CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- pglombardo passwordpusherPasswordPusher before v2.9.6 Authentication Bypass via Null Comparison6.9 Medium
- openwrt luciluci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow6.9 Medium
- nettyNetty before 4.2.16.Final SOCKS Proxy Null Byte Injection6.3 Medium
- nettyNetty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass8.7 High
- siyuan-note siyuanSiYuan before v3.7.4 Plugin Overwrite via Bazaar Install5.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate8.4 High
- siyuan-note siyuanSiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool6.9 Medium
- siyuan-note siyuanSiYuan before v3.8.0 Secret Exfiltration via http_request URL6.9 Medium
- wwbn avideoAVideo Authentication Bypass via Unkeyed Video Hash Disclosure8.7 High
- wwbn avideoWWBN AVideo Unbound Token Authorization Bypass via Gallery8.7 High
- wwbn avideoWWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php7.1 High
- wwbn avideoWWBN AVideo Authorization Bypass via Users_affiliations add.json.php7.1 High
- wwbn avideoWWBN AVideo Cross-Site Request Forgery via videoEditLight.php6.9 Medium
- jeemok better-npm-auditbetter-npm-audit OS Command Injection via registry flag8.5 High
- wwbn avideoAVideo channelToGallery.json.php Cross-Site Request Forgery5.3 Medium
- wwbn avideoAVideo feed/index.php Exposure of Channel Owner Email Address6.9 Medium
- trendnet tew-823druTRENDnet TEW-823DRU CLI Configuration Tool nvram_get command injection5.1 Medium
- metaphor creations post duplicatorPost Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication4.3 Medium
- collizo4sky kk star ratings – rate post & collect user feedbackskk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter5.3 Medium
- joomgalleryfriends.net joomgallery extension for joomlaJoomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.06.9 Medium
- joomgalleryfriends.net joomgallery extension for joomlaJoomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.08.6 High
- trendnet tew-821dapTRENDnet TEW-821DAP NTP Timezone Configuration apply_time.cgi uci_safe_get stack-based overflow10.0 Critical
- trendnet tew-821dapTRENDnet TEW-821DAP ssi upload.cgi command injection5.3 Medium
- mailgun for wordpress, unknown mailgun for wordpress +1 moreMailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys9.8 Critical
- google cloud application integrationMissing Authorization in Application Integration QueryEngineTask9.3 Critical
- opensslAEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()9.1 Critical
- unknown smilepass selfie loginSmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass9.8 Critical
- unknown social login & sharing buttons with analytics by socleverSocial Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass9.8 Critical
- unknown wp social media loginWP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow9.8 Critical
- unknown firebase authenticationFirebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim8.1 High
- quantumcloud slider hero with video background, animationSlider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers8.8 High
- unknown forminator formsForminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass6.6 Medium
- unknown forminator formsForminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite7.2 High
- themeum tutor lmsTutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path6.8 Medium
- managewp worker, unknown managewp worker +1 moreManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters8.1 High
- conekta group payment gateway, unknown conekta payment gateway +1 moreConekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery5.3 Medium
- damian góra fibosearchFiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure5.3 Medium
- unknown post grid, slider & carousel ultimatePost Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field6.8 Medium
- themeum tutor lmsTutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR2.7 Low
- rubengc automatorwp – automator plugin for no-code automations, webhooks & custom integrations in wordpressAutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action4.3 Medium
- rubengc automatorwp – automator plugin for no-code automations, webhooks & custom integrations in wordpressAutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action4.3 Medium
- themifyme themify builderThemify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action5.3 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action8.8 High
hareopenSUSEhare-0.26.0.1-1.1 on GA mediaNo scorelibtie-hash-regex-perlDebianTie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys7.5 High- basekick-labs arcArc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peer8.3 High
- basekick-labs arcArc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive8.3 High
- combodo itopCombodo iTop: Unauthenticated user can delete .readonly file6.5 Medium
- nicmx fort-validatorFORT-validator Vulnerable to RRDP Shared Snapshot Cache Poisoning7.2 High
- combodo itopCombodo iTop: Access control bypass via OQL joins7.7 High
- Show moreLoading…