5 vulnerabilities across 5 products scored HIGH or above on August 30, 2026.

  • 🟠 HIGH: 5

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin.

🟠 [HIGH] tw93/pake

1 CVE | CVSS 3.1: 8.8 | AAS 10.6

  • cpe:2.3:a:tw93:pake:*:*:*:*:*:*:*:*

Pake, the open-source tool by tw93 for wrapping web applications into desktop apps via Tauri, is affected by one high-severity vulnerability (CVE-2026-82635, CVSS 8.8). The flaw allows path traversal through unsanitized filenames in the download_file Tauri command, enabling an attacker-controlled script to write arbitrary content to any user-writable location outside the intended Downloads directory. This can lead to code execution by planting malicious files in startup or configuration directories.

Teams running Pake-built desktop applications should upgrade to version 3.13.1 or later immediately. Given the high severity rating and the exploitable nature of this issue, prioritize patching any internally distributed or user-facing applications built with affected versions. Refer to the project’s GitHub repository at github.com/tw93/Pake for further details and the fix.

Vendor Advisory

🟠 [HIGH] jina-ai/reader

1 CVE | CVSS 4.0: 8.7 | AAS 9.6

  • cpe:2.3:a:jina-ai:reader:*:*:*:*:*:*:*:*

Jina AI Reader, a widely used tool for converting URLs and web content into LLM-friendly text, is affected by one high-severity server-side request forgery vulnerability (CVE-2026-82638, CVSS 8.7). The application disables its private-address guard when deployed outside Google Cloud environments, allowing unauthenticated attackers to supply crafted hostnames that resolve to internal addresses, enabling retrieval of cloud instance metadata, internal service responses, and other sensitive resources.

Organizations self-hosting Jina Reader outside of Google Cloud should treat this as an urgent priority, as the SSRF is exploitable without authentication and can expose cloud credentials and internal infrastructure. Apply the vendor’s patch as soon as it becomes available and review access logs for any suspicious requests targeting internal or metadata endpoints. Refer to the project’s GitHub repository at github.com/jina-ai/reader for remediation guidance.

Vendor Advisory

🟠 [HIGH] wwbn/avideo

1 CVE | CVSS 4.0: 9.2 | AAS 9.3

  • cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

AVideo, the open-source video platform by WWBN, is affected by one high-severity authentication bypass vulnerability (CVE-2026-82645, CVSS 9.2). A flaw in the Live restreams plugin allows unauthenticated attackers to retrieve stream keys and stream URLs for any configured restream by supplying a trivially guessable encrypted token, bypassing all access controls. Exposed credentials grant direct access to connected third-party streaming platforms such as YouTube, Facebook, and Twitch, enabling unauthorized broadcasting or stream hijacking.

Organizations running AVideo with the Live restreams plugin enabled should restrict public access to the affected endpoint immediately and update to a patched commit as soon as one is available. Rotate any stream keys for external platforms that may have been exposed and review the vendor’s security advisory at the linked GitHub URL for full remediation details.

Vendor Advisory

🟠 [HIGH] admidio/admidio

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*

Admidio, an open-source membership management platform used by organizations and clubs, is affected by one high-severity blind SQL injection vulnerability (CVE-2026-82655, CVSS 8.7). The flaw in the relation_type_list parameter of lists_show.php allows unauthenticated attackers to execute arbitrary SQL queries by bypassing authentication with a dummy UUID, enabling full extraction of database contents including password hashes and user credentials.

Organizations running Admidio should upgrade to version 5.0.12 or later immediately, as this vulnerability requires no authentication and is confirmed exploitable. After patching, force a password reset for all users and audit the database for signs of unauthorized access. Full details and the fix are available in the vendor’s security advisory at the linked GitHub URL.

Vendor Advisory

🟠 [HIGH] readest/readest

1 CVE | CVSS 3.1: 8.8 | AAS 9.1

  • cpe:2.3:a:readest:readest:*:*:*:*:*:*:*:*

Readest, an open-source e-book reader built on Tauri, is affected by one high-severity cross-site scripting vulnerability (CVE-2026-82642, CVSS 8.8). The application’s DOMPurify sanitization configuration only blocks script tags, allowing attackers to craft malicious EPUB files containing iframe elements with embedded HTML documents in the srcdoc attribute that bypass sanitization entirely and achieve arbitrary code execution within the application context.

Anyone using Readest to open EPUB files from untrusted sources should upgrade to version 0.11.16 or later immediately. Until patched, avoid opening e-books from unknown or unverified origins. The fix and further details are available in the vendor’s commit linked in the advisory.

Vendor Advisory