# CVEs published 2026-08-30

92 CVEs were published on August 30, 2026: 8 critical, 20 high. Days are UTC.

- [CVE-2026-82595](https://cve.now/CVE-2026-82595.md): D-Link DIR-825M System Command Execution formSysCmd sub\_456CF4 command injection (CVSS 5.3, D-Link DIR-825M)
- [CVE-2026-82594](https://cve.now/CVE-2026-82594.md): LogNet grpc-spring-boot-starter Annotation Processing improper authorization (CVSS 2.3, LogNet grpc-spring-boot-starter)
- [CVE-2026-82593](https://cve.now/CVE-2026-82593.md): D-Link DIR-825M LTE Module Firmware Upgrade formLtefotaUpgradeFibocom sub\_41802C stack-based overflow (CVSS 9.4, D-Link DIR-825M)
- [CVE-2026-82592](https://cve.now/CVE-2026-82592.md): D-Link DIR-825M Disk Formatting Handler Endpoint formDiskFormat sub\_46725C stack-based overflow (CVSS 9.4, D-Link DIR-825M)
- [CVE-2026-82591](https://cve.now/CVE-2026-82591.md): Open Asset Import Library Assimp MD5Loader.cpp MakeDataUnique heap-based overflow (CVSS 4.8, Open Asset Import Library Assimp)
- [CVE-2026-82590](https://cve.now/CVE-2026-82590.md): Open5GS SMF nudm-handler.c smf\_nudm\_sdm\_handle\_get assertion (CVSS 5.3, Open5GS)
- [CVE-2026-82589](https://cve.now/CVE-2026-82589.md): Open5GS N1-N2 Message namf-handler.c amf\_namf\_comm\_handle\_n1\_n2\_message\_transfer denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-82588](https://cve.now/CVE-2026-82588.md): Open5GS Transfer Endpoint namf-handler.c null pointer dereference (CVSS 5.3, Open5GS)
- [CVE-2026-56718](https://cve.now/CVE-2026-56718.md): AJCloud AJY IPC Firmware Path Traversal via jdbhttpd (CVSS 8.7, AJCloud AJY IPC Firmware)
- [CVE-2026-82587](https://cve.now/CVE-2026-82587.md): Open5GS AMF namf-handler.c amf\_namf\_comm\_decode\_ue\_mm\_context\_list memory corruption (CVSS 5.3, Open5GS)
- [CVE-2026-78693](https://cve.now/CVE-2026-78693.md): Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names (CVSS 6.9, ash-project ash\_graphql)
- [CVE-2026-80223](https://cve.now/CVE-2026-80223.md): Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read (CVSS 7.1, ash-project ash\_graphql)
- [CVE-2026-81636](https://cve.now/CVE-2026-81636.md): Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service (CVSS 8.7, ash-project ash\_graphql)
- [CVE-2026-81633](https://cve.now/CVE-2026-81633.md): Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment (CVSS 6.9, ash-project ash\_graphql)
- [CVE-2026-81643](https://cve.now/CVE-2026-81643.md): Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification (CVSS 2.3, ash-project ash\_graphql)
- [CVE-2026-82367](https://cve.now/CVE-2026-82367.md): Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic (CVSS 2.3, ash-project ash\_graphql)
- [CVE-2026-81322](https://cve.now/CVE-2026-81322.md): Cloaked plaintext leaks through a non-sensitive action argument in AshCloak (CVSS 2.1, ash-project ash\_cloak)
- [CVE-2026-81319](https://cve.now/CVE-2026-81319.md): Unsafe deserialization of decrypted terms enables node DoS in AshCloak (CVSS 5.9, ash-project ash\_cloak)
- [CVE-2026-82556](https://cve.now/CVE-2026-82556.md): Forgejo Repository Migration is\_migrate\_allowed.go net.LookupIP server-side request forgery (CVSS 5.3, Forgejo)
- [CVE-2026-82555](https://cve.now/CVE-2026-82555.md): TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values (CVSS 6.3, TOTOLINK N600R)
- [CVE-2026-82554](https://cve.now/CVE-2026-82554.md): SourceCodester Queue Management System add\_customer.php cross site scripting (CVSS 5.3, SourceCodester Queue Management System)
- [CVE-2026-82553](https://cve.now/CVE-2026-82553.md): sambitraj Student Management System Student Dashboard student\_dashboard.php mysqli\_query improper authorization (CVSS 5.3, sambitraj Student Management System)
- [CVE-2026-82552](https://cve.now/CVE-2026-82552.md): Linux Foundation Magma gNB Termination ngap\_amf.c denial of service (CVSS 5.3, Linux Foundation Magma)
- [CVE-2026-82551](https://cve.now/CVE-2026-82551.md): Linux Foundation Magma NGSetup ngap\_amf\_handlers.c state issue (CVSS 6.9, Linux Foundation Magma)
- [CVE-2026-82550](https://cve.now/CVE-2026-82550.md): Linux Foundation Magma NGSetupRequest input validation (CVSS 6.9, Linux Foundation Magma)
- [CVE-2026-82549](https://cve.now/CVE-2026-82549.md): Linux Foundation Magma SecurityModeComplete integrity check (CVSS 6.9, Linux Foundation Magma)
- [CVE-2026-78699](https://cve.now/CVE-2026-78699.md): rename\_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres (CVSS 7.2, ash-project ash\_postgres)
- [CVE-2026-82548](https://cve.now/CVE-2026-82548.md): Linux Foundation Magma InitialUEMessage information disclosure (CVSS 6.9, Linux Foundation Magma)
- [CVE-2026-82547](https://cve.now/CVE-2026-82547.md): Linux Foundation Magma Registration Complete Message amf\_fsm.cpp improper authentication (CVSS 6.9, Linux Foundation Magma)
- [CVE-2026-82658](https://cve.now/CVE-2026-82658.md): Admidio before 5.0.12 Broken Access Control via profile\_function.php (CVSS 5.3, admidio)
- [CVE-2026-82657](https://cve.now/CVE-2026-82657.md): Admidio before 5.0.12 Authentication Bypass via RSS feeds (CVSS 8.7, admidio)
- [CVE-2026-82656](https://cve.now/CVE-2026-82656.md): Admidio before 5.0.12 Path Traversal via Photo ZIP Download (CVSS 2.1, admidio)
- [CVE-2026-82655](https://cve.now/CVE-2026-82655.md): Admidio before 5.0.12 SQL Injection via relation\_type\_list (CVSS 8.7, admidio)
- [CVE-2026-82654](https://cve.now/CVE-2026-82654.md): SiYuan before v3.8.1 Stored XSS via block name (CVSS 9.3, siyuan-note siyuan)
- [CVE-2026-82653](https://cve.now/CVE-2026-82653.md): SiYuan before v3.8.1 Stored XSS via confirmDialog (CVSS 9.3, siyuan-note siyuan)
- [CVE-2026-82652](https://cve.now/CVE-2026-82652.md): SiYuan before v3.8.1 Information Disclosure via Publish Access (CVSS 6.9, siyuan-note siyuan)
- [CVE-2026-82651](https://cve.now/CVE-2026-82651.md): SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-82650](https://cve.now/CVE-2026-82650.md): SiYuan before v3.8.1 Path Traversal via /api/template/render (CVSS 5.9, siyuan-note siyuan)
- [CVE-2026-82649](https://cve.now/CVE-2026-82649.md): SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path (CVSS 7.0, siyuan-note siyuan)
- [CVE-2026-82648](https://cve.now/CVE-2026-82648.md): WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address (CVSS 7.1, WWBN AVideo)
- [CVE-2026-82647](https://cve.now/CVE-2026-82647.md): WWBN AVideo Cross-Site Request Forgery via sendEmail.json.php (CVSS 5.3, WWBN AVideo)
- [CVE-2026-82646](https://cve.now/CVE-2026-82646.md): WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php (CVSS 5.3, WWBN AVideo)
- [CVE-2026-82645](https://cve.now/CVE-2026-82645.md): AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token (CVSS 9.2, WWBN AVideo)
- [CVE-2026-82644](https://cve.now/CVE-2026-82644.md): WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent (CVSS 8.7, WWBN AVideo)
- [CVE-2026-82643](https://cve.now/CVE-2026-82643.md): WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php (CVSS 6.9, WWBN AVideo)
- [CVE-2026-82545](https://cve.now/CVE-2026-82545.md): itsourcecode Sales and Inventory System sup\_searchfrm.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-82544](https://cve.now/CVE-2026-82544.md): wger-project wger Password Reset gym.py reset\_user\_password cross-site request forgery (CVSS 5.3, wger-project wger)
- [CVE-2026-82642](https://cve.now/CVE-2026-82642.md): Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution (CVSS 8.8, readest)
- [CVE-2026-82641](https://cve.now/CVE-2026-82641.md): Keploy 3.1.0-3.6.25 Unauthenticated TLS Key Exposure (CVSS 8.8, Keploy)
- [CVE-2026-82640](https://cve.now/CVE-2026-82640.md): browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage (CVSS 6.8, browser-use web-ui)
- [CVE-2026-82639](https://cve.now/CVE-2026-82639.md): NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure (CVSS 8.7, ChatGPTNextWeb NextChat)
- [CVE-2026-82638](https://cve.now/CVE-2026-82638.md): jina-ai reader Server-Side Request Forgery via disabled private-address guard (CVSS 8.7, jina-ai reader)
- [CVE-2026-82637](https://cve.now/CVE-2026-82637.md): browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation (CVSS 6.9, browser-use web-ui)
- [CVE-2026-82636](https://cve.now/CVE-2026-82636.md): Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qu (CVSS 7.9, Qubes OS)
- [CVE-2026-82543](https://cve.now/CVE-2026-82543.md): vastsa FileCodeBox Pickup Limit views.py update\_file\_usage race condition (CVSS 6.9, vastsa FileCodeBox)
- [CVE-2026-82634](https://cve.now/CVE-2026-82634.md): Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint (CVSS 7.1, frappe)
- [CVE-2026-82633](https://cve.now/CVE-2026-82633.md): Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint (CVSS 5.3, dolibarr)
- [CVE-2026-82542](https://cve.now/CVE-2026-82542.md): Tenda HG10 Boa Web Server formIPv6Routing buffer overflow (CVSS 10.0, Tenda HG10)
- [CVE-2026-82635](https://cve.now/CVE-2026-82635.md): Pake arbitrary file write via unsanitized download\_file filename (CVSS 8.8, tw93 Pake)
- [CVE-2026-77454](https://cve.now/CVE-2026-77454.md): exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql (CVSS 5.9, ash-project ash\_sql)
- [CVE-2026-82541](https://cve.now/CVE-2026-82541.md): itsourcecode Sales and Inventory System sup\_edit.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-81316](https://cve.now/CVE-2026-81316.md): Same-named aggregates with differing filters are conflated in AshSql (CVSS 2.1, ash-project ash\_sql)
- [CVE-2026-81318](https://cve.now/CVE-2026-81318.md): Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql (CVSS 2.1, ash-project ash\_sql)
- [CVE-2026-78691](https://cve.now/CVE-2026-78691.md): Unescaped backslash allows LIKE wildcard injection in AshSql string search (CVSS 2.1, ash-project ash\_sql)
- [CVE-2026-80227](https://cve.now/CVE-2026-80227.md): SQL string\_trim removes only spaces, diverging from in-memory trimming in AshSql (CVSS 2.1, ash-project ash\_sql)
- [CVE-2026-78228](https://cve.now/CVE-2026-78228.md): Unbounded handle\_error recursion enables denial of service in AshOban triggers (CVSS 5.9, ash-project ash\_oban)
- [CVE-2026-78038](https://cve.now/CVE-2026-78038.md): Job argument injection via :args overrides primary\_key and tenant in AshOban (CVSS 5.9, ash-project ash\_oban)
- [CVE-2026-82540](https://cve.now/CVE-2026-82540.md): itsourcecode Sales and Inventory System cust\_searchfrm.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-82539](https://cve.now/CVE-2026-82539.md): TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption (CVSS 9.4, TOTOLINK A720R)
- [CVE-2026-82488](https://cve.now/CVE-2026-82488.md): Beetel 450TC3 User Management cross site scripting (CVSS 5.1, Beetel 450TC3)
- [CVE-2026-82487](https://cve.now/CVE-2026-82487.md): Beetel 450TC3 password recovery (CVSS 5.3, Beetel 450TC3)
- [CVE-2026-82486](https://cve.now/CVE-2026-82486.md): SiteServer SSCMS Agent Installation Workflow access control (CVSS 2.3, SiteServer SSCMS)
- [CVE-2026-82485](https://cve.now/CVE-2026-82485.md): itsourcecode Sales and Inventory System pro\_edit.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-82484](https://cve.now/CVE-2026-82484.md): itsourcecode Sales and Inventory System emp\_searchfrm.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-82483](https://cve.now/CVE-2026-82483.md): coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db\_input.php cross site scripting (CVSS 5.1, coppermine-gallery Coppermine Photo Gallery)
- [CVE-2026-82482](https://cve.now/CVE-2026-82482.md): coppermine-gallery Coppermine Photo Gallery edit\_profile Endpoint profile.php cross site scripting (CVSS 5.1, coppermine-gallery Coppermine Photo Gallery)
- [CVE-2026-81766](https://cve.now/CVE-2026-81766.md): Really Simple Security \< 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp\_upgrade\_install\_plugin (CVSS 6.6, Really Simple Security)
- [CVE-2026-81660](https://cve.now/CVE-2026-81660.md): Groundhogg \< 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field (CVSS 8.8, Groundhogg — CRM, Newsletters, and Marketing Automation)
- [CVE-2026-78364](https://cve.now/CVE-2026-78364.md): MW WP Form \< 5.1.6 - Editor+ Stored XSS via Inquiry Data List (CVSS 3.5, MW WP Form)
- [CVE-2026-76585](https://cve.now/CVE-2026-76585.md): Customer Reviews for WooCommerce \< 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter (CVSS 8.8, Customer Reviews for WooCommerce)
- [CVE-2026-19722](https://cve.now/CVE-2026-19722.md): WPvivid Backup & Migration \< 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore (CVSS 6.6, WPvivid — Backup, Migration & Staging)
- [CVE-2026-14307](https://cve.now/CVE-2026-14307.md): Geotargeting WP \< 3.5.6.2 - Reflected XSS (CVSS 7.1, geotargetingwp)
- [CVE-2026-14835](https://cve.now/CVE-2026-14835.md): SOGO Add Script to Individual Pages Header Footer \<= 3.9 - Contributor+ Stored XSS via Post Metabox (CVSS 6.8, SOGO Add Script to Individual Pages Header Footer)
- [CVE-2026-82480](https://cve.now/CVE-2026-82480.md): NASA cFS cFE Software Bus cfe\_sb\_util.c CFE\_SB\_GetUserDataLength integer underflow (CVSS 5.3, NASA cFS)
- [CVE-2026-82479](https://cve.now/CVE-2026-82479.md): NASA cFS SBN TCP sbn\_tcp\_if.c OS\_read buffer overflow (CVSS 5.3, NASA cFS)
- [CVE-2026-15980](https://cve.now/CVE-2026-15980.md): MyHome Core \<= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token (CVSS 9.8, TangibleWP MyHome Core)
- [CVE-2026-82478](https://cve.now/CVE-2026-82478.md): NASA Trick TCP Socket JSONVariableServerThread.cpp parse\_request stack-based overflow (CVSS 6.9, NASA Trick)
- [CVE-2026-77846](https://cve.now/CVE-2026-77846.md): JSON path injection via unescaped get\_path segments in AshSqlite (CVSS 2.1, ash-project ash\_sqlite)
- [CVE-2026-75759](https://cve.now/CVE-2026-75759.md): Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc (CVSS 7.6, erlef oidcc)
- [CVE-2026-77831](https://cve.now/CVE-2026-77831.md): Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking (CVSS 2.1, ash-project ash\_paper\_trail)
- [CVE-2026-77970](https://cve.now/CVE-2026-77970.md): Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions (CVSS 5.9, ash-project ash\_paper\_trail)
- [CVE-2026-75847](https://cve.now/CVE-2026-75847.md): Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail (CVSS 5.9, ash-project ash\_paper\_trail)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.