CVE-2026-19598CRITICALAug 20, 2026

1 exploit120

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead

CVE-2026-19598CRITICALAug 20, 2026

1 exploit120

CVE-2021-42292CRITICALAug 19, 2026

KEV1 exploit54846

Microsoft Excel Security Feature Bypass Vulnerability

CVE-2021-42287CRITICALAug 19, 2026

KEV7 exploits55325

Active Directory Domain Services Elevation of Privilege Vulnerability

CVE-2021-42278CRITICALAug 19, 2026

KEV6 exploits55325

Active Directory Domain Services Elevation of Privilege Vulnerability

CVE-2021-27065CRITICALAug 19, 2026

KEV1 exploit55376

Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-26857CRITICALAug 19, 2026

KEV2 exploits55376

Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-26855CRITICALAug 19, 2026

KEV47 exploits55378

Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2020-1054CRITICALAug 19, 2026

KEV3 exploits55446

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application th

CVE-2026-65400CRITICALAug 19, 2026

KEV1 exploit19130

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

CVE-2026-59310CRITICALAug 19, 2026

KEV2 exploits19130

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

CVE-2026-55040CRITICALAug 19, 2026

KEV2 exploits20050

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-33824CRITICALAug 19, 2026

KEV2 exploits19150

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

CVE-2025-25256CRITICALAug 18, 2026

1 exploit500

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through 7.2.5, FortiSIEM 7.1.0 through 7.1.7, FortiSIEM 7.0.0 through 7.0.3, FortiSIEM 6.7.0 through 6.7.9, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions, FortiSIEM 6.3 all versions, FortiSIEM 6.2 all versions, FortiSIEM 6.1 all versions, FortiSIEM 5.4 all versions, FortiS

CVE-2025-62593CRITICALAug 18, 2026

KEV1 exploit22770

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DN

CVE-2026-9198CRITICALAug 17, 2026

KEV1 exploit55790

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

CVE-2026-73678CRITICALAug 17, 2026

1 exploit200

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python source without sandboxing. Attackers can first configure their own LLM API key through the unauthenticated PUT /api/v1/settings/ endpoin

CVE-2026-58231CRITICALAug 17, 2026

1 exploit480

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

CVE-2026-9645CRITICALAug 17, 2026

1 exploit600

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.

CVE-2023-52440CRITICALAug 15, 2026

1 exploit1000

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client.

Security Feed