CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- jfrog artifactorySSRF In CocoaPods Via JFrog Artifactory External Dependency3.5 Low
- gemelo-ai vocosVocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration8.6 High
- rclonerclone before 1.75.0 Authentication Bypass via pprof6.9 Medium
- rclonerclone Archive Backend SquashFS Parser Denial of Service7.1 High
- sparklemotion nokogiriNokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args8.7 High
- nltkNLTK before 3.10.3 Path Traversal via Symlink Bypass8.2 High
- nltkNLTK before 3.10.3 JVM Argument Injection via Per-Call Options9.3 Critical
- nltkNLTK 3.10.2 Path Traversal via corpus-reader constructors8.8 High
- mervinpraison praisonaiPraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret8.2 High
- mervinpraison praisonaiPraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete8.6 High
- jfrog artifactoryPotential unauthorized repository migration in JFrog Artifactory7.6 High
- mervinpraison praisonaiPraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location7.1 High
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morezipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits2.1 Low
- jfrog artifactoryServer-Side Request Forgery Via VCS remote download in JFrog Artifactory8.5 High
- mervinpraison praisonaiPraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced8.8 High
- mervinpraison praisonaiPraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation6.8 Medium
- mervinpraison praisonaiPraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-401147.1 High
- mervinpraison praisonaiPraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated7.3 High
- mintyitanium lost-auctionMintyItanium Lost-Auction takes items like barrier blocks out from search GUI5.3 Medium
- mervinpraison praisonaiPraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks7.1 High
- red hat ansible automation platform 2Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction6.4 Medium
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool6.1 Medium
- mervinpraison praisonaiPraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution8.6 High
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)8.5 High
- mervinpraison praisonaiPraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)6.5 Medium
- mervinpraison praisonai, praisonaiagents +1 morepraisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)8.2 High
- mervinpraison praisonaiPraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server6.9 Medium
- trtek technological products computer software hardware industry and trade limited company software repository managementFile Upload in TRTEK Software's Software Repository Management9.8 Critical
- gnu wgetDenial of Service in GNU wget5.1 Medium
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: SSRF via redirect-following in praisonaiagents web_crawl7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreSos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write7.8 High
- fishcodetech mutekiFishCodeTech Muteki Default Local Worker Backend settings.json os command injection5.3 Medium
- dekdee adobe-xd-mcpdekdee adobe-xd-mcp file-access-from-request Endpoint xd-parser.ts path traversal6.9 Medium
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana4.2 Medium
- macrozheng mallmacrozheng mall quantity OmsCartItemServiceImpl.updateQuantity logic error5.3 Medium
- crater-invoice-inc craterCrater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint8.7 High
- miniorange.com saml sp single sign on – login with adfs extension for joomla, saml sso basic for joomla extension for joomla, saml sso enterprise for joomla extension for joomla +4 more +6 moreJoomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Si…10.0 Critical
- liketrek trekliketrek TREK Journey Photo Proxy validateShareTokenForAsset authorization6.3 Medium
- liketrek trekliketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal6.3 Medium
openssl-3-livepatchesSUSESecurity update for openssl-3-livepatchesNo score- liketrek trekliketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authentication6.3 Medium
- yootheme.com yootheme pro extension for joomlaJoomla Extension - yootheme.com - Authenticated, privileged information disclosure about site modules YOOtheme Pro 1.0.0-5.0.405.1 Medium
- yootheme.com yootheme pro extension for joomlaJoomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.417.5 High
- watchguard agentWatchGuard Agent improper authentication allows unauthenticated remote code execution9.3 Critical
- watchguard agentWatchGuard Agent path traversal allows unauthenticated remote code execution9.4 Critical
- lin-snow ech0Ech0 before 4.5.1 Authorization Bypass via Session Tokens8.7 High
- lin-snow ech0Ech0 before 5.0.1 Denial of Service via Accept-Language8.7 High
- nltkNLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization9.3 Critical
- vllmvLLM before 0.27.0 Denial of Service via DeepStream Backend6.9 Medium
- liketrek trekliketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection5.3 Medium
- Show moreLoading…