14 vulnerabilities across 7 products scored HIGH or above on August 22, 2026.

  • 🟠 HIGH: 14

🟠 [HIGH] netty/netty

1 CVE | CVSS 4.0: 8.7 | AAS 10.6

  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* (< 4.1.137.final)
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* (>= 4.2.0.final, < 4.2.17.final)

Netty has one high-severity vulnerability (CVE-2026-62243, CVSS 8.7) affecting netty-handler versions 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final. The flaw disables TLS hostname verification on the OpenSSL client path when a plain X509TrustManager is used and unsafe-based trust-manager wrapping is unavailable, such as on Java 25 and later. This allows a man-in-the-middle attacker to present a certificate for a different hostname and have it accepted, undermining the confidentiality and integrity of encrypted connections. Teams running Netty-based services or clients with OpenSSL TLS providers should upgrade immediately and consult the vendor advisory at the linked GitHub security page for patched versions and mitigation guidance.

Vendor Advisory

🟠 [HIGH] nltk/nltk

8 CVEs | CVSS 4.0: 9.3 | AAS 10.2

  • cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:* (< 3.9.4)

NLTK versions before 3.9.3 are affected by eight vulnerabilities (CVSS up to 9.3), including multiple flaws in the downloader module that fail to verify file integrity after downloading packages and before extraction. This allows attackers to perform man-in-the-middle or DNS poisoning attacks to inject malicious content into downloaded NLTK data packages, which are then extracted without validation. Organizations using NLTK in data science, NLP, or machine learning pipelines should upgrade to version 3.9.3 or later immediately and review the vendor advisories linked from the GitHub security page for full details on all eight issues.

Vendor Advisory

🟠 [HIGH] westguard/ws_form_lite_–drag&_drop_contact_form_builder

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:westguard:ws_form_lite_drag_drop_contact_form_builder:*:*:*:*:*:*:*:* (< 1.10.81)

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress has one critical vulnerability (CVE-2026-4703, CVSS 9.8) affecting all versions up to and including 1.10.80. The flaw allows unauthenticated attackers to perform PHP Object Injection via deserialization of untrusted form submission meta values, which can lead to remote code execution, file access, or other severe impacts if a suitable POP chain exists in any other installed plugin or theme. WordPress administrators using this plugin should update beyond version 1.10.80 immediately and audit their sites for additional plugins that could provide an exploitable POP chain.

Vendor Advisory

🟠 [HIGH] mailgun/mailgun_for_wordpress

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:mailgun:mailgun_for_wordpress:*:*:*:*:*:*:*:*

The Mailgun for WordPress plugin has one critical vulnerability (CVE-2026-78003, CVSS 9.8) affecting versions up to and including 2.2.0. The flaw is a server-side request forgery via path traversal in the add_list() function, allowing unauthenticated attackers to make authenticated POST requests to arbitrary Mailgun API endpoints using the site’s stored API key, potentially enabling full abuse of the connected Mailgun account. WordPress administrators using this plugin should update beyond version 2.2.0 immediately and consider rotating their Mailgun API keys as a precaution.

Vendor Advisory

🟠 [HIGH] hashcat/hashcat

1 CVE | CVSS 4.0: 8.5 | AAS 9.4

  • cpe:2.3:a:hashcat:hashcat:*:*:*:*:*:*:*:*

Hashcat has one high-severity vulnerability (CVE-2026-68766, CVSS 8.5) where the tool fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options such as –outfile and –potfile-path. A crafted restore file can cause hashcat to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files like .bashrc or .profile. Security teams and penetration testers using hashcat should avoid resuming sessions from untrusted restore files, monitor the vendor’s GitHub repository for a patched release, and audit any restore files received from external sources.

Vendor Advisory

🟠 [HIGH] wwbn/avideo

1 CVE | CVSS 4.0: 8.7 | AAS 9.3

  • cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

AVideo through commit 9c39d8c8 has one high-severity authentication bypass vulnerability (CVE-2026-59808, CVSS 8.7) that allows attackers with basic upload permissions to escalate to full administrative access. The flaw chains two functions — deduplicateByEncoderQueueId() leaks video_id_hash credentials without ownership verification, and useVideoHashOrLogin() converts that hash into a passwordless login as the video owner, including administrators. Organizations running self-hosted AVideo instances should update to a commit beyond 9c39d8c8 immediately, review the vendor advisory on GitHub for remediation details, and audit access logs for signs of unauthorized privilege escalation.

Vendor Advisory

🟠 [HIGH] tecnativa/docker-socket-proxy

1 CVE | CVSS 4.0: 8.3 | AAS 9.0

  • cpe:2.3:a:tecnativa:docker-socket-proxy:*:*:*:*:*:*:*:*

Tecnativa’s docker-socket-proxy has one high-severity vulnerability (CVE-2026-78122, CVSS 8.3) where read endpoints in the /containers Docker API namespace are not properly gated when the CONTAINERS environment variable is set. Attackers with network access to the proxy can use GET requests to endpoints such as /containers/{id}/archive, /containers/{id}/export, and /containers/{id}/logs to read arbitrary files and download entire container filesystems as tar archives. Teams using docker-socket-proxy to restrict Docker socket access should review the vendor advisory for patched versions and audit their deployment configurations to ensure container API access is appropriately restricted.

Vendor Advisory