10 vulnerabilities across 4 products scored HIGH or above on August 01, 2026.

  • 🟠 HIGH: 10

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-65921 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin.
  • [UPGRADED] CVE-2026-66014 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin.
  • [UPGRADED] CVE-2026-65617 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin.

🟠 [HIGH] freerdp/freerdp

6 CVEs | CVSS 4.0: 9.4 | AAS 10.0

  • cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* (< 3.29.0)

FreeRDP versions prior to 3.29.0 are affected by six vulnerabilities, including multiple high-severity issues. The most critical is a heap buffer overflow in the clipboard virtual channel where a malicious RDP server can send oversized clipboard response data, corrupting heap memory and potentially enabling remote code execution when a user pastes content. Additional flaws across this batch carry a maximum CVSS 4.0 score of 9.4.

Organizations using FreeRDP clients on Windows or other platforms for remote desktop connectivity should prioritize this update immediately, as the lead vulnerability is considered exploitable and requires only that a user connect to a malicious or compromised RDP server. Upgrade to FreeRDP 3.29.0 or later and review the vendor security advisory at the FreeRDP GitHub security page for full details on all six CVEs.

Vendor Advisory

🟠 [HIGH] gitpython-developers/gitpython

2 CVEs | CVSS 4.0: 9.3 | AAS 9.7

  • cpe:2.3:a:gitpython-developers:gitpython:*:*:*:*:*:*:*:* (< 3.1.51)

GitPython version 3.1.50 is affected by two vulnerabilities, including multiple unsafe-option gate bypasses rated at a maximum CVSS 4.0 of 9.3. The lead issue allows attackers to smuggle malicious Git options such as –upload-pack through the safety filter by using joined short-option syntax like -u, which the gate fails to recognize. When applications pass attacker-influenced input to operations like Repo.clone_from with the default allow_unsafe_options=False setting, this bypass can result in arbitrary command execution during Git clone operations.

Any application or service that uses GitPython to perform Git operations with user-supplied input should treat this as a high-priority update. Upgrade to GitPython 3.1.51 immediately and review the vendor advisory on the GitPython GitHub security page for complete details on both CVEs.

Vendor Advisory

🟠 [HIGH] tigroumeow/ai_engine_–_the_chatbot,ai_framework&_mcp_for_wordpress

1 CVE | CVSS 3.1: 8.8 | AAS 9.6

  • cpe:2.3:a:tigroumeow:ai_engine_the_chatbot_ai_framework_mcp_for_wordpress:*:*:*:*:*:*:*:* (< 3.6.6)

The AI Engine plugin for WordPress, versions up to and including 3.6.5, contains a cross-site request forgery vulnerability tracked as CVE-2026-15988 with a CVSS 3.1 score of 8.8. Due to missing nonce validation on the reauth_for_authorize function, unauthenticated attackers can trick a site administrator into triggering a request that creates a new administrator account with attacker-controlled credentials, effectively enabling full site takeover.

WordPress site operators running this AI chatbot and MCP framework plugin should update beyond version 3.6.5 immediately. Given the low complexity of exploitation and the potential for complete administrative compromise, this should be treated as a high-priority remediation item for any site with this plugin installed.

Vendor Advisory

🟠 [HIGH] axios/axios

1 CVE | CVSS 4.0: 8.3 | AAS 9.4

  • cpe:2.3:a:axios:axios:*:*:*:*:*:*:*:* (>= 1.0.0)

Axios for Node.js contains a proxy configuration poisoning vulnerability tracked as CVE-2026-67320 with a CVSS 4.0 score of 8.3. When request interceptors use common patterns like spread syntax or Object.assign to copy configuration, the hardened null-prototype object is converted back to a regular object, allowing an attacker to inject proxy settings via prototype pollution and route outbound HTTP requests through an attacker-controlled proxy, potentially exposing sensitive data in transit.

Teams running Axios in Node.js server-side deployments should review the vendor commit and update to a patched version as soon as one is available. Applications that use request interceptors with object-spreading patterns are particularly at risk and should be audited promptly.

Vendor Advisory