CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- misp misp-stixCross-Document Parser State Contamination in misp-stix6.3 Medium
- spring micrometer tracingMicrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability5.3 Medium
- misp misp-stixDenial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library8.7 High
- joshnuss xml builderRound-trip Corruption via Improper Entity Escaping in xml_builder2.1 Low
- joshnuss xml builderElement and Attribute Names Injected Verbatim into XML Output in xml_builder2.1 Low
- joshnuss xml builderCDATA Section Breakout via Unsanitised ]]> in xml_builder2.1 Low
- misp misp-stixPath Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library8.8 High
- codeastro online job portalCodeAstro Online Job Portal update-profile.php unrestricted upload5.3 Medium
- cloud foundry foundation bosh cliCVE-2026-47827 – BOSH CLI Powershell Injection7.5 High
- misp misp-stixSTIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library6.9 Medium
- apache inlongApache InLong: Agent Installer — Command Injection to RCE via Default Credentials8.8 High
- apache cloudstackApache CloudStack: OS Command Injection due to unsanitized mount command8.8 High
- apache cloudstackApache CloudStack: RCE and SSRF in direct download, metalink and NFS templates8.8 High
- apache cloudstackApache CloudStack: Improper access control in Userdata reference APIs7.5 High
- apache cloudstackApache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module9.1 Critical
- apache cloudstackApache CloudStack: Unauthenticated OAuth provider client-secret disclosure7.5 High
- apache cloudstackApache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob7.5 High
- apache cloudstackApache CloudStack: LDAP provider configuration disclosure7.5 High
- apache cloudstackApache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow8.8 High
- apache cloudstackApache CloudStack: OAuth2 Token Cross-Request Leak7.5 High
- apache cloudstackApache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI9.1 Critical
- apache cloudstackApache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI4.8 Medium
- apache cloudstackApache CloudStack: Get and Run Diagnostics Command Injection8.8 High
- apache cloudstackApache CloudStack: Authenticated pre-validation SSRF in registerTemplate4.3 Medium
- apache cloudstackApache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation9.1 Critical
- apache cloudstackApache CloudStack: Webhook Deliveries Incorrect Access4.3 Medium
- apache cloudstackApache CloudStack: Authorization issue with listHostTags for domain admins2.7 Low
- apache cloudstackApache CloudStack: ProjectRole & ProjectRolePermission authorization issue7.2 High
- apache cloudstackApache CloudStack: Unauthorised comment creation and disclosure5.4 Medium
- apache cloudstackApache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP8.1 High
- @fastify/busboy, fastify fastify\/busyboy +1 more@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name5.8 Medium
- ikas technology inc. rushUnauthenticated API Allows Analytics Data Manipulation in IKAS Technology's Rush5.3 Medium
- 101gen automation web platform – notifications and otp for woocommerce, advanced country codeAutomation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure9.8 Critical
- japan science and technology agency (jst) miraikan assist app android version, miraikan assist app ios version +1 moreCross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is...5.1 Medium
- fuyaweb internet and informatics services architectpanel web admin panelAuthentication Bypass via Execution After Redirect in FuyaSoft's Architect Panel Web Management Panel7.5 High
podmanSUSESecurity update for podmanNo scorecontainerdSUSESecurity update for containerdNo scorerootlesskitSUSESecurity update for rootlesskitNo scoredockerSUSESecurity update for dockerNo scorebuildahSUSESecurity update for buildahNo scorecosignSUSESecurity update for cosignNo score- jordy meow ai engineAI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools7.2 High
- copydeleteposts duplicate postCopy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure2.7 Low
- copydeleteposts duplicate postCopy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure2.7 Low
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass8.1 High
- david lingren media library assistantMedia Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector6.8 Medium
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount2.7 Low
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API7.2 High
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint5.3 Medium
- unknown link whisper freeLink Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter6.8 Medium
- Show moreLoading…