# CVEs published 2026-08-29

66 CVEs were published on August 29, 2026: 13 critical, 18 high. Days are UTC.

- [CVE-2026-82562](https://cve.now/CVE-2026-82562.md): qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391) (CVSS 3.7, ljharb qs · qs)
- [CVE-2026-82417](https://cve.now/CVE-2026-82417.md): qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property (CVSS 5.3, ljharb qs · qs)
- [CVE-2026-82424](https://cve.now/CVE-2026-82424.md): PHPGurukul Student Information System student\_edit1.php sql injection (CVSS 5.3, PHPGurukul Student Information System)
- [CVE-2026-82423](https://cve.now/CVE-2026-82423.md): macrozheng mall Payment Status Endpoint paySuccess behavioral workflow (CVSS 5.3, macrozheng mall)
- [CVE-2026-82422](https://cve.now/CVE-2026-82422.md): itsourcecode Sales and Inventory System emp\_del.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-82421](https://cve.now/CVE-2026-82421.md): itsourcecode Sales and Inventory System emp\_edit.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-15369](https://cve.now/CVE-2026-15369.md): Custom User Registration Fields for WooCommerce \<= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg\_select\_user\_role' Parameter in Store API Checkout (CVSS 9.8, Addify Custom User Registration Fields for WooCommerce)
- [CVE-2026-75807](https://cve.now/CVE-2026-75807.md): SAML Single Sign On \<= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning (CVSS 7.5, cyberlord92 SAML Single Sign On – SSO Login)
- [CVE-2026-82476](https://cve.now/CVE-2026-82476.md): Memos through 0.30.0 SSRF via Omitted CGNAT Address Range (CVSS 6.9, usememos memos)
- [CVE-2026-82475](https://cve.now/CVE-2026-82475.md): iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check (CVSS 8.6, iflytek astron-agent)
- [CVE-2026-82474](https://cve.now/CVE-2026-82474.md): Sudo through 1.9.17p2 Intercept Policy Bypass via execveat (CVSS 8.5, sudo-project sudo)
- [CVE-2026-82473](https://cve.now/CVE-2026-82473.md): KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints (CVSS 8.8, kubeedge)
- [CVE-2026-82472](https://cve.now/CVE-2026-82472.md): Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf (CVSS 8.7, documenso)
- [CVE-2026-82470](https://cve.now/CVE-2026-82470.md): Rodauth before 2.47.0 TOTP Code Reuse via Drift Window (CVSS 5.1, jeremyevans rodauth)
- [CVE-2026-82469](https://cve.now/CVE-2026-82469.md): Rodauth before 2.47.0 Authentication Bypass via jwt\_refresh (CVSS 5.1, jeremyevans rodauth)
- [CVE-2026-82468](https://cve.now/CVE-2026-82468.md): Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type (CVSS 4.9, jeremyevans rodauth)
- [CVE-2026-82467](https://cve.now/CVE-2026-82467.md): Rodauth before 2.47.0 Open Redirect via Return-to Path (CVSS 4.9, jeremyevans rodauth)
- [CVE-2026-82466](https://cve.now/CVE-2026-82466.md): Rodauth before 2.46.0 Authentication Bypass via webauthn\_login (CVSS 9.4, jeremyevans rodauth)
- [CVE-2026-82465](https://cve.now/CVE-2026-82465.md): pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest (CVSS 6.9, pac4j)
- [CVE-2026-82464](https://cve.now/CVE-2026-82464.md): pac4j-core before 6.5.6 Open Redirect via Backslash Logout (CVSS 5.3, pac4j)
- [CVE-2026-82463](https://cve.now/CVE-2026-82463.md): pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check (CVSS 8.6, pac4j)
- [CVE-2026-82462](https://cve.now/CVE-2026-82462.md): pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution (CVSS 6.9, pac4j)
- [CVE-2026-82461](https://cve.now/CVE-2026-82461.md): pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token (CVSS 8.6, pac4j)
- [CVE-2026-82460](https://cve.now/CVE-2026-82460.md): Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown (CVSS 9.3, coderaiser cloudcmd)
- [CVE-2026-82481](https://cve.now/CVE-2026-82481.md): The cohttp package before 6.3.0 for OCaml allows directory traversal. (CVSS 8.7, mirage cohttp)
- [CVE-2026-82477](https://cve.now/CVE-2026-82477.md): In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via th (CVSS 5.8, MITRE Heimdall)
- [CVE-2026-82457](https://cve.now/CVE-2026-82457.md): su-exec through 0.3 Privilege Escalation via Numeric User ID (CVSS 8.5, ncopa su-exec)
- [CVE-2026-82456](https://cve.now/CVE-2026-82456.md): argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP (CVSS 10.0, argoproj-labs argocd-mcp)
- [CVE-2026-82454](https://cve.now/CVE-2026-82454.md): Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in (CVSS 9.3, omnivore-app omnivore)
- [CVE-2026-82453](https://cve.now/CVE-2026-82453.md): rust-iot-platform Cleartext Password Storage via User Model (CVSS 8.7, iot-ecology rust-iot-platform)
- [CVE-2026-82452](https://cve.now/CVE-2026-82452.md): rust-iot-platform Authentication Bypass via Missing Request Guards (CVSS 9.3, iot-ecology rust-iot-platform)
- [CVE-2026-82451](https://cve.now/CVE-2026-82451.md): Formwork \< 2.3.11 Stored XSS via Referer Header (CVSS 5.3, getformwork Formwork)
- [CVE-2026-82450](https://cve.now/CVE-2026-82450.md): BookStack before 26.05.4 Remote Code Execution via Book Cover (CVSS 8.7, bookstackapp bookstack)
- [CVE-2026-82449](https://cve.now/CVE-2026-82449.md): Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing (CVSS 6.9, cockpit-hq cockpit)
- [CVE-2026-82448](https://cve.now/CVE-2026-82448.md): Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key (CVSS 9.3, Shinobi Systems Shinobi)
- [CVE-2026-82447](https://cve.now/CVE-2026-82447.md): Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock (CVSS 8.7, Skyvern-AI skyvern)
- [CVE-2026-14494](https://cve.now/CVE-2026-14494.md): Sigma Forms Pro \<= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field (CVSS 9.8, bdthemes SigmaForms Pro – AI Generated Forms)
- [CVE-2026-82364](https://cve.now/CVE-2026-82364.md): macrozheng mall Order Submission submit race condition (CVSS 2.3, macrozheng mall)
- [CVE-2026-80725](https://cve.now/CVE-2026-80725.md): net: gro: properly validate BIG TCP aggregation criteria (CVSS 9.8, Linux)
- [CVE-2026-81346](https://cve.now/CVE-2026-81346.md): Frontend Admin by DynamiApps \< 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion (CVSS 4.3, Frontend Admin by DynamiApps)
- [CVE-2026-81342](https://cve.now/CVE-2026-81342.md): MasterStudy LMS \< 3.7.43 - Unauthenticated Open Redirect (CVSS 4.7, MasterStudy LMS WordPress Plugin)
- [CVE-2026-81200](https://cve.now/CVE-2026-81200.md): MasterStudy LMS \< 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR (CVSS 2.7, MasterStudy LMS WordPress Plugin)
- [CVE-2026-81026](https://cve.now/CVE-2026-81026.md): MasterStudy LMS \< 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN (CVSS 4.8, MasterStudy LMS WordPress Plugin)
- [CVE-2026-80488](https://cve.now/CVE-2026-80488.md): WP Ultimate CSV Importer \< 9.0 - Admin+ SQLi via AIOSEO Import Fields (CVSS 4.1, WP Ultimate CSV Importer)
- [CVE-2026-80311](https://cve.now/CVE-2026-80311.md): Stripe Payment Forms by WP Full Pay \< 8.5.5 - Cross-Customer Subscription Cancellation via IDOR (CVSS 4.3, Stripe Payment Forms by WP Full Pay)
- [CVE-2026-77786](https://cve.now/CVE-2026-77786.md): Rank Math SEO \< 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability (CVSS 4.9, Rank Math SEO)
- [CVE-2026-77704](https://cve.now/CVE-2026-77704.md): Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval (CVSS 2.7, Booking for Appointments and Events Calendar)
- [CVE-2026-77012](https://cve.now/CVE-2026-77012.md): Icollect \<= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password (CVSS 9.3, 爱采集数据采集和发布插件)
- [CVE-2026-77010](https://cve.now/CVE-2026-77010.md): HEL Online Classroom: AI-powered Online Classrooms \<= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass (CVSS 6.5, HEL Online Classroom: AI-powered Online Classrooms)
- [CVE-2026-77008](https://cve.now/CVE-2026-77008.md): HEL Online Classroom: AI-powered Online Classrooms \<= 1.0.3 - Unauthenticated Plugin Settings Update (CVSS 6.5, HEL Online Classroom: AI-powered Online Classrooms)
- [CVE-2026-77007](https://cve.now/CVE-2026-77007.md): HEL Online Classroom: AI-powered Online Classrooms \<= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure (CVSS 7.5, HEL Online Classroom: AI-powered Online Classrooms)
- [CVE-2026-76586](https://cve.now/CVE-2026-76586.md): BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation (CVSS 7.5, Appointment Booking Calendar Plugin and Scheduling Plugin)
- [CVE-2026-76548](https://cve.now/CVE-2026-76548.md): Profile Builder \< 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass (CVSS 8.2, User Profile Builder)
- [CVE-2026-76547](https://cve.now/CVE-2026-76547.md): Profile Builder \< 4.0.1 - Admin+ PHP Object Injection via Import/Export (CVSS 6.6, User Profile Builder)
- [CVE-2026-76546](https://cve.now/CVE-2026-76546.md): Profile Builder \< 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode (CVSS 6.8, User Profile Builder)
- [CVE-2026-19430](https://cve.now/CVE-2026-19430.md): CatFolders Document Gallery Pro \< 2.0.7 - Unauthenticated Missing Authorization via download-all (CVSS 5.3, Catfolders Document Gallery Pro)
- [CVE-2026-18234](https://cve.now/CVE-2026-18234.md): MStore API \< 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet (CVSS 6.5, MStore API)
- [CVE-2026-18233](https://cve.now/CVE-2026-18233.md): MStore API \< 4.21.1 - Subscriber+ Arbitrary Order Completion (CVSS 6.5, MStore API)
- [CVE-2026-17522](https://cve.now/CVE-2026-17522.md): Newsletters \< 4.17 - Arbitrary Plugin Option Update via CSRF (CVSS 5.4, Newsletters)
- [CVE-2026-17520](https://cve.now/CVE-2026-17520.md): Newsletters \< 4.17 - Unauthenticated API Access via Predictable API Key (CVSS 4.8, Newsletters)
- [CVE-2026-16947](https://cve.now/CVE-2026-16947.md): Total Processing Card Payments for WooCommerce \<= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure (CVSS 9.1, Total processing card payments for WooCommerce)
- [CVE-2026-16600](https://cve.now/CVE-2026-16600.md): SmartAIPress \<= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress\_openai\_upload\_and\_set\_featured\_image (CVSS 7.7, SmartAIPress)
- [CVE-2026-16259](https://cve.now/CVE-2026-16259.md): Uix UserCenter \<= 1.0.3 - Unauthenticated Privilege Escalation (CVSS 9.8, Uix UserCenter)
- [CVE-2026-16061](https://cve.now/CVE-2026-16061.md): Rest Routes \<= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table\_name} (CVSS 8.6, Rest Routes)
- [CVE-2026-10522](https://cve.now/CVE-2026-10522.md): Simple User Registration \<= 6.9 - Unauthenticated Privilege Escalation to Administrator (CVSS 9.8, MemberHero)
- [CVE-2026-41012](https://cve.now/CVE-2026-41012.md): BOSH vSphere CPI Improper Cert Validation (CVSS 7.7, Cloud Foundry bosh-vsphere-cpi-release)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.