21 vulnerabilities across 15 products scored HIGH or above on August 26, 2026.

  • 🟣 EMERGENCY: 1
  • 🟠 HIGH: 20

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-76904 (geotools/geotools) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-08-21 bulletin.
  • [UPGRADED] CVE-2026-72843 (evershopcommerce/evershop) — F1: exploitable → functional, AAS: 10.2 → 12.2 (HIGH → CRITICAL). Originally in 2026-08-20 bulletin.

🟣 [EMERGENCY] gitea/gitea

1 CVE | CVSS 3.1: 9.8 | AAS 17.2

  • cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*

Gitea self-hosted Git service versions prior to 1.27.1 are affected by one critical vulnerability (CVE-2026-60004, CVSS 9.8) that allows remote code execution through the diffpatch API by way of Git hook installation. This vulnerability is confirmed exploited in the wild, making it an immediate priority for any organization running a self-hosted Gitea instance.

Administrators should upgrade to Gitea 1.27.1 or later without delay. If immediate patching is not possible, restrict or disable access to the diffpatch API endpoint and audit Git hook configurations for unauthorized modifications. Refer to the vendor advisory at blog.gitea.com for full details and upgrade instructions.

Vendor Advisory

🟠 [HIGH] ubiquiti_inc/unifi_os_server

4 CVEs | CVSS 3.1: 10.0 | AAS 10.8

  • cpe:2.3:a:ubiquiti_inc:unifi_os_server:*:*:*:*:*:*:*:*

Ubiquiti UniFi OS Server is affected by four vulnerabilities (CVSS up to 10.0), including at least one critical CRLF injection flaw that allows a network-adjacent attacker to bypass authentication on affected UniFi OS devices. These issues pose a serious risk to any organization relying on UniFi infrastructure for network management, as successful exploitation could grant unauthorized administrative access.

Administrators should review Ubiquiti Security Advisory Bulletin 067 immediately, apply all available firmware updates, and restrict management interface access to trusted networks. Audit device logs for signs of unauthorized access, particularly any anomalous authentication activity.

Vendor Advisory

🟠 [HIGH] veeam/one

1 CVE | CVSS 4.0: 9.3 | AAS 10.4

  • cpe:2.3:a:veeam:one:*:*:*:*:*:*:*:*

Veeam ONE is affected by one high-severity vulnerability (CVE-2026-65641, CVSS 9.3) that allows an unauthenticated network attacker to coerce SMB authentication from the service account. This could enable credential relay or capture attacks, particularly dangerous in environments where Veeam ONE service accounts hold elevated domain privileges, making it a priority for any organization using this monitoring platform.

Administrators should apply the patch documented in Veeam KB4905 immediately. As interim mitigations, consider restricting outbound SMB traffic from Veeam ONE servers, enforcing SMB signing, and ensuring service accounts follow least-privilege principles.

Vendor Advisory

🟠 [HIGH] ubiquiti_inc/unifi_protect_application

2 CVEs | CVSS 3.1: 10.0 | AAS 10.3

  • cpe:2.3:a:ubiquiti_inc:unifi_protect_application:*:*:*:*:*:*:*:*

Ubiquiti UniFi Protect Application is affected by two critical vulnerabilities (CVSS up to 10.0), including at least one input validation flaw that allows a network-adjacent attacker to execute arbitrary commands on the host device. Organizations using UniFi Protect for physical security surveillance should treat this as urgent, as full device compromise could grant attackers access to camera feeds, recordings, and the underlying operating system.

Administrators should apply the firmware updates referenced in Ubiquiti Security Advisory Bulletin 067 immediately and ensure UniFi Protect management interfaces are not exposed to untrusted network segments. Review device access logs for any signs of exploitation or unauthorized command execution.

Vendor Advisory

🟠 [HIGH] vesoft-inc/nebula

1 CVE | CVSS 4.0: 9.3 | AAS 10.2

  • cpe:2.3:a:vesoft-inc:nebula:*:*:*:*:*:*:*:*

NebulaGraph, the open-source distributed graph database by vesoft-inc, is affected by one high-severity vulnerability (CVE-2026-81032, CVSS 9.3) in which each daemon exposes an unauthenticated HTTP service bound to all interfaces by default, allowing any network attacker to read and write runtime configuration flags without any authentication or access controls. Exposed data includes sensitive values such as certificate paths and other internal configuration, and the write capability could allow an attacker to manipulate daemon behavior at runtime.

Organizations running NebulaGraph should immediately restrict network access to the web service ports using firewall rules, binding the service to localhost or a trusted management interface only. Monitor the vendor’s GitHub repository for a patched release and audit logs for any unauthorized access to the configuration endpoints.

Vendor Advisory

🟠 [HIGH] themefusion/avada_(fusion)_builder

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:themefusion:avada_fusion_builder:*:*:*:*:*:*:*:*

The Avada (Fusion) Builder plugin for WordPress, used alongside the popular Avada theme, is affected by one critical vulnerability (CVE-2026-18431, CVSS 9.8) that allows unauthenticated attackers to write arbitrary files to the server through chained authorization and input validation weaknesses. Successful exploitation enables remote code execution via crafted PHP files, posing a complete site takeover risk to any WordPress installation running Avada theme versions through 7.16 with Fusion Builder versions through 3.16.

Site administrators should update both the Avada theme and Fusion Builder plugin immediately by consulting the Avada changelog. Conduct a filesystem audit for any unexpected PHP files, review web server access logs for exploitation attempts, and consider deploying a web application firewall rule to block unauthenticated file upload requests as an interim measure.

Vendor Advisory

🟠 [HIGH] kyverno/kyverno

1 CVE | CVSS 3.1: 9.6 | AAS 9.9

  • cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*

Kyverno, the widely used Kubernetes policy engine, is affected by one high-severity vulnerability (CVE-2026-54523, CVSS 9.6) in versions 1.18.0 through 1.18.1 where the NamespacedMutatingPolicy CEL compiler fails to enforce namespace scope, allowing a namespace-scoped policy author to generate resources in arbitrary namespaces via the generator library. This effectively breaks Kubernetes namespace isolation boundaries, enabling privilege escalation across namespaces in any cluster relying on Kyverno for policy enforcement.

Teams running Kyverno 1.18.x should upgrade to version 1.18.2 or later immediately. Audit existing NamespacedMutatingPolicy resources for any use of generator.apply targeting foreign namespaces, and review cluster activity logs for unexpected cross-namespace resource creation.

Vendor Advisory

🟠 [HIGH] seaweedfs/seaweedfs

2 CVEs | CVSS 4.0: 8.7 | AAS 9.6

  • cpe:2.3:a:seaweedfs:seaweedfs:*:*:*:*:*:*:*:* (>= 3.88, < 4.40)

SeaweedFS, the open-source distributed storage system, is affected by two high-severity vulnerabilities (CVSS up to 8.7) in versions 4.39 and earlier, including at least one critical IAM bypass where the S3 API accepts external OIDC JWTs directly via the Authorization header and maps them to IAM roles without enforcing trust policies. This allows a federated user to assume roles they are not authorized to hold, bypassing the access controls that the standard STS AssumeRoleWithWebIdentity path correctly enforces.

Organizations using SeaweedFS with S3-compatible API access and OIDC federation should update to the patched version immediately and audit IAM role assumption logs for any unauthorized role bindings. As an interim measure, restrict direct S3 bearer token authentication and enforce all federated access through the STS AssumeRoleWithWebIdentity path.

Vendor Advisory

🟠 [HIGH] open-metadata/openmetadata

1 CVE | CVSS 4.0: 8.5 | AAS 9.6

  • cpe:2.3:a:open-metadata:openmetadata:*:*:*:*:*:*:*:*

OpenMetadata, the open-source data governance and metadata platform, is affected by one high-severity vulnerability (CVE-2026-81029, CVSS 8.5) where the SAML, OIDC, and OAuth2 authentication handlers accept an attacker-controlled post-login redirect URL without validating it against registered destinations, then append the freshly issued JWT along with the user’s email and name to that URL. This enables an open redirect token theft attack where any authenticated user clicking a crafted login link would have their session token silently exfiltrated to an attacker-controlled server.

Organizations running OpenMetadata with federated authentication should monitor the vendor’s GitHub repository for a patched release and apply it immediately. In the interim, deploy a reverse proxy rule to restrict or strip the callback parameter on authentication endpoints, and audit access logs for redirect URLs pointing to external domains.

Vendor Advisory

🟠 [HIGH] cozmoslabs/translatepress_–_translate_multilingual_sites_with_ai_translation

1 CVE | CVSS 3.1: 9.8 | AAS 9.6

  • cpe:2.3:a:cozmoslabs:translatepress_translate_multilingual_sites_with_ai_translation:*:*:*:*:*:*:*:*

The TranslatePress plugin for WordPress is affected by one critical vulnerability (CVE-2026-19632, CVSS 9.8) in all versions through 3.3.1, where the unauthenticated AJAX action trp_get_translations_regular exposes sensitive data from the translation dictionary table, including plaintext administrator password-reset URLs with reset keys and login parameters. This enables complete administrator account takeover on any WordPress site running the affected plugin without requiring any authentication.

Site administrators should update TranslatePress to a patched version immediately and invalidate any outstanding password reset tokens. Audit user accounts for unauthorized access, purge the translation dictionary of any cached sensitive URLs, and consider restricting unauthenticated access to WordPress AJAX endpoints as a defense-in-depth measure.

Vendor Advisory

🟠 [HIGH] stalwartlabs/stalwart

1 CVE | CVSS 4.0: 8.5 | AAS 9.6

  • cpe:2.3:a:stalwartlabs:stalwart:*:*:*:*:*:*:*:*

Stalwart Mail Server is affected by one high-severity vulnerability (CVE-2026-81036, CVSS 8.5) where the OAuth implementation in its default configuration fails to validate redirect URIs against registered client destinations, as the validation routine bypasses all checks when client authentication is disabled — which is the shipped default. This allows an attacker to supply an arbitrary redirect URL during the OAuth authorization flow, capturing authorization codes and enabling account takeover of any user who completes the login prompt.

Administrators running Stalwart Mail Server should monitor the vendor’s GitHub repository for a patched release and apply it immediately. As a critical interim mitigation, enable client-authentication requirements in the OAuth configuration to activate redirect URI validation, and audit OAuth authorization logs for any redirects to unrecognized external domains.

Vendor Advisory

🟠 [HIGH] ubiquiti_inc/unifi_access_application

2 CVEs | CVSS 3.1: 9.9 | AAS 9.2

  • cpe:2.3:a:ubiquiti_inc:unifi_access_application:*:*:*:*:*:*:*:*

Ubiquiti UniFi Access Application, used for physical access control systems, is affected by two critical vulnerabilities (CVSS up to 9.9), including at least one input validation flaw that allows a low-privileged network attacker to execute arbitrary commands on the host device. Organizations using UniFi Access for door entry and physical security management face significant risk, as exploitation could compromise access control decisions and the underlying infrastructure.

Administrators should apply the firmware updates detailed in Ubiquiti Security Advisory Bulletin 067 immediately and ensure UniFi Access management interfaces are isolated to trusted management networks. Audit device logs for signs of unauthorized command execution and review accounts for any unexpected privilege changes.

Vendor Advisory

🟠 [HIGH] senaite/senaite.core

1 CVE | CVSS 3.1: 9.8 | AAS 9.1

  • cpe:2.3:a:senaite:senaite.core:*:*:*:*:*:*:*:*

SENAITE.CORE, the core framework of the SENAITE laboratory information management system, is affected by one critical vulnerability (CVE-2026-54569, CVSS 9.8) in versions 2.0.0 through 2.6.0 where multiple JSON API routes lack authorization checks and allow unsafe evaluation, enabling unauthenticated remote code execution through a simple two-request chain. Healthcare laboratories and research facilities running SENAITE are at severe risk, as exploitation could compromise sensitive patient data, test results, and the underlying server infrastructure.

Administrators should apply the patch referenced in the vendor’s GitHub pull request immediately and restrict network access to the SENAITE JSON API endpoints. Audit web server logs for unauthorized requests to the update, update_many, remove, doActionFor, and getusers API routes, and conduct a full compromise assessment on any internet-exposed instances.

Vendor Advisory

🟠 [HIGH] rustdesk/rustdesk

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:rustdesk:rustdesk:*:*:*:*:*:*:*:* (< 1.4.7)

RustDesk, the open-source remote desktop application, is affected by one high-severity vulnerability (CVE-2026-73108, CVSS 8.7) in versions prior to 1.4.7 where the BytesCodec decoder trusts an attacker-controlled payload length from the frame header before authentication, allowing unauthenticated attackers to trigger speculative memory allocations of up to 1 GB per connection. By opening concurrent TCP connections with crafted headers, an attacker can rapidly exhaust server memory and cause a denial of service against any exposed RustDesk relay or client.

Organizations using RustDesk for remote access should upgrade to version 1.4.7 or later immediately. As an interim measure, apply connection rate limiting and monitor memory consumption on RustDesk-facing services to detect exploitation attempts.

Vendor Advisory

🟠 [HIGH] kimai/kimai

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:*

Kimai, the open-source time-tracking application, is affected by one high-severity vulnerability (CVE-2026-80196, CVSS 8.7) in versions prior to 2.58.0 where password reset links remain valid even after the user has changed their password, because the LoginLink signature is bound only to the user ID and does not incorporate the password hash. An attacker who intercepts or retrieves a cached reset link can reuse it up to two additional times within a one-hour window to authenticate as the victim, bypassing any password change the legitimate user has made.

Organizations running Kimai should upgrade to version 2.58.0 or later immediately. Review email and web server logs for reuse of password reset URLs, and advise users who recently reset their passwords to verify their account activity for unauthorized access.

Vendor Advisory