[vulnfeed] 16 critical CVEs — 2026-08-25 20:00 UTC
vulnfeed
Critical alert — 2026-08-25 20:52 UTC
16 new critical CVEs
in the last 5 hours — 16 CVSS ≥ 9.0
New vulnerabilities
CVE-2026-76193CRITICAL
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could resu
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could explo
CVSS 10.0
CVE-2026-76195CRITICAL
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Comma
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in
CVSS 10.0
CVE-2026-76197CRITICAL
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Comma
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in
CVSS 10.0
CVE-2026-55546CRITICAL
QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed
QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strin
CVSS 9.8
CVE-2026-45018CRITICAL
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 unt
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.
CVSS 9.8
CVE-2022-51000CRITICAL
Nokogiri before 1.13.2 (CRuby, when using packaged libraries) ships vendored libxml2 2.9.12 and libxslt 1.1.34
Nokogiri before 1.13.2 (CRuby, when using packaged libraries) ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application t
CVSS 9.3
CVE-2024-58377CRITICAL
Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllin
Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the ma
CVSS 9.3
CVE-2024-58378CRITICAL
Nokogiri before 1.15.6 and 1.16.x before 1.16.2 (CRuby, when using the packaged libxml2) is affected by a use-
Nokogiri before 1.15.6 and 1.16.x before 1.16.2 (CRuby, when using the packaged libxml2) is affected by a use-after-free vulnerability in libxml2 (CVE-2024-25062) in the xmlTextReader module, which un
CVSS 9.3
CVE-2025-71407CRITICAL
Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation
Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation aga
CVSS 9.3
CVE-2026-79675CRITICAL
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() f
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious
CVSS 9.3
CVE-2026-79774CRITICAL
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permis
CVSS 9.3
CVE-2026-79782CRITICAL
rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HT
rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AW
CVSS 9.3
CVE-2026-79787CRITICAL
Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allow
Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from
CVSS 9.3
CVE-2026-78379CRITICAL
Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools
Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's ho
CVSS 9.2
CVE-2026-55536CRITICAL
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension:/
CVSS 9.1
vulnfeed critical alerts — vulnfeed.it.
Unsubscribe
Don't miss what's next. Subscribe to Vulnfeed: