CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- oscal-compass compliance-trestleTrestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)7.8 High
- oscal-compass compliance-trestleTrestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data7.8 High
- spring security, vmware spring security +1 moreSpring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay7.4 High
- totolink n600rTOTOLINK N600R cstecgi.cgi getCurrentTime command injection6.9 Medium
- drupal pankmPanKM - Critical - Unsupported - SA-CONTRIB-2026-0835.7 Medium
- drupal powerful surveysPowerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-0925.7 Medium
- totolink n600rTOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow10.0 Critical
- macwarrior clipbucket-v5ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter9.2 Critical
- doorkeeper-gem doorkeeper-openid connectDoorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes4.2 Medium
- contribsys faktoryFaktory: Unrecovered panic in command handlers allows full-server denial of service8.7 High
- contribsys faktoryFaktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)7.3 High
- code-projects simple inventory systemcode-projects Simple Inventory System edit.php sql injection6.9 Medium
- apache tomcatApache Tomcat: Principal lookup can fail open in some cases8.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreBluez: stack overflow in name2utf8 causes dos and potential code execution7.6 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreBluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root5.7 Medium
- baptistearno typebot.ioTypeBot: Arbitrary server file read via Send Email block attachment path8.7 High
- baptistearno typebot.ioTypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain6.4 Medium
- baptistearno typebot.ioTypeBot: Account takeover via brute-forceable 6-digit magic-link code9.1 Critical
- code-projects food ordering systemSililaWijesinghe Food Ordering System search.php sql injection6.9 Medium
- openstack keystoneIn OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms ...7.6 High
- No product listedPunk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session9.1 Critical
- No product listedPunk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically9.8 Critical
- openstack keystoneIn OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application...7.6 High
- cliGitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default2.1 Low
- code-projects online shopping systemcode-projects Online Shopping System sumit_form.php cross site scripting5.3 Medium
- mesop-dev mesopMesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server8.7 High
- gimp, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreGimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation4.4 Medium
- red hat enterprise linux 10Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix5.3 Medium
- deislabs orasORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption6.5 Medium
- zackees transcribe-anythingzackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection6.3 Medium
- eosphoros-ai db-gptDB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename9.3 Critical
- nvidia nemoclawNVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote...8.1 High
- nvidia nemoclawNVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of process...5.5 Medium
- nvidia nemoclawNVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected...5.6 Medium
- nvidia openshellNVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an...6.8 Medium
- nvidia openshellNVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker...5.2 Medium
- nvidia nemoclawNVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker...8.1 High
- nvidia openshellNVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an...9.9 Critical
- nvidia nemoclawNVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local...7.0 High
- nvidia nemoclawNVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker...8.1 High
- nvidia nemoclawNVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where...7.8 High
- nvidia nemoclawNVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an...7.8 High
- nvidia nemoclawNVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an...7.8 High
- nvidia nemoclawNVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an...8.1 High
- nvidia nemoclawNVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker...7.5 High
- nvidia nemoclawNVIDIA NemoClaw for Linux contains a vulnerability in the Telegram bridge component, where an...7.8 High
- nvidia openshellNVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox...9.9 Critical
- nvidia openshellNVIDIA OpenShell Sandbox for Linux contains a vulnerability where an attacker could cause a path...8.5 High
- nvidia openshellNVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause...8.8 High
- google chromeUse after free in Sync in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote...9.6 Critical
- Show moreLoading…