CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- the gnu c library glibcStack-based out-of-bounds write in tdelete during tree rebalancing5.6 Medium
- ubiquiti inc unifi access applicationA malicious actor with access to the network and low privileges could exploit an Improper Input...9.9 Critical
- ubiquiti inc cloud gateways, cloud keys, dream machines +10 more +12 moreA malicious actor with access to the network, low privileges and under certain conditions could...9.0 Critical
- oneuptimeOneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL7.1 High
- tarscloud tarswebTarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter9.3 Critical
- tarscloud tarswebTarsWeb through 3.0.16 Missing Authorization on Patch Deploy, Download and Delete Endpoints8.7 High
- kazuph mcp-fetchmcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets8.7 High
- starrocksStarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized Views7.1 High
- ubiquiti inc unifi access applicationA malicious actor with access to the network and low privileges could exploit an Improper Input...9.9 Critical
- ubiquiti inc uid enterprise agentA malicious actor with access to the network and high privileges could exploit an Improper Input...9.1 Critical
- ubiquiti inc unifi network applicationA malicious actor with access to the network and high privileges could exploit an Improper Access...9.1 Critical
- ubiquiti inc unifi os serverA malicious actor with access to the network and high privileges could exploit an Improper Input...9.1 Critical
- ubiquiti inc unifi os serverA malicious actor with access to the network and high privileges could exploit an Improper Input...9.1 Critical
- ubiquiti inc unifi connect applicationA malicious actor with access to the network could exploit an Improper Access Control...8.2 High
- ubiquiti inc unifi protect applicationA malicious actor with access to the network could exploit an Improper Input Validation...10.0 Critical
- ubiquiti inc cloud gateways, cloud keys, dream machines +10 more +12 moreA malicious actor with access to the network and low privileges could exploit an Improper Access...9.9 Critical
- calcprogrammer1 openrgbOpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite8.8 High
- designextreme reviews and rating – google reviewsReviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes6.4 Medium
- ubiquiti inc unifi network applicationA malicious actor with access to the network and high privileges could exploit an Improper Input...9.1 Critical
- calcprogrammer1 openrgbOpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings9.3 Critical
- ubiquiti inc cloud gateways, cloud keys, dream machines +10 more +12 moreA malicious actor with access to the network and low privileges could exploit an Improper Access...9.9 Critical
- nagios host, teamviewer full client +1 moreCommand Injection in TeamViewer Desktop Client for Linux through Chat Link Handling8.8 High
- teamviewer full client, host, quicksupport & portable, full client, host, quicksupport & portable (for windows 7 & 8), full client, host, quicksupport & portable (v13 for windows) +5 more +7 moreImproper Validation of File Paths in TeamViewer Desktop Clients7.5 High
- ubiquiti inc unifi protect applicationA malicious actor with access to the network and low privileges could exploit an Improper Input...9.9 Critical
- grafana enterprise, oss +1 moreBroken access control in dashboard snapshots6.3 Medium
- nlnet labs nsdBypass of BLOCKED ACL items on proxy protocol port over TCP or TLS8.2 High
- nlnet labs nsdRemote UDP DoS by sending multiple DNS Cookie options8.2 High
- nlnet labs nsdRemote TCP DoS by throttling the TCP receive window6.9 Medium
- nlnet labs nsdWrong interpretation of ACL ranges8.2 High
- thinking software efenceThinking Software Technology｜Efence - Arbitrary File Upload8.7 High
- thinking software efenceThinking Software Technology｜Efence - SQL Injection8.8 High
- thinking software efenceThinking Software Technology｜EFence - Arbitrary File Upload9.3 Critical
- cayin technology cms-se, cms-ws +1 moreCAYIN Technology｜CAYIN CMS-WS/CMS-SE - Missing Authentication6.9 Medium
- cayin technology cms-se, cms-ws, smp +2 moreCAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Upload8.6 High
- zte scpSQL injection vulnerability in ZTE SCP product6.3 Medium
- kitae-park mang board wpMang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie8.8 High
- muffingroup bethemeBetheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode6.4 Medium
- wpgenie woocommerce lotteryWooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters7.5 High
- admin by request (abr) by request (abr)Insufficient input validation in Admin By Request (ABR)7.8 High
- admin by request (abr) by request (abr)Insecure PIN derivation mechanism in Admin By Request (ABR)8.8 High
- ericsson codecheckerPersonal access token delete filters on Session columns while deleting from PersonalAccessTokenDB1.2 Low
- vivo kids modeA control logic defect in a specific built-in webpage of Kids Mode allows users to view local...2.4 Low
- vivo kids modeA pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password...2.4 Low
- themefusion avada (fusion) builder, avada | website builder for wordpress & woocommerce +1 moreAvada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write9.8 Critical
- strategy11team formidable forms – wordpress form builder for contact forms, calculators, quizzes & moreFormidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter7.2 High
- jegstudio gutenverse – wordpress blocks, page builder & site editorGutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks6.4 Medium
- unknown simple newsletter pluginNoptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page6.5 Medium
- metagauss registrationmagicRegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' Parameter5.5 Medium
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDOR4.3 Medium
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session5.3 Medium
- Show moreLoading…