12 vulnerabilities across 7 products scored HIGH or above on August 14, 2026.

  • 🟠 HIGH: 12

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin.
  • [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin.
  • [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin.
  • [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin.
  • [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin.
  • [UPGRADED] CVE-2026-71558 (apache/fory) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-07 bulletin.
  • [UPGRADED] CVE-2026-62873 (microsoft/microsoft_365_admin_center) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-08-07 bulletin.

🟠 [HIGH] laravel/socialite

1 CVE | CVSS 4.0: 9.2 | AAS 10.6

  • cpe:2.3:a:laravel:socialite:*:*:*:*:*:*:*:* (>= 5.6.0)

Laravel Socialite, the popular OAuth authentication library for Laravel applications, is affected by one high-severity vulnerability (CVE-2026-73683, CVSS 9.2). The Facebook provider fails to validate the nonce claim in OIDC id_tokens, allowing unauthenticated attackers to replay captured tokens and bypass authentication entirely to gain unauthorized access to user accounts. Any application using Socialite’s Facebook login flow should treat this as urgent — review the vendor advisory at the Socialite GitHub repository for patched versions and update immediately, and audit authentication logs for any signs of token replay activity.

Vendor Advisory

🟠 [HIGH] getgrav/grav

5 CVEs | CVSS 4.0: 9.3 | AAS 9.9

  • cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*

Grav CMS by getgrav is affected by five high-severity vulnerabilities, including at least one rated CVSS 9.3, spanning API key scope bypass, privilege escalation, and unauthorized account manipulation. The most critical issue allows an attacker holding a scoped API key minted on a super-admin account to bypass scope restrictions and promote arbitrary users to full super-admin privileges, effectively compromising the entire CMS installation. Organizations running Grav with the API plugin should update to version 1.0.13 or later immediately, review the vendor advisory at the linked GitHub security page, and audit API key assignments and user privilege changes for signs of exploitation.

Vendor Advisory

🟠 [HIGH] zephyrproject/zephyr

2 CVEs | CVSS 3.1: 8.8 | AAS 9.6

  • cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*

Zephyr RTOS is affected by two high-severity vulnerabilities, including at least one rated CVSS 8.8, involving unsafe kernel object disposal in the userspace subsystem. The most critical issue stems from the dynamic object cleanup path failing to cancel armed timers before freeing their backing memory, leaving a dangling pointer in the global timeout queue that can be exploited for use-after-free attacks, potentially leading to arbitrary code execution on embedded devices. Teams deploying Zephyr in IoT or embedded environments should apply the fix referenced in the vendor commit immediately and review any applications using dynamically allocated kernel timers for exposure.

Vendor Advisory

🟠 [HIGH] siyuan-note/siyuan

1 CVE | CVSS 4.0: 9.9 | AAS 9.3

  • cpe:2.3:a:siyuan-note:siyuan:*:*:*:*:*:*:*:*

SiYuan note-taking application versions 3.7.2 and earlier are affected by one high-severity SQL injection vulnerability (CVE-2026-72811, CVSS 9.9) in the backlink and mention search functionality. The flaw arises from incomplete input sanitization in the search query construction, where single quotes are not escaped, allowing unauthenticated or low-privileged users on the publish surface to inject arbitrary SQL and potentially extract or manipulate the underlying database. Organizations and individuals using SiYuan, particularly with any network-exposed or shared instances, should upgrade beyond version 3.7.2 immediately and review the vendor advisory at the linked GitHub security page for remediation details.

Vendor Advisory

🟠 [HIGH] microsoft/microsoft_edge_(chromium-based)

1 CVE | CVSS 3.1: 8.3 | AAS 9.1

  • cpe:2.3:a:microsoft:microsoft_edge_chromium-based:*:*:*:*:*:*:*:*

Microsoft Edge (Chromium-based) is affected by one high-severity heap-based buffer overflow vulnerability (CVE-2026-72970, CVSS 8.3) that allows an unauthorized attacker to achieve remote code execution over a network. Given Edge’s massive enterprise deployment footprint, this issue poses significant risk to any organization relying on it as a primary browser. Administrators should apply the latest Microsoft Edge update immediately via standard update channels and consult the MSRC advisory for full version and patch details.

Vendor Advisory

🟠 [HIGH] semaphoreui/semaphore

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:semaphoreui:semaphore:*:*:*:*:*:*:*:* (< 2.18.20)

Semaphore UI, the open-source automation and deployment platform, versions prior to 2.18.20 are affected by one high-severity OS command injection vulnerability (CVE-2026-73682, CVSS 8.7) in the repository git_url handling. Authenticated users with Manager or Owner roles can exploit git’s –upload-pack option to inject arbitrary shell commands, achieving full remote code execution on the Semaphore server host. Organizations running Semaphore should upgrade to version 2.18.20 or later immediately, audit repository URL configurations for suspicious entries, and review project role assignments to limit exposure.

Vendor Advisory

🟠 [HIGH] limesurvey/limesurvey

1 CVE | CVSS 4.0: 8.5 | AAS 9.1

  • cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*

LimeSurvey Community Edition version 7.0.5 is affected by one high-severity authenticated reflected cross-site scripting vulnerability (CVE-2026-63361, CVSS 8.5) in the HTML editor popup endpoint. The text and name query parameters rely on insufficient blacklist-based sanitization without proper output encoding, allowing attackers to execute arbitrary JavaScript in the context of an authenticated user’s session, potentially leading to session hijacking or administrative account compromise. Organizations using LimeSurvey should update to a patched release as soon as one is available, consult the Fluid Attacks advisory for technical details, and consider restricting access to the survey administration interface in the interim.

Vendor Advisory