CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- spring for apache kafka, vmware spring for apache kafka +1 moreIn Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages6.5 Medium
- spring amqp, vmware spring advanced message queuing protocol +1 moreRemote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)6.6 Medium
- spring integration, vmware spring integration +1 moreUnbounded decompression in UnZipTransformer enables zip-bomb DoS6.5 Medium
- spring amqp, vmware spring advanced message queuing protocol +1 moreAdmin password disclosed in BrokerNotAliveException message5.3 Medium
- spring security, vmware spring security +1 moreSpring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces9.4 Critical
- spring cloud config, vmware spring cloud config +1 moreSpring Cloud Config Server Native Environment Repository Exposure4.9 Medium
- broadcom spring batch, spring batch +1 moreDenial of Service in Spring Batch FlatFileItemReader via Malformed Input File5.9 Medium
- spring integration, vmware spring integration +1 moreDefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names5.4 Medium
- spring cloud gateway, vmware spring cloud gateway +1 moreSpring Cloud Gateway SSRF and native file access with gRPC7.7 High
- broadcom spring batch, spring batch +1 moreUnsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist5.6 Medium
- spring security, vmware spring security +1 moreSpring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)8.2 High
- broadcom spring batch, spring batch +1 moreJobParameterDeserializer bypasses the trusted-type allowlist5.6 Medium
- spring integration, vmware spring integration +1 moreUnsafe Java deserialization in SerializingHttpMessageConverter — remote code execution6.4 Medium
- spring data rest, vmware spring data rest +1 moreSpring Data REST allows mutation of identifier and version properties via JSON Patch7.1 High
- rapid7 metasploit-frameworkAuthentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails5.1 Medium
- boxpositron with-context-mcpboxpositron with-context-mcp index.ts project_folder path traversal6.9 Medium
- asus fa507nu, fa507nv +1 more“unsupported-when-assigned.” An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU...6.8 Medium
- eclipse foundation jettyA client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty...8.3 High
- eclipse foundation jettyA client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are...8.7 High
- bsmi021 mcp-file-context-serverbsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal6.9 Medium
- danielpopamd linkedin-ads-mcpdanielpopamd linkedin-ads-mcp Media Upload campaign-management.ts fs.readFileSync path traversal6.9 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Server Sent Event stream corruption while rendering fragments9.8 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink5.5 Medium
- the gnu c library glibcSHIFT_JISX0213 decoding may hang on crafted input5.9 Medium
- No product listedgo-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer()...8.8 High
- No product listedA path traversal vulnerability exists in the built-in preview/development web server of Lektor <3...7.5 High
- No product listedA SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid()...7.2 High
- No product listedAn issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the...9.8 Critical
- No product listedThe storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any...8.8 High
- No product listedThe static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to...9.8 Critical
ffmpegDebian,ffmpeg-4openSUSE,ffmpeg-7openSUSE +3 more +5 moreAn integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528...7.5 HighffmpegDebian,ffmpeg-4openSUSE,ffmpeg-7openSUSE +3 more +5 moreAn integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528...7.5 HighffmpegDebian,ffmpeg-4openSUSE,ffmpeg-7openSUSE +3 more +5 moreAn integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows...7.5 HighffmpegDebian,ffmpeg-4openSUSE,ffmpeg-7openSUSE +3 more +5 moreA heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git...7.5 HighffmpegDebian,ffmpeg-4openSUSE,ffmpeg-7openSUSE +3 more +5 moreAn integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528...7.5 HighffmpegDebian,ffmpeg-4openSUSE,ffmpeg-7openSUSE +3 more +5 moreA Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c)...6.5 MediumffmpegDebian,ffmpeg-8openSUSE,ffmpeg-9openSUSE +1 more +3 moreA NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N...7.5 HighffmpegDebian,libavUbuntu +1 moreAn integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows...6.5 Medium- No product listedAn integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of...7.5 High
- No product listedIncorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9...5.3 Medium
- No product listedVeno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access...9.8 Critical
- No product listedArbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno...9.8 Critical
- No product listedIncorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9...6.5 Medium
- No product listedAbsolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1...5.3 Medium
- No product listedArbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File...8.1 High
- No product listedIncorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project...5.3 Medium
- No product listedPath traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax...6.5 Medium
- No product listedVeno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php...9.1 Critical
- No product listedUser enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an...5.3 Medium
- No product listedA vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to...7.5 High
- Show moreLoading…