CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- microchip sama5d4SAMA5D44 Fault Injection Vulnerability7.3 High
- hp inc easy start for macosHP Easy Start for macOS - Security Update7.7 High
- hp inc easy start for macosHP Easy Start for macOS - Security Update7.7 High
- hp inc easy start for macosHP Easy Start for macOS - Security Update8.5 High
- zephyrproject zephyrZephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id8.8 High
- zephyrproject zephyrUninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder5.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAwx: notification backends allow ssrf and credential leakage7.7 High
- netis systems nc63Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter9.3 Critical
- netis systems nc63Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter9.3 Critical
- hclsoftware hcl hiveHCL Hive is affected by incorrect default permissions7.5 High
- craftcms cmsAuthenticated RCE via `condition.config` JSON cleanse bypass8.7 High
- bookstackapp bookstackBookStack < 26.05.4 Broken Access Control via Image Gallery API5.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAwx: project archive extraction allows path traversal file writes7.2 High
- hclsoftware hcl hiveHCL Hive is affected by a use of vulnerable third-party components7.5 High
- konami metal gear online 3Konami's Metal Gear Online 3 contains a heap-based buffer overflow9.1 Critical
- horde impHorde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name5.1 Medium
- network optix nx witness vmsCross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name8.0 High
- zephyrproject zephyrTOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory6.4 Medium
- black duck blackduck-c-cppImproper Neutralization of Special Elements used in an OS Command in the package manager...7.5 High
- tim solutions flowTIM Flow < 26.0.6 Unauthorized SQL Query Execution via Dashboard Export Endpoint7.1 High
- black duck blackduck-c-cppInvocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17...7.1 High
- hclsoftware hcl hiveHCL Hive is affected by a missing rate limit5.3 Medium
- tim solutions flowTIM Flow < 26.0.6 CRLF Injection via rt Parameter8.5 High
- ransomlookStored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook8.8 High
- ransomlookRansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification9.4 Critical
- phpipamphpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache9.3 Critical
- ransomlookUnauthenticated Disclosure of Scraping Credentials and Bypass Configuration via RansomLook API8.7 High
- grafana ossCVE-2026-17033 CVE Record6.8 Medium
- ransomlookRansomLook Analysis PDF Generation Allows Server-Side Request Forgery and Arbitrary Local File Access8.2 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: rpmbuild gettarspec() crafted tar member name → macro injection7.0 High
- zscaler client connectorRemote Code Execution9.1 Critical
- hclsoftware hcl hiveHCL Hive is affected by use of a cryptographic primitive with a risky implementation5.3 Medium
- zscaler client connectorLocal privilege escalation8.8 High
- zscaler client connectorLocal denial-of-service8.4 High
- zscaler client connectorLocal and kernel denial-of-service8.8 High
- zscaler client connectorAuthentication bypass between ZCC and client connector portal9.1 Critical
- ransomlookRansomLook Arbitrary File Read via Path Traversal in Post screen Field8.2 High
- the webkitgtk team webkitgtk, webkit, red hat enterprise linux 6 +13 more +15 moreWebkitgtk: use-after-free of jscvalue function parameters8.8 High
- ransomlookPrivate Group and Market Posts Disclosed Through Public Notification Channels in RansomLook8.7 High
- ransomlookRedis Glob Pattern Injection Allows Unauthorized Enumeration of Private Ransomlook Data6.9 Medium
- hclsoftware hcl hiveHCL Hive is affected by use of a cryptographic primitive with a risky implementation7.4 High
- bytebot-ai bytebotbytebot-ai bytebot Agent Execution Workflow infinite loop5.3 Medium
- nektos actact 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend8.7 High
- cthackers adm-zipadm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction6.8 Medium
- webpack webpack-dev-middlewarewebpack-dev-middleware before 7.4.6 and 8.3.0 Path Traversal via Non-Slash-Terminated publicPath8.3 High
- flairFlair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load8.4 High
- mercadopagoMercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients8.8 High
- xorbits inferenceXinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders8.7 High
- ransomlookRansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data9.2 Critical
- miniorange.com login with keycloak oauth single sign-on (sso) (free) extension for joomla, miniorange oauth client (free) extension for joomla, oauth single sign-on – oidc sso | login with azure ad (free) extension for joomla +1 more +3 moreJoomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Sing…10.0 Critical
- Show moreLoading…