13 vulnerabilities across 5 products scored HIGH or above on August 01, 2026.

  • 🟠 HIGH: 13

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-65921 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin.
  • [UPGRADED] CVE-2026-66014 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin.
  • [UPGRADED] CVE-2026-65617 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin.

🟠 [HIGH] freerdp/freerdp

6 CVEs | CVSS 4.0: 9.4 | AAS 10.0

  • cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* (< 3.29.0)

FreeRDP versions prior to 3.29.0 are affected by six vulnerabilities, including multiple high-severity issues. The most critical is a heap buffer overflow in the clipboard virtual channel that allows a malicious RDP server to achieve remote code execution when a user pastes content, carrying a CVSS 4.0 score of 9.4. Additional flaws span multiple attack surfaces within the FreeRDP client.

Organizations using FreeRDP for remote desktop connectivity, particularly on Windows, should treat this as a high-priority update. Security teams should upgrade to FreeRDP 3.29.0 or later immediately and review the vendor advisory at the FreeRDP GitHub security page for full details on all six CVEs.

Vendor Advisory

🟠 [HIGH] arcadedata/arcadedb

3 CVEs | CVSS 4.0: 9.3 | AAS 9.7

  • cpe:2.3:a:arcadedata:arcadedb:*:*:*:*:*:*:*:* (< 26.7.2)

ArcadeDB versions prior to 26.7.2 are affected by three vulnerabilities, including multiple high-severity authorization bypass flaws. The most critical, with a CVSS 4.0 score of 9.3, allows any user with database access to execute arbitrary JavaScript code via SQL DEFINE FUNCTION statements, completely bypassing scripting restrictions intended to be administrator-only.

Organizations running ArcadeDB should upgrade to version 26.7.2 or later immediately, as these flaws are exploitable by any authenticated database user to achieve arbitrary code execution. Review the vendor advisory on the ArcadeData GitHub security page for complete details on all three CVEs.

Vendor Advisory

🟠 [HIGH] gitpython-developers/gitpython

2 CVEs | CVSS 4.0: 9.3 | AAS 9.7

  • cpe:2.3:a:gitpython-developers:gitpython:*:*:*:*:*:*:*:* (< 3.1.51)

GitPython version 3.1.50 is affected by two vulnerabilities, including multiple unsafe-option gate bypasses with a maximum CVSS 4.0 score of 9.3. The most critical flaw allows attackers to smuggle malicious options such as upload-pack helpers through joined short-option forms like -u, bypassing security controls even when allow_unsafe_options is set to False, ultimately enabling arbitrary command execution during clone operations.

Any application or automation pipeline using GitPython that passes user-influenced options to Repo.clone_from or similar methods should upgrade to version 3.1.51 immediately. Review the vendor advisory on the GitPython GitHub security page for full details on both CVEs.

Vendor Advisory

🟠 [HIGH] tigroumeow/ai_engine_–_the_chatbot,ai_framework&_mcp_for_wordpress

1 CVE | CVSS 3.1: 8.8 | AAS 9.6

  • cpe:2.3:a:tigroumeow:ai_engine_the_chatbot_ai_framework_mcp_for_wordpress:*:*:*:*:*:*:*:* (< 3.6.6)

The AI Engine plugin for WordPress, versions up to and including 3.6.5, contains a cross-site request forgery vulnerability tracked as CVE-2026-15988 with a CVSS 3.1 score of 8.8. Due to missing nonce validation on the reauth_for_authorize function, unauthenticated attackers can trick a site administrator into triggering the creation of a new administrator account with attacker-controlled credentials, leading to full site compromise.

WordPress site owners running this plugin should update beyond version 3.6.5 immediately and audit existing administrator accounts for any unauthorized additions. Review the vendor advisory for technical details on the affected code path.

Vendor Advisory

🟠 [HIGH] axios/axios

1 CVE | CVSS 4.0: 8.3 | AAS 9.4

  • cpe:2.3:a:axios:axios:*:*:*:*:*:*:*:* (>= 1.0.0)

Axios in Node.js deployments is affected by CVE-2026-67320, a proxy configuration hijacking vulnerability with a CVSS 4.0 score of 8.3. When request interceptors use common spread or Object.assign patterns to copy configuration, they inadvertently strip the null-prototype hardening that axios applies, allowing an attacker to route outbound HTTP requests through an attacker-controlled proxy via prototype pollution of the proxy property.

Teams running Axios in server-side Node.js applications, particularly those using request interceptors, should update to the patched version referenced in the vendor commit and review any custom interceptor logic that copies configuration objects. See the vendor advisory for full details.

Vendor Advisory