29 vulnerabilities across 15 products scored HIGH or above on August 06, 2026.

  • 🟠 HIGH: 29

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-67305 (freerdp/freerdp) — F1: exploitable → functional, AAS: 10.0 → 12.0 (HIGH → CRITICAL). Originally in 2026-08-01 bulletin.
  • [UPGRADED] CVE-2026-15988 (suspended_starter/ai_engine) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-08-01 bulletin.
  • [UPGRADED] CVE-2026-67320 (axios/axios) — F1: theoretical → poc, AAS: 9.4 → 11.9 (HIGH → HIGH). Originally in 2026-08-01 bulletin.
  • [UPGRADED] CVE-2026-48449 (adobe/campaign) — F1: exploitable → functional, AAS: 10.2 → 12.6 (HIGH → CRITICAL). Originally in 2026-07-30 bulletin.

🟠 [HIGH] wso2/wso2_api_manager

2 CVEs | CVSS 3.1: 9.8 | AAS 11.4

  • cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*

WSO2 API Manager is affected by 2 vulnerabilities, including at least one critical-severity issue rated CVSS 9.8. The lead vulnerability involves insufficient token scope restrictions, allowing a low-privileged authenticated user to escalate privileges by reusing their token to invoke Admin REST APIs, potentially achieving full administrative account takeover. These vulnerabilities are considered exploitable in the wild.

Organizations running WSO2 API Manager should treat this as a high-priority remediation item. Security teams should review the vendor advisory at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/ and apply available patches or mitigations immediately. In the interim, restrict API access to trusted networks and audit logs for unauthorized admin API calls from low-privileged accounts.

Vendor Advisory

🟠 [HIGH] eclipse_foundation/eclipse_glassfish

1 CVE | CVSS 3.1: 9.6 | AAS 11.2

  • cpe:2.3:a:eclipse:eclipse_glassfish:*:*:*:*:*:*:*:* (>= 8.0.0, < 8.0.4)

Eclipse GlassFish versions 8.0.x before 8.0.4 are affected by a critical vulnerability (CVE-2026-12605, CVSS 9.6) that chains CSRF and SSRF flaws in the DownloadServlet ContentSources component. If an authenticated admin visits a malicious page, the attack leaks the admin REST token to an attacker-controlled host, enabling full unauthenticated takeover of the GlassFish domain until the token expires.

Organizations running Eclipse GlassFish 8.0.x should upgrade to version 8.0.4 or later immediately. Until patching is complete, limit Admin Console access to trusted networks, avoid browsing untrusted sites while authenticated to the console, and monitor for unexpected outbound requests from the GlassFish server. Review the vendor advisory at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/127 for full details.

Vendor Advisory

🟠 [HIGH] ggml-org/llama.cpp

7 CVEs | CVSS 4.0: 9.2 | AAS 11.0

  • cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:* (>= b1886, < b7446)

llama.cpp builds b4882 through b9058 are affected by 7 vulnerabilities, including multiple high-severity issues with a maximum CVSS score of 9.2. The lead vulnerability is a heap buffer overflow in the KV cache state restore path, where insufficient overflow checking in the state_read_data() function allows attackers with write access to the slot save directory to craft malicious state files that corrupt heap memory and write attacker-controlled bytes past buffer boundaries.

Teams deploying llama.cpp for LLM inference should prioritize this update, particularly in environments where state save/restore functionality is enabled or the slot_save_path directory is accessible to untrusted users. Review the vendor advisory at https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches for available patches and upgrade to a fixed build as soon as possible. In the interim, restrict file system permissions on the slot save directory and audit any externally sourced state files.

Vendor Advisory

🟠 [HIGH] wgdashboard/wgdashboard

3 CVEs | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:wgdashboard:wgdashboard:*:*:*:*:*:*:*:*

WGDashboard version 4.3.2 and earlier is affected by 3 vulnerabilities, including multiple critical-severity issues with a maximum CVSS score of 9.8. The lead vulnerability is a Server-Side Template Injection flaw that allows authenticated attackers to execute arbitrary code with root privileges, representing a complete compromise of the underlying host. A public proof-of-concept exploit is available, increasing the likelihood of active exploitation.

Organizations using WGDashboard to manage WireGuard deployments should treat this as an urgent priority given the root-level code execution impact and public exploit availability. Upgrade to a patched version immediately and review the vendor advisory at https://github.com/Stuub/WGDashboard-v4.3.2-SSTI-to-Root-RCE-PoC for details. Until a fix is applied, restrict access to the WGDashboard interface to trusted administrators only and monitor for signs of unauthorized command execution on the host.

Vendor Advisory

🟠 [HIGH] sergey/aiwu

1 CVE | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:sergey:aiwu:*:*:*:*:*:*:*:* (< 1.5.7)

The AIWU (AI Copilot Content Generator) WordPress plugin versions 1.5.6 and earlier is affected by a critical unauthenticated privilege escalation vulnerability (CVE-2026-65507, CVSS 9.8). This flaw allows remote attackers to escalate privileges without any authentication, potentially gaining full administrative control over the WordPress site.

WordPress administrators using the AIWU plugin should update to a patched version immediately or deactivate the plugin until a fix is applied. Review the vendor advisory at https://patchstack.com/database/wordpress/plugin/ai-copilot-content-generator/vulnerability/wordpress-aiwu-plugin-1-5-6-privilege-escalation-vulnerability for remediation details. Given the unauthenticated nature of this vulnerability, exposed sites should be audited for signs of compromise, including unauthorized user accounts or role changes.

Vendor Advisory

🟠 [HIGH] wso2/wso2_universal_gateway

1 CVE | CVSS 3.1: 10.0 | AAS 10.7

  • cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*

WSO2 Universal Gateway is affected by a critical JWT authentication bypass vulnerability (CVE-2026-5430, CVSS 10.0) where the JWT validation mechanism accepts tokens signed with algorithms other than those explicitly configured. An attacker can craft a JWT using an unsupported algorithm that is incorrectly validated, bypassing authentication entirely and potentially achieving full administrative account takeover without any prior credentials.

Organizations using WSO2 Universal Gateway should treat this as a top-priority remediation given the maximum CVSS rating and the network-accessible, unauthenticated nature of the attack. Review the vendor advisory at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/ and apply patches immediately. Until remediation is complete, consider placing additional authentication controls in front of the gateway and monitoring for anomalous JWT usage or unexpected administrative access.

Vendor Advisory

🟠 [HIGH] apache/apr-util

2 CVEs | CVSS 3.1: 9.1 | AAS 10.5

  • cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:* (>= 1.6.0, <= 1.6.3)
  • cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:* (< 1.6.4)

Apache Portable Runtime Utility (apr-util) versions 1.6.0 through 1.6.3 is affected by 2 vulnerabilities, including multiple high-severity issues with a maximum CVSS score of 9.1. The lead vulnerability is a SQL injection flaw in the apr_dbd_oracle database provider, which could allow attackers to execute arbitrary SQL commands against backend Oracle databases used by applications built on apr-util.

This is a foundational library used by Apache HTTP Server and numerous other projects, so the blast radius extends well beyond direct apr-util deployments. Teams running applications that use apr-util with the Oracle database driver should prioritize patching immediately. Review the vendor advisory at https://lists.apache.org/thread/8xch90zogywwpo5wnsf4o088mkxy4qtf for fixed versions and apply updates across all affected systems, paying particular attention to web servers and middleware that depend on this library.

Vendor Advisory

🟠 [HIGH] flowiseai/flowise

2 CVEs | CVSS 4.0: 8.7 | AAS 10.1

  • cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*

Flowise versions through 3.1.4 are affected by 2 vulnerabilities, including multiple high-severity issues with a maximum CVSS score of 8.7. The lead vulnerability is an authentication bypass that exploits prefix-based whitelist matching in the authentication middleware, allowing unauthenticated attackers to access the OAuth2 credential refresh endpoint and trigger unauthorized token rotation against connected third-party services without any credentials.

Organizations running Flowise for AI workflow orchestration should act immediately, particularly since the vendor advisory at https://flowiseai.com/sunset indicates the product has been sunsetted, meaning patches may not be forthcoming. Teams should evaluate migrating to a supported alternative, and in the interim restrict network access to Flowise instances, place them behind an additional authentication layer, and audit OAuth2 credentials for signs of unauthorized token refresh activity.

Vendor Advisory

🟠 [HIGH] wpdreams/ajax_search_lite

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:wpdreams:ajax_search_lite:*:*:*:*:*:*:*:* (< 4.14.5)

Ajax Search Lite, a WordPress search plugin by WPDreams, versions 4.14.4 and earlier is affected by a critical unauthenticated PHP Object Injection vulnerability (CVE-2026-28139, CVSS 9.8). This flaw allows remote attackers to inject arbitrary PHP objects without any authentication, which depending on available gadget chains in the WordPress environment could lead to remote code execution, file manipulation, or full site compromise.

WordPress administrators using Ajax Search Lite should update to a patched version immediately or deactivate the plugin until a fix is applied. Review the vendor advisory at https://patchstack.com/database/wordpress/plugin/ajax-search-lite/vulnerability/wordpress-ajax-search-lite-plugin-4-14-4-php-object-injection-vulnerability for remediation guidance. Given the unauthenticated attack vector and critical severity, exposed sites should be audited for indicators of compromise including unexpected files, modified content, or unauthorized administrative accounts.

Vendor Advisory

🟠 [HIGH] nexcess/kadence_woocommerce_email_designer

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:nexcess:kadence_woocommerce_email_designer:*:*:*:*:*:*:*:* (< 1.5.20)

Kadence WooCommerce Email Designer by Nexcess, versions 1.5.19 and earlier, is affected by a critical unauthenticated privilege escalation vulnerability (CVE-2026-28005, CVSS 9.8). This flaw allows remote attackers to escalate privileges without any authentication, potentially gaining full administrative control over the WordPress site and its associated WooCommerce store.

WordPress administrators running this plugin should update to a patched version immediately or deactivate the plugin until a fix is available. Review the vendor advisory at https://patchstack.com/database/wordpress/plugin/kadence-woocommerce-email-designer/vulnerability/wordpress-kadence-woocommerce-email-designer-plugin-1-5-19-privilege-escalation-vulnerability for remediation details. Given the unauthenticated nature of the attack and the e-commerce context, affected sites should be audited for unauthorized user accounts, role changes, and any signs of order or payment data tampering.

Vendor Advisory

🟠 [HIGH] wso2/wso2_identity_server

1 CVE | CVSS 3.1: 9.4 | AAS 9.9

  • cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*

WSO2 Identity Server is affected by a critical authentication bypass vulnerability (CVE-2025-15039, CVSS 9.4) in its Conditional Authentication (Adaptive Authentication) scripting engine. The flaw allows attackers to bypass intermediate authentication steps in multi-factor authentication flows by exploiting how the script handles callbacks and re-execution of authentication challenges, ultimately gaining unauthorized access to targeted user accounts.

Organizations using WSO2 Identity Server with multi-step adaptive authentication configurations should treat this as a high-priority remediation. Review the vendor advisory at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4973/ and apply patches immediately. Until patched, audit adaptive authentication scripts for multi-step configurations that may be susceptible, review access logs for anomalous authentication patterns, and consider enforcing additional access controls at the network level.

Vendor Advisory

🟠 [HIGH] apache/cxf

2 CVEs | CVSS 3.1: 9.8 | AAS 9.9

  • cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* (< 3.6.12)
  • cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* (>= 4.0.0, < 4.1.8)
  • cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* (>= 4.2.0, < 4.2.3)

Apache CXF is affected by 2 vulnerabilities, including multiple high-severity issues with a maximum CVSS score of 9.8. The lead vulnerability is an authentication bypass in the OIDC relying-party token validation, where self-issued ID tokens can be accepted without proper enforcement of required claim checks such as issuer, subject, audience, time, and sub_jwk binding, allowing attackers to craft tokens that bypass authentication. While self-issued ID tokens are not accepted by default, deployments that have enabled this feature are directly exposed.

Organizations using Apache CXF for OIDC-based authentication should upgrade to versions 4.2.3, 4.1.8, or 3.6.12 immediately. Review the vendor advisory at https://lists.apache.org/thread/fzj8yzgfl53gclxrcdrnrx3grcpkq51j for full details and assess whether self-issued ID token validation is enabled in your configuration. Given that CXF is widely embedded in Java-based web services and middleware, teams should inventory all applications and frameworks that bundle CXF as a dependency.

Vendor Advisory

🟠 [HIGH] ffmpeg/ffmpeg

2 CVEs | CVSS 4.0: 8.5 | AAS 9.9

  • cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

FFmpeg versions 4.4 through 8.x (prior to 9.0) are affected by 2 vulnerabilities, including multiple high-severity issues with a maximum CVSS score of 8.5. The lead vulnerability is an out-of-bounds heap write in the native GoPro CineForm HD (CFHD) decoder, where the cfhd_decode() function fails to enforce width constraints during transform reconstruction, allowing remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing.

Given FFmpeg’s extremely wide deployment across media applications, transcoding pipelines, streaming services, and embedded systems, this affects a broad range of environments that process untrusted video files. Teams should upgrade to FFmpeg 9.0 or apply the fix referenced in the vendor commit at https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e as soon as possible. Until patched, consider disabling the CFHD decoder if not needed, and avoid processing untrusted AVI files with affected FFmpeg versions.

Vendor Advisory

🟠 [HIGH] decidim/decidim

1 CVE | CVSS 3.1: 8.5 | AAS 9.7

  • cpe:2.3:a:decidim:decidim:*:*:*:*:*:*:*:*

Decidim, an open-source participatory democracy framework, versions prior to 0.31.5 and version 0.32.0.rc1 are affected by a high-severity JWT cross-tenant authentication bypass vulnerability (CVE-2026-45414, CVSS 8.5). The JWT-backed API authentication fails to bind tokens to the organization selected by the current host, allowing an attacker with a valid JWT from one tenant to replay it against another tenant’s API to read participant details and access the proposal answer mutation path.

Organizations running multi-tenant Decidim deployments should upgrade to version 0.31.5 or 0.32.0.rc2 immediately, as cross-tenant data exposure and unauthorized proposal manipulation pose significant integrity and privacy risks. Review the fix at https://github.com/decidim/decidim/commit/023e206127c984a501345676e4789b31ddd115a1 for details. Until patched, monitor API access logs for cross-tenant token usage and audit any unexpected proposal modifications across tenants.

Vendor Advisory

🟠 [HIGH] datalinkdc/dinky

2 CVEs | CVSS 4.0: 9.3 | AAS 9.7

  • cpe:2.3:a:datalinkdc:dinky:*:*:*:*:*:*:*:*

Dinky, an open-source data development platform by DataLinkDC, is affected by 2 vulnerabilities, including multiple critical-severity issues with a maximum CVSS score of 9.3. The lead vulnerability is an unauthenticated arbitrary file upload via the /download/uploadFromRsByLocal endpoint, which passes user-supplied paths directly to file operations without validation. The route bypasses authentication entirely, and the only protection is a hardcoded default token value shipped in the source code, meaning anyone with network access to Dinky’s HTTP port (8888 by default) can write arbitrary files to the server.

Organizations running Dinky should treat this as an urgent priority given the trivially exploitable nature of the flaw and the publicly known default token. Immediately restrict network access to the Dinky HTTP port, change the default dinkyToken value, and monitor for unauthorized file uploads or suspicious activity. Review the vendor repository at https://github.com/DataLinkDC/dinky for available patches and upgrade as soon as a fix is released.

Vendor Advisory