12 vulnerabilities across 6 products scored HIGH or above on August 19, 2026.

  • 🟠 HIGH: 12

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin.

🟠 [HIGH] ibm/aix

7 CVEs | CVSS 3.1: 9.9 | AAS 11.9

  • cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* (>= 7.2)
  • cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* (>= 7.3)

IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, are affected by seven vulnerabilities, including multiple critical issues up to CVSS 9.9. The most severe flaw allows a remote attacker to gain root privileges through improper authentication, and at least one vulnerability is considered exploitable. Organizations running AIX or PowerVM VIOS in their environments should treat this as a high-priority patch cycle and apply fixes immediately by reviewing the vendor advisory at https://www.ibm.com/support/pages/node/7283858.

Vendor Advisory

🟠 [HIGH] verbb/formie

1 CVE | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:verbb:formie:*:*:*:*:*:*:*:*

Formie, a popular form-building plugin for Craft CMS, contains a critical server-side template injection vulnerability rated CVSS 9.8 that allows unauthenticated remote code execution. An attacker can inject Twig template syntax through request-controlled Hidden field inputs such as User Agent or Referer headers, which are passed unsanitized into the Twig rendering layer during front-end form display. Any site running Formie versions prior to 3.1.27 with publicly accessible forms using affected Hidden field types should upgrade immediately by reviewing the fix at https://github.com/verbb/formie/commit/d3b9d15290405e484e3b5c91c5d8fab93047f9b2.

Vendor Advisory

🟠 [HIGH] sgoudelis/ground-station

1 CVE | CVSS 3.1: 9.8 | AAS 10.6

  • cpe:2.3:a:sgoudelis:ground-station:*:*:*:*:*:*:*:* (< 0.4.13)

Ground Station, a browser-based satellite tracking and SDR reception suite, contains a critical unauthenticated path traversal vulnerability rated CVSS 9.8 in versions prior to 0.4.13. The save-waterfall-snapshot Socket.IO command passes attacker-controlled input directly into os.path.join without sanitization, allowing a remote attacker to write arbitrary base64-decoded content to any location on the filesystem, which can lead to remote code execution. Organizations running Ground Station instances should upgrade to version 0.4.13 or later immediately and review the fix at https://github.com/sgoudelis/ground-station/commit/5649905f1021155933463a54a76030924adffb9d.

Vendor Advisory

🟠 [HIGH] electerm/electerm

1 CVE | CVSS 3.1: 8.8 | AAS 10.1

  • cpe:2.3:a:electerm:electerm:*:*:*:*:*:*:*:*

Electerm, an open-source terminal and SSH/SFTP client, contains a command injection vulnerability rated CVSS 8.8 in versions prior to 3.11.11. A malicious SSH or SFTP server can supply crafted filenames containing shell metacharacters that are interpolated unsanitized into OS commands during file transfer, rename, copy, or move operations, allowing arbitrary command execution on the victim’s local system. Users of electerm should upgrade to version 3.11.11 or later and review the fix at https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42.

Vendor Advisory

🟠 [HIGH] libfuse/sshfs

1 CVE | CVSS 3.1: 9.3 | AAS 10.1

  • cpe:2.3:a:libfuse:sshfs:*:*:*:*:*:*:*:* (< 3.7.6)

SSHFS, the widely used FUSE-based SSH filesystem client maintained by libfuse, contains a critical symlink traversal vulnerability rated CVSS 9.3 in versions prior to 3.7.6. A rogue SFTP server can return crafted symlink targets containing absolute paths or parent-directory traversal components that bypass the transform_symlinks mitigation and are resolved by the client kernel against the local filesystem, potentially allowing read or write access to arbitrary local files. Anyone mounting remote filesystems via SSHFS should upgrade to version 3.7.6 or later and review the fix at https://github.com/libfuse/sshfs/commit/bcd132f17ccf1b8592a229df797c9b08883fec26.

Vendor Advisory

🟠 [HIGH] thorsten/phpmyfaq

1 CVE | CVSS 4.0: 8.8 | AAS 9.2

  • cpe:2.3:a:thorsten:phpmyfaq:*:*:*:*:*:*:*:* (>= 3.1.0, < 4.1.7)

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability rated CVSS 8.8 in the LDAP authentication module. When LDAP authentication is enabled, a successful LDAP bind unconditionally sets the local account status to active, allowing users whose phpMyFAQ accounts have been administratively blocked to bypass that restriction and regain full access by authenticating through LDAP. Organizations running phpMyFAQ with LDAP authentication should update beyond version 4.1.6 immediately and review the advisory at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8pr3-q3cw-q234.

Vendor Advisory