Security Digest: August 31, 2026 - 91 Critical Vulnerabilities

Today’s digest covers 91 critical vulnerabilities, including multiple actively exploited flaws already in CISA’s Known Exploited Vulnerabilities catalog. The immediate risk is highest for internet-facing appliances, CMS and admin panels, and any Linux or virtualization stack exposed to remote users.

2026-08-31 · 51 min read

Executive Summary

Today’s digest covers 91 critical vulnerabilities, including multiple actively exploited flaws already in CISA’s Known Exploited Vulnerabilities catalog. The immediate risk is highest for internet-facing appliances, CMS and admin panels, and any Linux or virtualization stack exposed to remote users.

Act now: patch the exploited items first, isolate anything that cannot be updated immediately, and hunt for signs of compromise on NetScaler, Linux servers, ownCloud, SQL Server, and legacy Red Hat components.

Critical Vulnerabilities

• CVE-2022-0995: Linux kernel out-of-bounds write
  • Impact: Local privilege escalation or denial of service.
  • Affected Systems: Linux kernel deployments.
  • Immediate Action: Patch kernel packages now; prioritize exposed multi-user systems.
  • Mitigation: Apply vendor kernel updates and review local user access.
• CVE-2026-8452: Citrix NetScaler ADC/Gateway memory buffer restriction flaw
  • Impact: Denial of service on edge access infrastructure.
  • Affected Systems: Citrix NetScaler ADC and NetScaler Gateway.
  • Immediate Action: Upgrade immediately and restrict management access.
  • Mitigation: Apply Citrix patch guidance and monitor for crashes/restarts.
• CVE-2015-5287: Red Hat ABRT privilege escalation
  • Impact: Local privilege escalation on affected systems.
  • Affected Systems: Red Hat ABRT, including EoL/EoS deployments.
  • Immediate Action: Remove or disable ABRT where possible; replace unsupported systems.
  • Mitigation: Transition off unsupported releases and apply fixes on supported hosts.
• CVE-2015-3246: Red Hat libuser race condition
  • Impact: /etc/passwd corruption, denial of service, or privilege escalation.
  • Affected Systems: Red Hat libuser.
  • Immediate Action: Patch and audit for local account tampering.
  • Mitigation: Update affected packages and limit local shell access.
• CVE-2026-53362: Linux kernel IPv6 privilege escalation
  • Impact: Local privilege escalation via IPv6 networking subsystem.
  • Affected Systems: Linux kernel across multiple distributions.
  • Immediate Action: Patch kernels on all servers and endpoints.
  • Mitigation: Apply vendor updates; restrict local access until patched.
• CVE-2023-49105: ownCloud improper authentication
  • Impact: Unauthenticated file access, modification, and deletion.
  • Affected Systems: ownCloud deployments without signing-key protection.
  • Immediate Action: Upgrade ownCloud and rotate credentials.
  • Mitigation: Apply vendor fix and review file integrity.
• CVE-2019-1068: Microsoft SQL Server RCE
  • Impact: Remote code execution as the SQL Server service account.
  • Affected Systems: Microsoft SQL Server.
  • Immediate Action: Apply Microsoft security updates immediately.
  • Mitigation: Patch and restrict SQL exposure to trusted networks.
• CVE-2021-23758: Ajax.NET Professional deserialization RCE
  • Impact: Remote code execution.
  • Affected Systems: Ajax.NET Professional / AjaxPro, including EoL deployments.
  • Immediate Action: Remove exposed instances or upgrade to supported alternatives.
  • Mitigation: Discontinue use of unsupported versions.
• CVE-2026-81780: Hash Form arbitrary file upload
  • Impact: Unauthenticated file upload, potential server compromise.
  • Affected Systems: Hash Form <= 1.4.2.
  • Immediate Action: Disable the plugin/app until patched.
  • Mitigation: Upgrade and verify upload restrictions.
• CVE-2026-82970: WP Cookie Notice dangerous file upload
  • Impact: Malicious file upload leading to code execution risk.
  • Affected Systems: WP Cookie Notice for GDPR, CCPA & ePrivacy Consent through 4.4.1.
  • Immediate Action: Update the plugin now.
  • Mitigation: Remove unneeded upload features and review webroot for dropped files.
• CVE-2026-79748: MCPHub command execution via server config
  • Impact: Authenticated non-admin users can execute OS commands.
  • Affected Systems: MCPHub prior to 0.12.15.
  • Immediate Action: Block non-admin access and upgrade immediately.
  • Mitigation: Apply 0.12.15 and review for unauthorized server configs.
• CVE-2026-55565: Yamcs SQL-to-Java injection
  • Impact: Remote code execution as the Yamcs service user.
  • Affected Systems: Yamcs prior to 5.12.8 and 5.13.2.
  • Immediate Action: Upgrade and restrict archive/query APIs.
  • Mitigation: Patch and audit mission control instances.
• CVE-2026-76133: Ebyte weak hashing authentication flaw
  • Impact: Possible unauthorized access under predictable exchange conditions.
  • Affected Systems: Affected Ebyte product.
  • Immediate Action: Identify deployed Ebyte devices and check vendor guidance.
  • Mitigation: Replace or update firmware as soon as available.
• CVE-2026-73819: Ebyte admin bypass in vendor utility
  • Impact: Nearby attacker can change settings or credentials.
  • Affected Systems: Affected Ebyte product.
  • Immediate Action: Restrict adjacent-network access and update device firmware.
  • Mitigation: Apply vendor patch and segment management traffic.
• CVE-2026-55559: Yamcs YAML injection to command execution
  • Impact: Command execution as Yamcs service account.
  • Affected Systems: Yamcs prior to 5.12.8 and 5.13.2.
  • Immediate Action: Patch and review instance-creation permissions.
  • Mitigation: Upgrade and restrict who can create or update instances.
• CVE-2026-82226: Tickera PHP object injection
  • Impact: Potential remote code execution or data compromise.
  • Affected Systems: Tickera <= 3.6.0.2.
  • Immediate Action: Disable or update the plugin immediately.
  • Mitigation: Remove unsafe deserialization paths where possible.
• CVE-2026-54754: Klever-Go settlement accounting flaw
  • Impact: Supply corruption and unbacked currency creation.
  • Affected Systems: Klever-Go prior to 1.7.19.
  • Immediate Action: Upgrade blockchain nodes immediately.
  • Mitigation: Apply 1.7.19 and validate ledger integrity.
• CVE-2026-54755: Klever-Go royalty overflow flaw
  • Impact: Creation of unbacked assets and supply corruption.
  • Affected Systems: Klever-Go prior to 1.7.19.
  • Immediate Action: Upgrade nodes and pause risky market operations if needed.
  • Mitigation: Apply 1.7.19 and audit token/account balances.
• CVE-2026-81756: Smart Marketing SMS SQL injection
  • Impact: Unauthenticated database access.
  • Affected Systems: Smart Marketing SMS and Newsletters <= 5.1.24.
  • Immediate Action: Patch or disable public-facing forms.
  • Mitigation: Update and review database logs for abuse.
• CVE-2026-59111: eObčanka-Identifikace command injection
  • Impact: OS command execution on macOS clients.
  • Affected Systems: DIA eObčanka-Identifikace prior to 3.6.0.
  • Immediate Action: Update endpoints and block untrusted URL-scheme handling.
  • Mitigation: Deploy version 3.6.0 or later.
• CVE-2026-81293: WP Data Access SQL injection
  • Impact: Unauthenticated database compromise.
  • Affected Systems: WP Data Access <= 5.5.81.
  • Immediate Action: Update plugin immediately.
  • Mitigation: Patch and inspect for modified records.
• CVE-2026-81763: Throws SPAM Away SQL injection
  • Impact: Unauthenticated database access.
  • Affected Systems: Throws SPAM Away <= 3.8.2.
  • Immediate Action: Disable or update the plugin.
  • Mitigation: Apply vendor patch and monitor for injection attempts.
• CVE-2026-55248: Plone RSS portlet SSRF and XSS
  • Impact: Internal network probing, memory exhaustion, and stored script execution.
  • Affected Systems: plone.app.portlets before 5.0.8, 6.0.4, 7.0.2.
  • Immediate Action: Upgrade Plone components and restrict portlet creation.
  • Mitigation: Apply fixed versions and validate feed URLs.
• CVE-2026-55511: Yamcs StreamSQL injection to RCE
  • Impact: Arbitrary Java execution and possible denial of service.
  • Affected Systems: Yamcs prior to 5.12.8 and 5.13.2.
  • Immediate Action: Patch and restrict archive APIs.
  • Mitigation: Upgrade and review query privileges.
• CVE-2026-55247: Plone iCalendar import SSRF/DoS/XSS
  • Impact: Internal requests, resource exhaustion, and stored XSS.
  • Affected Systems: plone.app.event before 5.2.4 and 6.0.1.
  • Immediate Action: Upgrade immediately.
  • Mitigation: Enforce URL restrictions and import limits.
• CVE-2026-79744: MCPHub system config authorization bypass
  • Impact: Authenticated users can alter system configuration.
  • Affected Systems: MCPHub prior to 1.0.29.
  • Immediate Action: Upgrade and restrict access to config endpoints.
  • Mitigation: Apply 1.0.29 and review admin controls.
• CVE-2026-55521: Yamcs missing authorization checks
  • Impact: Data exposure, COP-1 disruption, and time manipulation.
  • Affected Systems: Yamcs prior to 5.12.8 and 5.13.2.
  • Immediate Action: Upgrade and audit low-privilege accounts.
  • Mitigation: Apply fixed versions and recheck privilege mappings.
• CVE-2026-83497: OpenSearch SQL cursor deserialization RCE
  • Impact: Remote code execution by authenticated users.
  • Affected Systems: OpenSearch SQL plugin.
  • Immediate Action: Patch immediately and restrict SQL plugin access.
  • Mitigation: Update to the fixed release and monitor plugin usage.
• CVE-2026-55207: Pimcore admin takeover via reset URL
  • Impact: Full admin account takeover after victim clicks a reset link.
  • Affected Systems: pimcore/studio-backend-bundle.
  • Immediate Action: Patch immediately and review password reset flow.
  • Mitigation: Remove attacker-controlled reset URLs and enforce server-side URL construction.
• CVE-2026-55485: Piccolo Admin session token exposure
  • Impact: Session theft and superuser impersonation.
  • Affected Systems: piccolo_admin before 1.14.0.
  • Immediate Action: Upgrade and review exposed session tables.
  • Mitigation: Patch to 1.14.0 and protect session-token fields.
• CVE-2026-55466: Snipe-IT stored XSS via inline file serving
  • Impact: Stored XSS and privilege escalation.
  • Affected Systems: composer snipe/snipe-it.
  • Immediate Action: Patch and restrict inline file serving.
  • Mitigation: Enforce safe MIME whitelisting and sanitize uploads.
• CVE-2026-55848: MapFish Print XXE/SSRF
  • Impact: File disclosure and server-side request forgery.
  • Affected Systems: MapFish Print prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, 4.0.5.
  • Immediate Action: Upgrade and block untrusted print jobs.
  • Mitigation: Apply the fixed versions and disable external entity resolution.
• CVE-2026-55638: 9router /codex bypass
  • Impact: Unauthenticated access to LLM proxy and provider credits.
  • Affected Systems: npm 9router.
  • Immediate Action: Restrict exposure and patch immediately.
  • Mitigation: Upgrade and require API-key checks for all remote requests.
• CVE-2026-81889: elFinder SSRF via URL uploads
  • Impact: Internal request exposure and file disclosure.
  • Affected Systems: elFinder before 2.1.70.
  • Immediate Action: Upgrade and disable remote URL uploads if possible.
  • Mitigation: Apply 2.1.70 and block DNS rebinding paths.
• CVE-2026-81287: Charitable subscriber SQL injection
  • Impact: Database compromise by authenticated users.
  • Affected Systems: Charitable <= 1.8.12.1.
  • Immediate Action: Patch the plugin immediately.
  • Mitigation: Update and review form inputs for injection.
• CVE-2026-55108: KubeVela remote config loader DoS
  • Impact: Cluster controller memory exhaustion and restart loops.
  • Affected Systems: KubeVela prior to 1.9.14 / 1.10.9 / 1.11.0-alpha.4.
  • Immediate Action: Upgrade and restrict ComponentDefinition writes.
  • Mitigation: Apply fixed versions and monitor vela-core health.
• CVE-2026-55830: RestrictedPython guard bypass
  • Impact: Sandbox policy bypass; can lead to code execution in chained apps.
  • Affected Systems: pip RestrictedPython.
  • Immediate Action: Upgrade and reject positional-only underscore parameters.
  • Mitigation: Patch and revalidate any sandboxed code paths.
• CVE-2026-55641: 9router Host-header auth bypass
  • Impact: Unauthenticated access to LLM proxy and SSRF capability.
  • Affected Systems: npm 9router <= 0.4.80.
  • Immediate Action: Treat as internet-exposed and patch now.
  • Mitigation: Trust socket peer IP, not Host header; require API keys by default.
• CVE-2026-61641: Wallos OIDC email verification bypass
  • Impact: Full account takeover via unverified email claim.
  • Affected Systems: Wallos 4.0.0 through 4.9.5.
  • Immediate Action: Upgrade and review IdP trust settings.
  • Mitigation: Enforce verified email checks in OIDC flow.
• CVE-2026-81892: EasyAdmin route swap access-control bypass
  • Impact: Low-privilege backend users can reach protected controllers.
  • Affected Systems: EasyAdmin 4.0.0 to 4.29.15 and 5.5.0.
  • Immediate Action: Upgrade and review path-based firewall rules.
  • Mitigation: Apply 4.29.16 or 5.5.1 and use controller-level authorization.
• CVE-2026-79746: MCPHub group-route authorization flaw
  • Impact: Key scope can expand to more servers than intended.
  • Affected Systems: MCPHub prior to 1.0.31.
  • Immediate Action: Rotate keys and patch immediately.
  • Mitigation: Upgrade and revalidate group-scoped permissions.
• CVE-2026-55065: Vikunja cross-project view deletion
  • Impact: Cross-tenant data destruction of board state.
  • Affected Systems: Vikunja 0.24.6 through 2.3.x.
  • Immediate Action: Upgrade and review project-view permissions.
  • Mitigation: Apply 2.4.0 and audit deleted view records.
• CVE-2026-66047: ProfilePress plugin install/auth bypass
  • Impact: Unauthenticated plugin installation and PHP code execution.
  • Affected Systems: ProfilePress before 4.17.2.
  • Immediate Action: Update immediately and inspect for rogue plugins.
  • Mitigation: Patch and rotate WordPress credentials if exposed.
• CVE-2026-55228: Weblate team-scope enforcement failure
  • Impact: Unauthorized access to private projects.
  • Affected Systems: Weblate prior to 2026.7.
  • Immediate Action: Upgrade and review team assignments.
  • Mitigation: Patch and verify project/workspace boundaries.
• CVE-2026-81891: elFinder PHP file extraction RCE
  • Impact: Executable files can be extracted into web paths.
  • Affected Systems: elFinder before 2.1.70.
  • Immediate Action: Upgrade and restrict archive extraction.
  • Mitigation: Patch and block executable extensions in uploads.
• CVE-2026-72001: Pangolin share-link auth bypass
  • Impact: Access to protected resources across organizations.
  • Affected Systems: Pangolin before 1.22.0.
  • Immediate Action: Upgrade and invalidate share links.
  • Mitigation: Patch and reissue access tokens.
• CVE-2026-54757: Trestle Jinja2 template injection
  • Impact: Server-side template injection leading to RCE.
  • Affected Systems: compliance-trestle before 3.12.4 and 4.0.0 through 4.0.3.
  • Immediate Action: Upgrade and review rendered Markdown sources.
  • Mitigation: Apply fixed versions and stop rendering untrusted templates.
• CVE-2026-79750: MCPHub cross-tenant tool execution
  • Impact: Non-admin users can invoke tools on other users’ servers.
  • Affected Systems: MCPHub prior to 1.0.30.
  • Immediate Action: Patch and review exposed MCP tools.
  • Mitigation: Upgrade and enforce ownership checks.
• CVE-2026-55621: Incus custom volume copy auth bypass
  • Impact: Secrets in custom volumes may be exposed.
  • Affected Systems: Incus prior to 7.2.0.
  • Immediate Action: Upgrade and audit project access controls.
  • Mitigation: Apply 7.2.0 and recheck volume permissions.
• CVE-2026-55516: Snipe-IT maintenance record re-parenting
  • Impact: Cross-company asset record tampering.
  • Affected Systems: composer snipe/snipe-it.
  • Immediate Action: Patch and review multi-company data integrity.
  • Mitigation: Re-authorize new asset_id values before save.
• CVE-2026-55874: SeaweedFS copy-source traversal
  • Impact: Read objects from buckets outside the caller’s scope.
  • Affected Systems: SeaweedFS S3 API gateway prior to 4.34.
  • Immediate Action: Upgrade and block traversal in copy-source headers.
  • Mitigation: Apply 4.34+ and reject `..` in `X-Amz-Copy-Source`.
• CVE-2026-55622: Incus instance copy auth bypass
  • Impact: Secrets from inaccessible instances may be copied out.
  • Affected Systems: Incus prior to 7.2.0.
  • Immediate Action: Upgrade and review project copy permissions.
  • Mitigation: Apply 7.2.0 and monitor copy operations.
• CVE-2026-55208: Pimcore blind SQL injection in DateFilter
  • Impact: Authenticated attackers can extract database contents, hashes, and tokens.
  • Affected Systems: pimcore/studio-backend-bundle.
  • Immediate Action: Patch immediately and inspect listing endpoints.
  • Mitigation: Quote identifiers safely and enforce allowlists.
• CVE-2026-17615: RESTEasy XXE file read
  • Impact: Unauthenticated file read via external entities.
  • Affected Systems: RESTEasy SourceProvider.
  • Immediate Action: Patch and disable XML entity resolution.
  • Mitigation: Apply vendor fix and block untrusted XML uploads.
• CVE-2026-81297: Fluent Forms Pro subscriber privilege escalation
  • Impact: Subscriber-level privilege escalation.
  • Affected Systems: Fluent Forms Pro Add On Pack <= 6.2.12.
  • Immediate Action: Update immediately.
  • Mitigation: Patch and review role assignment rules.
• CVE-2026-59724: Engine.IO WebTransport DoS
  • Impact: Remote crash or process termination.
  • Affected Systems: engine.io 6.5.0 through 6.6.6 when WebTransport is enabled.
  • Immediate Action: Upgrade to 6.6.7 or disable WebTransport.
  • Mitigation: Remove WebTransport from enabled transports list.
• CVE-2026-54598: Wallos unauthenticated migration trigger
  • Impact: Live database schema changes triggered over HTTP.
  • Affected Systems: Wallos before 4.9.4.
  • Immediate Action: Upgrade and block public access to migration endpoints.
  • Mitigation: Patch and verify no unauthorized migrations ran.
• CVE-2026-75133: Keep Backup Daily database dump exposure
  • Impact: Full MySQL backup exposure to unauthenticated attackers.
  • Affected Systems: Keep Backup Daily before 2.1.4.
  • Immediate Action: Update and remove public access to cron handlers.
  • Mitigation: Patch and delete exposed backups from webroot.
• CVE-2026-55784: free5GC AUSF authentication-state collision
  • Impact: Denial of authentication for targeted subscribers.
  • Affected Systems: free5GC 1.4.4 and earlier.
  • Immediate Action: Rate-limit and isolate AUSF interfaces.
  • Mitigation: No fixed version listed; apply network controls and vendor guidance.
• CVE-2026-55552: Yamcs static file traversal
  • Impact: Arbitrary readable host files may be disclosed.
  • Affected Systems: Yamcs prior to 5.11.13 / 5.12.0.
  • Immediate Action: Upgrade and review static content exposure.
  • Mitigation: Patch and restrict file-serving roots.
• CVE-2026-55841: Graylog FortiGate parser field manipulation
  • Impact: Attackers can alter or suppress security log fields.
  • Affected Systems: Graylog Server before 6.3.12, 7.0.7, 7.1.2; Forwarder 7.3.
  • Immediate Action: Upgrade logging infrastructure now.
  • Mitigation: Patch and validate log integrity.
• CVE-2026-55484: ALOS HTTP malformed path crash
  • Impact: Remote denial of service via server panic.
  • Affected Systems: ALOS HTTP prior to 0.0.0-20260617230736-314b6783e196.
  • Immediate Action: Upgrade and front with a strict reverse proxy.
  • Mitigation: Apply the fixed build and reject malformed request paths.
• CVE-2026-55215: MariaDB Connector/Node.js credential exposure
  • Impact: Credentials can be captured by a man-in-the-middle.
  • Affected Systems: MariaDB Connector/Node.js before 3.3.3, 3.4.6, 3.5.3.
  • Immediate Action: Upgrade and pin CA certificates.
  • Mitigation: Enforce certificate validation and CA pinning.
• CVE-2026-55584: phpSysInfo header spoofing bypass
  • Impact: Unauthenticated access to system information.
  • Affected Systems: phpSysInfo before 3.4.6.
  • Immediate Action: Patch and stop trusting forwarded client IP headers.
  • Mitigation: Use REMOTE_ADDR only and update to 3.4.6.
• CVE-2026-54788: dd-trace-rs tracestate DoS
  • Impact: CPU and memory exhaustion on instrumented services.
  • Affected Systems: dd-trace-rs before 0.3.3.
  • Immediate Action: Upgrade and rate-limit suspicious trace headers.
  • Mitigation: Apply 0.3.3 and cap header sizes.
• CVE-2026-19616: KitLogistic ACL bypass
  • Impact: Access to functionality not properly constrained by ACLs.
  • Affected Systems: KitLogistic before v2.2.2.
  • Immediate Action: Patch and review role permissions.
  • Mitigation: Update and audit authorization checks.
• CVE-2026-76763: SmallRye GraphQL BigInteger exhaustion
  • Impact: CPU exhaustion or OutOfMemoryError.
  • Affected Systems: SmallRye GraphQL number scalar coercion.
  • Immediate Action: Patch and rate-limit GraphQL input.
  • Mitigation: Upgrade and validate numeric magnitudes.
• CVE-2026-82225: RegistrationMagic broken authentication
  • Impact: Unauthenticated account compromise risk.
  • Affected Systems: RegistrationMagic <= 6.0.9.8.
  • Immediate Action: Update immediately.
  • Mitigation: Patch and test login/registration flows.
• CVE-2026-82914: Hospital-Management-System SQL injection
  • Impact: Remote SQL injection through search input.
  • Affected Systems: kishan0725 Hospital-Management-System 1.0.
  • Immediate Action: Remove from exposure or patch if maintained.
  • Mitigation: Apply vendor fix if available and sanitize input.
• CVE-2026-82701: Online Shopping System SQL injection
  • Impact: Remote database compromise.
  • Affected Systems: code-projects Online Shopping System 1.0.
  • Immediate Action: Patch or take the app offline until fixed.
  • Mitigation: Use parameterized queries and update the application.
• CVE-2026-82919: cu silicon missing authentication
  • Impact: Unauthenticated access to edit functionality.
  • Affected Systems: cu silicon up to 0.1.5.
  • Immediate Action: Restrict public exposure and update.
  • Mitigation: Patch and add authentication checks.
• CVE-2026-82808: ActiveInbox hard-coded credential exposure
  • Impact: Credential leakage from extension code.
  • Affected Systems: Inbox Foundry ActiveInbox Extension up to 7.10.24.
  • Immediate Action: Update extension and rotate exposed secrets.
  • Mitigation: Patch and remove embedded credentials.
• CVE-2026-54718: Silverstripe workflow template RCE
  • Impact: Arbitrary code execution through crafted email templates.
  • Affected Systems: Silverstripe Advanced Workflow before 6.4.5, 7.1.3, 7.2.1.
  • Immediate Action: Upgrade and restrict template authorship.
  • Mitigation: Apply patched releases and review workflow templates.
• CVE-2026-82392: pnpm lockfile path escape
  • Impact: Package contents may be written outside node_modules; lifecycle scripts can then execute code.
  • Affected Systems: pnpm before 10.34.5 and 11.11.0 in affected ranges.
  • Immediate Action: Upgrade and do not install untrusted lockfiles.
  • Mitigation: Patch and validate lockfile provenance.
• CVE-2026-55066: Vikunja task bucket cross-tenant task access
  • Impact: Task disclosure and completion-state tampering.
  • Affected Systems: Vikunja prior to 2.4.0.
  • Immediate Action: Upgrade and review project/task permissions.
  • Mitigation: Apply 2.4.0 and audit task updates.
• CVE-2026-55212: Pimcore class-definition privilege escalation
  • Impact: Editor-level users can create class definitions and alter schema.
  • Affected Systems: pimcore/studio-backend-bundle.
  • Immediate Action: Patch and restrict class-definition endpoints to admins.
  • Mitigation: Use the correct `classes` permission and validate UIDs early.
• CVE-2026-81764: Email Essentials XSS
  • Impact: Unauthenticated cross-site scripting.
  • Affected Systems: Email Essentials <= 6.0.6.
  • Immediate Action: Update the plugin.
  • Mitigation: Patch and review public forms.
• CVE-2026-81765: Tailored Tools XSS
  • Impact: Unauthenticated cross-site scripting.
  • Affected Systems: Tailored Tools <= 3.0.2.
  • Immediate Action: Update immediately.
  • Mitigation: Patch and sanitize untrusted input.
• CVE-2026-79745: MCPHub prompt/resource tampering
  • Impact: Non-admin users can overwrite globally served prompts and resources.
  • Affected Systems: MCPHub prior to 1.0.32.
  • Immediate Action: Upgrade and lock down prompt/resource routes.
  • Mitigation: Apply 1.0.32 and review shared content integrity.
• CVE-2026-82229: WordPress Social Login and Register XSS
  • Impact: Unauthenticated cross-site scripting.
  • Affected Systems: WordPress Social Login and Register <= 7.8.2.
  • Immediate Action: Patch plugin now.
  • Mitigation: Update and test public login pages.
• CVE-2026-81768: Super Store Finder XSS
  • Impact: Unauthenticated cross-site scripting.
  • Affected Systems: Super Store Finder <= 7.10.
  • Immediate Action: Update immediately.
  • Mitigation: Patch and validate search inputs.
• CVE-2026-82221: RegistrationMagic XSS
  • Impact: Unauthenticated cross-site scripting.
  • Affected Systems: RegistrationMagic <= 6.0.9.8.
  • Immediate Action: Patch and review forms.
  • Mitigation: Update and sanitize output.
• CVE-2026-82224: SliceWP XSS
  • Impact: Unauthenticated cross-site scripting.
  • Affected Systems: SliceWP <= 1.2.10.
  • Immediate Action: Update the plugin.
  • Mitigation: Patch and inspect affiliate-facing pages.
• CVE-2026-79747: MCPHub arbitrary URL SSRF
  • Impact: Authenticated users can trigger server-side requests to internal or external targets.
  • Affected Systems: MCPHub prior to 1.0.32.
  • Immediate Action: Upgrade and block private/link-local destinations.
  • Mitigation: Apply egress filtering and patch to 1.0.32.
• CVE-2026-81290: Email Subscribers & Newsletters XSS
  • Impact: Unauthenticated cross-site scripting.
  • Affected Systems: Email Subscribers & Newsletters <= 5.9.33.
  • Immediate Action: Update the plugin.
  • Mitigation: Patch and review public subscription forms.
• CVE-2026-81291: Uncode XSS
  • Impact: Unauthenticated cross-site scripting.
  • Affected Systems: Uncode <= 2.12.7.
  • Immediate Action: Update theme immediately.
  • Mitigation: Patch and test rendered content.
• CVE-2026-81298: LeadConnector XSS
  • Impact: Unauthenticated cross-site scripting.
  • Affected Systems: LeadConnector <= 4.0.5.
  • Immediate Action: Update immediately.
  • Mitigation: Patch and review public integration endpoints.
• CVE-2026-55460: Snipe-IT bulk delete authorization bypass
  • Impact: Non-admin users can soft-delete other users.
  • Affected Systems: composer snipe/snipe-it.
  • Immediate Action: Patch and verify `users.delete` enforcement.
  • Mitigation: Apply the vendor fix and audit user-management logs.
• CVE-2026-66384: Artifactory Docker cache path escape
  • Impact: Authenticated users may write outside the intended cache path.
  • Affected Systems: JFrog Artifactory.
  • Immediate Action: Patch and review repository permissions.
  • Mitigation: Apply vendor guidance and inspect cache paths.
• CVE-2026-81578: PaperCut MF/NG access-control flaw
  • Impact: Backend actions may occur before access validation completes.
  • Affected Systems: PaperCut MF and PaperCut NG.
  • Immediate Action: Restrict administrative interfaces and apply vendor updates.
  • Mitigation: Patch and monitor configuration changes.
• CVE-2026-82078: PaperCut dynamic class loading risk
  • Impact: Arbitrary Java bytecode execution if configuration is manipulated.
  • Affected Systems: PaperCut MF and PaperCut NG.
  • Immediate Action: Lock down configuration access and patch.
  • Mitigation: Use allowlisted drivers only and apply vendor fixes.

🚨 ACTIVELY EXPLOITED

• CVE-2022-0995 — Linux kernel
• CVE-2026-8452 — Citrix NetScaler ADC/Gateway
• CVE-2015-5287 — Red Hat ABRT
• CVE-2015-3246 — Red Hat libuser
• CVE-2026-53362 — Linux kernel IPv6 subsystem
• CVE-2023-49105 — ownCloud
• CVE-2019-1068 — Microsoft SQL Server
• CVE-2021-23758 — Ajax.NET Professional

Previously Alerted

• CVE-2026-53552
• CVE-2026-53553
• CVE-2026-55175
• CVE-2026-35290
• CVE-2026-47056
• CVE-2026-60217
• CVE-2026-60247
• CVE-2026-60275
• CVE-2026-46982
• CVE-2026-60216
• CVE-2026-60234
• CVE-2026-60256
• CVE-2026-46983
• CVE-2026-60204
• CVE-2026-60278
• CVE-2026-46876
• CVE-2026-60221
• CVE-2026-60230
• CVE-2026-60200
• CVE-2026-60232
• CVE-2026-60269
• CVE-2026-63764
• CVE-2026-60168
• CVE-2026-46989
• CVE-2026-47037
• CVE-2026-60193
• CVE-2026-47688
• CVE-2026-60192
• CVE-2026-60180
• CVE-2026-60179
• CVE-2026-16484
• CVE-2026-46954
• CVE-2026-60257
• CVE-2026-46994
• CVE-2026-46924
• CVE-2026-60225
• CVE-2026-60241
• CVE-2026-60258
• CVE-2026-47036
• CVE-2026-60210
• CVE-2026-60280
• CVE-2026-60198
• CVE-2026-60224
• CVE-2026-60240
• CVE-2026-60205
• CVE-2026-60244
• CVE-2026-60272
• CVE-2026-65057
• CVE-2026-60249
• CVE-2026-60163
• CVE-2026-47018
• CVE-2026-47690
• CVE-2026-47058
• CVE-2026-47685
• CVE-2026-47697
• CVE-2026-60206
• CVE-2026-60259
• CVE-2026-60197
• CVE-2026-60227
• CVE-2026-60246
• CVE-2026-60274
• CVE-2026-60173
• CVE-2026-60236
• CVE-2026-60212
• CVE-2026-60226
• CVE-2026-60242
• CVE-2026-60209
• CVE-2026-60254
• CVE-2026-60279
• CVE-2026-60248
• CVE-2026-60208
• CVE-2026-65056
• CVE-2026-46923
• CVE-2026-47057
• CVE-2026-47687
• CVE-2026-56147
• CVE-2026-60262
• CVE-2026-60202
• CVE-2026-60229
• CVE-2026-60251
• CVE-2026-60276
• CVE-2026-60199
• CVE-2026-60253
• CVE-2026-60215
• CVE-2026-60228
• CVE-2026-60250
• CVE-2026-60219
• CVE-2026-60264
• CVE-2026-60239
• CVE-2026-60220
• CVE-2026-60267
• CVE-2026-47040
• CVE-2026-47731
• CVE-2026-10678
• CVE-2026-47237
• CVE-2026-47063
• CVE-2026-63358
• CVE-2026-52472
• CVE-2026-52469
• CVE-2026-52470
• CVE-2026-30631
• CVE-2026-52474
• CVE-2026-52476
• CVE-2026-55851
• CVE-2026-8983
• CVE-2026-64881
• CVE-2026-55634
• CVE-2026-81779

What to Do Now

1. Patch the actively exploited items first: Linux kernel, Citrix NetScaler, ownCloud, SQL Server, and legacy Red Hat components.
2. Update exposed internet-facing apps immediately: WordPress plugins/themes, Pimcore, Yamcs, MCPHub, elFinder, Plone, and 9router.
3. Isolate or disable EoL/EoS software that cannot be patched safely today.
4. Rotate credentials and session tokens for systems that may have been exposed to account takeover or RCE issues.
5. Check logs for exploitation attempts on admin panels, upload endpoints, SQL endpoints, and AI proxy routes.

Verification steps: confirm installed versions against vendor advisories, check whether vulnerable services are reachable from the internet, and validate patch deployment across all nodes, containers, and replicas.

Monitoring recommendations: watch for unexpected process launches, new webshells, unusual outbound connections, repeated 5xx/401 patterns on management routes, and suspicious database activity or token resets.

Related Resources

• Internal blog posts: add an internal “August 31, 2026 critical patching priorities” briefing and a separate “internet-facing exposure checklist” post.
• Official vendor advisories: follow Citrix, Microsoft, Red Hat, ownCloud, Pimcore, Yamcs, JFrog, Plone, OpenSearch, and WordPress plugin vendor notices for fixed versions and backported releases.