CVE-2026-74018

CRITICAL9.9

Published 2026-08-20 · Updated 2026-08-20 · Source audit@patchstack.com

Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-434

Same severity, most recent

CVE-2026-16926
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input.
2026-08-20 · score 9.1
CVE-2026-15706
Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.
2026-08-20 · score 9.8
CVE-2026-28164
Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.
2026-08-20 · score 9.6
CVE-2026-74016
Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.
2026-08-20 · score 9.9
CVE-2026-74014
Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.
2026-08-20 · score 9.9