6 vulnerabilities across 6 products scored HIGH or above on August 30, 2026.

  • 🟠 HIGH: 6

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin.

🟠 [HIGH] tw93/pake

1 CVE | CVSS 3.1: 8.8 | AAS 10.6

  • cpe:2.3:a:tw93:pake:*:*:*:*:*:*:*:*

Pake, the open-source tool by tw93 for wrapping web pages into desktop applications, is affected by one high-severity vulnerability (CVE-2026-82635, CVSS 8.8). The flaw exists in the download_file Tauri command, which fails to sanitize JavaScript-supplied filenames before writing fetched content to disk. An attacker can supply path traversal sequences or absolute paths to write arbitrary attacker-controlled content outside the intended Downloads directory, enabling file overwrite of any user-writable location — potentially achieving code execution through mechanisms such as startup agents or shell profiles.

Teams running applications built with Pake should upgrade to version 3.13.1 or later immediately. Any Pake-based application exposed to untrusted web content is at risk, as exploitation requires only the ability to invoke the vulnerable Tauri command from JavaScript. Consult the vendor’s GitHub repository at https://github.com/tw93/Pake for patch details and updated releases.

Vendor Advisory

🟠 [HIGH] chatgptnextweb/nextchat

1 CVE | CVSS 4.0: 8.7 | AAS 9.8

  • cpe:2.3:a:chatgptnextweb:nextchat:*:*:*:*:*:*:*:*

NextChat, the popular open-source ChatGPT web interface by ChatGPTNextWeb, is affected by one high-severity vulnerability (CVE-2026-82639, CVSS 8.7). Versions 2.15.8 through 2.16.1 contain an improper URL validation flaw in the proxy endpoint where the x-base-url header is checked using substring matching rather than proper hostname parsing. An attacker can craft a URL that contains “api.openai.com” as a substring — such as a subdomain on an attacker-controlled domain — causing the server to forward the configured OpenAI API key in the Authorization header to a malicious endpoint, resulting in credential theft.

Organizations self-hosting NextChat should upgrade beyond version 2.16.1 immediately and rotate any OpenAI API keys that may have been exposed. Review proxy endpoint access logs for unusual x-base-url values that do not resolve to legitimate OpenAI infrastructure. Consult the vendor’s GitHub repository at https://github.com/ChatGPTNextWeb/NextChat for the patched release.

Vendor Advisory

🟠 [HIGH] jina-ai/reader

1 CVE | CVSS 4.0: 8.7 | AAS 9.6

  • cpe:2.3:a:jina-ai:reader:*:*:*:*:*:*:*:*

Jina AI Reader, an open-source tool for converting URLs and web content into LLM-friendly text, is affected by one high-severity vulnerability (CVE-2026-82638, CVSS 8.7). The application disables its private-address guard when deployed outside of Google Cloud environments, leaving it open to server-side request forgery. Unauthenticated attackers can supply publicly resolvable hostnames that map to internal IP addresses, enabling retrieval of cloud instance metadata, internal service responses, and other sensitive resources accessible from the server’s network position.

Organizations running Jina AI Reader on any non-Google Cloud infrastructure — including AWS, Azure, self-hosted, or on-premises deployments — should treat this as actively exploitable and prioritize remediation. Check the vendor’s GitHub repository at https://github.com/jina-ai/reader for a patched release, and in the interim consider restricting network-level access to the Reader service and blocking outbound requests to metadata endpoints and internal address ranges.

Vendor Advisory

🟠 [HIGH] wwbn/avideo

1 CVE | CVSS 4.0: 9.2 | AAS 9.3

  • cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

AVideo, the open-source video platform by WWBN, is affected by one high-severity vulnerability (CVE-2026-82645, CVSS 9.2). The getLiveKey.json.php endpoint in the Live plugin bypasses both access control and ownership checks when a token parameter is supplied, allowing unauthenticated attackers to retrieve stream keys and stream URLs for any configured restream destination. The token is trivially predictable — simply an encrypted integer ID with no user binding — meaning an attacker can enumerate and extract credentials for connected platforms such as YouTube, Facebook, and Twitch.

Organizations running AVideo with live restreaming enabled should apply the patch referenced in the vendor’s security advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-c4w3-h888-7ccv immediately. As an interim measure, consider restricting access to the getLiveKey.json.php endpoint at the web server level and rotating all external streaming platform credentials that may have been exposed.

Vendor Advisory

🟠 [HIGH] admidio/admidio

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* (< 5.0.12)

Admidio, the open-source membership management platform, is affected by one high-severity vulnerability (CVE-2026-82655, CVSS 8.7) in versions prior to 5.0.12. The lists_show.php endpoint contains a blind SQL injection flaw in the relation_type_list parameter that requires no authentication to exploit — attackers can bypass access controls by supplying a dummy UUID in the role_list parameter and then inject arbitrary SQL to extract full database contents, including password hashes and user credentials.

Organizations running Admidio should upgrade to version 5.0.12 or later immediately, as this vulnerability is considered exploitable and requires no prior access to the application. After patching, administrators should audit database logs for signs of extraction activity and force a password reset for all users if compromise cannot be ruled out. Full details are available in the vendor’s security advisory at https://github.com/Admidio/admidio/security/advisories/GHSA-p5cp-mhvx-w392.

Vendor Advisory

🟠 [HIGH] readest/readest

1 CVE | CVSS 3.1: 8.8 | AAS 9.1

  • cpe:2.3:a:readest:readest:*:*:*:*:*:*:*:*

Readest, an open-source e-book reader built on Tauri, is affected by one high-severity vulnerability (CVE-2026-82642, CVSS 8.8) in versions prior to 0.11.16. The application’s HTML sanitizer for EPUB chapter content uses a DOMPurify configuration that only blocks script tags, failing to account for iframe elements with srcdoc attributes — DOMPurify treats srcdoc as an opaque string, allowing an attacker to embed a complete unsanitized HTML document containing arbitrary JavaScript inside a crafted EPUB file.

Users and organizations distributing Readest should upgrade to version 0.11.16 or later immediately. Anyone who has opened EPUB files from untrusted sources using affected versions should consider the host system potentially compromised, as malicious e-books could execute arbitrary code within the Tauri application context. The fix is available in the vendor’s commit at https://github.com/readest/readest/commit/005aa2d6157a34049bf45641c06861d606a85edb.

Vendor Advisory