CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- combodo itopCombodo iTop: Improper access control in ajax.render.php and ajax.document.php6.5 Medium
- combodo itopCombodo iTop: Authentication bypass in exec.php allows PHP file execution8.6 High
- combodo itopCombodo iTop: Information disclosure in ajax.render.php3.5 Low
- perber leafwikiLeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)4.8 Medium
- perber leafwikiFileWiki has path traversal in RenameAsset via unsanitized oldFilename parameter8.8 High
- perber leafwikiLeafWiki Vulnerable to Privilege Escalation via User Self-Service Update8.8 High
- combodo itopCombodo iTop: Reflected XSS in foreign key search criteria8.8 High
- combodo itopCombodo iTop: Object can be locked by a user without write permissions4.3 Medium
- cenodude crosswatchCrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)5.3 Medium
- combodo itopCombodo iTop: Unauthorized access to object information via search operation8.8 High
- typemillTypemill has Stored HTML Attribute Injection in Metadata Fields4.6 Medium
- 4xmen xshopxShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution9.1 Critical
- jsonata-js jsonataJSONata: Arbitrary Code Execution via crafted JSONata expressions9.3 Critical
- h2o picotlspicotls has infinite recursion in the minicrypto ASN.1 decoder5.5 Medium
- combodo itopCombodo iTop: Reflected XSS in universal search8.0 High
- michaelrsweet pdfioPDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting7.1 High
- esri portal for arcgisstored cross site scripting issue in Esri Portal for ArcGIS5.5 Medium
- esri portal for arcgisreflected cross site scripting vulnerability in Esri Portal for ArcGIS6.1 Medium
- esri portal for arcgisstored cross site scripting issue in Esri Portal for ArcGIS6.1 Medium
- esri portal for arcgisstored cross site scripting issue in Esri Portal for ArcGIS6.1 Medium
- esri portal for arcgisHTML injection vulnerability in Esri Portal for ArcGIS3.8 Low
- combodo itopCombodo iTop: Reflected XSS in tag admin8.0 High
- jsonata-js jsonataJSONata: Arbitrary Code Execution via crafted JSONata expressions9.3 Critical
- esri portal for arcgisstored cross site scripting issue in Esri Portal for ArcGIS5.5 Medium
- esri portal for arcgisstored cross site scripting issue in Esri Portal for ArcGIS5.5 Medium
- esri portal for arcgisstored cross site scripting issue in Esri Portal for ArcGIS5.5 Medium
- esri portal for arcgisHTML injection vulnerability in Esri Portal for ArcGIS5.4 Medium
- esri portal for arcgismissing authentication vulnerability in Esri Portal for ArcGIS5.3 Medium
- jsonata-js jsonataJSONata: Arbitrary Code Execution via crafted JSONata expressions9.3 Critical
- esri portal for arcgisinformation disclosure vulnerability in Esri Portal for ArcGIS5.9 Medium
- esri portal for arcgisHTML injection vulnerability in Esri Portal for ArcGIS3.5 Low
- esri portal for arcgisinformation disclosure vulnerability in Esri Portal for ArcGIS5.9 Medium
- getkin kin-openapikin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding8.7 High
- getkin kin-openapikin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS7.5 High
- yourlsYOURLS: Stored XSS in referrer statistics chart via crafted Referer header8.2 High
- combodo itopCombodo iTop: Reflected XSS in synchro/synchro_import.php8.0 High
- combodo itopCombodo iTop: Reflected XSS in dashboard save7.1 High
- xorbits inferenceXinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing10.0 Critical
- runtipiRuntipi: Authenticated arbitrary file write via backup restore symlink planting6.5 Medium
- runatlantis atlantisAtlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation8.1 High
- phalcon cphalconPhalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)9.2 Critical
- gnu emacsGNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader6.9 Medium
- microsoft ufoMicrosoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution8.8 High
- combodo itopCombodo iTop: Reflected XSS in run_query.php8.0 High
- keystonejs keystoneKeystone: `graphql.maxTake` bypass with negative `take`7.5 High
- geotoolsGeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers9.8 Critical
- kepano defuddleDefuddle: XSS via unescaped attribute interpolation in site extractors8.2 High
- facebookresearch hydraHydra: hydra.utils.instantiate with untrusted config can lead to code execution7.8 High
- aws amazon opensearch service, opensearch dashboards dashboards-observability plugin +1 moreStored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards6.2 Medium
- combodo itopCombodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter7.3 High
- Show moreLoading…