CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission5.4 Medium
- themeum kirkiKirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis5.3 Medium
- unknown return refund and exchange for woocommerceWoo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation6.5 Medium
- arraytics eventinEventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token5.3 Medium
- railmedia order tip for woocommerceOrder Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax8.7 High
- jordy meow ai engineAI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant5.3 Medium
- jordy meow ai engineAI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter7.7 High
- unknown project managerWP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR4.3 Medium
- unknown project managerWP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR5.4 Medium
- unknown project managerWP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes7.5 High
- unknown podsPods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback7.2 High
- unknown blogvault backup & staging, malcare wordpress security plugin, the wp remote wordpress plugin +2 moreBlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery8.1 High
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings6.8 Medium
- unknown forminator formsForminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation3.7 Low
- themeum tutor lmsTutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters5.3 Medium
- masaakitanaka booking packageBooking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters5.3 Medium
- unknown privacy policy generator, terms & conditions, gdpr, ccpa, cookie policy & disclaimer templatesWP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure6.5 Medium
- arraytics wpcafeWPCafe < 3.0.18 - Unauthenticated Reservation Approval Bypass via Missing Authorization5.3 Medium
- unknown booking for appointments and events calendarAmelia < 2.4.7 - Unauthenticated Notification Queue Dispatch6.5 Medium
- unknown booking for appointments and events calendarAmelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR4.7 Medium
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure5.3 Medium
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init5.3 Medium
- arraytics eventinEventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure5.3 Medium
- freebsdTOCTOU race in POSIX shared memory large page configuration7.8 High
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreKetello: katello content view history api cross-organization authorization bypass4.3 Medium
- danfoss ic7-automation sp, ic7-hybrid, ic7-marine +2 moreDebug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software9.3 Critical
- freebsdKernel use-after-free via tty ioctls7.0 High
- emrevona wp fastest cache – wordpress cache pluginWP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header7.2 High
- freebsdppp(8): missing length validation in mp_SetEnddisc()7.8 High
- freebsdppp(8): missing length validation in LcpDecodeConfig()8.8 High
- freebsdppp(8): incorrect length calculation in mp_Enddisc()8.8 High
- sasaki nobuyuki corvusskkCorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be...4.6 Medium
- sasaki nobuyuki corvusskkCorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on...8.4 High
- digital agency android app "myna point"Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom...4.6 Medium
- freebsdUnauthorized credential switching8.1 High
- freebsdKernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl7.8 High
- freebsdUse-after-free in unix SOCK_STREAM message handling7.8 High
- freebsdhwpmc fails to detach PMCs during exec credential transitions7.8 High
- trustedfirmware trusted firmware-mOn the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization...7.0 High
- cozmoslabs translatepress – translate multilingual sites with ai translationTranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure9.8 Critical
- milesight am102/102l v2, am103/103l v2, am304l +61 more +63 moreA cleartext transmission of sensitive information vulnerability in the NFC interface of multiple...8.3 High
- librenmsLibreNMS Virtualisation Discovery Module RCE8.6 High
- insyde software insydeh2oFMTSWriteUseIntelLib: FMTS SMM IHISI Buffer Overflow2.7 Low
libjpeg-turboopenSUSE,libjpeg6bUbuntu,libjpeg9Ubuntu +2 morelibjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When...6.5 Medium- No product listedAntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java...7.5 High
- No product listedIn AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering...9.8 Critical
- No product listedDocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through...7.5 High
- No product listedJeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow...9.8 Critical
- No product listedComfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET...6.8 Medium
- No product listedAn issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via...6.8 Medium
- Show moreLoading…