https://exploitbulletin.com A daily brief of the few security issues that require action today — each with affected versions, what to do, and the evidence behind it. Most days the list is short. Some days it is empty. en-us https://exploitbulletin.com/bulletin/2026-09-01 https://exploitbulletin.com/bulletin/2026-09-01 Tue, 01 Sep 2026 15:19:38 GMT Affects: SolarWinds Web Help Desk, JFrog Artifactory, WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy, Addify Custom User Registration Fields for WooCommerce, Sangoma Switchvox SMB Edition. Unauthenticated deserialization enables remote code execution in SolarWinds Web Help Desk (CVE-2025-40553) — Default-configuration authentication bypass grants administrative access in JFrog Artifactory (CVE-2026-82329) — Unauthenticated arbitrary file upload in WP Cookie Notice GDPR consent plugin (CVE-2026-82970) — Unauthenticated role escalation via checkout parameter in Custom User Registration Fields for WooCommerce (CVE-2026-15369) — Unauthenticated SQL injection in /pa endpoint leads to remote code execution in Sangoma Switchvox (CVE-2026-9586) https://exploitbulletin.com/bulletin/2026-08-31 https://exploitbulletin.com/bulletin/2026-08-31 Mon, 31 Aug 2026 18:04:10 GMT Affects: GiveWP. Unauthenticated PHP object injection allows remote code execution in GiveWP WordPress plugin (CVE-2026-82222) https://exploitbulletin.com/bulletin/2026-08-30 https://exploitbulletin.com/bulletin/2026-08-30 Mon, 31 Aug 2026 17:53:58 GMT Affects: WPMU DEV Dashboard plugin for WordPress, Langflow. HMAC canonicalization mismatch in WPMU DEV Dashboard SSO lets unauthenticated attackers log in as administrator (CVE-2026-76581) — Unauthenticated Python code injection in Langflow validate endpoint executes as root (CVE-2026-0768) https://exploitbulletin.com/bulletin/2026-08-29 https://exploitbulletin.com/bulletin/2026-08-29 Sat, 29 Aug 2026 15:48:28 GMT Affects: SQL Server. Crafted-query code execution in Microsoft SQL Server Database Engine (CVE-2019-1068) https://exploitbulletin.com/bulletin/2026-08-28 https://exploitbulletin.com/bulletin/2026-08-28 Fri, 28 Aug 2026 16:04:52 GMT Affects: PaperCut MF, PaperCut NG, Zbtlink, MoreQuick, infiniflow RAGFlow. Unsafe database driver class loading enables exploitation chain to code execution on PaperCut NG/MF servers (CVE-2026-82078) — Factory C2 implant (yunmgrd) in Zbtlink and MoreQuick router firmware enables unauthenticated remote root (CVE-2026-74232) — Personal API keys derivable from shared assistant links in RAGFlow (CVE-2025-69286) https://exploitbulletin.com/bulletin/2026-08-27 https://exploitbulletin.com/bulletin/2026-08-27 Thu, 27 Aug 2026 16:18:28 GMT Affects: Citrix NetScaler ADC/Gateway, Kestra, TranslatePress, ownCloud, vBulletin, Zbtlink, Drag and Drop Multiple File Upload for Contact Form 7, Ajax.NET Professional. Unauthenticated memory buffer flaw in Citrix NetScaler ADC and Gateway exploited for remote code execution (CVE-2026-8452) — Suffix-match auth bypass in Kestra AuthenticationFilter lets unauthenticated attackers run arbitrary workflows (CVE-2026-49869) — Unauthenticated admin password-reset key disclosure in TranslatePress WordPress plugin (CVE-2026-19632) — Pre-signed WebDAV URL authentication bypass in ownCloud grants full file access (CVE-2023-49105) — Pre-auth PHP eval injection in vBulletin template runtime runMaths() via ajax/render (CVE-2026-61511) — Unauthenticated UDP command injection in Zbtlink router infosrvd service yields root (CVE-2026-74233) — Filename sanitization bypass allows unauthenticated upload and code execution in Drag and Drop Multiple File Upload for Contact Form 7 (CVE-2026-18781) — Deserialization of untrusted data in Ajax.NET Professional enables unauthenticated RCE on ASP.NET servers (CVE-2021-23758) https://exploitbulletin.com/bulletin/2026-08-26 https://exploitbulletin.com/bulletin/2026-08-26 Wed, 26 Aug 2026 16:19:04 GMT Affects: rails, Keycloak, D-Link. Active Storage libvips unsafe operations let crafted image uploads read arbitrary files and Rails secrets (CVE-2026-66066) — Reset-credentials flow bypass allows unauthenticated account takeover in Red Hat Build of Keycloak (CVE-2026-18963) — Unauthenticated root command injection in fileaccess.cgi on end-of-life D-Link DIR-868L routers (CVE-2025-55583) https://exploitbulletin.com/bulletin/2026-08-25 https://exploitbulletin.com/bulletin/2026-08-25 Tue, 25 Aug 2026 10:00:00 GMT Affects: Oracle HTTP Server / WebLogic Server Proxy Plug-in, miniOrange SAML Single Sign On, TYPO3 extension powermail. Unauthenticated access to all data behind Oracle HTTP Server / WebLogic Proxy Plug-in (CVE-2026-21962) — Two SAML signature bypasses in the miniOrange SSO plugin let anyone log in as any WordPress user (CVE-2026-15981) — Unauthenticated Fluid template injection in TYPO3 powermail forms enables RCE (CVE-2026-77136) https://exploitbulletin.com/bulletin/2026-08-24 https://exploitbulletin.com/bulletin/2026-08-24 Mon, 24 Aug 2026 10:00:00 GMT No issues require immediate action today. https://exploitbulletin.com/bulletin/2026-08-23 https://exploitbulletin.com/bulletin/2026-08-23 Sun, 23 Aug 2026 10:00:00 GMT Affects: sglang. Unauthenticated deserialization in sglang /update_weights_from_tensor endpoint under active scanning (CVE-2025-10164) https://exploitbulletin.com/bulletin/2026-08-22 https://exploitbulletin.com/bulletin/2026-08-22 Sat, 22 Aug 2026 10:00:00 GMT No issues require immediate action today. https://exploitbulletin.com/bulletin/2026-08-21 https://exploitbulletin.com/bulletin/2026-08-21 Fri, 21 Aug 2026 10:00:00 GMT Affects: SPIP. Unauthenticated remote code execution in SPIP via X-Spip-Filtre header (CVE-2026-77806) https://exploitbulletin.com/bulletin/2026-08-20 https://exploitbulletin.com/bulletin/2026-08-20 Thu, 20 Aug 2026 10:00:00 GMT Affects: arrayref, internment, append-only-vec, SPIP, FUXA. Malicious arrayref, internment and append-only-vec releases ran code at Rust build time — Universal pre-auth remote code execution in SPIP CMS, fixed in 4.4.20 (CVE-2026-77647) — Unauthenticated arbitrary file write enables takeover of FUXA SCADA/HMI servers (CVE-2026-25895) https://exploitbulletin.com/bulletin/2026-08-19 https://exploitbulletin.com/bulletin/2026-08-19 Wed, 19 Aug 2026 10:00:00 GMT Affects: Elementor Pro, GitLab CE/EE, PTC Windchill, PTC FlexPLM, WP Compress, TrueConf Server. Unauthenticated file upload to RCE in Elementor Pro page builder (CVE-2026-32475) — Unauthenticated GraphQL flaw lets attackers alter or delete GitLab projects (CVE-2026-19478) — Cl0p mass-exploits unauthenticated RCE in PTC Windchill and FlexPLM (CVE-2026-12569) — Unauthenticated RCE in WP Compress image optimizer plugin (CVE-2026-73343) — Unauthenticated script execution and sandbox escape in TrueConf Server over port 4307 hand attackers the host (CVE-2026-72530) https://exploitbulletin.com/bulletin/2026-08-18 https://exploitbulletin.com/bulletin/2026-08-18 Tue, 18 Aug 2026 10:00:00 GMT Affects: Windows 10, Windows 11, Windows Server, VMware vCenter, VMware Cloud Foundation, VMware vSphere, VMware Telco Cloud, macOS, Microsoft SharePoint, SAP Commerce Cloud, Ray, MLflow, Zimbra Collaboration, Pods, User Profile Builder. Unauthenticated RCE via Double Free in Windows IKE Service Extensions (CVE-2026-33824) — Unauthenticated Path Traversal to Code Execution in VMware vCenter (CVE-2026-59310) — Credential-Free Authentication Bypass in macOS Screen Sharing (CVE-2026-65400) — Pre-Auth JWT Authentication Bypass in Microsoft SharePoint Server (CVE-2026-55040) — Unauthenticated RCE via Default Auth Client in SAP Commerce Cloud Data Hub Adapter (CVE-2026-58231) — Browser-Triggered Code Injection RCE in Ray Distributed Computing Framework (CVE-2025-62593) — MLflow webhook DNS-rebinding SSRF leaks cloud metadata credentials (CVE-2026-64849) — Zimbra ZCS unauthenticated OS command injection via crafted SMTP requests (CVE-2026-73570) — Unauthenticated privilege escalation in Pods WordPress plugin AJAX router (CVE-2026-19598) — User Profile Builder type-confusion auth bypass enables admin account takeover (CVE-2026-15826)