CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
runcSUSESecurity update for runcNo scoredistributionSUSESecurity update for distributionNo scorerootlesskitSUSESecurity update for rootlesskitNo scorebuildahSUSESecurity update for buildahNo scorecontainerdSUSESecurity update for containerdNo score- team-alembic ash authenticationPurpose-limited JWT accepted as full bearer authentication in AshAuthentication7.6 High
- team-alembic ash authenticationReflected XSS in AshAuthentication confirmation and magic link interaction forms2.1 Low
- dassault systèmes tuleap enterprise editionUse of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.57.7 High
- furuno electric co., ltd. fa-50FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has...8.8 High
- furuno electric co., ltd. fa-50FA-50 all versions miss authentication for some configuration. An attacker with access to the...8.7 High
- cozmoslabs translatepress – translate multilingual sites with ai translationTranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor6.4 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter7.2 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)7.2 High
- roxnor metform – contact form, survey, quiz, conditional forms, form templates & custom form builder for elementorMetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting6.4 Medium
- creativemindssolutions cm map locations – visualize and share your locations in a few clicksCM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action8.8 High
- red hat directory server 11, directory server 12, directory server 13 +6 more +8 more389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos6.5 Medium
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +2 moreFile-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers6.5 Medium
- sky co., ltd. skymec it manager, skysea client view +1 moreSKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this...5.8 Medium
- sky co., ltd. skymec it manager, skysea client view +1 moreSKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this...5.8 Medium
- sky co., ltd. skymec it manager, skysea client view +1 moreA missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this...8.5 High
- sky co., ltd. skymec it manager, skysea client view +1 moreA stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager....5.8 Medium
- sky co., ltd. skymec it manager, skysea client view +1 moreSKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If...8.5 High
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System cust_del.php sql injection5.3 Medium
- cleverbrush deep, framework +1 morecleverbrush framework/deep deepExtend.ts deepExtend prototype pollution6.9 Medium
- elated-themes mane, måne +1 moreMåne <= 1.7 - Unauthenticated Local File Inclusion8.1 High
- wedevs wp project manager proWP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- peerigon unzip-crx, unzip-crx-3 +1 morepeerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal4.8 Medium
- fdawgs node-popplerFdawgs node-poppler Argument Injection index.js pdfUnite argument injection6.9 Medium
- zephyrproject zephyrZephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem image6.8 Medium
- zephyrproject zephyrStack buffer overflow in OCPP GetConfiguration key parsing9.8 Critical
- tagdiv composertagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- jegstudio gutenverse – wordpress blocks, page builder & site editorGutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute6.4 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys6.6 Medium
- roxnor fundengine – donation and crowdfunding platformFundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter6.4 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter6.1 Medium
- roxnor fundengine – donation and crowdfunding platformFundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter4.3 Medium
- infused addons infusedwoo proInfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure8.8 High
- cozythemes cozy blocks – page builder for gutenberg editor & fse with 700+ patterns, 58 blocks & templatesCozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute6.4 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter4.4 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters5.3 Medium
- buildwps ppwp – password protect pagesPassword Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- le-yan medical practice management systemLe-yan｜Medical Practice Management System - Remote Code Execution8.6 High
- nltkNLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization9.4 Critical
- nltkNLTK before 3.10.3 SSRF Protection Bypass via Proxy8.7 High
- nltkNLTK before 3.10.3 Entity Expansion DoS via ElementTree8.7 High
- nltkNLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary8.5 High
- gitpython-developers gitpythonGitPython before 3.1.59 Arbitrary File Read via TagReference.create7.1 High
- gitpython-developers gitpythonGitPython before 3.1.59 Arbitrary File Read via Repo.blame()7.1 High
- gitpython-developers gitpythonGitPython before 3.1.59 Path Traversal via separate-git-dir8.7 High
- gitpython-developers gitpythonGitPython before 3.1.59 Remote Code Execution via Config Injection9.3 Critical
- Show moreLoading…