CVEs published in August 2026
12,183 vulnerabilities, 1,784 critical, 23 exploited.
- redport optimizer wxa-203, optimizer wxa-213, optimizer wxa-223 +2 more RedPort Optimizer wXa-223 System Clock datetime.php exec command injection 9.4 Critical
-
mysql2npm,@rootio/mysql2Root +1 more MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials 8.2 High - qvidium opera11 QVidium Opera11 CGI Script net_tr.cgi command injection 10.0 Critical
- hyperledger-firefly firefly hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery 6.9 Medium
- dokploy Dokploy Settings application.ts writeTraefikConfigInPath path traversal 9.4 Critical
- py-pdf pypdf pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace 6.9 Medium
- shopex ecshop ShopEx ECShop flow.php flow_update_cart sql injection 6.9 Medium
- tornadoweb tornado Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop 7.5 High
- sulu Sulu: Stored XSS via media download inline-disposition override 5.4 Medium
- ellite wallos Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export 4.6 Medium
- ellite wallos Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user) 4.3 Medium
- sulu Sulu: Media move/update authorization bypass (IDOR) 5.3 Medium
- sulu Sulu: Fix authorization bypass when creating preview links 5.3 Medium
- ellite wallos Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php` 8.2 High
- shopex ecshop ShopEx ECShop pack.php check_img_type unrestricted upload 6.9 Medium
- ellite wallos Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings 3.5 Low
- pnpm pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install 7.5 High
- devtron-labs devtron Devtron through 2.2.0 Missing Authorization via webhook API token endpoint 8.7 High
- pnpm pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph 7.1 High
- cu silicon cu silicon edit Endpoint views.py create_app missing authentication 6.9 Medium
- smarty-php smarty Smarty: SSRF via redirect bypass of trusted_uri using {fetch} 6.9 Medium
- getkirby kirby Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling 8.2 High
- ellite wallos Wallos: OIDC account takeover via email-based account linking without `email_verified` check 8.1 High
- getkirby kirby Kirby: Access to image files outside of the site root via path traversal in the media handling 6.9 Medium
- ellite wallos Wallos: SSRF via OIDC Token/UserInfo URL Configuration 8.5 High
- the webkitgtk team webkitgtk, webkit, red hat enterprise linux 6 +13 more +15 more Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature 8.8 High
- getkirby kirby Kirby: File upload permissions are not checked during processing of chunk data 7.1 High
- kishan0725 hospital-management-system kishan0725 Hospital-Management-System search.php sql injection 6.9 Medium
- ellite wallos Wallos: Zip Slip path traversal in database restore writes files to webroot 8.5 High
- silk themes newspapers x WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability 10.0 Critical
- ellite wallos Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port 8.2 High
- saad iqbal post smtp WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability 5.4 Medium
- easycorp easyadminbundle EasyAdmin custom-action dispatcher bypasses access_control on other routes 8.1 High
- hp inc imagediags HP ImageDiags - Potential Escalation of Privilege 7.0 High
- studio-42 elfinder elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE) 8.1 High
- ellite wallos Wallos: Unauthenticated database replacement via import endpoint on fresh install 8.2 High
- miniorange wordpress social login and register WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability 7.1 High
- siteground security WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability 8.1 High
- tickera WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability 9.8 Critical
- metagauss registrationmagic WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability 7.4 High
- iova.mihai slicewp WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability 7.1 High
- metagauss registrationmagic WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability 7.1 High
- hashthemes hash form WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability 10.0 Critical
- the4 kalles addons WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- highwarden super store finder WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability 7.1 High
- tailored media tools WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability 7.1 High
- acato email essentials WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability 7.1 High
- unknown throws spam away WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability 9.3 Critical
- magepeopleteam booking and rental manager WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability 6.5 Medium
- ownerrez api WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability 6.3 Medium
- Show olderLoading…