CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
io.netty.incubator:netty-incubator-codec-bhttpMavennetty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary7.5 Highio.netty.incubator:netty-incubator-codec-bhttpMavennetty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash5.3 Mediumio.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringsslMavennetty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages8.1 High- laravel-backpack crudbackpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation6.5 Medium
- wagtailWagtail: Improper restriction handling on Pages admin API4.3 Medium
@nocobase/servernpmNocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code executionNo score- wintercms winterWinter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata5.4 Medium
- io.netty.incubator netty-incubator-codec-ohttpnetty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service8.7 High
- fleetdm fleetFleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database7.6 High
- laravel-backpack crudbackpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)8.1 High
- laravel-backpack crudbackpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted5.4 Medium
- laravel-backpack crudbackpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)7.6 High
- laravel-backpack crudbackpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk4.4 Medium
- laravel-backpack crudbackpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk8.1 High
- laravel-backpack crudbackpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver6.6 Medium
- laravel-backpack crudbackpack/crud: MyAccountController allows changing the login email without a current-password check6.5 Medium
- laravel-backpack crudbackpack/crud: Unverified password change in MyAccountController via mass assignment7.6 High
- tektoncd pipelines-as-codePipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution6.5 Medium
- tektoncd pipelines-as-codePipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header8.2 High
github.com/opentofu/opentofuGoOpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers2.6 Low- alexandre-daubois emberEmber: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI4.7 Medium
- node-opcuanode-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS7.5 High
- node-opcuanode-opcua: Missing nonce verification in UserNameIdentityToken authentication7.7 High
- muxinc next-videonext-video: Unauthenticated arbitrary file read via /api/video request handler6.9 Medium
- coderCoder before 2.34.2 Stored HTML Injection via Appearance Settings4.8 Medium
- coderCoder before 2.34.2 User Enumeration via Login Placeholder Hash6.3 Medium
kcl-libcrates.io,zoo-kclPyPI +1 moreZoo Design Studio: Memory-corruption in memory handling of lib-kcl6.9 Mediumkcl-libcrates.io,zoo-kclPyPI +1 moreZoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service6.9 Medium- merit lilin v1, tp-link dr3150 firmware, dr3220v-4g firmware +34 more +36 moreUnencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways6.3 Medium
- merit lilin v1, tp-link dr3150 firmware, dr3220v-4g firmware +34 more +36 morePre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways9.3 Critical
- tp-link dr3150 firmware, dr3220v-4g firmware, dr3650v-4g firmware +34 more +36 moreUnauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways6.0 Medium
- bunkerity bunkerwebBunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot5.9 Medium
- elated-themes frappeFrappe: User Enumeration via PDDR6.9 Medium
- elated-themes frappeFrappe: Improper Authorization in OAuth2 Consent Endpoint8.5 High
- elated-themes frappeFrappe: Mass assignment via set_value7.1 High
- elated-themes frappeFrappe: Unauthenticated Workflow approval via confirm_action6.9 Medium
- msgpack msgpack-cmsgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation5.8 Medium
- hank-ai darknetdarknet Integer Overflow in Convolutional Layer Buffer Sizing Leads to Heap Buffer Overflow8.5 High
helmSUSESecurity update for helmNo scorekubernetesSUSESecurity update for kubernetesNo scorekubernetes-oldSUSESecurity update for kubernetes-oldNo score- red hat advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +1 moreLighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label9.9 Critical
libcatalyst-plugin-static-simple-perlDebian,perl-Catalyst-Plugin-Static-SimpleMageia +1 moreCatalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable5.7 Medium- red hat advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +1 moreLighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses8.7 High
- elated-themes frappeFrappe: Missing authorization in toggle_like and mark_as_seen5.3 Medium
- comfast cf-n1-sComfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow9.4 Critical
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack8.7 High
cohttpopamPath traversal in Cohttp.Path.resolve_local_file8.7 High- django cms association django-cmsdjango CMS: Stored XSS in edit-mode plugin exception rendering4.4 Medium
- django cms association django-cmsdjango CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)6.5 Medium
- Show moreLoading…