# CVEs published 2026-08-22

239 CVEs were published on August 22, 2026: 37 critical, 111 high. Days are UTC.

- [CVE-2026-78051](https://cve.now/CVE-2026-78051.md): alexta69 MeTube Cookie File cookies.txt file access (CVSS 6.9, alexta69 MeTube)
- [CVE-2026-0551](https://cve.now/CVE-2026-0551.md): PPWP – Password Protect Pages \<= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post\_protection\_roles (CVSS 8.8, buildwps PPWP – Password Protect Pages)
- [CVE-2026-18027](https://cve.now/CVE-2026-18027.md): WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels \<= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer\_note' Parameter (CVSS 6.5, WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…)
- [CVE-2026-16149](https://cve.now/CVE-2026-16149.md): Security Hardener \<= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission\_callback Overwrite (CVSS 8.8, marc4 Security Hardener)
- [CVE-2026-78050](https://cve.now/CVE-2026-78050.md): Comfast CF-N1-S Web Management mbox-config sub\_41AD7C stack-based overflow (CVSS 9.4, Comfast CF-N1-S)
- [CVE-2026-78122](https://cve.now/CVE-2026-78122.md): docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems (CVSS 8.3, Tecnativa docker-socket-proxy)
- [CVE-2026-78049](https://cve.now/CVE-2026-78049.md): Systerel S2OPC AddNodes Service sopc\_node\_mgt\_helper\_internal.c out-of-bounds (CVSS 6.3, Systerel S2OPC)
- [CVE-2026-12999](https://cve.now/CVE-2026-12999.md): Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion (CVSS 5.3, zephyrproject zephyr)
- [CVE-2026-74733](https://cve.now/CVE-2026-74733.md): gpio: pca953x: fix pca953x\_irq\_bus\_sync\_unlock regmap lock (CVSS 7.8, Linux)
- [CVE-2026-74731](https://cve.now/CVE-2026-74731.md): sched\_ext: Skip sub-disable teardown for never-linked sub-schedulers (CVSS 7.8, Linux)
- [CVE-2026-74730](https://cve.now/CVE-2026-74730.md): NFS: Pin the 'struct nfs\_server' during a FREE\_STATEID call (CVSS 9.8, Linux)
- [CVE-2026-74729](https://cve.now/CVE-2026-74729.md): soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop\_file\_read (no CVSS, Linux)
- [CVE-2026-74728](https://cve.now/CVE-2026-74728.md): xfs: handle NULL b\_addr in xfs\_buf\_free (no CVSS, Linux)
- [CVE-2026-74727](https://cve.now/CVE-2026-74727.md): ovpn: skip rehash for peers already removed from by\_id (CVSS 9.8, Linux)
- [CVE-2026-74726](https://cve.now/CVE-2026-74726.md): bonding: alb: re-check primary\_is\_promisc under RTNL in bond\_alb\_monitor (CVSS 7.3, Linux)
- [CVE-2026-74725](https://cve.now/CVE-2026-74725.md): enic: fix tx\_hang\_reset use-after-free on device removal (CVSS 7.8, Linux)
- [CVE-2026-74724](https://cve.now/CVE-2026-74724.md): ipvs: avoid out-of-bounds write in ip\_vs\_nat\_icmp (CVSS 7.8, Linux)
- [CVE-2026-74723](https://cve.now/CVE-2026-74723.md): btrfs: lzo: reject inline extents without valid headers (CVSS 9.8, Linux)
- [CVE-2026-74722](https://cve.now/CVE-2026-74722.md): btrfs: fix memory leak in btrfs\_do\_encoded\_write() (no CVSS, Linux)
- [CVE-2026-74721](https://cve.now/CVE-2026-74721.md): accel/amxdna: Fix page-insertion errors in amdxdna\_insert\_pages() (CVSS 7.8, Linux)
- [CVE-2026-74720](https://cve.now/CVE-2026-74720.md): bpf: Preserve pointer state for commuted arithmetic (CVSS 7.8, Linux)
- [CVE-2026-74719](https://cve.now/CVE-2026-74719.md): net/smc: fix qentry overwrite for CONFIRM\_LINK and ADD\_LINK\_CONT in smc\_llc\_event\_handler() (no CVSS, Linux)
- [CVE-2026-74718](https://cve.now/CVE-2026-74718.md): devlink: fix net namespace reference leak in reload (no CVSS, Linux)
- [CVE-2026-74717](https://cve.now/CVE-2026-74717.md): net/mlx5: fw\_tracer, return NULL on create error (CVSS 7.5, Linux)
- [CVE-2026-74716](https://cve.now/CVE-2026-74716.md): accel/amdxdna: Fix locally exploitable BUG\_ON in amdxdna\_insert\_pages() (no CVSS, Linux)
- [CVE-2026-74715](https://cve.now/CVE-2026-74715.md): bpf: Fix netns reference imbalance in conntrack kfuncs (CVSS 7.8, Linux)
- [CVE-2026-74714](https://cve.now/CVE-2026-74714.md): bpf: tcp: Fix use-after-free in bpf\_iter\_tcp\_established\_batch() (CVSS 7.8, Linux)
- [CVE-2026-74713](https://cve.now/CVE-2026-74713.md): vhost\_iotlb: bound map allocation in add\_range (CVSS 7.1, Linux)
- [CVE-2026-74712](https://cve.now/CVE-2026-74712.md): vdpa/mlx5: Fix buffer length in create\_direct\_keys() (CVSS 9.3, Linux)
- [CVE-2026-74711](https://cve.now/CVE-2026-74711.md): hwmon: (pmbus) Fix type confusion in notification logic (CVSS 8.4, Linux)
- [CVE-2026-74710](https://cve.now/CVE-2026-74710.md): xsk: require at least 16 bytes of TX metadata (CVSS 7.8, Linux)
- [CVE-2026-74709](https://cve.now/CVE-2026-74709.md): xsk: clear metadata pointer when no timestamp is requested (no CVSS, Linux)
- [CVE-2026-74708](https://cve.now/CVE-2026-74708.md): xsk: validate launch-time metadata size (CVSS 7.8, Linux)
- [CVE-2026-74707](https://cve.now/CVE-2026-74707.md): xsk: validate metadata when processing requests (CVSS 7.8, Linux)
- [CVE-2026-74706](https://cve.now/CVE-2026-74706.md): bnge: Fix NULL pointer dereference in aux device release (no CVSS, Linux)
- [CVE-2026-74705](https://cve.now/CVE-2026-74705.md): udp: fix potential use-after-free in tunnel segmentation (CVSS 10.0, Linux)
- [CVE-2026-74704](https://cve.now/CVE-2026-74704.md): net/sched: sch\_cake: drop WARN\_ON(1) for malformed packets in ACK filter (CVSS 8.2, Linux)
- [CVE-2026-74703](https://cve.now/CVE-2026-74703.md): vhost-scsi: Validate T10 PI scatterlist counts (CVSS 7.1, Linux)
- [CVE-2026-74702](https://cve.now/CVE-2026-74702.md): vhost-scsi: reject feature changes after endpoint (CVSS 8.8, Linux)
- [CVE-2026-74701](https://cve.now/CVE-2026-74701.md): net/openvswitch: check Ethernet header length in key\_extract() (CVSS 7.8, Linux)
- [CVE-2026-74700](https://cve.now/CVE-2026-74700.md): net/sched: cls\_api: Always acquire rtnl\_lock when destroying locked classifiers (CVSS 7.8, Linux)
- [CVE-2026-74699](https://cve.now/CVE-2026-74699.md): drm/xe: Fix memory leak in exec\_queue\_set\_hang\_replay\_state() (no CVSS, Linux)
- [CVE-2026-74698](https://cve.now/CVE-2026-74698.md): net/mlx5e: fix BQL reset on SQ re-activation (no CVSS, Linux)
- [CVE-2026-74697](https://cve.now/CVE-2026-74697.md): bnxt\_en: Disable EOP for TPA on all chips to prevent data corruption (CVSS 8.2, Linux)
- [CVE-2026-74696](https://cve.now/CVE-2026-74696.md): tcp: fix TFO max\_qlen accounting across reuseport migration (CVSS 7.5, Linux)
- [CVE-2026-74695](https://cve.now/CVE-2026-74695.md): netfilter: nf\_flow\_table: drop existing skb dst before skb\_dst\_set\_noref() (CVSS 7.5, Linux)
- [CVE-2026-74694](https://cve.now/CVE-2026-74694.md): net/ncsi: fix heap OOB read in NCSI\_CMD\_SEND\_CMD payload length (no CVSS, Linux)
- [CVE-2026-74693](https://cve.now/CVE-2026-74693.md): net: prestera: validate firmware header length (no CVSS, Linux)
- [CVE-2026-74692](https://cve.now/CVE-2026-74692.md): net/smc: fix TOCTOU race between smc\_listen\_out() and listener close (CVSS 7.5, Linux)
- [CVE-2026-74691](https://cve.now/CVE-2026-74691.md): net: thunderbolt: Tear down DMA paths before stopping the rings (CVSS 8.8, Linux)
- [CVE-2026-74690](https://cve.now/CVE-2026-74690.md): s390/ism: Fix UAF of sba and ieq during ism\_dev\_exit() (CVSS 8.4, Linux)
- [CVE-2026-74689](https://cve.now/CVE-2026-74689.md): net/atm: fix slab-out-of-bounds read in vcc\_setsockopt() (CVSS 7.1, Linux)
- [CVE-2026-74688](https://cve.now/CVE-2026-74688.md): sctp: clear control chunk transport if it is being removed (CVSS 9.8, Linux)
- [CVE-2026-74687](https://cve.now/CVE-2026-74687.md): watchdog: at91sam9\_wdt: prevent timer rearm during teardown (CVSS 7.8, Linux)
- [CVE-2026-74686](https://cve.now/CVE-2026-74686.md): rqspinlock: Reset tail when preserving queue on deadlock (no CVSS, Linux)
- [CVE-2026-74685](https://cve.now/CVE-2026-74685.md): hwmon: (ltc4282) Clamp negative current limits (no CVSS, Linux)
- [CVE-2026-74684](https://cve.now/CVE-2026-74684.md): net: tap: set skb-\>dev before parsing virtio net header in tap\_get\_user\_xdp() (CVSS 7.1, Linux)
- [CVE-2026-74683](https://cve.now/CVE-2026-74683.md): Input: evdev - sanitize event type index when fetching event masks (no CVSS, Linux)
- [CVE-2026-74682](https://cve.now/CVE-2026-74682.md): ALSA: usb-audio: fix OOB write on Type II inbound URBs (no CVSS, Linux)
- [CVE-2026-74681](https://cve.now/CVE-2026-74681.md): usb: misc: usbio: check ibuf\_len against rxbuf\_len in bulk msg (no CVSS, Linux)
- [CVE-2026-74680](https://cve.now/CVE-2026-74680.md): usb: atm: cxacru: properly kill rcv\_urb on error in cxacru\_cm() (no CVSS, Linux)
- [CVE-2026-74679](https://cve.now/CVE-2026-74679.md): usb: gadget: f\_ncm: Use unsigned int for ndp\_index (no CVSS, Linux)
- [CVE-2026-74678](https://cve.now/CVE-2026-74678.md): net: usb: ax88179\_178a: fix skb leak in ax88179\_tx\_fixup() (CVSS 7.5, Linux)
- [CVE-2026-74677](https://cve.now/CVE-2026-74677.md): net: usb: ipheth: fix carrier\_work UAF on disconnect (no CVSS, Linux)
- [CVE-2026-74676](https://cve.now/CVE-2026-74676.md): vt: add permission check for KDSKBMETA ioctl (no CVSS, Linux)
- [CVE-2026-74675](https://cve.now/CVE-2026-74675.md): vt: stabilize tty reference in kbd\_keycode with tty\_port\_tty\_get (CVSS 7.8, Linux)
- [CVE-2026-74674](https://cve.now/CVE-2026-74674.md): mm: fix incorrect flush address in direct page table reclaim (CVSS 7.8, Linux)
- [CVE-2026-74673](https://cve.now/CVE-2026-74673.md): Input: evdev - fix information leak in evdev\_pass\_values() (no CVSS, Linux)
- [CVE-2026-74672](https://cve.now/CVE-2026-74672.md): mm/vmalloc: acquire init\_mm lock on huge vmap to avoid ptdump UAF (no CVSS, Linux)
- [CVE-2026-74671](https://cve.now/CVE-2026-74671.md): ima: fix out-of-bounds read in xattr\_verify() (no CVSS, Linux)
- [CVE-2026-74670](https://cve.now/CVE-2026-74670.md): ipvs: stop estimator after disabled calc phase (CVSS 7.8, Linux)
- [CVE-2026-74669](https://cve.now/CVE-2026-74669.md): ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVSS 9.8, Linux)
- [CVE-2026-74668](https://cve.now/CVE-2026-74668.md): packet: use consistent hard\_header\_len in TX\_RING send path (CVSS 7.8, Linux)
- [CVE-2026-74667](https://cve.now/CVE-2026-74667.md): net/packet: reset the MAC header on the packet-socket transmit path (CVSS 7.8, Linux)
- [CVE-2026-74666](https://cve.now/CVE-2026-74666.md): packet: synchronize pressure clearing with ring reconfiguration (CVSS 7.8, Linux)
- [CVE-2026-74665](https://cve.now/CVE-2026-74665.md): net: fix skb length accounting after generic XDP frag adjustment (CVSS 9.1, Linux)
- [CVE-2026-74664](https://cve.now/CVE-2026-74664.md): net: openvswitch: reallocate update replies for mismatched IDs (no CVSS, Linux)
- [CVE-2026-74663](https://cve.now/CVE-2026-74663.md): net/sched: reject overly deep qdisc hierarchies (CVSS 7.8, Linux)
- [CVE-2026-74662](https://cve.now/CVE-2026-74662.md): inet: frags: publish queues before arming timer (CVSS 9.8, Linux)
- [CVE-2026-74661](https://cve.now/CVE-2026-74661.md): mac802154: fix netdev use-after-free in beacon worker (CVSS 7.8, Linux)
- [CVE-2026-74660](https://cve.now/CVE-2026-74660.md): netfilter: ebt\_nflog: pin the NFLOG backend (CVSS 7.8, Linux)
- [CVE-2026-74659](https://cve.now/CVE-2026-74659.md): net: bridge: mrp: fix uninitialised bytes on the wire (no CVSS, Linux)
- [CVE-2026-74658](https://cve.now/CVE-2026-74658.md): futex: Prevent robust futex exit race some more (no CVSS, Linux)
- [CVE-2026-74657](https://cve.now/CVE-2026-74657.md): ipv4: Fix fib\_nlmsg\_size() for RTA\_VIA nexthops (no CVSS, Linux)
- [CVE-2026-74656](https://cve.now/CVE-2026-74656.md): ipv4: fix use-after-free in fib\_nhc\_update\_mtu() (CVSS 7.8, Linux)
- [CVE-2026-74655](https://cve.now/CVE-2026-74655.md): serial: qcom-geni: fix TX DMA buffer flush (CVSS 8.8, Linux)
- [CVE-2026-74654](https://cve.now/CVE-2026-74654.md): serial: 8250\_dma: Clear stale RX state on shutdown (no CVSS, Linux)
- [CVE-2026-74653](https://cve.now/CVE-2026-74653.md): serial: 8250\_of: clear stuck empty-FIFO RX-timeout on LPC32xx (no CVSS, Linux)
- [CVE-2026-74652](https://cve.now/CVE-2026-74652.md): serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ (CVSS 7.8, Linux)
- [CVE-2026-74651](https://cve.now/CVE-2026-74651.md): staging: rtl8723bs: fix OOB read in rtw\_get\_wpa\_ie() (CVSS 8.1, Linux)
- [CVE-2026-74650](https://cve.now/CVE-2026-74650.md): staging: rtl8723bs: fix OOB read in WMM\_param\_handler() (no CVSS, Linux)
- [CVE-2026-74649](https://cve.now/CVE-2026-74649.md): staging: rtl8723bs: fix missing shared-key auth challenge length check (CVSS 8.8, Linux)
- [CVE-2026-74648](https://cve.now/CVE-2026-74648.md): staging: rtl8723bs: validate monitor transmit frame lengths (CVSS 7.8, Linux)
- [CVE-2026-74647](https://cve.now/CVE-2026-74647.md): misc: fastrpc: Remove buffer from list prior to unmap operation (CVSS 7.8, Linux)
- [CVE-2026-74646](https://cve.now/CVE-2026-74646.md): misc: fastrpc: take fl-\>lock when moving mmaps on interrupted invoke (CVSS 7.8, Linux)
- [CVE-2026-74645](https://cve.now/CVE-2026-74645.md): mm/damon/lru\_sort: error out for \>10000 active\_mem\_bp (no CVSS, Linux)
- [CVE-2026-74644](https://cve.now/CVE-2026-74644.md): mm/damon/ops-common: putback folios on invalid migrate nid (no CVSS, Linux)
- [CVE-2026-74643](https://cve.now/CVE-2026-74643.md): samples/damon/mtier: error out for zero quota goal target values (no CVSS, Linux)
- [CVE-2026-74642](https://cve.now/CVE-2026-74642.md): ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (no CVSS, Linux)
- [CVE-2026-74641](https://cve.now/CVE-2026-74641.md): ALSA: usx2y: bound the hwdep mmap fault offset (CVSS 7.8, Linux)
- [CVE-2026-74640](https://cve.now/CVE-2026-74640.md): ALSA: FCP: fix OOB write in fcp\_meter\_ctl\_get() (CVSS 7.8, Linux)
- [CVE-2026-74639](https://cve.now/CVE-2026-74639.md): ALSA: us144mkii: re-anchor capture URBs on resubmission (no CVSS, Linux)
- [CVE-2026-74638](https://cve.now/CVE-2026-74638.md): drm/v3d: Serialize the scheduler timeout handlers (no CVSS, Linux)
- [CVE-2026-74637](https://cve.now/CVE-2026-74637.md): perf/core: Fix group leader use-after-free after sibling detach (CVSS 7.8, Linux)
- [CVE-2026-74636](https://cve.now/CVE-2026-74636.md): tracing: Fix race between update\_event\_fields and, event\_define\_fields (no CVSS, Linux)
- [CVE-2026-74635](https://cve.now/CVE-2026-74635.md): fbdev: bitblit: bound-check glyph index in bit\_cursor() (CVSS 7.8, Linux)
- [CVE-2026-74634](https://cve.now/CVE-2026-74634.md): ring-buffer: Prevent subbuf order change when resizing is disabled (CVSS 7.8, Linux)
- [CVE-2026-74633](https://cve.now/CVE-2026-74633.md): tracing: Fix NULL pointer dereference in module event cache removal (no CVSS, Linux)
- [CVE-2026-74632](https://cve.now/CVE-2026-74632.md): mm/huge\_memory: fix huge\_zero\_pfn race (CVSS 7.8, Linux)
- [CVE-2026-74631](https://cve.now/CVE-2026-74631.md): net: smc: fix splice entry lifetime imbalance in smc\_rx\_splice (CVSS 8.4, Linux)
- [CVE-2026-74630](https://cve.now/CVE-2026-74630.md): ipv6: prevent in6\_dev\_get() from resurrecting inet6\_dev (CVSS 7.8, Linux)
- [CVE-2026-74629](https://cve.now/CVE-2026-74629.md): net/dibs: Correct freeing of dmb\_clientid\_arr (CVSS 8.8, Linux)
- [CVE-2026-74628](https://cve.now/CVE-2026-74628.md): net/x25: fix use-after-free of the socket by its timers (CVSS 9.8, Linux)
- [CVE-2026-74627](https://cve.now/CVE-2026-74627.md): net: devmem: prevent net-iov / page mixing (CVSS 7.8, Linux)
- [CVE-2026-74626](https://cve.now/CVE-2026-74626.md): NTB: ntb\_netdev: Preserve RX queue depth on allocation failure (CVSS 7.5, Linux)
- [CVE-2026-74625](https://cve.now/CVE-2026-74625.md): netfilter: bridge: release template ct on non-IP path (CVSS 7.5, Linux)
- [CVE-2026-74624](https://cve.now/CVE-2026-74624.md): netfilter: nf\_conntrack: defer invalid log until after unlock (CVSS 7.5, Linux)
- [CVE-2026-74623](https://cve.now/CVE-2026-74623.md): net: atlantic: free stranded TX buffers on ring deinit (no CVSS, Linux)
- [CVE-2026-74622](https://cve.now/CVE-2026-74622.md): net: atlantic: free RX pages of consumed but not refilled buffers (no CVSS, Linux)
- [CVE-2026-74621](https://cve.now/CVE-2026-74621.md): net/sched: act\_ct: fix sk\_buff leak when the header checks reject a packet (CVSS 7.5, Linux)
- [CVE-2026-74620](https://cve.now/CVE-2026-74620.md): net/sched: act\_gact, act\_police: range check the fallback control action (no CVSS, Linux)
- [CVE-2026-74619](https://cve.now/CVE-2026-74619.md): ovl: don't warn when the mount is completed from another user namespace (no CVSS, Linux)
- [CVE-2026-74618](https://cve.now/CVE-2026-74618.md): binfmt\_misc: don't warn when the mount is completed from another user namespace (no CVSS, Linux)
- [CVE-2026-74617](https://cve.now/CVE-2026-74617.md): dibs: initialise dibs-\>lock in dibs\_dev\_alloc() (CVSS 9.8, Linux)
- [CVE-2026-74616](https://cve.now/CVE-2026-74616.md): xdp: reject clones that overrun skb\_shared\_info tailroom (CVSS 9.8, Linux)
- [CVE-2026-74615](https://cve.now/CVE-2026-74615.md): vxlan: do not arm the ageing timer on a device that is down (CVSS 8.8, Linux)
- [CVE-2026-74614](https://cve.now/CVE-2026-74614.md): vsock/virtio: read virtqueues under worker locks (CVSS 8.4, Linux)
- [CVE-2026-74613](https://cve.now/CVE-2026-74613.md): vsock/virtio: avoid refilling the RX queue after teardown (CVSS 7.8, Linux)
- [CVE-2026-74612](https://cve.now/CVE-2026-74612.md): veth: fix skb length accounting after XDP frag adjustment (CVSS 10.0, Linux)
- [CVE-2026-74611](https://cve.now/CVE-2026-74611.md): tls: rx: restore msg\_iter before TLS 1.3 optimistic retry (CVSS 9.8, Linux)
- [CVE-2026-74610](https://cve.now/CVE-2026-74610.md): tls: don't leave a full plaintext sk\_msg ring unpushed (CVSS 7.8, Linux)
- [CVE-2026-74609](https://cve.now/CVE-2026-74609.md): tipc: read le-\>link under the node lock in tipc\_node\_link\_down() (CVSS 7.8, Linux)
- [CVE-2026-74608](https://cve.now/CVE-2026-74608.md): smb: client: Fix use-after-free in cifs\_try\_adding\_channels() (CVSS 9.8, Linux)
- [CVE-2026-74607](https://cve.now/CVE-2026-74607.md): KVM: SVM: Serialize accesses to the owner and mirror list with separate lock (CVSS 8.8, Linux)
- [CVE-2026-74606](https://cve.now/CVE-2026-74606.md): eventfs: Fix use-after-free in eventfs\_remove\_rec() (CVSS 7.8, Linux)
- [CVE-2026-74605](https://cve.now/CVE-2026-74605.md): eventfs: Use children field for rcu head and add memory barriers (CVSS 7.8, Linux)
- [CVE-2026-74604](https://cve.now/CVE-2026-74604.md): Revert "thermal/drivers/hwmon: Cleanup coding style a bit" (CVSS 8.4, Linux)
- [CVE-2026-74603](https://cve.now/CVE-2026-74603.md): ptp: ocp: Fix board ID over-read (CVSS 7.1, Linux)
- [CVE-2026-74602](https://cve.now/CVE-2026-74602.md): ring-buffer: Initialise reader page order in rb\_allocate\_cpu\_buffer() (no CVSS, Linux)
- [CVE-2026-74601](https://cve.now/CVE-2026-74601.md): ring-buffer: Use current\_context for safe per-CPU buffer swap (CVSS 7.8, Linux)
- [CVE-2026-74600](https://cve.now/CVE-2026-74600.md): mm/page\_table\_check: skip special zero mappings (no CVSS, Linux)
- [CVE-2026-74599](https://cve.now/CVE-2026-74599.md): mm/ptdump: always stabilise against page table freeing using init\_mm (no CVSS, Linux)
- [CVE-2026-74598](https://cve.now/CVE-2026-74598.md): ipv6: fix Route Information option length validation (CVSS 7.5, Linux)
- [CVE-2026-74597](https://cve.now/CVE-2026-74597.md): ip6\_tunnel: clear skb2-\>cb\[\] in ip6ip6\_err() (CVSS 9.8, Linux)
- [CVE-2026-74596](https://cve.now/CVE-2026-74596.md): fs,fsverity: remove check for fsverity being enabled in setattr\_prepare() (no CVSS, Linux)
- [CVE-2026-74595](https://cve.now/CVE-2026-74595.md): fscrypt: use the mount idmap for the owner check in fscrypt\_ioctl\_set\_policy() (CVSS 7.8, Linux)
- [CVE-2026-74594](https://cve.now/CVE-2026-74594.md): sched/psi: Shut down rtpoll\_timer in psi\_cgroup\_free() (CVSS 7.8, Linux)
- [CVE-2026-74593](https://cve.now/CVE-2026-74593.md): sched\_ext: Take cgroup\_lock() first in scx\_cgroup\_lock() (no CVSS, Linux)
- [CVE-2026-74592](https://cve.now/CVE-2026-74592.md): ima: Instantiate file\_truncate and path\_truncate hooks (CVSS 8.1, Linux)
- [CVE-2026-74591](https://cve.now/CVE-2026-74591.md): mm/filemap: \_\_filemap\_add\_folio() restore index before retrying (CVSS 9.8, Linux)
- [CVE-2026-74590](https://cve.now/CVE-2026-74590.md): fsverity: Fix bpf\_get\_fsverity\_digest() dynptr assumptions (CVSS 7.8, Linux)
- [CVE-2026-74589](https://cve.now/CVE-2026-74589.md): bpf, sockmap: Fix sk\_redir use-after-free in send verdict (CVSS 8.4, Linux)
- [CVE-2026-74588](https://cve.now/CVE-2026-74588.md): sctp: keep chunk-\>transport in step with the list it is queued on (CVSS 9.8, Linux)
- [CVE-2026-74587](https://cve.now/CVE-2026-74587.md): sctp: fix use-after-free of cached ASCONF chunk (CVSS 9.8, Linux)
- [CVE-2026-74586](https://cve.now/CVE-2026-74586.md): sctp: clear new\_transport when removing a peer (CVSS 9.8, Linux)
- [CVE-2026-74585](https://cve.now/CVE-2026-74585.md): thunderbolt: Bound the DROM dual link port number before indexing sw-\>ports (no CVSS, Linux)
- [CVE-2026-4703](https://cve.now/CVE-2026-4703.md): WS Form LITE \<= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission (CVSS 9.8, westguard WS Form LITE – Drag & Drop Contact Form Builder)
- [CVE-2026-74584](https://cve.now/CVE-2026-74584.md): RDMA/bnxt\_re: zero shared page before exposing to userspace (CVSS 7.1, Linux)
- [CVE-2026-76606](https://cve.now/CVE-2026-76606.md): Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik \< 4.7.2 (CVSS 10.0, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-77027](https://cve.now/CVE-2026-77027.md): Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik \< 4.7.2 (CVSS 8.6, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76602](https://cve.now/CVE-2026-76602.md): Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik \< 4.7.2 (CVSS 9.3, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76603](https://cve.now/CVE-2026-76603.md): Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik \< 4.7.2 (CVSS 6.9, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76571](https://cve.now/CVE-2026-76571.md): Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik \< 4.7.2 (CVSS 9.3, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76597](https://cve.now/CVE-2026-76597.md): Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik \< 4.7.2 (CVSS 8.7, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76598](https://cve.now/CVE-2026-76598.md): Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax\_getFolders in Fabrik \< 4.7.2 (CVSS 8.7, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76605](https://cve.now/CVE-2026-76605.md): Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik \< 4.7.2 (CVSS 10.0, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76596](https://cve.now/CVE-2026-76596.md): Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik \< 4.7.2 (CVSS 8.7, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-77992](https://cve.now/CVE-2026-77992.md): Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik \< 4.7.2 (CVSS 9.5, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76600](https://cve.now/CVE-2026-76600.md): Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik \< 4.7.2 (CVSS 6.9, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76604](https://cve.now/CVE-2026-76604.md): Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik \< 4.7.2 (CVSS 10.0, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76607](https://cve.now/CVE-2026-76607.md): Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik \< 4.7.2 (CVSS 10.0, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76609](https://cve.now/CVE-2026-76609.md): Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik \< 4.7.2 (CVSS 6.9, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76608](https://cve.now/CVE-2026-76608.md): Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik \< 4.7.2 (CVSS 6.9, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76599](https://cve.now/CVE-2026-76599.md): Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik \< 4.7.2 (CVSS 8.7, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-76601](https://cve.now/CVE-2026-76601.md): Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik \< 4.7.2 (CVSS 6.9, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-70626](https://cve.now/CVE-2026-70626.md): NLTK before 3.9.4 Symlink Escape via CorpusReader (CVSS 8.6, nltk)
- [CVE-2026-68768](https://cve.now/CVE-2026-68768.md): hashcat through 7.1.2 Heap Buffer Overflow in outfile\_write() via Oversized Username (CVSS 6.9, hashcat)
- [CVE-2026-68767](https://cve.now/CVE-2026-68767.md): hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl() (CVSS 6.9, hashcat)
- [CVE-2026-68766](https://cve.now/CVE-2026-68766.md): hashcat through 7.1.2 Arbitrary File Write via Restore File Option Injection (CVSS 8.5, hashcat)
- [CVE-2026-66393](https://cve.now/CVE-2026-66393.md): NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder (CVSS 8.7, nltk)
- [CVE-2026-65915](https://cve.now/CVE-2026-65915.md): NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer (CVSS 7.1, nltk)
- [CVE-2026-63312](https://cve.now/CVE-2026-63312.md): NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read (CVSS 8.7, nltk)
- [CVE-2026-63311](https://cve.now/CVE-2026-63311.md): NLTK before 3.10.0 SSRF via DNS Resolution Failure (CVSS 6.9, nltk)
- [CVE-2026-62388](https://cve.now/CVE-2026-62388.md): NLTK before 3.10.0 Insecure Default Configuration in pathsec.py (CVSS 8.7, nltk)
- [CVE-2026-62385](https://cve.now/CVE-2026-62385.md): NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers (CVSS 8.2, nltk)
- [CVE-2026-62384](https://cve.now/CVE-2026-62384.md): NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2 (CVSS 8.7, nltk)
- [CVE-2026-62383](https://cve.now/CVE-2026-62383.md): nltk IPIPANCorpusReader Symlink Arbitrary File Read (CVSS 6.8, nltk)
- [CVE-2026-75866](https://cve.now/CVE-2026-75866.md): Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them (CVSS 9.1, Punk-OAuth2)
- [CVE-2026-75870](https://cve.now/CVE-2026-75870.md): Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret (CVSS 9.1, Punk)
- [CVE-2026-71514](https://cve.now/CVE-2026-71514.md): NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec Bypass (CVSS 2.0, nltk)
- [CVE-2026-71513](https://cve.now/CVE-2026-71513.md): NLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name Bypass (CVSS 8.7, nltk)
- [CVE-2026-4559](https://cve.now/CVE-2026-4559.md): Image Photo Gallery Final Tiles Grid \<= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute (CVSS 6.4, wpchill Image Photo Gallery Final Tiles Grid)
- [CVE-2026-5093](https://cve.now/CVE-2026-5093.md): Greenshift \<= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb\_update\_global\_wp\_settings' (CVSS 4.3, wpsoul Greenshift – animation and page builder blocks)
- [CVE-2026-4561](https://cve.now/CVE-2026-4561.md): MC4WP: Mailchimp for WordPress \<= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages (CVSS 6.4, dvankooten MC4WP: Mailchimp for WordPress)
- [CVE-2026-2996](https://cve.now/CVE-2026-2996.md): Advanced Product Fields (Product Addons) for WooCommerce \<= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request (CVSS 7.5, maartenbelmans Advanced Product Fields (Product Addons) for…)
- [CVE-2026-4244](https://cve.now/CVE-2026-4244.md): Post Duplicator \<= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution (CVSS 4.3, metaphorcreations Post Duplicator)
- [CVE-2026-62382](https://cve.now/CVE-2026-62382.md): PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison (CVSS 6.9, pglombardo PasswordPusher)
- [CVE-2026-62381](https://cve.now/CVE-2026-62381.md): luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow (CVSS 6.9, openwrt luci)
- [CVE-2026-62380](https://cve.now/CVE-2026-62380.md): Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection (CVSS 6.3, netty)
- [CVE-2026-62243](https://cve.now/CVE-2026-62243.md): Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass (CVSS 8.7, netty)
- [CVE-2026-62204](https://cve.now/CVE-2026-62204.md): SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install (CVSS 5.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-60084](https://cve.now/CVE-2026-60084.md): SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate (CVSS 8.4, siyuan-note siyuan)
- [CVE-2026-60083](https://cve.now/CVE-2026-60083.md): SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-59809](https://cve.now/CVE-2026-59809.md): SiYuan before v3.8.0 Secret Exfiltration via http\_request URL (CVSS 6.9, siyuan-note siyuan)
- [CVE-2026-59808](https://cve.now/CVE-2026-59808.md): AVideo Authentication Bypass via Unkeyed Video Hash Disclosure (CVSS 8.7, WWBN AVideo)
- [CVE-2026-59256](https://cve.now/CVE-2026-59256.md): WWBN AVideo Unbound Token Authorization Bypass via Gallery (CVSS 8.7, WWBN AVideo)
- [CVE-2026-58003](https://cve.now/CVE-2026-58003.md): WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php (CVSS 7.1, WWBN AVideo)
- [CVE-2026-58002](https://cve.now/CVE-2026-58002.md): WWBN AVideo Authorization Bypass via Users\_affiliations add.json.php (CVSS 7.1, WWBN AVideo)
- [CVE-2026-58001](https://cve.now/CVE-2026-58001.md): WWBN AVideo Cross-Site Request Forgery via videoEditLight.php (CVSS 6.9, WWBN AVideo)
- [CVE-2026-57998](https://cve.now/CVE-2026-57998.md): better-npm-audit OS Command Injection via registry flag (CVSS 8.5, jeemok better-npm-audit)
- [CVE-2026-57944](https://cve.now/CVE-2026-57944.md): AVideo channelToGallery.json.php Cross-Site Request Forgery (CVSS 5.3, WWBN AVideo)
- [CVE-2026-56380](https://cve.now/CVE-2026-56380.md): AVideo feed/index.php Exposure of Channel Owner Email Address (CVSS 6.9, WWBN AVideo)
- [CVE-2026-77988](https://cve.now/CVE-2026-77988.md): TRENDnet TEW-823DRU CLI Configuration Tool nvram\_get command injection (CVSS 5.1, TRENDnet TEW-823DRU)
- [CVE-2026-4245](https://cve.now/CVE-2026-4245.md): Post Duplicator \<= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication (CVSS 4.3, metaphorcreations Post Duplicator)
- [CVE-2026-3424](https://cve.now/CVE-2026-3424.md): kk Star Ratings \<= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter (CVSS 5.3, properfraction kk Star Ratings – Rate Post & Collect User F…)
- [CVE-2026-66916](https://cve.now/CVE-2026-66916.md): Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery \< 4.4.0 (CVSS 6.9, joomgalleryfriends.net JoomGallery extension for Joomla)
- [CVE-2026-66917](https://cve.now/CVE-2026-66917.md): Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery \< 4.4.0 (CVSS 8.6, joomgalleryfriends.net JoomGallery extension for Joomla)
- [CVE-2026-77946](https://cve.now/CVE-2026-77946.md): TRENDnet TEW-821DAP NTP Timezone Configuration apply\_time.cgi uci\_safe\_get stack-based overflow (CVSS 10.0, TRENDnet TEW-821DAP)
- [CVE-2026-77945](https://cve.now/CVE-2026-77945.md): TRENDnet TEW-821DAP ssi upload.cgi command injection (CVSS 5.3, TRENDnet TEW-821DAP)
- [CVE-2026-78003](https://cve.now/CVE-2026-78003.md): Mailgun for WordPress \<= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys (CVSS 9.8, Mailgun for WordPress)
- [CVE-2026-12710](https://cve.now/CVE-2026-12710.md): Missing Authorization in Application Integration QueryEngineTask (CVSS 9.3, Google Cloud Application Integration)
- [CVE-2026-77002](https://cve.now/CVE-2026-77002.md): SmilePass Selfie Login \<= 1.0.2 - Unauthenticated Authentication Bypass (CVSS 9.8, SmilePass Selfie Login)
- [CVE-2026-77001](https://cve.now/CVE-2026-77001.md): Social Login & Sharing buttons with Analytics By SoClever \<= 1.2.0 - Unauthenticated Authentication Bypass (CVSS 9.8, Social Login & Sharing buttons with Analytics By SoClever)
- [CVE-2026-77000](https://cve.now/CVE-2026-77000.md): WP Social Media Login \<= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow (CVSS 9.8, WP Social Media Login)
- [CVE-2026-76793](https://cve.now/CVE-2026-76793.md): Firebase Authentication \< 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim (CVSS 8.1, Firebase Authentication)
- [CVE-2026-76789](https://cve.now/CVE-2026-76789.md): Slider Hero \< 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers (CVSS 8.8, Slider Hero with Video Background, Animation)
- [CVE-2026-19222](https://cve.now/CVE-2026-19222.md): Forminator Forms \< 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass (CVSS 6.6, Forminator Forms)
- [CVE-2026-19221](https://cve.now/CVE-2026-19221.md): Forminator Forms \< 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite (CVSS 7.2, Forminator Forms)
- [CVE-2026-19093](https://cve.now/CVE-2026-19093.md): Tutor LMS \< 4.0.6 - Instructor+ Arbitrary File Read via Video Path (CVSS 6.8, Tutor LMS)
- [CVE-2026-18052](https://cve.now/CVE-2026-18052.md): ManageWP Worker \< 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters (CVSS 8.1, ManageWP Worker)
- [CVE-2026-16738](https://cve.now/CVE-2026-16738.md): Conekta Payment Gateway \< 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery (CVSS 5.3, Conekta Payment Gateway)
- [CVE-2026-16612](https://cve.now/CVE-2026-16612.md): FiboSearch \< 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure (CVSS 5.3, FiboSearch)
- [CVE-2026-16260](https://cve.now/CVE-2026-16260.md): Post Grid, Slider & Carousel Ultimate \< 1.8.1 - Contributor+ Stored XSS via Header Title Field (CVSS 6.8, Post Grid, Slider & Carousel Ultimate)
- [CVE-2026-14187](https://cve.now/CVE-2026-14187.md): Tutor LMS \< 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR (CVSS 2.7, Tutor LMS)
- [CVE-2026-76074](https://cve.now/CVE-2026-76074.md): AutomatorWP \<= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp\_campaign\_monitor\_get\_lists AJAX Action (CVSS 4.3, rubengc AutomatorWP – Automator plugin for no-code automati…)
- [CVE-2026-75027](https://cve.now/CVE-2026-75027.md): Themify Builder \<= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb\_update\_old\_data' AJAX Action (CVSS 5.3, themifyme Themify Builder)
- [CVE-2026-76057](https://cve.now/CVE-2026-76057.md): AutomatorWP \<= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp\_convertkit\_get\_forms AJAX Action (CVSS 4.3, rubengc AutomatorWP – Automator plugin for no-code automati…)
- [CVE-2026-19883](https://cve.now/CVE-2026-19883.md): WPeMatico RSS Feed Fetcher \<= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico\_import\_settings admin\_action (CVSS 8.8, etruel WPeMatico RSS Feed Fetcher)
- [CVE-2026-47895](https://cve.now/CVE-2026-47895.md): In strongSwan before 6.0.7, identity parsing/cloning is mishandled. (CVSS 7.5, strongSwan)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.