Latest Security Vulnerabilities

Friday August 21, 2026

Apple watchOS

CVE-2026-43679 Apple Watch watchOS 26.4: Physical Access Contact Disclosure

Apple macOS

CVE-2026-20679 Apple macOS Sequoia 15.7.5 / Sonoma 14.8.5 File Crash

Wpforms

CVE-2026-18409 WPForms Pro <=2.0.0.2 Stored XSS via Text Fields (iframe data-src)

CVE-2026-77761 MISP STIX Parser State Isolation Causing Integrity Leak
CVE-2026-77710 MISP STIX Import: Spoofed Document Alters Attribute Metadata
CVE-2026-77755 DoS via SysExit & Large Documents in MISP-STIX Importer
CVE-2026-77751 Path Traversal in PyMISP Template Resolution via Untrusted STIX Names

Unclassified

CVE-2026-74866 CRLF Injection in @fastify/busboy 3.2.1, fixed in 3.2.2
CVE-2026-16575 Unauth Disclosure in Dokan 5.0.14 via unauth REST endpoint
CVE-2026-19435 Duplicate Post WP Plugin <1.5.6: PrivEsc & Info Disclosure
CVE-2026-77264 Auth Bypass in WP OTP Plugin v4.8.6: Magic Token Leakage
CVE-2026-47827 Command Injection in Cloud Foundry BOSH CLI <2.840.0 on Windows
CVE-2026-19848 ProfilePress WP Plugin before 4.17.1 Shortcode XSS Exposes Email
CVE-2026-15150 myCred WP Plugin <3.2.5: Unauthenticated Payment Notification Bypass
CVE-2026-16577 Dokan WP Plugin 5.0.13 Reverse-Withdrawal Amount Validation Flaw
CVE-2026-16576 Dokan WP Plugin <5.0.14 Privilege Escalation via Admin REST API
And others...

Rocketchat Rocket Chat

CVE-2026-65644 Rocket.Chat <8.8.0 REST API XSS via unsanitized visitor name
CVE-2026-65645 Thread Data Disclosure via unvalidated rid/ tmid in Rocket.Chat <=8.8.0

Apache CloudStack

CVE-2026-66722 Apache CloudStack: Improper Auth for Project Role CRUD (4.15-4.20.3.0/4.21-4.22.1.0)
CVE-2026-47359 Apache CloudStack OS Command Injection (NAS Backup Provider v4.20-4.22.1)
CVE-2026-61422 SSRF Pre-Validation in CloudStack 4.20.3.0-4.22.1.0 (template/ISO)
CVE-2026-61400 Command Injection in CloudStack 4.20.x4.22.x runDiagnostics
CVE-2026-61397 Apache CloudStack OAuth2 Plugin Info Leak before 4.20.3.1/4.22.1.1
CVE-2026-59657 Cleartext Storage via AsyncJob DB in Apache CloudStack 4.0.0-4.22.1.0
CVE-2026-50112 Apache CloudStack SSRF & KVM RCE via Metalink URLs 4.144.22
CVE-2026-65613 Apache CloudStack: webhook info leak 4.20-4.22 before 4.20.3.1/4.22.1.1
CVE-2026-66721 CloudStack HostTags API Missing Auth (4.124.20.3.0, 4.214.22.1.0)
And others...

Apache InLong

CVE-2026-63046 Apache InLong <2.4.0 Argument Injection in Agent Installer's ModuleManager
CVE-2026-63043 Relative Path Traversal in Apache InLong Agent hosts (2.0.0<2.4.0)
CVE-2026-63038 Apache InLong 2.0.x<2.4.0 SQLi via dbName/tableName params

VMware Spring Framework

CVE-2026-59296 Micrometer StatsD Registry Injection via Unvalidated Metric Names
CVE-2026-59279 Spring AI 2.0 Unbounded Session Accumulation DoS

VMware

CVE-2026-59323 DoS via Unbounded Baggage Allocation in Micrometer-tracing-Bridge-Brave (W3C)

Checkmk

CVE-2026-15576 Checkmk <2.5.0p10 Agent Receiver Auth Bypass via TLS Client Cert Verification

Dolibarr

CVE-2026-77686 Dolibarr <=23.0.4 Improper Auth via ID in AccHdlr (card.php)

Red Hat Multicluster Engine

CVE-2026-73267 MCE clusterclaims-controller DoS via unauthorized ManagedCluster deletion

Spring

CVE-2026-59308 Spring AI 2.0.0 Semantic Cache Context Hash Flaw: Cross-Context Leakage
CVE-2026-59318 Spring AI 1.x/2.0.0 Privilege Escalation: Unrestricted Tool Call (AI)

Roskus Prospero Flow Crm

CVE-2026-77759 Auth Bypass in Roskus Prospero Flow CRM 5.0.05.3.5 Transaction API

Juicedata Juicefs

CVE-2026-77763 JuiceFS filestore backend path traversal writes outside root

Joshnuss Xml Builder

CVE-2026-47079 Inappropriate Encoding in xml_builder 0.0.62.4.1: XSS via <script
CVE-2026-48590 XML Injection in joshnuss xml_builder < 2.4.1 Content Spoofing
CVE-2026-47080 XML Injection in xml_builder 0.0.72.4.1 via Unchecked CDATA

Comfast Cf N1 S

CVE-2026-77683 Command Injection in Comfast CF-N1-S 2.6.0.1 via /cgi-bin/mbox-config

Sourcecodester Dynamic Input Field Generator Using Html Css Php

CVE-2026-77391 CVE-2026-77391 XSRF in SourceCodester Dynamic Input Field Generator 1.0
CVE-2026-77392 Remote SQLi in SourceCodester Dynamic Input Field Generator 1.0 (saveUser)

Codeastro Online Job Portal

CVE-2026-77681 CodeAstro 1.0 Unrestricted File Upload via Name param in update-profile.php

Thursday August 20, 2026

Google Chrome

CVE-2026-76019 High-Severity Auth Bypass in Chrome Workers (151.0.7922.173)
CVE-2026-76020 Race condition in V8 in Chrome <151.0.7922.173: RCE in sandbox
CVE-2026-76017 Chrome <151.0.7922.173 Chromoting UAF RCE
CVE-2026-76022 Chrome<151.0.7922.173 Buffer Overflow: RCE outside Sandbox
CVE-2026-76023 Google Chrome <151: Improper resource control in Linux Toolkit Theming
CVE-2026-76018 Chrome Import Priv Elevation <151.0.7922.173
CVE-2026-76021 Google Chrome < 151.0.7922.173 UAF in DOM leads to sandbox escape

IBM Aix

CVE-2026-16936 IBM AIX 7.2/7.3 & PowerVM VIOS 4.1 buffer overflow local code exec
CVE-2026-16980 IBM AIX 7.2/7.3 & PowerVM VIOS 4.1: Local DoS from Improper Symlink Validation
CVE-2026-18828 IBM AIX 7.2-7.3 / PowerVM VIOS 4.1 DoS via stack overflow
CVE-2026-17121 IBM AIX 7.2/7.3 & PowerVM VIOS 4.1 Recursion DoS
CVE-2026-17120 IBM AIX 7.2/7.3 & PowerVM VIOS 4.1 Remote DoS via Buffer Overflow
CVE-2026-17157 IBM AIX 7.2/7.3 & PowerVM VIOS 4.1 stack buffer overflow RCE
CVE-2026-17159 IBM AIX 7.2/7.3 & PowerVM VIOS 4.1 Integer Overflow DoS
CVE-2026-17060 IBM AIX 7.2/7.3 & PowerVM VIOS 4.1 Kernel Heap Over-Read Remote Info Leak & DoS
CVE-2026-17003 IBM AIX 7.2-7.3 & PowerVM VIOS 4.1 OOB Write Remote RCE
And others...

Red Hat Camel Quarkus

CVE-2026-19611 WildFly Elytron Unicode Normalization Weakens Password Hashing

Canonical Ubuntu Linux

CVE-2026-61897 Local PrivEsc via Ubuntu AccountsService 23.13.9-8ubuntu7
CVE-2026-53586 CVE-2026-53586 libgit2 credentials leak via HTTP redirect (before 1.8.6/1.9.5)
CVE-2026-53584 libgit2 submodule path traversal before 1.8.6/1.9.5
CVE-2026-61898 accountsservice LPE via sed injection in PAM language script v<23.13.9
CVE-2026-53587 libgit2 Heap OOB Walk: smart_pkt.c <1.8.6/1.9.5
CVE-2026-53585 Memory Exhaustion in libgit2 <1.8.6/1.9.5 via Malicious delta

Unclassified

Microsoft Windows Remote Help

CVE-2026-55013 Aug 2026: Windows Remote Help Defense Spoofing Vulnerability
CVE-2026-55015 Aug 2026: Microsoft Remote Help Denial of Service Vulnerability

Microsoft Exchange Online

CVE-2026-65801 Aug 2026: Microsoft Exchange Online Elevation of Privilege Vulnerability

Microsoft Azure Web Apps

CVE-2026-65816 Aug 2026: Azure Arc Elevation of Privilege Vulnerability

Microsoft Azure Managed Instance Apache Cassandra

CVE-2026-65770 Aug 2026: Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

Microsoft Fabric

CVE-2026-63509 Aug 2026: Microsoft Fabric Elevation of Privilege Vulnerability

Microsoft Azure Data Factory

CVE-2026-62834 Aug 2026: Azure Data Factory Elevation of Privilege Vulnerability
CVE-2026-66800 Aug 2026: Azure Data Factory Information Disclosure Vulnerability

Torproject Tor

CVE-2026-77641 Tor <0.4.9.9 NULL Write After Free in relay_send_command_from_edge
CVE-2026-77587 Tor Use-After-Free in conflux component before 0.4.9.11
CVE-2026-77639 Tor pre-0.4.9.9 Compression Bomb Bypass via gzip/zlib Concatenation
CVE-2026-77642 Tor OOB Write in Consensus parsing before 0.4.9.9

Ptc

CVE-2026-77646 PTC Windchill PDMLink/FlexPLM SSRF via Deserialization

OpenStack Glance

CVE-2026-77648 OpenStack Glance < 32.0 SSRF via /v2/tasks Import API

Codexthemes

CVE-2026-66609 Unauthenticated SQL Injection in TheGem (Elementor) <=5.12.3 WordPress Theme

Microsoft Azure Sql Database

CVE-2026-66309 Aug 2026: Azure SQL Database Elevation of Privilege Vulnerability
CVE-2026-68782 Aug 2026: Azure SQL Database Elevation of Privilege Vulnerability
CVE-2026-68789 Aug 2026: Azure SQL Database Elevation of Privilege Vulnerability

Microsoft Azure Logic Apps

CVE-2026-69400 Aug 2026: Azure Logic Apps Elevation of Privilege Vulnerability

Microsoft Azure Data Manager For Energy

CVE-2026-69419 Aug 2026: Azure Data Manager for Energy Remote Code Execution Vulnerability

Microsoft Azure Stack Hci

CVE-2026-69519 Aug 2026: Azure Stack HCI Information Disclosure Vulnerability

Microsoft Azure Virtual Machines

CVE-2026-69543 Aug 2026: Azure Virtual Machines Elevation of Privilege Vulnerability

Microsoft Azure Arc

CVE-2026-69555 Aug 2026: Azure Arc Elevation of Privilege Vulnerability

Microsoft Partner Center

CVE-2026-69558 Aug 2026: Microsoft Partner Center Information Disclosure Vulnerability

Microsoft Entra Id

CVE-2026-69836 Aug 2026: Microsoft Entra ID Remote Code Execution Vulnerability
CVE-2026-69851 Aug 2026: Microsoft Entra ID Elevation of Privilege Vulnerability

Microsoft Copilot In Azure

CVE-2026-69855 Aug 2026: Microsoft Copilot in Azure Information Disclosure Vulnerability

Microsoft Office 2019

CVE-2026-70105 Aug 2026: Microsoft Word Information Disclosure Vulnerability

Red Hat Rhmt

CVE-2026-19582 Binutils <2.46.1: PE File Stack Bof Arbitrary Code Exec

Tp Link

CVE-2026-9033 TP-Link Captive Portal Session Termination (CVE-2026-9033)
CVE-2026-19683 Unencrypted DDNS Credential Transmission in TP-Link Omada Gateway
CVE-2026-19586 TP-Link Omada Gateway OpenVPN Server Command Injection

Red Hat Enterprise Linux (RHEL)

CVE-2026-11861 Privilege Escalation: PAC Omission in FreeIPA AD Trust
CVE-2026-13097 FreeIPA Kerberos Principal Uniqueness Flaw Priv Escalation
CVE-2026-18917 libvirt NodeGetFreePages Int Overflow (Privilege Escalation)

Amazon Aws

CVE-2026-18420 OpenSearch Dashboards 3.8 TVBZ RCE via JSON (Prototype Pollution)

Genians

CVE-2026-16520 Genian NAC SQLi & AuthBypass Vulnerable before 4.0.175, 5.0.88, 6.0.48

Gimp

CVE-2026-18308 GIMP TIF Integer Overflow RCE in File Parser
CVE-2026-18303 GIMP TIF Parsing Stack-Buffer Overflow RCE
CVE-2026-18301 GIMP PSD Parser Integer Overflow RCE
CVE-2026-18300 GIMP HDR Parsing Integer Overflow RCE

Gstreamer

CVE-2026-18295 GStreamer MRF OOB Write RCE Vulnerability

Canonical Apport

CVE-2026-77113 Path Trvsl in Canonical Apportunpack <2.36.0 via Crash Report Keys

Aws Athena Federated Query Clickhouse Connector Deployment Template

CVE-2026-75910 Amazon Athena Query ClickHouse Connector v2026.17.1 Priv Escalation

Hakan Ozevin Wp Base Booking Appointments Services Events

CVE-2026-73402 WP Base Booking <=6.3.2 XSS Vulnerability

Revmakx Infinitewp Client

CVE-2026-74011 InfiniteWP Client 1.13.9 Blind SQLi via Improper Neutralization

Lxml

CVE-2026-49825 lxml <6.1.1: Missing xlink:href in link_attrs Enables URL Bypass (SVG/MathML)

Repute Infosystems

CVE-2026-68566 Unauth SQL Injection in BP Appointment Booking Pro <=6.0.2

Red Hat Acm

CVE-2026-66788 Lighthouse Namespace Injection for Unauthorized EndpointSlice/ServiceImport
CVE-2026-73137 RHACM multicloud-operators-subscription: privilege escalation allows exfil
CVE-2026-66787 RedHat AMK Lighthouse IP validation flaw enabling MITM
CVE-2026-66785 Red Hat Submariner Unauthorized Network Traffic Redirection Vulnerability