6 vulnerabilities across 6 products scored HIGH or above on August 29, 2026.

  • 🟠 HIGH: 6

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin.

🟠 [HIGH] coderaiser/cloudcmd

1 CVE | CVSS 4.0: 9.3 | AAS 10.5

  • cpe:2.3:a:coderaiser:cloudcmd:*:*:*:*:*:*:*:* (< 19.20.2)

Cloud Commander by coderaiser, versions prior to 19.20.2, is affected by one critical-severity vulnerability (CVE-2026-82460, CVSS 9.3 HIGH). The flaw is a directory traversal in the REST file-operation and markdown endpoints that allows attackers to read, write, move, or copy arbitrary files outside the intended root directory due to insufficient path normalization. This vulnerability is considered exploitable in the wild.

Teams running Cloud Commander as a web-based file manager should treat this as an urgent priority, particularly in environments where the application is internet-facing or handles sensitive data. Upgrade immediately to version 19.20.2 or later, and review the vendor advisory at the project’s GitHub repository for additional details. As a temporary mitigation, restrict network access to Cloud Commander instances and audit file system activity for signs of unauthorized path traversal.

Vendor Advisory

🟠 [HIGH] jeremyevans/rodauth

1 CVE | CVSS 4.0: 9.4 | AAS 10.2

  • cpe:2.3:a:jeremyevans:rodauth:*:*:*:*:*:*:*:* (< 2.46.0)

Rodauth, the Ruby authentication framework by jeremyevans, versions prior to 2.46.0, is affected by one high-severity vulnerability (CVE-2026-82466, CVSS 9.4 HIGH). The flaw resides in the webauthn_login route, where improper account resolution logic allows an already-authenticated user to bypass credential binding checks and complete authentication as any other account by exploiting a fallback to session-based account identifiers. This is an exploitable authentication bypass that enables full account takeover.

Any application relying on Rodauth’s WebAuthn login functionality should treat this as an urgent fix. Upgrade to Rodauth 2.46.0 or later immediately, and review authentication logs for anomalous account switches during WebAuthn login flows. Organizations unable to patch immediately should consider disabling the WebAuthn login route as a temporary mitigation. Refer to the vendor advisory on the project’s GitHub repository for full details.

Vendor Advisory

🟠 [HIGH] omnivore-app/omnivore

1 CVE | CVSS 4.0: 9.3 | AAS 10.2

  • cpe:2.3:a:omnivore-app:omnivore:*:*:*:*:*:*:*:* (< abf53d6)

Omnivore, the open-source read-it-later platform by omnivore-app, is affected by one high-severity vulnerability in its API component (CVE-2026-82454, CVSS 9.3 HIGH). The flaw is a classic JWT algorithm confusion attack in Apple sign-in token verification, where the decodeAppleToken function trusts the attacker-supplied algorithm header, allowing an adversary to forge valid authentication tokens using Apple’s publicly available RSA public key as an HMAC secret. This is an exploitable authentication bypass that grants unauthorized access to any account using Apple sign-in.

Organizations and individuals self-hosting Omnivore with Apple sign-in enabled should treat this as critical. Apply the fix from commit abf53d6 immediately, or disable Apple sign-in as a temporary mitigation until the patch is deployed. Review authentication logs for suspicious Apple sign-in activity, particularly tokens using the HS256 algorithm. Full details are available at the project’s GitHub repository.

Vendor Advisory

🟠 [HIGH] documenso/documenso

1 CVE | CVSS 4.0: 8.7 | AAS 9.6

  • cpe:2.3:a:documenso:documenso:*:*:*:*:*:*:*:* (< 2.13.0)

Documenso, the open-source document signing platform, versions prior to 2.13.0, is affected by one high-severity vulnerability (CVE-2026-82472, CVSS 8.7 HIGH). The /api/files/upload-pdf endpoint accepts arbitrary PDF file uploads without any authentication, allowing unauthenticated attackers to flood the instance with unlimited uploads to exhaust storage resources and fill the database with orphaned document records. This is an exploitable denial-of-service condition that can render self-hosted instances inoperable.

Organizations self-hosting Documenso should upgrade to version 2.13.0 or later immediately. As a temporary mitigation, restrict access to the /api/files/upload-pdf endpoint at the reverse proxy or firewall level to block unauthenticated requests. Monitor storage utilization and database size for signs of ongoing abuse. Refer to the vendor advisory on the project’s GitHub repository for additional guidance.

Vendor Advisory

🟠 [HIGH] kubeedge/kubeedge

1 CVE | CVSS 4.0: 8.8 | AAS 9.2

  • cpe:2.3:a:kubeedge:kubeedge:*:*:*:*:*:*:*:* (< 1.23.2)

KubeEdge CloudCore, versions through 1.23.1, is affected by one high-severity vulnerability (CVE-2026-82473, CVSS 8.8 HIGH). The HTTPS server on port 10002 accepts node task status reports without verifying authentication, allowing attackers with network access to forge upgrade job results, marking them as succeeded or failed. This enables an adversary to deceive the control plane about the true state of edge node upgrades and block further upgrade scheduling across the cluster.

Organizations running KubeEdge in production should assess their exposure immediately, particularly if CloudCore port 10002 is reachable from untrusted networks. Restrict network access to the CloudCore HTTPS endpoint using firewall rules or network policies as an immediate mitigation, and monitor upgrade task status for unexpected state changes. Review the vendor advisory for patch availability and upgrade to a fixed release when one becomes available.

Vendor Advisory

🟠 [HIGH] skyvern-ai/skyvern

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:skyvern-ai:skyvern:*:*:*:*:*:*:*:* (< 1.0.45)

Skyvern, the AI-powered browser automation platform by skyvern-ai, versions prior to 1.0.45, is affected by one high-severity vulnerability (CVE-2026-82447, CVSS 8.7 HIGH). The TextPromptBlock component renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed one, allowing attackers to inject malicious Jinja template syntax via workflow parameters or upstream block output to achieve arbitrary code execution with full server process privileges. This is an exploitable server-side template injection that completely compromises the hosting environment.

Organizations running Skyvern should upgrade to version 1.0.45 or later immediately, as this flaw can be triggered through normal workflow inputs without requiring direct server access. Until patched, restrict who can create or modify workflows and audit existing workflow parameters for suspicious template syntax. Refer to the vendor advisory on the project’s GitHub repository for further details.

Vendor Advisory