootheme.com Zoo extension for Joomla)
- [CVE-2026-77780](https://cve.now/CVE-2026-77780.md): Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers (CVSS 5.3, Roskus Prospero Flow CRM)
- [CVE-2026-77029](https://cve.now/CVE-2026-77029.md): Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo \< 4.1.66 (CVSS 4.6, yootheme.com Zoo extension for Joomla)
- [CVE-2026-59318](https://cve.now/CVE-2026-59318.md): DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection (CVSS 6.5, Spring AI)
- [CVE-2026-59308](https://cve.now/CVE-2026-59308.md): Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation (CVSS 4.2, Spring AI)
- [CVE-2026-59279](https://cve.now/CVE-2026-59279.md): Unbounded persistent session allocation via repeated initialize requests (CVSS 7.5, Spring AI)
- [CVE-2026-19848](https://cve.now/CVE-2026-19848.md): ProfilePress \< 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name (CVSS 6.5, ProfilePress)
- [CVE-2026-18356](https://cve.now/CVE-2026-18356.md): Limit Login Attempts Reloaded \< 3.3.5 - Username Denylist Bypass via Case Variant and Account Email (CVSS 3.7, Limit Login Attempts Security)
- [CVE-2026-17559](https://cve.now/CVE-2026-17559.md): Content Protector (Passster) \< 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass (CVSS 5.3, Passster)
- [CVE-2026-16650](https://cve.now/CVE-2026-16650.md): Charitable \< 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass (CVSS 5.3, Charitable)
- [CVE-2026-15150](https://cve.now/CVE-2026-15150.md): myCred \< 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED (CVSS 5.3, myCred)
- [CVE-2026-15046](https://cve.now/CVE-2026-15046.md): LitExtension: Store to WooCommerce Migration \<= 1.2.5 - Connector Token Takeover via CSRF (CVSS 4.2, LitExtension)
- [CVE-2026-13176](https://cve.now/CVE-2026-13176.md): Eventin \< 4.1.21 - Contributor+ Server-Side Request Forgery (CVSS 2.7, Eventin)
- [CVE-2026-77759](https://cve.now/CVE-2026-77759.md): IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records (CVSS 8.7, Roskus Prospero Flow CRM)
- [CVE-2026-77776](https://cve.now/CVE-2026-77776.md): Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity (CVSS 9.1, Headroom Labs Headroom)
- [CVE-2026-77775](https://cve.now/CVE-2026-77775.md): Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation (CVSS 8.6, Headroom Labs Headroom)
- [CVE-2026-15576](https://cve.now/CVE-2026-15576.md): Agent receiver accepts mTLS requests without a client certificate (CVSS 6.9, Checkmk)
- [CVE-2026-77769](https://cve.now/CVE-2026-77769.md): OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries (CVSS 6.5, Openpanel-dev openpanel)
- [CVE-2026-77768](https://cve.now/CVE-2026-77768.md): OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access (CVSS 6.5, Openpanel-dev openpanel)
- [CVE-2026-77767](https://cve.now/CVE-2026-77767.md): Reconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authentication (CVSS 7.5, reconmap)
- [CVE-2026-77763](https://cve.now/CVE-2026-77763.md): JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory (CVSS 6.5, juicedata juicefs)
- [CVE-2026-77086](https://cve.now/CVE-2026-77086.md): SiYuan before v3.7.4 Path Traversal via packageName (CVSS 9.4, siyuan-note siyuan)
- [CVE-2026-77686](https://cve.now/CVE-2026-77686.md): Dolibarr Account card.php improper authorization (CVSS 5.3, Dolibarr)
- [CVE-2026-14208](https://cve.now/CVE-2026-14208.md): Local Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host \<=7.7.3.0 (CVSS 7.3, Remote Utilities Pte. Remote Utilities Host)
- [CVE-2026-59296](https://cve.now/CVE-2026-59296.md): Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability (CVSS 5.9, Spring Micrometer)
- [CVE-2026-77683](https://cve.now/CVE-2026-77683.md): Comfast CF-N1-S mbox-config system command injection (CVSS 9.4, Comfast CF-N1-S)
- [CVE-2026-77761](https://cve.now/CVE-2026-77761.md): Cross-Document Parser State Contamination in misp-stix (CVSS 6.3, misp-stix)
- [CVE-2026-59323](https://cve.now/CVE-2026-59323.md): Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability (CVSS 5.3, Spring Micrometer Tracing)
- [CVE-2026-77755](https://cve.now/CVE-2026-77755.md): Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library (CVSS 8.7, misp-stix)
- [CVE-2026-47079](https://cve.now/CVE-2026-47079.md): Round-trip Corruption via Improper Entity Escaping in xml\_builder (CVSS 2.1, joshnuss xml\_builder)
- [CVE-2026-48590](https://cve.now/CVE-2026-48590.md): Element and Attribute Names Injected Verbatim into XML Output in xml\_builder (CVSS 2.1, joshnuss xml\_builder)
- [CVE-2026-47080](https://cve.now/CVE-2026-47080.md): CDATA Section Breakout via Unsanitised \]\]\> in xml\_builder (CVSS 2.1, joshnuss xml\_builder)
- [CVE-2026-77751](https://cve.now/CVE-2026-77751.md): Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library (CVSS 8.8, misp-stix)
- [CVE-2026-77681](https://cve.now/CVE-2026-77681.md): CodeAstro Online Job Portal update-profile.php unrestricted upload (CVSS 5.3, CodeAstro Online Job Portal)
- [CVE-2026-47827](https://cve.now/CVE-2026-47827.md): CVE-2026-47827 – BOSH CLI Powershell Injection (CVSS 7.5, Cloud Foundry Foundation BOSH CLI)
- [CVE-2026-77710](https://cve.now/CVE-2026-77710.md): STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library (CVSS 6.9, misp-stix)
- [CVE-2026-63046](https://cve.now/CVE-2026-63046.md): Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials (CVSS 8.8, Apache Software Foundation Apache InLong)
- [CVE-2026-47359](https://cve.now/CVE-2026-47359.md): Apache CloudStack: OS Command Injection due to unsanitized mount command (CVSS 8.8, Apache Software Foundation Apache CloudStack)
- [CVE-2026-50112](https://cve.now/CVE-2026-50112.md): Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates (CVSS 8.8, Apache Software Foundation Apache CloudStack)
- [CVE-2026-50222](https://cve.now/CVE-2026-50222.md): Apache CloudStack: Improper access control in Userdata reference APIs (CVSS 7.5, Apache Software Foundation Apache CloudStack)
- [CVE-2026-59085](https://cve.now/CVE-2026-59085.md): Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module (CVSS 9.1, Apache Software Foundation Apache CloudStack)
- [CVE-2026-59655](https://cve.now/CVE-2026-59655.md): Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure (CVSS 7.5, Apache Software Foundation Apache CloudStack)
- [CVE-2026-59657](https://cve.now/CVE-2026-59657.md): Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob (CVSS 7.5, Apache Software Foundation Apache CloudStack)
- [CVE-2026-59780](https://cve.now/CVE-2026-59780.md): Apache CloudStack: LDAP provider configuration disclosure (CVSS 7.5, Apache Software Foundation Apache CloudStack)
- [CVE-2026-59799](https://cve.now/CVE-2026-59799.md): Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow (CVSS 8.8, Apache Software Foundation Apache CloudStack)
- [CVE-2026-61397](https://cve.now/CVE-2026-61397.md): Apache CloudStack: OAuth2 Token Cross-Request Leak (CVSS 7.5, Apache Software Foundation Apache CloudStack)
- [CVE-2026-61398](https://cve.now/CVE-2026-61398.md): Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI (CVSS 9.1, Apache Software Foundation Apache CloudStack)
- [CVE-2026-61399](https://cve.now/CVE-2026-61399.md): Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI (CVSS 4.8, Apache Software Foundation Apache CloudStack)
- [CVE-2026-61400](https://cve.now/CVE-2026-61400.md): Apache CloudStack: Get and Run Diagnostics Command Injection (CVSS 8.8, Apache Software Foundation Apache CloudStack)
- [CVE-2026-61422](https://cve.now/CVE-2026-61422.md): Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate (CVSS 4.3, Apache Software Foundation Apache CloudStack)
- [CVE-2026-62440](https://cve.now/CVE-2026-62440.md): Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation (CVSS 9.1, Apache Software Foundation Apache CloudStack)
- [CVE-2026-65613](https://cve.now/CVE-2026-65613.md): Apache CloudStack: Webhook Deliveries Incorrect Access (CVSS 4.3, Apache Software Foundation Apache CloudStack)
- [CVE-2026-66721](https://cve.now/CVE-2026-66721.md): Apache CloudStack: Authorization issue with listHostTags for domain admins (CVSS 2.7, Apache Software Foundation Apache CloudStack)
- [CVE-2026-66722](https://cve.now/CVE-2026-66722.md): Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue (CVSS 7.2, Apache Software Foundation Apache CloudStack)
- [CVE-2026-66797](https://cve.now/CVE-2026-66797.md): Apache CloudStack: Unauthorised comment creation and disclosure (CVSS 5.4, Apache Software Foundation Apache CloudStack)
- [CVE-2026-68745](https://cve.now/CVE-2026-68745.md): Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP (CVSS 8.1, Apache Software Foundation Apache CloudStack)
- [CVE-2026-74866](https://cve.now/CVE-2026-74866.md): @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name (CVSS 5.8, @fastify/busboy)
- [CVE-2026-19441](https://cve.now/CVE-2026-19441.md): Unauthenticated API Allows Analytics Data Manipulation in IKAS Technology's Rush (CVSS 5.3, IKAS Technology Rush)
- [CVE-2026-77264](https://cve.now/CVE-2026-77264.md): Automation Web Platform \<= 4.8.6 - Unauthenticated Authentication Bypass via 'otp\_transient' Token Disclosure (CVSS 9.8, 101gen Automation Web Platform – Notifications and OTP for…)
- [CVE-2026-73537](https://cve.now/CVE-2026-73537.md): Cross-site scripting vulnerability exists in Miraikan Assist App. (CVSS 4.7, Japan Science and Technology Agency (JST) Miraikan Assist A…)
- [CVE-2026-16323](https://cve.now/CVE-2026-16323.md): Authentication Bypass via Execution After Redirect in FuyaSoft's Architect Panel Web Management Panel (CVSS 7.5, FuyaWeb Internet and Informatics Services ArchitectPanel We…)
- [CVE-2026-75796](https://cve.now/CVE-2026-75796.md): AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools (CVSS 7.2, AI Engine)
- [CVE-2026-19435](https://cve.now/CVE-2026-19435.md): Copy & Delete Posts \< 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure (CVSS 2.7, Duplicate Post)
- [CVE-2026-19085](https://cve.now/CVE-2026-19085.md): Copy & Delete Posts \< 1.5.6 - Author+ Password-Protected Post Content Disclosure (CVSS 2.7, Duplicate Post)
- [CVE-2026-18781](https://cve.now/CVE-2026-18781.md): Drag and Drop Multiple File Upload for Contact Form 7 \< 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass (CVSS 8.1, Drag and Drop Multiple File Upload for Contact Form)
- [CVE-2026-16959](https://cve.now/CVE-2026-16959.md): Media Library Assistant \< 3.40 - Author+ SQL Injection via mla\_search\_connector (CVSS 6.8, Media Library Assistant)
- [CVE-2026-16577](https://cve.now/CVE-2026-16577.md): Dokan \< 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount (CVSS 2.7, Dokan: AI Powered WooCommerce Multivendor Marketplace Solut…)
- [CVE-2026-16576](https://cve.now/CVE-2026-16576.md): Dokan \< 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API (CVSS 7.2, Dokan: AI Powered WooCommerce Multivendor Marketplace Solut…)
- [CVE-2026-16575](https://cve.now/CVE-2026-16575.md): Dokan \< 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint (CVSS 5.3, Dokan: AI Powered WooCommerce Multivendor Marketplace Solut…)
- [CVE-2026-14601](https://cve.now/CVE-2026-14601.md): Link Whisper \< 0.9.7 - Editor+ SQL Injection via domain Parameter (CVSS 6.8, Link Whisper Free)
- [CVE-2026-14325](https://cve.now/CVE-2026-14325.md): Drag and Drop Multiple File Upload for Contact Form 7 \< 1.3.9.9 - Admin+ Stored XSS via drag\_n\_drop\_heading\_tag Setting (CVSS 3.5, Drag and Drop Multiple File Upload for Contact Form)
- [CVE-2025-15671](https://cve.now/CVE-2025-15671.md): Welcart e-Commerce \< 2.12.1 - Session Fixation via uscesid Parameter (CVSS 5.4, Welcart e-Commerce)
- [CVE-2026-16962](https://cve.now/CVE-2026-16962.md): Tamara Checkout \<= 1.9.9.20 - Unauthenticated Order Status Manipulation (CVSS 5.3, Tamara Checkout)
- [CVE-2026-13736](https://cve.now/CVE-2026-13736.md): NewPath WildApricotPress Add-on – Member Directory \<= 1.0.0 - Unauthenticated Member PII Disclosure via REST API (CVSS 5.3, NewPath WildApricotPress Add-on)
- [CVE-2026-45202](https://cve.now/CVE-2026-45202.md): GPU DDK - Silent High-Order CMA Memory Leak & Double Free in \`\_FreeOSPages\_Fast\` (CVSS 5.5, Imagination Technologies Graphics DDK)
- [CVE-2026-45201](https://cve.now/CVE-2026-45201.md): GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memory (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-18409](https://cve.now/CVE-2026-18409.md): WPForms Pro \<= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values (CVSS 7.2, WPForms Pro)
- [CVE-2026-45199](https://cve.now/CVE-2026-45199.md): GPU DDK - rgxfw\_to\_ptr() does not reject FW private data pointers (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-65644](https://cve.now/CVE-2026-65644.md): Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/live (CVSS 7.5, Rocket.Chat)
- [CVE-2026-65645](https://cve.now/CVE-2026-65645.md): Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. (CVSS 4.3, Rocket.Chat)
- [CVE-2026-73267](https://cve.now/CVE-2026-73267.md): Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check (CVSS 7.7, Red Hat multicluster engine for Kubernetes)
- [CVE-2026-76137](https://cve.now/CVE-2026-76137.md): Missing authentication for critical function vulnerability exists in VOCALOID6. (CVSS 3.3, Yamaha VOCALOID6)
- [CVE-2026-76131](https://cve.now/CVE-2026-76131.md): Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain (CVSS 5.3, Yamaha VOCALOID6)
- [CVE-2026-76158](https://cve.now/CVE-2026-76158.md): Datiphy Data Management Center - External Control of File Name or Path (CVSS 9.3, Datiphy Data Management Center)
- [CVE-2026-76157](https://cve.now/CVE-2026-76157.md): Datiphy Data Management Center - Missing Authentication for Critical Function (CVSS 8.8, Datiphy Data Management Center)
- [CVE-2026-77392](https://cve.now/CVE-2026-77392.md): SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection (CVSS 5.3, SourceCodester Dynamic Input Field Generator Using HTML, CS…)
- [CVE-2026-76156](https://cve.now/CVE-2026-76156.md): Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command (CVSS 9.4, Datiphy Data Management Center)
- [CVE-2026-76155](https://cve.now/CVE-2026-76155.md): Datiphy Data Management Center - Use of Default Credentials (CVSS 9.3, Datiphy Data Management Center)
- [CVE-2026-77391](https://cve.now/CVE-2026-77391.md): SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery (CVSS 5.3, SourceCodester Dynamic Input Field Generator Using HTML, CS…)
- [CVE-2026-77651](https://cve.now/CVE-2026-77651.md): The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a ro (CVSS 9.8, droundy arrayref)
- [CVE-2026-77650](https://cve.now/CVE-2026-77650.md): The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it ha (CVSS 9.8, droundy append-only-vec)
- [CVE-2026-77649](https://cve.now/CVE-2026-77649.md): The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a r (CVSS 9.8, droundy internment)
- [CVE-2026-43679](https://cve.now/CVE-2026-43679.md): This issue was addressed with improved permissions checking. (CVSS 2.4, Apple watchOS)
- [CVE-2026-20679](https://cve.now/CVE-2026-20679.md): The issue was addressed with improved checks. (CVSS 4.3, Apple macOS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.