CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- openstack keystoneIn OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project...7.1 High
- penpotPenpot: Stored XSS via comment content, innerHTML renders unsanitized HTML8.7 High
- penpotPenpot: Stored XSS via custom font family name injected into a @font-face style rule7.6 High
- 1panel-dev kubepiKubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF10.0 Critical
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System ajax.php login2 sql injection6.9 Medium
- hclsoftware connectionsHCL Connections is vulnerable to server-side request forgery (SSRF)3.7 Low
- red hat ceph storage 5, ceph storage 9, openstack platform 17.1 +1 more +3 moreAnsible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings5.5 Medium
- 1panel-dev kubepiKubePi: Insufficient per-cluster authorization checks in cluster management APIs5.8 Medium
- hclsoftware bigfix quantum risk analyzerHCL BigFix Quantum Risk Analyzer is affected by logging sensitive information4.1 Medium
- hclsoftware bigfix quantum risk analyzerHCL BigFix Quantum Risk Analyzer is affected by a stack-based buffer overflow3.9 Low
- pterodactyl wingsPterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion7.7 High
- hclsoftware bigfix quantum risk analyzerHCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking4.4 Medium
- limesurveyLimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint7.4 High
- limesurveyLimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering7.2 High
- seaweedfsSeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename7.1 High
- codeastro payroll systemitsourcecode Payroll System CRUD Operation ajax.php delete missing authentication6.9 Medium
- free5gc smfSimple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()8.6 High
- seaweedfsSeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite8.1 High
- limesurveyLimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields4.8 Medium
- webpros plesk migrator, plesk site import +1 moreImproper symlink resolution before file access in Plesk allows remote authenticated users to...8.7 High
- pleskImproper neutralization of special elements in Plesk allows remote authenticated users to...9.9 Critical
- pleskInsecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3,...8.6 High
- samsung open source oneA vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter...8.5 High
- veeam backup and replicationA vulnerability that records guest OS processing credentials in cleartext in a support log on the...6.8 Medium
- samsung open source oneA vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from...9.3 Critical
- seaweedfsSeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy8.7 High
- seaweedfsSeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths7.6 High
- hclsoftware bigfix quantum risk analyzerHCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive information3.9 Low
- weblateorg weblateWeblate: DNS rebinding in VCS operations allows server-side request forgery3.5 Low
- weblateorg weblateWeblate: Object-scoped RSS feeds disclose private change history to unauthorized users5.3 Medium
- limesurveyLimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries8.4 High
- weblateorg weblateWeblate Has Uncontrolled Resource Consumption via6.5 Medium
- weblateorg weblateWeblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint4.3 Medium
- weblateorg weblateWeblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)7.7 High
- rabbitmq amqp091-goamqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload8.9 High
- weblateorg weblateWeblate: Team-enforced 2FA is bypassed for global permissions4.4 Medium
- weblateorg weblateWeblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project8.1 High
- weblateorg weblateObservable object existence disclosure in private Weblate projects via globally scoped object lookups4.3 Medium
- oracle corporation java seVulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle...6.5 Medium
- weblateorg weblateWeblate: Unverified REST API email changes3.5 Low
- static-web-serverStatic Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled4.3 Medium
- giteaGitea: Remote Code Execution via diffpatch Git Hook Installation9.8 Critical
- dell cyber recovery, powerprotect cyber recovery, power protect cyber recovery +2 moreDell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication...7.6 High
- dell cyber recovery, powerprotect cyber recovery, power protect cyber recovery +2 moreDell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink)...5.8 Medium
- elated-themes frappeFrappe: Access control bypass via REST API dot-notation fields on linked doctypes7.1 High
- dell cyber recovery, powerprotect cyber recovery, power protect cyber recovery +2 moreDell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of...6.5 Medium
- broadcom reactor nettyReactor Netty WebSocket Client Leaks Credentials On Redirect6.1 Medium
- broadcom reactor nettyReactor Netty HTTP Server Leaks Exception Details5.3 Medium
- broadcom reactor nettyReactor Netty may incorrectly route traffic due to DNS resolver reuse3.7 Low
- spring security, vmware spring security +1 moreDeterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation6.5 Medium
- Show moreLoading…