CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- rocq-prover rocqRocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument6.8 Medium
- rocq-prover rocqRocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport6.8 Medium
- rocq-prover rocqRocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Calls6.8 Medium
- rocq-prover rocqCoq and Rocq Prover Print Assumptions Omits Unsafe Universe Checking Inlined Through Parameter Inline6.8 Medium
- authlib joserfcjoserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)6.5 Medium
- lepture mistuneMistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown7.5 High
- nettyNetty: MQTT Topic Name and Client ID Validation Bypass3.5 Low
- sworddut mcp-ffmpeg-helpersworddut mcp-ffmpeg-helper Tool handlers.ts handleToolCall os command injection4.8 Medium
- sakaiproject sakaiSakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image6.5 Medium
- dell alienware area 51m r2, alienware area-51 aat2265, alienware aurora r13 +14 more +16 moreDell Client BIOS contains an Improper Link Resolution Before File Access ('Link Following')...6.6 Medium
- ransomlookRansomLook API Key Disclosure Through /admin/apikeys HTML Source9.4 Critical
- sakaiproject sakaiSakai Conversations has a Stored XSS Issue8.7 High
- ransomlookInsecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook7.0 High
- fasterxml com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind +1 morejackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)5.3 Medium
- dolibarr, dolibarr erp\/crm +1 moreDolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action5.3 Medium
- dell thinos, thinos 10 +1 moreDell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability....7.8 High
- ibm mcp-context-forgeMCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server10.0 Critical
- ransomlookRansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts8.8 High
- dolibarrDolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints7.1 High
- dolibarrDolibarr < 24.0.0 Users REST API SQL Injection via filter parameter7.1 High
- dolibarrDolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint7.1 High
- dolibarrDolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint7.1 High
- dolibarrDolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes7.1 High
- dolibarrDolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint7.2 High
- dolibarrDolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route7.1 High
- combodo itopCombodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences8.7 High
- dolibarrDolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset8.6 High
- dolibarrDolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template5.1 Medium
- combodo itopCombodo iTop: Reflected XSS in dashboard revert8.9 High
libarchiveSUSESecurity update for libarchiveNo scorelibarchiveSUSESecurity update for libarchiveNo score- combodo itopCombodo iTop: Remote code execution using external auth variable value9.4 Critical
libarchiveopenSUSESecurity update for libarchiveNo score- devolutions remote desktop managerInsufficient verification of data authenticity in the IronVNC client in Devolutions Remote...4.3 Medium
- tp-link systems inc. archer be3600 v1Command Injection in Parent Control of TP-Link Archer BE3600 v18.5 High
- humansignal label-studioLabel Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset8.7 High
- continuedev continueContinue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode8.3 High
- hieventsdev hi.eventsHi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects8.4 High
- baserowBaserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name5.3 Medium
- azuracastAzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass8.7 High
- tp-link systems inc. archer be800 v1Command Injection Vulnerability in VPN connection of Archer BE8008.5 High
- tp-link systems inc. archer be800 v1, archer ax75 v1, archer be3600 v1 +2 moreCommand Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices8.7 High
- johnson controls metasys 14, metasys 15 +1 moreImproper neutralization of input during web page generation ('cross-site scripting')...6.1 Medium
- gimp, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreGimp: unbounded stack vla and 21-byte stack over-read in pix (esm) loader6.1 Medium
- zephyrproject zephyrBluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register5.3 Medium
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models Buffer Overflow via mail_mailalert8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models Buffer Overflow via diag_logmail8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Edit ACE8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Add ACE8.6 High
- Show moreLoading…