| CVE-2026-82452 |
rust-iot-platform Authentication Bypass via Missing Request Guards |
29.08.2026 |
9.3 |
| CVE-2026-82454 |
Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in |
29.08.2026 |
9.3 |
| CVE-2026-82456 |
argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP |
29.08.2026 |
10 |
| CVE-2026-82448 |
Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key |
29.08.2026 |
9.3 |
| CVE-2026-14494 |
Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field |
29.08.2026 |
9.8 |
| CVE-2026-18527 |
IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ]. |
28.08.2026 |
9.9 |
| CVE-2026-19286 |
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement |
28.08.2026 |
9.8 |
| CVE-2026-19295 |
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement |
28.08.2026 |
9.9 |
| CVE-2026-3627 |
Multiple Vulnerabilities in IBM Concert Software |
28.08.2026 |
9.1 |
| CVE-2026-54745 |
Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true |
28.08.2026 |
10 |
| CVE-2026-54754 |
Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) |
28.08.2026 |
9.6 |
| CVE-2026-54755 |
Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) |
28.08.2026 |
9.6 |
| CVE-2026-55068 |
free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints |
28.08.2026 |
9.3 |
| CVE-2026-55220 |
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column |
28.08.2026 |
9.3 |
| CVE-2026-55247 |
plone.app.event: Denial of service via iCalendar import |
28.08.2026 |
9.1 |
| CVE-2026-55248 |
plone.app.portlets: Denial of service via RSS feed portlet |
28.08.2026 |
9.1 |
| CVE-2026-55378 |
JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values |
28.08.2026 |
9.3 |
| CVE-2026-55511 |
Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` |
28.08.2026 |
9.1 |
| CVE-2026-55559 |
Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance) |
28.08.2026 |
9.8 |
| CVE-2026-55565 |
Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) |
28.08.2026 |
9.9 |
| CVE-2026-55634 |
Pimcore: Remote Code Execution via DataObject Class-Definition Field Name |
28.08.2026 |
9.9 |
| CVE-2026-82021 |
Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference |
29.08.2026 |
9 |
| CVE-2026-82266 |
Redpanda Admin API Unauthenticated Superuser Access via Default Configuration |
28.08.2026 |
9.3 |
| CVE-2026-82277 |
Argo Rollouts Dashboard Unauthenticated Mutating Operations |
28.08.2026 |
9.3 |
| CVE-2026-82281 |
Kotaemon Missing Ownership Check in Conversation Functions |
28.08.2026 |
9.1 |
| CVE-2026-82329 |
Potential authentication bypass leading to administrative access in Artifactory |
28.08.2026 |
9.8 |
| CVE-2026-82078 |
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector |
29.08.2026 |
9.4 |
| CVE-2026-18918 |
OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default |
28.08.2026 |
9.1 |
| CVE-2026-42007 |
|
28.08.2026 |
9.1 |
| CVE-2026-82222 |
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability |
28.08.2026 |
10 |
| CVE-2026-82244 |
Budibase before 3.41.3 Remote Code Execution via Plugin eval() |
28.08.2026 |
9.4 |
| CVE-2026-40541 |
|
28.08.2026 |
9 |
| CVE-2026-76581 |
WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion |
28.08.2026 |
9.8 |
| CVE-2026-78032 |
|
28.08.2026 |
9.3 |
| CVE-2026-80600 |
batman-adv: dat: acquire ARP hw source only after skb realloc |
29.08.2026 |
9.8 |
| CVE-2026-80603 |
netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read |
29.08.2026 |
9.1 |
| CVE-2026-80609 |
qede: fix out-of-bounds check for cqe->len_list[] |
29.08.2026 |
9.8 |
| CVE-2026-80612 |
net: lwtunnel: Drop skb metadata before LWT encapsulation |
29.08.2026 |
9.8 |
| CVE-2026-80617 |
net: airoha: fix foe_check_time allocation size |
29.08.2026 |
9.8 |
| CVE-2026-80630 |
net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen |
29.08.2026 |
9.8 |
| CVE-2026-80634 |
netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag |
29.08.2026 |
9.8 |
| CVE-2026-80668 |
netfilter: nf_conntrack_expect: use conntrack GC to reap expectations |
29.08.2026 |
9.8 |
| CVE-2026-80670 |
perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
29.08.2026 |
9.1 |
| CVE-2026-80671 |
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON |
29.08.2026 |
9.3 |
| CVE-2026-80673 |
ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find() |
29.08.2026 |
9.8 |
| CVE-2026-80674 |
ntfs: validate resident attribute lists and harden the validator |
29.08.2026 |
9.8 |
| CVE-2026-80681 |
vxlan: re-fetch eth header after route_shortcircuit() |
29.08.2026 |
9.8 |
| CVE-2026-80684 |
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure |
29.08.2026 |
9.3 |
| CVE-2026-80693 |
idpf: bound interrupt-vector register fill to the allocated array |
29.08.2026 |
9.3 |
| CVE-2026-80694 |
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller |
29.08.2026 |
9.8 |
| CVE-2026-80714 |
ipvs: do not propagate one-packet flag to synced conns |
29.08.2026 |
9.8 |
| CVE-2026-82082 |
Green-Computing｜NUMail - OS Command Injection |
28.08.2026 |
9.3 |
| CVE-2026-82090 |
|
28.08.2026 |
9.2 |
| CVE-2026-13086 |
Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint |
29.08.2026 |
9.3 |
| CVE-2026-19313 |
Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution |
29.08.2026 |
9.3 |
| CVE-2026-19315 |
Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution |
29.08.2026 |
9.3 |
| CVE-2026-19318 |
Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution |
29.08.2026 |
9.3 |
| CVE-2026-61800 |
Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893) |
28.08.2026 |
9.1 |
| CVE-2026-78174 |
WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs |
28.08.2026 |
9.3 |
| CVE-2026-18717 |
Improper Certificate Validation in ASE 2000 |
28.08.2026 |
9.1 |
| CVE-2026-50152 |
Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users |
28.08.2026 |
9.1 |
| CVE-2026-68929 |
FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization |
28.08.2026 |
9.3 |
| CVE-2026-69658 |
Ebyte NE2-D11 Cleartext Transmission of Sensitive Information |
28.08.2026 |
9.3 |
| CVE-2026-71187 |
Ebyte NE2-D11 Use of Client-Side Authentication |
28.08.2026 |
9.3 |
| CVE-2026-73125 |
Ebyte NE2-D11 Missing Authentication for Critical Function |
28.08.2026 |
9.3 |
| CVE-2026-76179 |
Ebyte NE2-D11 Use of GET Request Method With Sensitive Query Strings |
28.08.2026 |
9.3 |
| CVE-2026-76943 |
Xiiaozet LK100W Authentication Bypass Using an Alternate Path or Channel |
28.08.2026 |
9.3 |
| CVE-2026-78239 |
Xiiaozet LK100W Missing Authentication for Critical Function |
28.08.2026 |
9.3 |
| CVE-2026-18885 |
Unauthenticated Remote Code Execution in GraphQL Composite Data API |
29.08.2026 |
10 |
| CVE-2026-18886 |
Unauthenticated Privilege Escalation via System Configuration Image Upload Processor |
29.08.2026 |
10 |
| CVE-2026-19092 |
Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing |
28.08.2026 |
9.8 |
| CVE-2026-48996 |
Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client |
29.08.2026 |
9.3 |
| CVE-2026-53578 |
Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml |
27.08.2026 |
9.3 |
| CVE-2026-53579 |
Trilium: Note Import to RCE via Book Note |
28.08.2026 |
9.3 |
| CVE-2026-74820 |
Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause |
29.08.2026 |
10 |
| CVE-2026-81934 |
Redis TLS pending-data list use-after-free |
28.08.2026 |
9.2 |
| CVE-2026-16279 |
Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x |
27.08.2026 |
9.3 |
| CVE-2026-57499 |
Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE) |
27.08.2026 |
9.1 |
| CVE-2026-81094 |
mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication |
29.08.2026 |
9.3 |
| CVE-2026-81096 |
ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape |
29.08.2026 |
9.3 |
| CVE-2026-81098 |
Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport |
29.08.2026 |
9.3 |
| CVE-2026-81680 |
openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal |
27.08.2026 |
9.3 |
| CVE-2026-81681 |
openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage |
27.08.2026 |
9.3 |
| CVE-2026-81685 |
openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata |
27.08.2026 |
9.3 |
| CVE-2026-81694 |
verify-usb before 1.4.9 Output Injection via Unsanitized Filenames |
28.08.2026 |
9.3 |
| CVE-2026-81695 |
openssl_encrypt before 1.4.9 Terminal Injection via key_id |
27.08.2026 |
9.3 |
| CVE-2026-81696 |
openssl_encrypt before 1.4.9 Terminal Injection via info Command |
27.08.2026 |
9.3 |
| CVE-2026-81698 |
openssl_encrypt before 1.4.9 Shell Injection via info command |
27.08.2026 |
9.3 |
| CVE-2026-81700 |
openssl_encrypt before 1.4.9 GPG Signature Verification Bypass |
27.08.2026 |
9.3 |
| CVE-2026-81701 |
openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin |
27.08.2026 |
9.3 |
| CVE-2026-81702 |
openssl_encrypt before 1.4.9 Key Substitution via Identity Load |
27.08.2026 |
9.3 |
| CVE-2026-81706 |
openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing |
27.08.2026 |
9.3 |
| CVE-2026-81707 |
openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email |
27.08.2026 |
9.3 |
| CVE-2026-81714 |
openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass |
27.08.2026 |
9.3 |
| CVE-2026-81717 |
openssl_encrypt before 1.4.9 Integrity Bypass via Added Files |
27.08.2026 |
9.3 |
| CVE-2026-81719 |
openssl_encrypt before 1.4.9 Remote Code Execution via Plugin |
27.08.2026 |
9.3 |
| CVE-2026-81735 |
UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution |
29.08.2026 |
10 |
| CVE-2026-81826 |
Flowintel Fails to Invalidate Active Sessions After Password Change |
27.08.2026 |
9.1 |
| CVE-2026-74232 |
Zbtlink MQWrt yunmgrd Cloud C2 Implant |
27.08.2026 |
9.3 |
| CVE-2026-74233 |
Zbtlink MQWrt infosrvd Command Injection |
27.08.2026 |
9.3 |
| CVE-2026-81672 |
Multiple Vulnerabilities in TOOOLS' iSquad |
27.08.2026 |
9.3 |
| CVE-2026-81673 |
Multiple Vulnerabilities in TOOOLS' iSquad |
27.08.2026 |
9.3 |
| CVE-2026-81674 |
Multiple Vulnerabilities in TOOOLS' iSquad |
27.08.2026 |
9.3 |
| CVE-2026-81675 |
Multiple Vulnerabilities in TOOOLS' iSquad |
27.08.2026 |
9.3 |
| CVE-2026-32479 |
WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability |
28.08.2026 |
9.3 |
| CVE-2026-32566 |
WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability |
27.08.2026 |
9.8 |
| CVE-2026-59354 |
Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata |
28.08.2026 |
9.6 |
| CVE-2026-78260 |
WordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability |
28.08.2026 |
9.3 |
| CVE-2026-78274 |
WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability |
27.08.2026 |
9.1 |
| CVE-2026-78286 |
WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability |
28.08.2026 |
9.8 |
| CVE-2026-78288 |
WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability |
27.08.2026 |
9.3 |
| CVE-2026-78292 |
WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability |
27.08.2026 |
9.8 |
| CVE-2026-59270 |
Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces |
28.08.2026 |
9.4 |
| CVE-2026-77991 |
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 |
28.08.2026 |
9.4 |
| CVE-2026-65956 |
KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF |
29.08.2026 |
10 |
| CVE-2026-65641 |
|
27.08.2026 |
9.3 |
| CVE-2026-60004 |
|
26.08.2026 |
9.8 |
| CVE-2026-19485 |
Bucket Squatting in Vertex AI Search for Commerce |
26.08.2026 |
9.3 |
| CVE-2026-70419 |
|
26.08.2026 |
9.1 |
| CVE-2026-54569 |
SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core |
26.08.2026 |
9.8 |
| CVE-2026-80428 |
ILIAS before 9.22, 10.10 and 11.3 Unauthenticated PHP Object Injection via Shibboleth Logout Endpoint |
29.08.2026 |
9.3 |
| CVE-2026-81032 |
NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration |
26.08.2026 |
9.3 |
| CVE-2026-75062 |
Eval Injection in google/langfun via default lf.query protocol |
27.08.2026 |
9.2 |
| CVE-2026-74737 |
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG |
27.08.2026 |
9.8 |
| CVE-2026-74743 |
macvlan: inherit needed_headroom and needed_tailroom from lowerdev |
27.08.2026 |
9.8 |
| CVE-2026-74744 |
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev |
27.08.2026 |
9.8 |
| CVE-2026-74746 |
netfilter: flowtable: publish GC-visible tuple last |
27.08.2026 |
9.8 |
| CVE-2026-74751 |
riscv: lib: Fix ZBB strnlen reading past count boundary |
27.08.2026 |
9.4 |
| CVE-2026-74752 |
sctp: validate cookie AUTH state before use |
27.08.2026 |
9.8 |
| CVE-2026-80519 |
ovpn: finish crypto callback cleanup before peer release |
27.08.2026 |
9.8 |
| CVE-2026-80528 |
ceph: avoid fs reclaim while using current->journal_info |
27.08.2026 |
9.8 |
| CVE-2026-80551 |
s390/vfio_ccw: Ensure first IDAW remains constant |
27.08.2026 |
9.3 |
| CVE-2026-80554 |
s390/vfio_ccw: Limit the number of channel program segments |
27.08.2026 |
9.3 |
| CVE-2026-80557 |
libceph: fix OOB read in decode_watchers() via missing bounds check |
27.08.2026 |
9.8 |
| CVE-2026-80558 |
libceph: Avoid using invalid osd indices from primary_temp |
27.08.2026 |
9.8 |
| CVE-2026-80561 |
libceph: fix multiple unsafe decodes in decode_locker() |
27.08.2026 |
9.8 |
| CVE-2026-80585 |
mptcp: fastopen: only mark MPTFO subflows with SYN data |
27.08.2026 |
9.4 |
| CVE-2026-80586 |
mptcp: options: reset DSS fields in case of unexpected size |
27.08.2026 |
9.8 |
| CVE-2026-80587 |
mptcp: avoid combining some incoming suboptions |
27.08.2026 |
9.8 |
| CVE-2026-80589 |
block: stop the timeout timer when releasing a never added disk |
27.08.2026 |
9.8 |
| CVE-2026-54523 |
Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system |
26.08.2026 |
9.6 |
| CVE-2026-75896 |
Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's Liderahenk |
26.08.2026 |
9.1 |
| CVE-2026-12717 |
Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection |
26.08.2026 |
9.4 |
| CVE-2026-18080 |
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment |
26.08.2026 |
9.8 |
| CVE-2026-77532 |
|
26.08.2026 |
9.6 |
| CVE-2026-77554 |
|
26.08.2026 |
10 |
| CVE-2026-77557 |
|
26.08.2026 |
9.8 |
| CVE-2026-77549 |
|
27.08.2026 |
9 |
| CVE-2026-77550 |
|
27.08.2026 |
10 |
| CVE-2026-77551 |
|
26.08.2026 |
9 |
| CVE-2026-77552 |
|
26.08.2026 |
9.8 |
| CVE-2026-77553 |
|
26.08.2026 |
9.9 |
| CVE-2026-77546 |
|
26.08.2026 |
9.9 |
| CVE-2026-77547 |
|
26.08.2026 |
9.9 |
| CVE-2026-77548 |
|
26.08.2026 |
9.9 |
| CVE-2026-80203 |
Grav before 1.0.18 Authentication Bypass via Scoped API Key |
28.08.2026 |
9.3 |
| CVE-2026-80204 |
Grav before 1.0.18 Authentication Bypass via Scoped API Key |
26.08.2026 |
9.3 |
| CVE-2026-77542 |
|
26.08.2026 |
9.1 |
| CVE-2026-77543 |
|
26.08.2026 |
9.9 |
| CVE-2026-77545 |
|
27.08.2026 |
9 |
| CVE-2026-80349 |
TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter |
26.08.2026 |
9.3 |
| CVE-2026-77539 |
|
27.08.2026 |
9.1 |
| CVE-2026-77540 |
|
27.08.2026 |
9.1 |
| CVE-2026-77541 |
|
26.08.2026 |
9.1 |
| CVE-2026-59683 |
OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings |
26.08.2026 |
9.3 |
| CVE-2026-77535 |
|
26.08.2026 |
9.1 |
| CVE-2026-77536 |
|
27.08.2026 |
9.9 |
| CVE-2026-77537 |
|
26.08.2026 |
10 |
| CVE-2026-77534 |
|
27.08.2026 |
9.9 |
| CVE-2026-77533 |
|
26.08.2026 |
9.9 |
| CVE-2026-80235 |
Thinking Software Technology｜EFence - Arbitrary File Upload |
26.08.2026 |
9.3 |
| CVE-2026-18431 |
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write |
27.08.2026 |
9.8 |
| CVE-2026-15203 |
Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software |
26.08.2026 |
9.3 |
| CVE-2026-19632 |
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure |
26.08.2026 |
9.8 |
| CVE-2026-80202 |
Kimai before 2.56.0 Authorization Bypass via TimesheetVoter |
26.08.2026 |
9.3 |
| CVE-2026-79911 |
TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow |
27.08.2026 |
10 |
| CVE-2026-80138 |
ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter |
26.08.2026 |
9.2 |
| CVE-2026-62862 |
TypeBot: Account takeover via brute-forceable 6-digit magic-link code |
26.08.2026 |
9.1 |
| CVE-2026-65083 |
|
26.08.2026 |
9.9 |
| CVE-2026-65093 |
|
26.08.2026 |
9.9 |
| CVE-2026-80104 |
DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename |
29.08.2026 |
9.3 |
| CVE-2026-45018 |
Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution |
25.08.2026 |
9.8 |
| CVE-2026-78379 |
Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools |
25.08.2026 |
9.2 |
| CVE-2026-79787 |
Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature |
25.08.2026 |
9.3 |
| CVE-2026-76193 |
Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) |
27.08.2026 |
10 |
| CVE-2026-76195 |
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) |
27.08.2026 |
10 |
| CVE-2026-76197 |
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) |
27.08.2026 |
10 |
| CVE-2026-55640 |
Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default ) |
25.08.2026 |
9.1 |
| CVE-2022-51000 |
Nokogiri before 1.13.2 Multiple Vulnerabilities via libxml2 libxslt |
28.08.2026 |
9.3 |
| CVE-2024-58378 |
Nokogiri before 1.16.2 Use-After-Free via xmlTextReader |
28.08.2026 |
9.3 |
| CVE-2025-71407 |
Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free |
25.08.2026 |
9.3 |
| CVE-2026-55536 |
Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92) |
28.08.2026 |
9.1 |
| CVE-2026-55546 |
QWED-MCP: Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input |
25.08.2026 |
9.8 |
| CVE-2026-79675 |
NLTK before 3.10.3 JVM Argument Injection via Per-Call Options |
27.08.2026 |
9.3 |
| CVE-2026-79774 |
Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy |
26.08.2026 |
9.3 |
| CVE-2026-79782 |
rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect |
28.08.2026 |
9.3 |
| CVE-2026-16286 |
File Upload in TRTEK Software's Software Repository Management |
25.08.2026 |
9.8 |
| CVE-2026-77998 |
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 |
26.08.2026 |
10 |
| CVE-2026-57909 |
WatchGuard Agent path traversal allows unauthenticated remote code execution |
26.08.2026 |
9.4 |
| CVE-2026-57910 |
WatchGuard Agent improper authentication allows unauthenticated remote code execution |
25.08.2026 |
9.3 |
| CVE-2026-79657 |
NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization |
25.08.2026 |
9.3 |
| CVE-2026-79664 |
Ech0 before 4.7.3 Access Token Revocation Bypass |
25.08.2026 |
9.1 |
| CVE-2026-78570 |
Total Donations <= 2.0.5 - Unauthenticated Privilege Escalation |
27.08.2026 |
9.8 |
| CVE-2026-63586 |
Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface |
25.08.2026 |
9.3 |
| CVE-2026-77136 |
Server-Side Template Injection in extension "powermail" (powermail) |
25.08.2026 |
9.5 |
| CVE-2026-77138 |
Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) |
25.08.2026 |
9.3 |
| CVE-2026-78568 |
Total Donations <= 2.0.5 - Unauthenticated SQL Injection |
25.08.2026 |
9.8 |
| CVE-2026-78477 |
Jawn <= 1.4.2 - Unauthenticated Privilege Escalation |
25.08.2026 |
9.8 |
| CVE-2026-13214 |
Stack buffer overflow in OCPP GetConfiguration key parsing |
25.08.2026 |
9.8 |
| CVE-2026-56705 |
Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection |
25.08.2026 |
9.3 |
| CVE-2026-56710 |
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock |
25.08.2026 |
9.3 |
| CVE-2026-72699 |
Grav Login Plugin before 3.9.1 Email Enumeration via Registration |
29.08.2026 |
9.3 |
| CVE-2026-72702 |
Grav CMS before 2.0.16 Origin Validation Bypass via Referer |
28.08.2026 |
9.3 |
| CVE-2026-78676 |
GitPython before 3.1.59 Remote Code Execution via Config Injection |
26.08.2026 |
9.3 |
| CVE-2026-78683 |
NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization |
25.08.2026 |
9.4 |
| CVE-2026-32554 |
WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability |
25.08.2026 |
9.3 |
| CVE-2026-32555 |
WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability |
25.08.2026 |
9.3 |
| CVE-2026-32559 |
WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability |
27.08.2026 |
9.9 |
| CVE-2026-32563 |
WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability |
25.08.2026 |
9.8 |
| CVE-2026-77337 |
CakePHP: Potential Authentication bypass with CookieAuthenticator |
25.08.2026 |
9.1 |
| CVE-2026-78262 |
WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability |
27.08.2026 |
9.8 |
| CVE-2026-78265 |
WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability |
25.08.2026 |
9.8 |
| CVE-2026-78267 |
WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability |
27.08.2026 |
9.8 |
| CVE-2026-77635 |
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver |
25.08.2026 |
9.2 |
| CVE-2026-78555 |
RansomLook API Key Disclosure Through /admin/apikeys HTML Source |
24.08.2026 |
9.4 |
| CVE-2026-39975 |
Combodo iTop: Remote code execution using external auth variable value |
24.08.2026 |
9.4 |
| CVE-2026-76835 |
OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set |
29.08.2026 |
9.3 |
| CVE-2026-71914 |
DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm |
24.08.2026 |
9.3 |
| CVE-2026-71921 |
DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi |
27.08.2026 |
9.3 |
| CVE-2025-36939 |
|
24.08.2026 |
10 |
| CVE-2026-77915 |
rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php |
29.08.2026 |
9.3 |
| CVE-2026-76070 |
Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter |
24.08.2026 |
9.3 |
| CVE-2026-76071 |
Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter |
26.08.2026 |
9.3 |
| CVE-2026-78387 |
RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification |
24.08.2026 |
9.4 |
| CVE-2026-59568 |
Remote Code Execution |
25.08.2026 |
9.1 |
| CVE-2026-67602 |
phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache |
29.08.2026 |
9.3 |
| CVE-2026-59564 |
Authentication bypass between ZCC and client connector portal |
25.08.2026 |
9.1 |
| CVE-2026-77995 |
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 |
25.08.2026 |
10 |
| CVE-2026-78370 |
RansomLook Unauthenticated Database Export Exposes Private Data |
24.08.2026 |
9.2 |
| CVE-2026-78372 |
RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data |
24.08.2026 |
9.2 |
| CVE-2026-78365 |
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification |
24.08.2026 |
9.3 |
| CVE-2026-28165 |
WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability |
24.08.2026 |
9.8 |
| CVE-2026-32551 |
WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability |
24.08.2026 |
9.3 |
| CVE-2026-32558 |
WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability |
24.08.2026 |
9.8 |
| CVE-2026-66587 |
WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability |
24.08.2026 |
9.8 |
| CVE-2026-66648 |
WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability |
24.08.2026 |
9.8 |
| CVE-2026-66650 |
WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability |
24.08.2026 |
9.8 |
| CVE-2026-66897 |
Instance template path traversal allows arbitrary host file write as root |
25.08.2026 |
9.9 |
| CVE-2026-77994 |
Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 |
25.08.2026 |
9.3 |
| CVE-2026-78251 |
DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory |
27.08.2026 |
9.3 |
| CVE-2026-78211 |
4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command Injection |
24.08.2026 |
9.3 |
| CVE-2026-78168 |
EFM ipTIME T24000M Session Validation httpcon_check_session_url improper authentication |
27.08.2026 |
9.3 |
| CVE-2026-78169 |
UTT HiPER 1250GW HTTP Request aspRemoteApConfTempSend strcpy stack-based overflow |
24.08.2026 |
9.4 |
| CVE-2026-78167 |
EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication |
24.08.2026 |
10 |
| CVE-2026-78207 |
exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization |
29.08.2026 |
9.3 |
| CVE-2026-5388 |
justhtml before 1.15.0 Multiple Security Issues |
26.08.2026 |
9.3 |
| CVE-2026-7808 |
justhtml before 1.16.0 Multiple Security Issues via Sanitization |
24.08.2026 |
9.3 |
| CVE-2026-8445 |
justhtml before 1.12.0 Sanitizer Bypass via Markdown |
24.08.2026 |
9.3 |
| CVE-2026-78155 |
Untrusted Search Path in StackGres |
24.08.2026 |
9.9 |