2 vulnerabilities across 2 products scored HIGH or above on August 31, 2026.

  • 🟠 HIGH: 2

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-65641 (veeam/one) — F1: exploitable → functional, AAS: 10.4 → 12.4 (HIGH → CRITICAL). Originally in 2026-08-26 bulletin.

🟠 [HIGH] yacy/yacy_search_server

1 CVE | CVSS 4.0: 8.7 | AAS 10.8

  • cpe:2.3:a:yacy:yacy_search_server:*:*:*:*:*:*:*:*

YaCy Search Server through version 1.941 is affected by one high-severity vulnerability (CVE-2026-82880, CVSS 8.7) involving XML external entity injection in the SVG, FreeMind, and OpenSearch parsers. Because the crawler fails to disable external entity resolution, an attacker can craft malicious documents that cause the server to read local files and expose their contents in the searchable index, effectively turning the crawler into a file exfiltration tool. Organizations running YaCy instances, particularly those crawling untrusted content, should monitor the project repository at github.com/yacy/yacy_search_server for a patched release and, in the interim, restrict crawler scope to trusted sources and limit filesystem permissions for the YaCy process.

Vendor Advisory

🟠 [HIGH] nodemailer/nodemailer

1 CVE | CVSS 4.0: 9.3 | AAS 10.2

  • cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:*:*:* (< 8.0.4)

Nodemailer versions prior to 8.0.4 are affected by one high-severity vulnerability (CVE-2026-82854, CVSS 9.3) that enables SMTP command injection through unsanitized CRLF characters in the envelope size parameter. When applications pass user-influenced envelope objects to sendMail(), an attacker can inject arbitrary SMTP commands such as RCPT TO, silently adding attacker-controlled recipients to outgoing emails and potentially enabling data exfiltration or phishing from trusted infrastructure. Any Node.js application using Nodemailer with custom envelope handling should upgrade to version 8.0.4 or later immediately and review the advisory at the linked GitHub security page for additional mitigation details.

Vendor Advisory