CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-08-01 (8)

2026-08-01 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-08-01

8 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-52855 — 9.9 — Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{con…
  • CVE-2026-15964 — 9.8 — The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the ssoprocess_ajax() function — reg…
  • CVE-2026-66402 — 9.8 — FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP perf…
  • CVE-2026-67324 — 9.8 — GitPython 3.1.50 fails to recognize joined short-option forms such as -u (the short form of --upload-pack=) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clon…
  • CVE-2026-54725 — 9.6 — vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-a…
  • CVE-2026-16503 — 9.1 — Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own i…
  • CVE-2026-3141 — 9.1 — The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and includ…
  • CVE-2026-13596 — 9.1 — The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attack…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.