CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)10.0 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreEmacs: emacs: command injection via crafted filenames in tramp7.8 High
- ni labviewOut-of-Bounds Write Vulnerability in NI LabVIEW when loading VI8.5 High
- academysoftwarefoundation openexrOpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin7.1 High
- ni labviewOut-of-Bounds Read Vulnerability in NI LabVIEW when loading VI8.5 High
- ni labviewOut-of-Bounds Read Vulnerability in NI LabVIEW when loading VI8.5 High
- ni labviewOut-of-Bounds Read Vulnerability in NI LabVIEW when loading VI8.5 High
- academysoftwarefoundation openexrOpenEXR: exrmetrics deep pixelmode heap buffer overflow7.1 High
- webkul qloappsWebkul QloApps SQL injection8.6 High
- webkul qloappsWebkul QloApps SQL injection8.6 High
- ni labviewOut-of-Bounds Read Vulnerability in NI LabVIEW when loading VI8.5 High
- webkul qloappsWebkul QloApps improper file upload validation8.6 High
- academysoftwarefoundation openexrOpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) builds7.1 High
- academysoftwarefoundation openexrOpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write7.1 High
- ni labviewOut-of-Bounds Write Vulnerability in NI LabVIEW when loading VI8.5 High
- that1drifter browse-mcpbrowse-mcp: Arbitrary file write via unconfined download and state paths8.6 High
- qwed-ai qwed-verificationQWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`8.8 High
- kaltura html5 video player, html5lib libraryCVE-2026-199137.5 High
- kaltura html5 video player, html5 libraryCVE-2026-199129.8 Critical
- node-modules urlliburllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage7.5 High
- nvidia unified fabric manager enterprise - ga, unified fabric manager enterprise - lts 2023, unified fabric manager enterprise - lts 2024 +1 more +3 moreNVIDIA UFM Enterprise contains a vulnerability in the session management component, where an...5.1 Medium
- nvidia unified fabric manager enterprise - ga, unified fabric manager enterprise - lts 2023, unified fabric manager enterprise - lts 2024 +1 more +3 moreNVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated...6.8 Medium
- nvidia unified fabric manager enterprise - ga, unified fabric manager enterprise - lts 2023, unified fabric manager enterprise - lts 2024 +1 more +3 moreNVIDIA UFM Enterprise contains a vulnerability in the user management component, where an...6.8 Medium
- nvidia unified fabric manager enterprise - ga, unified fabric manager enterprise - lts 2023, unified fabric manager enterprise - lts 2024 +1 more +3 moreNVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an...8.0 High
- nvidia unified fabric manager enterprise - ga, unified fabric manager enterprise - lts 2023, unified fabric manager enterprise - lts 2024 +1 more +3 moreNVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component,...8.8 High
- ni labviewInteger Overflow Vulnerability Resulting in an Out of Bounds Write in NI LabVIEW6.9 Medium
- nvidia dgx spark, dgx spark uefi +1 moreNVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by...6.0 Medium
- nvidia dgx spark, dgx spark uefi +1 moreNVIDIA DGX Spark contains a vulnerability in the standalone MM firmware where an attacker could...6.0 Medium
- nvidia dgx spark, dgx spark uefi +1 moreNVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker...8.2 High
- nvidia dgx spark, dgx spark uefi +1 moreNVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker...8.2 High
- nvidia dgx spark, dgx spark uefi +1 moreNVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker...8.2 High
- ni labviewInteger Conversion Vulnerability Resulting in an Out of Bounds Read in NI LabVIEW6.9 Medium
- djust-org djustdjust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls8.2 High
- zephyrproject zephyrOut-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count5.5 Medium
- zephyrproject zephyrNULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi5.9 Medium
- zephyrproject zephyrOut-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length6.1 Medium
- cbcoutinho nextcloud-mcp-serverNextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )9.1 Critical
- cvhub520 x-anylabelingX-AnyLabeling before 4.0.0-beta.9 Improper Certificate Validation in Model Downloads8.2 High
pickemnpmpickem vulnerable to terminal escape-sequence injection via unsanitized item text8.6 Highutcp-httpPyPIutcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion7.1 Highutcp-httpPyPIutcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target8.2 High- sonirico mcp-shellmcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist8.6 High
- sonirico mcp-shellmcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable8.4 High
- sonirico mcp-shellmcp-shell: Secure Mode Allowlist Bypass via Git Shell Alias8.4 High
- qwed-ai qwed-mcpQWED-MCP: Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input9.8 Critical
- jfrog artifactoryPotential unauthorized access to private Composer repository metadata in JFrog Artifactory6.5 Medium
- mervinpraison praisonaiBrowser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)9.1 Critical
- mervinpraison praisonaiPraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server7.6 High
- Show moreLoading…