CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- django cms association django-cmsdjango CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff4.3 Medium
- django cms association django-cmsdjango CMS: Clipboard copy IDOR discloses unauthorized plugin content6.5 Medium
- django cms association django-cmsdjango CMS: Structure endpoint bypasses page-view permission6.5 Medium
- vsdesk) Missing Server-Side File Extension Validation in vsDesk9.4 Critical
- django cms association django-cmsdjango CMS: Plugin move endpoint allows cyclic reparenting (DoS)7.1 High
- django cms association django-cmsdjango CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)4.8 Medium
- libeventLibevent: Null Pointer Dereference in `evws_new_session`5.7 Medium
- libeventLibevent: Unbounded memory accumulation in WebSocket server via fragmented frames7.5 High
- automattic mongooseMongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching9.1 Critical
- automattic mongooseMongoose: Path traversal in SSI #include directives enables arbitrary file read6.5 Medium
- automattic mongooseMongoose: Reflected XSS via decoded URI in directory listing render5.4 Medium
- automattic mongooseMongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE9.1 Critical
- automattic mongooseMongoose: Stored XSS via unescaped filenames in directory listing5.4 Medium
- automattic mongooseMongoose: Multipart boundary/header scan logic error in mg_http_next_multipart6.5 Medium
- automattic mongooseMongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification9.3 Critical
- libexpatExpat Out-of-Bounds Read via dtdCopy8.7 High
- automattic mongooseMongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling9.1 Critical
- elunez eladminelunez eladmin GenConfigController improper authorization5.3 Medium
- langchain-ai langgraph-checkpoint-mongodb, langgraph-store-mongodb, langchain-mongodb +2 moreLangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure7.7 High
- dropbox samlyMissing one-time-use enforcement in Samly allows replay of SAML bearer assertions9.1 Critical
- lmfit astevalasteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter5.5 Medium
- vouch vouch-proxyVouch Proxy: Unbounded Multipart Cookie Allocation DoS7.5 High
- dropbox samlyMissing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses7.6 High
- open-telemetry opentelemetry-goOpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access5.9 Medium
- velero-io veleroVelero vulnerable to file path traversal when extracting from backup's tarball5.9 Medium
- canop brootbroot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View2.4 Low
- leanprover lean4Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projections6.8 Medium
- tenda ch22Tenda CH22 formcreateFileName command injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System viewappointmentpending.php sql injection5.3 Medium
- victoriametricsVictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root6.8 Medium
- comfast cf-n1-sComfast CF-N1-S SSID Configuration mbox-config sub_44B438 stack-based overflow9.4 Critical
- unstructured-io unstructuredunstructured: Server-Side Request Forgery in the URL-based partitioning9.3 Critical
- udecode platePlate: SSRF with response disclosure in DOCX image embedding8.2 High
- t8y2 dbxdbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)9.8 Critical
- sumatrapdfreader sumatrapdfSumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files6.6 Medium
- pylons webobWebOb: Open redirect in Location header normalization via leading C0 control / space characters6.1 Medium
- codeastro apartment visitor management systemCodeAstro Apartment Visitor Management System password-recovery.php sql injection6.9 Medium
- orange-opensource hurlHurl: Cookies in Cookies section leak when redirecting to a different host6.9 Medium
- parallels ras clientParallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability7.8 High
- opf openprojectOpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields5.3 Medium
- parallels ras clientParallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability7.8 High
- parallels ras clientParallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability7.8 High
- adminerAdminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability7.2 High
- hugging face pytorch image modelsHugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- gimpGIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- gimpGIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability7.8 High
- gstreamerGStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability7.8 High
- gstreamerGStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- gstreamerGStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- gstreamerGStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- Show moreLoading…