2026-08-06 (Critical: 67, High: 65)

[github-actions]

CVE Daily Brief

Date: 2026-08-06

Summary

• Total qualifying CVEs: 132
• Critical: 67
• High: 65
• With GitHub PoC references: 24
• In CISA KEV: 0

Critical

All Critical CVE details are preserved across this issue and managed follow-up comments.

High Index

• 🟠 CVE-2026-15572 | CVSS 8.8 | A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, wh…
• 🟠 CVE-2026-17623 | CVSS 8.8 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation…
• 🟠 CVE-2026-17626 | CVSS 8.8 | IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Do…
• 🟠 CVE-2026-17630 | CVSS 8.8 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration p…
• 🟠 CVE-2026-20200 | CVSS 8.8 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to exe…
• 🟠 CVE-2026-20312 | CVSS 8.8 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a…
• 🟠 CVE-2026-17625 | CVSS 8.8 | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 throug…
• 🟠 CVE-2026-70431 | CVSS 8.8 | Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugi…
• 🟠 CVE-2026-70432 | CVSS 8.8 | A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute ar…
• 🟠 CVE-2026-17624 | CVSS 8.8 | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 throug…
• 🟠 CVE-2026-17632 | CVSS 8.8 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of P…
• 🟠 CVE-2026-17633 | CVSS 8.8 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection.
• 🟠 CVE-2026-8182 | CVSS 8.8 | IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any creden…
• 🟠 CVE-2026-8478 | CVSS 8.8 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of…
• 🟠 CVE-2026-9196 | CVSS 8.8 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation…
• 🟠 CVE-2026-9201 | CVSS 8.8 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in th…
• 🟠 CVE-2026-17556 | CVSS 8.8 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary file… | PoC 5
• 🟠 CVE-2026-15991 | CVSS 8.8 | The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector fu…
• 🟠 CVE-2026-28111 | CVSS 8.8 | Contributor Privilege Escalation in Forminator <= 1.56.0 versions.
• 🟠 CVE-2026-65542 | CVSS 8.8 | Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.
• 🟠 CVE-2026-69111 | CVSS 8.7 | Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate servi… | PoC 3
• 🟠 CVE-2026-66733 | CVSS 8.7 | Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that all… | PoC 1
• 🟠 CVE-2026-20263 | CVSS 8.6 | A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software could allow an unauthenticated, remote a…
• 🟠 CVE-2026-20268 | CVSS 8.6 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a…
• 🟠 CVE-2026-20269 | CVSS 8.6 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a…
• 🟠 CVE-2026-20270 | CVSS 8.6 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a…
• 🟠 CVE-2026-20271 | CVSS 8.6 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a…
• 🟠 CVE-2026-20273 | CVSS 8.6 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a…
• 🟠 CVE-2026-20301 | CVSS 8.6 | A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software…
• 🟠 CVE-2026-66298 | CVSS 8.6 | Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard… | PoC 4
• 🟠 CVE-2026-70617 | CVSS 8.6 | Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselv… | PoC 2
• 🟠 CVE-2026-71309 | CVSS 8.6 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rcl… | PoC 3
• 🟠 CVE-2026-9203 | CVSS 8.5 | A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-pri…
• 🟠 CVE-2026-17617 | CVSS 8.5 | IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of U…
• 🟠 CVE-2026-9077 | CVSS 8.5 | IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitr…
• 🟠 CVE-2026-18485 | CVSS 8.5 | There is a local privilege escalation vulnerability recently discovered in the NI-PAL kernel driver. This may allow a local, authenticated…
• 🟠 CVE-2026-70615 | CVSS 8.5 | boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation p… | PoC 1
• 🟠 CVE-2026-18597 | CVSS 8.5 | The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attack…
• 🟠 CVE-2026-65547 | CVSS 8.5 | Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.
• 🟠 CVE-2026-65569 | CVSS 8.5 | Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.
• 🟠 CVE-2026-55978 | CVSS 8.4 | An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel…
• 🟠 CVE-2026-17583 | CVSS 8.3 | The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker co…
• 🟠 CVE-2026-34966 | CVSS 8.3 | Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections b… | PoC 3
• 🟠 CVE-2026-66732 | CVSS 8.3 | Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established conn… | PoC 1
• 🟠 CVE-2026-16731 | CVSS 8.3 | OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism…
• 🟠 CVE-2026-10025 | CVSS 8.2 | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability.…
• 🟠 CVE-2026-71315 | CVSS 8.2 | Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to ma… | PoC 5
• 🟠 CVE-2026-19024 | CVSS 8.2 | NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose versio… | PoC 1
• 🟠 CVE-2026-14829 | CVSS 8.2 | The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict acc…
• 🟠 CVE-2026-16268 | CVSS 8.2 | The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied…
• 🟠 CVE-2026-66708 | CVSS 8.2 | Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.
• 🟠 CVE-2026-70637 | CVSS 8.2 | LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by… | PoC 1
• 🟠 CVE-2026-7327 | CVSS 8.1 | An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and…
• 🟠 CVE-2026-8400 | CVSS 8.1 | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB comp…
• 🟠 CVE-2026-70429 | CVSS 8.1 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attack…
• 🟠 CVE-2026-10547 | CVSS 8.1 | IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint…
• 🟠 CVE-2025-63822 | CVSS 8.1 | SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier pa… | PoC 1
• 🟠 CVE-2026-71320 | CVSS 8.1 | Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key thro… | PoC 5
• 🟠 CVE-2026-15459 | CVSS 8.1 | The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites no…
• 🟠 CVE-2026-57817 | CVSS 8.1 | The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the c_hash parameter when operating in the Hybrid Flow. If a…
• 🟠 CVE-2026-57818 | CVSS 8.1 | A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests,…
• 🟠 CVE-2026-16315 | CVSS 8.1 | OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism…
• 🟠 CVE-2026-65570 | CVSS 8.1 | Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.
• 🟠 CVE-2026-66710 | CVSS 8.1 | Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.
• 🟠 CVE-2026-71312 | CVSS 8.0 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone inte… | PoC 3

Notes

• PoC links are collected from NVD references and GitHub repository search. They are untrusted and may include unsafe code.
• Critical CVE details may span multiple managed comments to guarantee completeness without exceeding GitHub issue size limits.

[github-actions]

Critical Details (2026-08-06) - Part 1

🔴 CVE-2026-48168 | CVSS 10.0 | CRITICAL

Summary: PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comme…
Published: 2026-08-05T19:17:31.070
Last Modified: 2026-08-05T20:17:09.170
Affected: MervinPraison PraisonAI
CWE: CWE-862
GitHub PoC:

• commit/179cab02dbec0c1e9b601507a659
• advisories/GHSA-xp85-6wwf-r67c
  References:
• Reference
• Reference

---

🔴 CVE-2026-5430 | CVSS 10.0 | CRITICAL

Summary: The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result…
Published: 2026-08-06T08:16:33.240
Last Modified: 2026-08-06T15:31:57.827
Affected: WSO2 WSO2 Universal Gateway, WSO2 WSO2 Traffic Manager, WSO2 WSO2 API Control Plane, WSO2 WSO2 API Manager, WSO2 WSO2 Carbon API Manager Rest API Utility
CWE: CWE-347
References:

• Reference

---

🔴 CVE-2026-65553 | CVSS 10.0 | CRITICAL

Summary: Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.
Published: 2026-08-06T15:17:17.557
Last Modified: 2026-08-06T22:18:15.920
Affected: wbolt.com Spider Analyser – WordPress搜索引擎蜘蛛分析插件
CWE: CWE-94
References:

• Reference

---

🔴 CVE-2026-66665 | CVSS 10.0 | CRITICAL

Summary: Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
Published: 2026-08-06T15:17:21.227
Last Modified: 2026-08-06T22:18:19.223
Affected: Brandexponents Type Hub
CWE: CWE-434
References:

• Reference

---

🔴 CVE-2026-7329 | CVSS 9.9 | CRITICAL

Summary: An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized…
Published: 2026-08-05T16:17:09.200
Last Modified: 2026-08-07T05:17:04.130
Affected: Progress Software Corporation MarkLogic Server
CWE: CWE-269
References:

• Reference

---

🔴 CVE-2026-8709 | CVSS 9.9 | CRITICAL

Summary: An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database.
Published: 2026-08-05T16:17:09.820
Last Modified: 2026-08-07T05:17:04.360
Affected: Progress Software Corporation MarkLogic Server
CWE: CWE-269
References:

• Reference

---

🔴 CVE-2026-9193 | CVSS 9.9 | CRITICAL

Summary: An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database.
Published: 2026-08-05T16:17:10.183
Last Modified: 2026-08-07T05:17:04.700
Affected: Progress Software Corporation MarkLogic Server
CWE: CWE-269
References:

• Reference

---

🔴 CVE-2026-20303 | CVSS 9.9 | CRITICAL

Summary: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracke…
Published: 2026-08-05T17:16:50.513
Last Modified: 2026-08-06T15:44:56.043
Affected: Cisco Cisco Catalyst SD-WAN Controller, Cisco Cisco Catalyst SD-WAN Manager
CWE: CWE-20
References:

• Reference

---

🔴 CVE-2026-20304 | CVSS 9.9 | CRITICAL

Summary: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that address multiple internally discovered vulnerabilities. The vulnerabilities track…
Published: 2026-08-05T17:16:50.890
Last Modified: 2026-08-06T15:44:56.043
Affected: Cisco Cisco Catalyst SD-WAN Controller, Cisco Cisco Catalyst SD-WAN Manager
CWE: CWE-284
References:

• Reference

---

🔴 CVE-2026-65548 | CVSS 9.9 | CRITICAL

Summary: Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.
Published: 2026-08-06T15:17:16.737
Last Modified: 2026-08-06T22:18:15.703
Affected: Muffingroup Betheme
CWE: CWE-94
References:

• Reference

---

🔴 CVE-2026-9192 | CVSS 9.8 | CRITICAL

Summary: An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators.
Published: 2026-08-05T16:17:10.063
Last Modified: 2026-08-07T05:17:04.590
Affected: Progress Software Corporation MarkLogic Server
CWE: CWE-287
References:

• Reference

---

🔴 CVE-2026-20272 | CVSS 9.8 | CRITICAL

Summary: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracke…
Published: 2026-08-05T17:16:49.053
Last Modified: 2026-08-06T15:44:56.043
Affected: Cisco Cisco IOS XE Software
CWE: CWE-74
References:

• Reference

---

🔴 CVE-2026-9205 | CVSS 9.8 | CRITICAL

Summary: IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.
Published: 2026-08-05T19:17:49.193
Last Modified: 2026-08-06T18:30:33.060
Affected: IBM Langflow OSS
CWE: CWE-338
References:

• Vendor Advisory

---

🔴 CVE-2025-63823 | CVSS 9.8 | CRITICAL

Summary: My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values.
Published: 2026-08-05T22:17:07.053
Last Modified: 2026-08-06T15:16:42.183
Affected: n/a n/a
CWE: CWE-798
GitHub PoC:

• CVE-2025-63823/README.md
  References:
• Reference
• Reference

---

🔴 CVE-2026-52466 | CVSS 9.8 | CRITICAL

Summary: Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function.…
Published: 2026-08-06T00:16:53.593
Last Modified: 2026-08-06T13:18:19.720
Affected: n/a n/a
CWE: CWE-863
References:

• Reference

---

🔴 CVE-2026-67870 | CVSS 9.8 | CRITICAL

Summary: In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL…
Published: 2026-08-06T00:16:54.043
Last Modified: 2026-08-06T22:18:23.353
Affected: n/a n/a
CWE: CWE-476
GitHub PoC:

• open62541/types.h
• server/ua_services_nodemanagement.c
• src/ua_types.c
  References:
• Reference
• Reference
• Reference
• Reference

---

🔴 CVE-2026-67873 | CVSS 9.8 | CRITICAL

Summary: A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegment_encode() validates only the standalone segment length via FileSegment_GetMaxDataSize() and does not verify the residual capacity of the current ASDU frame before encoding obje…
Published: 2026-08-06T00:16:54.380
Last Modified: 2026-08-06T13:18:23.587
Affected: n/a n/a
CWE: CWE-122
GitHub PoC:

• mz-automation/lib60870
• master/user_guide.adoc
• issues/201
  References:
• Reference
• Reference
• Reference
• Reference

---

🔴 CVE-2026-1728 | CVSS 9.8 | CRITICAL

Summary: Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This req…
Published: 2026-08-06T08:16:31.423
Last Modified: 2026-08-06T15:31:57.827
Affected: WSO2 WSO2 API Manager, WSO2 WSO2 API Control Plane, WSO2 WSO2 Universal Gateway, WSO2 WSO2 Traffic Manager, WSO2 WSO2 Carbon API Manager Rest API Common Functions, WSO2 WSO2 Carbon API Manager Rest API Utility
CWE: CWE-269
References:

• Reference

---

🔴 CVE-2026-66909 | CVSS 9.8 | CRITICAL

Summary: Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget…
Published: 2026-08-06T11:16:30.583
Last Modified: 2026-08-07T00:16:39.457
Affected: Apache Software Foundation Apache CXF
CWE: CWE-502
References:

• Mailing List, Vendor Advisory
• Reference

---

🔴 CVE-2026-68079 | CVSS 9.8 | CRITICAL

Summary: In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended…
Published: 2026-08-06T12:16:28.060
Last Modified: 2026-08-07T00:16:39.950
Affected: Apache Software Foundation Apache CXF
CWE: CWE-294
References:

• Mailing List, Vendor Advisory
• Reference

---

🔴 CVE-2026-5134 | CVSS 9.8 | CRITICAL

Summary: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-06T14:16:36.840
Last Modified: 2026-08-06T16:16:44.323
Affected: Loca Software Informatics Technology Ltd. Co. CMS
CWE: CWE-89
References:

• Reference

---

🔴 CVE-2026-28005 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.
Published: 2026-08-06T15:16:51.560
Last Modified: 2026-08-06T16:16:41.680
Affected: Nexcess Kadence WooCommerce Email Designer
CWE: CWE-862
References:

• Reference

---

🔴 CVE-2026-28139 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.
Published: 2026-08-06T15:16:52.580
Last Modified: 2026-08-06T16:16:41.787
Affected: wpdreams Ajax Search Lite
CWE: CWE-502
References:

• Reference

---

🔴 CVE-2026-65507 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.
Published: 2026-08-06T15:17:14.823
Last Modified: 2026-08-06T22:18:14.743
Affected: Sergey AIWU
CWE: CWE-266
References:

• Reference

---

🔴 CVE-2026-65552 | CVSS 9.8 | CRITICAL

Summary: Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
Published: 2026-08-06T15:17:17.430
Last Modified: 2026-08-06T22:18:15.807
Affected: qstudio Export User Data
CWE: CWE-502
References:

• Reference

---

🔴 CVE-2026-65556 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.
Published: 2026-08-06T15:17:17.803
Last Modified: 2026-08-06T22:18:16.020
Affected: MihChe WPBruiser {no- Captcha anti-Spam}
CWE: CWE-502
References:

• Reference

---

🔴 CVE-2026-65571 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
Published: 2026-08-06T15:17:18.560
Last Modified: 2026-08-06T16:16:47.043
Affected: Axiomthemes 69 Clothing
CWE: CWE-502
References:

• Reference

---

🔴 CVE-2026-65572 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.
Published: 2026-08-06T15:17:18.683
Last Modified: 2026-08-06T22:18:16.460
Affected: Axiomthemes A.Williams
CWE: CWE-502
References:

• Reference

---

🔴 CVE-2026-65573 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.
Published: 2026-08-06T15:17:18.813
Last Modified: 2026-08-06T22:18:16.587
Affected: ThemeREX Abelle
CWE: CWE-502
References:

• Reference

---

🔴 CVE-2026-65574 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.
Published: 2026-08-06T15:17:18.940
Last Modified: 2026-08-06T16:16:47.150
Affected: AncoraThemes Abogado
CWE: CWE-502
References:

• Reference

---

🔴 CVE-2026-65575 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.
Published: 2026-08-06T15:17:19.067
Last Modified: 2026-08-06T22:18:16.713
Affected: AncoraThemes Accalia
CWE: CWE-502
References:

• Reference

---

🔴 CVE-2026-65576 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.
Published: 2026-08-06T15:17:19.190
Last Modified: 2026-08-06T16:16:47.283
Affected: AncoraThemes Adrena
CWE: CWE-502
References:

• Reference

---

🔴 CVE-2026-65577 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.
Published: 2026-08-06T15:17:19.313
Last Modified: 2026-08-06T22:18:16.810
Affected: AncoraThemes Advice
CWE: CWE-502
References:

• Reference

---

🔴 CVE-2026-65578 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated PHP Object Injection in Agora <= 1.9 versions.
Published: 2026-08-06T15:17:19.437
Last Modified: 2026-08-06T22:18:16.930
Affected: AncoraThemes Agora
CWE: CWE-502
References:

• Reference

---

🔴 CVE-2026-65579 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.
Published: 2026-08-06T15:17:19.560
Last Modified: 2026-08-06T16:16:47.417
Affected: axiomthemes Agricola
CWE: CWE-502
References:

• Reference

---

🔴 CVE-2026-65581 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.
Published: 2026-08-06T15:17:19.683
Last Modified: 2026-08-06T22:18:17.033
Affected: Axiomthemes AI ANN
CWE: CWE-502
References:

• Reference

---

🔴 CVE-2026-66662 | CVSS 9.8 | CRITICAL

Summary: Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.
Published: 2026-08-06T15:17:20.850
Last Modified: 2026-08-06T16:16:48.717
Affected: Shabti Kaplan Frontend Admin by DynamiApps
CWE: CWE-266
References:

• Reference

---

🔴 CVE-2026-67261 | CVSS 9.8 | CRITICAL

Summary: Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlyi…
Published: 2026-08-06T15:17:24.430
Last Modified: 2026-08-06T22:18:21.493
Affected: Dell Virtual Storage Integrator for VMware vSphere Client
CWE: CWE-78
References:

• Reference

---

🔴 CVE-2026-71319 | CVSS 9.6 | CRITICAL

Summary: Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (w…
Published: 2026-08-05T22:17:08.227
Last Modified: 2026-08-07T05:17:03.660
Affected: nuxt devtools
CWE: CWE-94, CWE-306
GitHub PoC:

• commit/a7b2718b930766e1ffb0640259d53f5b041a50b4
• tag/v3.3.1
• advisories/GHSA-279x-mwfv-vcqv
  References:
• Reference
• Reference
• Reference

---

🔴 CVE-2026-12605 | CVSS 9.6 | CRITICAL

Summary: In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -> full unauthenticated takeover of Eclipse GlassFish domain until the token expires.
Published: 2026-08-06T14:16:20.887
Last Modified: 2026-08-06T16:16:36.150
Affected: Eclipse Foundation Eclipse GlassFish
CWE: CWE-918
References:

• Reference
• Reference

---

🔴 CVE-2026-15587 | CVSS 9.4 | CRITICAL

Summary: Improper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication header. This vulnerability was patched with version 6.3.85, and no cust…
Published: 2026-08-05T16:16:51.147
Last Modified: 2026-08-05T16:16:51.147
Affected: Google Cloud Google SecOps (Chronicle SOAR)
CWE: CWE-346
References:

• Reference

---

🔴 CVE-2025-15039 | CVSS 9.4 | CRITICAL

Summary: The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how th…
Published: 2026-08-06T08:16:29.147
Last Modified: 2026-08-06T15:31:57.827
Affected: WSO2 WSO2 Identity Server, WSO2 WSO2 API Manager, WSO2 WSO2 Open Banking AM, WSO2 WSO2 Open Banking IAM, WSO2 WSO2 Traffic Manager, WSO2 WSO2 Universal Gateway
CWE: CWE-693
References:

• Reference

---

🔴 CVE-2026-9195 | CVSS 9.3 | CRITICAL

Summary: A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions…
Published: 2026-08-05T16:17:10.313
Last Modified: 2026-08-05T19:17:48.113
Affected: Progress Software Corporation MarkLogic Server
CWE: CWE-22, CWE-79
References:

• Reference

---

🔴 CVE-2026-67531 | CVSS 9.3 | CRITICAL

Summary: FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force…
Published: 2026-08-06T00:16:53.733
Last Modified: 2026-08-06T22:18:21.897
Affected: agentfront frontmcp
CWE: CWE-94
GitHub PoC:

• commit/209cddd19a8d4db0777f725b527818da7df6f67f
• advisories/GHSA-mp29-fxh8-92px
  References:
• Reference
• Reference

---

🔴 CVE-2026-53975 | CVSS 9.3 | CRITICAL

Summary: OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn() without any allowlist, blocklist, or argument validation.…
Published: 2026-08-06T15:16:55.827
Last Modified: 2026-08-06T16:16:43.257
Affected: Bohdan Triapitsyn OpenChamber
CWE: CWE-78
GitHub PoC:

• openchamber/openchamber
• commit/f1b9506132faf6c564a2694c7f33b94421a49b4a
  References:
• Reference
• Reference
• Reference

---

🔴 CVE-2026-53976 | CVSS 9.3 | CRITICAL

Summary: OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace bound…
Published: 2026-08-06T15:16:55.983
Last Modified: 2026-08-06T16:16:43.367
Affected: Bohdan Triapitsyn OpenChamber
CWE: CWE-22
GitHub PoC:

• openchamber/openchamber
• commit/f1b9506132faf6c564a2694c7f33b94421a49b4a
  References:
• Reference
• Reference
• Reference

---

🔴 CVE-2026-65508 | CVSS 9.3 | CRITICAL

Summary: Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.
Published: 2026-08-06T15:17:14.957
Last Modified: 2026-08-06T16:16:45.993
Affected: NSquared Simply Schedule Appointments
CWE: CWE-89
References:

• Reference

---

🔴 CVE-2026-65520 | CVSS 9.3 | CRITICAL

Summary: Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
Published: 2026-08-06T15:17:15.607
Last Modified: 2026-08-06T16:16:46.207
Affected: miniOrange WP OAuth Server
CWE: CWE-89
References:

• Reference

---

🔴 CVE-2026-65546 | CVSS 9.3 | CRITICAL

Summary: Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.
Published: 2026-08-06T15:17:16.480
Last Modified: 2026-08-06T22:18:15.590
Affected: QODE Qode Tours
CWE: CWE-89
References:

• Reference

---

🔴 CVE-2026-66447 | CVSS 9.3 | CRITICAL

Summary: Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.
Published: 2026-08-06T15:17:20.207
Last Modified: 2026-08-06T16:16:48.617
Affected: nickboss WordPress File Upload
CWE: CWE-89
References:

• Reference

---

🔴 CVE-2026-39923 | CVSS 9.2 | CRITICAL

Summary: Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing an…
Published: 2026-08-05T16:16:55.980
Last Modified: 2026-08-05T20:17:08.797
Affected: Flarum Flarum Framework
CWE: CWE-324
GitHub PoC:

• commit/2803058d0f9dc38252326070b46d4484fe5a857d
• pull/4545
• tag/v1.8.16
  References:
• Reference
• Reference
• Reference
• Reference

---

🔴 CVE-2026-60053 | CVSS 9.1 | CRITICAL

Summary: Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed…
Published: 2026-08-05T16:16:58.323
Last Modified: 2026-08-06T22:18:11.050
Affected: Apache Software Foundation Apache Answer
CWE: CWE-613
References:

• Reference
• Reference

---

🔴 CVE-2026-7557 | CVSS 9.1 | CRITICAL

Summary: An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators. This vulnerability affects deployments with SA…
Published: 2026-08-05T16:17:09.437
Last Modified: 2026-08-07T05:17:04.250
Affected: Progress Software Corporation MarkLogic Server
CWE: CWE-347
References:

• Reference

---

🔴 CVE-2026-9190 | CVSS 9.1 | CRITICAL

Summary: An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing bo…
Published: 2026-08-05T16:17:09.940
Last Modified: 2026-08-07T05:17:04.470
Affected: Progress Software Corporation MarkLogic Server
CWE: CWE-444
References:

• Reference

---

🔴 CVE-2026-20310 | CVSS 9.1 | CRITICAL

Summary: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracke…
Published: 2026-08-05T17:16:51.520
Last Modified: 2026-08-06T15:44:56.043
Affected: Cisco Cisco Catalyst SD-WAN Controller, Cisco Cisco Catalyst SD-WAN Manager
CWE: CWE-59
References:

• Reference

---

🔴 CVE-2026-8470 | CVSS 9.1 | CRITICAL

Summary: IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allo…
Published: 2026-08-05T19:17:44.823
Last Modified: 2026-08-06T18:52:08.387
Affected: IBM Langflow OSS
CWE: CWE-327
References:

• Vendor Advisory

---

🔴 CVE-2026-12713 | CVSS 9.1 | CRITICAL

Summary: The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.
Published: 2026-08-06T07:16:26.990
Last Modified: 2026-08-06T16:16:36.253
Affected: Unknown WPCargo Track & Trace
CWE: CWE-89
References:

• Reference

---

🔴 CVE-2026-16054 | CVSS 9.1 | CRITICAL

Summary: The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy custom…
Published: 2026-08-06T07:16:28.087
Last Modified: 2026-08-06T22:16:48.733
Affected: Unknown Drag and Drop Multiple File Upload for WooCommerce
CWE: CWE-73
References:

• Reference

---

🔴 CVE-2026-61466 | CVSS 9.1 | CRITICAL

Summary: In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. User…
Published: 2026-08-06T12:16:27.730
Last Modified: 2026-08-07T00:16:34.070
Affected: Apache Software Foundation Apache CXF
CWE: CWE-304
References:

• Mailing List, Vendor Advisory
• Reference

---

🔴 CVE-2026-63687 | CVSS 9.1 | CRITICAL

Summary: Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, c…
Published: 2026-08-06T12:16:27.843
Last Modified: 2026-08-07T00:16:37.110
Affected: Apache Software Foundation Apache CXF
CWE: CWE-345
References:

• Mailing List, Vendor Advisory
• Reference

---

🔴 CVE-2026-65583 | CVSS 9.1 | CRITICAL

Summary: Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. User…
Published: 2026-08-06T12:16:27.953
Last Modified: 2026-08-07T00:16:38.143
Affected: Apache Software Foundation Apache CXF
CWE: CWE-345
References:

• Mailing List, Vendor Advisory
• Reference

---

🔴 CVE-2026-32327 | CVSS 9.1 | CRITICAL

Summary: A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
Published: 2026-08-06T15:16:54.190
Last Modified: 2026-08-06T22:17:01.800
Affected: Apache Software Foundation Apache Portable Runtime Utility
CWE: CWE-674
References:

• Reference
• Reference

---

🔴 CVE-2026-34191 | CVSS 9.1 | CRITICAL

Summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3
Published: 2026-08-06T15:16:54.650
Last Modified: 2026-08-06T22:17:02.277
Affected: Apache Software Foundation Apache Portable Runtime Utility
CWE: CWE-89
References:

• Reference
• Reference

---

🔴 CVE-2026-54489 | CVSS 9.1 | CRITICAL

Summary: Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This vulnerability is considered…
Published: 2026-08-06T15:16:56.120
Last Modified: 2026-08-06T22:17:44.430
Affected: Dell Virtual Storage Integrator for VMware vSphere Client
CWE: CWE-200
References:

• Reference

---

🔴 CVE-2026-66709 | CVSS 9.1 | CRITICAL

Summary: Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.
Published: 2026-08-06T15:17:23.927
Last Modified: 2026-08-06T22:18:20.627
Affected: WebAppick CTX Feed
CWE: CWE-94
References:

• Reference

---

🔴 CVE-2026-20267 | CVSS 9.0 | CRITICAL

Summary: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracke…
Published: 2026-08-05T17:16:47.560
Last Modified: 2026-08-06T15:44:56.043
Affected: Cisco Cisco IOS XE Software
CWE: CWE-284
References:

• Reference

---

🔴 CVE-2026-70426 | CVSS 9.0 | CRITICAL

Summary: In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, a…
Published: 2026-08-05T18:17:12.233
Last Modified: 2026-08-06T05:17:05.850
Affected: Jenkins Project Jenkins, Jenkins Project Remoting
CWE: CWE-502
References:

• Reference

---