The Bug Report – August 2026 Edition

The Bug Report – August 2026 Edition By Jonathan Omakun · September 3, 2026 Why am I here? Sharpen your pencils and pull out those fresh notebooks; we're back with the bug report! Half the world is squeezing the last drops of joy out of their summer vacations, and the other half is on the...

Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild

Overview On September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549, can be chained to achieve unauthenticated remote code execution RCE ...

CVE-2026-78141

creationtimestamp| type| source ---|---|--- 2026-09-02 11:00:28+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9751b736-8bb9-4c37-8b98-397276c88a36 2026-09-03 01:02:36+00:00| exploited|...

CVE-2026-5153

creationtimestamp| type| source ---|---|--- 2026-09-02 10:00:30+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2026-09-01 2026-09-02 11:00:28+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7b4ab454-d7da-47b7-8de3-083f9b71d5a8 2026-09-03...

EUVD-2026-68393

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexit...

CVE-2026-82552

A security vulnerability has been detected in Linux Foundation Magma 1.9.0. Affected by this vulnerability is an unknown functionality of the file tasks/ngap/ngapamf.c of the component gNB Termination Handler. The manipulation leads to denial of service. The attack is possible to be carried out...

Exploit for Code Injection in Langflow

CVE-2025-3248 — Langflow Unauthenticated Remote Code Execution...

CVE-2026-66384

creationtimestamp| type| source ---|---|--- 2026-08-27 17:44:46+00:00| seen| https://bsky.app/profile/cvesentinel.bsky.social/post/3mu3fm5paxf24 2026-08-27 18:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d46c9d24-f8e3-4328-8a89-6da9954a94e6...

Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea. The vulnerability in question is CVE-2026-60004 CVSS score: 9.8, a case of remote code execution that allows an...

CGA-7R46-5XW5-56Q2

Bulletin has no description...

CVE-2026-77136

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...

CVE-2026-77136 Server-Side Template Injection in extension "powermail" (powermail)

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...

CVE-2026-77136

CVE-2026-77136 is a Server-Side Template Injection (SSTI) in the TYPO3 extension powermail (in2code). The raw value of a form field configured as the sender name is passed directly into a Fluid template without sanitization, allowing an unauthenticated user to inject Fluid template syntax and exe...

EUVD-2026-65340

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...

VulnCheck KEV: CVE-2026-77136

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...

Exploit for Integer Overflow or Wraparound in Google Android

CVE-2025-48595 — Android Framework Integer Overflow Vulnerabil...

Exploit for CVE-2026-31337

Patch: CVE-2026-31337 Vulnerability Details - CVE: CVE...

Vulnerability handling in Zimbra Collaboration Suite

Zimbra has identified a vulnerability in the Zimbra Collaboration Suite. This vulnerability exists in the Zimbra Collaboration Suite version 10.1.20. Unauthorized attackers can execute OS commands through specially crafted SMTP requests. This requires that the Zimbra SNMP package be installed and...

CVE-2025-10164

creationtimestamp| type| source ---|---|--- 2026-08-23 11:00:35+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5775be7d-1a29-41ee-bdff-b6026e93023f 2026-08-24 01:11:00+00:00| exploited|...

CVE-2021-27691

creationtimestamp| type| source ---|---|--- 2026-08-23 10:15:05+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2026-08-22 2026-08-23 11:00:35+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/39ee7ca1-fe23-494e-8a9e-ae5f349620a0...