CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- No product listedA Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall)...4.3 Medium
- No product listedA Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall)...5.4 Medium
- No product listedA SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall...4.3 Medium
- No product listedA SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit...5.4 Medium
- No product listedA Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW ...5.4 Medium
- No product listedA Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW ...5.4 Medium
- opensslQUIC Server May Trigger Double Free When Processing INITIAL Packet7.5 High
- opensslRPK Server Signature Algorithm Selection Can Dereference a Missing Certificate7.5 High
- academysoftwarefoundation openexrOpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow6.5 Medium
- cloudreveCloudreve before 4.16.1 Path Traversal via Remote Download2.3 Low
- cloudreveCloudreve before 4.16.1 Authentication Bypass via Cached Context Hint6.9 Medium
- faveo helpdeskFaveo Helpdesk Logo SettingsController.php unlink path traversal5.1 Medium
- mra13 stripe paymentsWordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- extend themes lead generation contact widget & ai chatbot: chat button, phone call, telegram, email – siteleadsWordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability7.5 High
- cozmoslabs translatepressWordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability9.8 Critical
- ruben garcia automatorwpWordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability6.5 Medium
- nexcess the events calendarWordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability9.8 Critical
- site building with toolset toolset blocksWordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability7.1 High
- nexcess event ticketsWordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- wedevs wp project managerWordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability9.8 Critical
- wp legal pages wplegalpagesWordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability7.3 High
- a cpt acpt (pro) - custom post types plugin for wordpress, acpt (pro) - custom post types plugin for wordpress +1 moreWordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability9.8 Critical
- liquidthemes booking hubWordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability8.8 High
- liquidthemes magicai for wordpress - ai text, image, chat, code, and voice generatorWordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability8.8 High
- tophive ultimateaiWordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability9.9 Critical
- microsoft boostWordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- microsoft boostWordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability9.3 Critical
- wbw woobewoo product filter proWordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability9.3 Critical
- analogwp style kitsWordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability6.5 Medium
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability8.6 High
- faveo helpdeskFaveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication6.9 Medium
- cakephp authenticationCakePHP: Potential Authentication bypass with CookieAuthenticator9.1 Critical
- red hat openshift container platform 4Cri-o: cri-o: unvalidated image env var causes daemon crash6.0 Medium
- libp2p js-libp2plibp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion7.5 High
github.com/gorilla/websocketGoGorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key6.9 Medium- autodesk 3ds maxSVG File Parsing Memory Corruption Vulnerability in Autodesk 3ds Max7.8 High
- autodesk 3ds maxFLT File Parsing Out-of-Bounds Write Vulnerability in Autodesk 3ds Max7.8 High
- autodesk 3ds maxABC File Parsing Out-of-Bounds Write Vulnerability in Autodesk 3ds Max7.8 High
- autodesk 3ds maxSVG File Parsing Out-of-Bounds Read Vulnerability in Autodesk 3ds Max5.3 Medium
- autodesk 3ds maxSVG File Parsing Stack Exhaustion Vulnerability in Autodesk 3ds Max5.5 Medium
github.com/tinfoil-factory/netfoilGonetfoil vulnerable to improper handling of untrusted DoH response data2.7 Low- cakephpCakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport6.3 Medium
- cakephpCakePHP: SmtpTransport vulnerable to CRLF header injection8.2 High
- hashicorp vault, vault enterprise +1 moreVault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths6.8 Medium
- cakephp, cakephp cakephp/database +1 moreCakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver9.2 Critical
- hexpmExplicit organization scopes survive token refresh after membership ends2.3 Low
- hexpmOAuth token exchange grants repository scopes for organizations the principal cannot access8.3 High
- filamentphp filamentFilament: App-based MFA can be bypassed when recovery codes are enabled8.1 High
- rocq-prover rocqRocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close6.8 Medium
- leanprover lean4Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variable6.8 Medium
- Show moreLoading…