CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- jahlives openssl encryptverify-usb before 1.4.9 Symlink Directory Traversal Code Execution8.7 High
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Weak Pepper Key Derivation8.7 High
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-2568.7 High
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Denial of Service via KDF8.7 High
- jahlives openssl encryptopenssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass6.9 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata9.3 Critical
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Information Disclosure via Command Line6.9 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Plaintext Private Key Storage8.6 High
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Insecure File Permissions8.6 High
- jahlives openssl encryptopenssl_encrypt before 1.4.9 False Encryption via Cleartext Storage9.3 Critical
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal9.3 Critical
- openremoteOpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API8.3 High
- wwbn avideoAVideo SSRF Guard Bypass via IPv6 Transition Addresses6.9 Medium
- openfaas faasOpenFaaS Gateway 0.27.11 through 0.27.13 Missing Authentication on the /system/telemetry Route6.9 Medium
- baserowBaserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources8.7 High
- hank-ai darknetdarknet through 6.0 Out-of-Bounds Read and Write via Unchecked Layer Index in .cfg Parser6.9 Medium
- dropbox mcp-server-dashDropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation2.3 Low
- airtable airtable-mcp-cliAirtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint6.9 Medium
- timescale tiger-gh-mcp-serverTimescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List7.6 High
- timescale tiger-slackTimescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List7.6 High
- team-telnyx telnyx-mcpTelnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport9.3 Critical
- maquina-app rails-mcp-serverrails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape8.6 High
- mims-harvard tooluniverseToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape9.3 Critical
- timescale pg-aiguideTimescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List7.6 High
- mcp-routermcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication9.3 Critical
- apify actors-mcp-serverApify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton8.7 High
- mark3labs mcp-gomcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding7.6 High
- mcp-usemcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL8.7 High
- frontaccountingFrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage8.2 High
- frontaccountingFrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms7.1 High
- fonosterFonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler5.3 Medium
- apitableAPITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints8.8 High
- apitableAPITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint6.9 Medium
- johnson controls t2000T2000 open debug port5.2 Medium
suseconnect-ngSUSESecurity update for suseconnect-ngNo score- dassault systèmes 3dswymerImproper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x9.3 Critical
- limanmys coreLiman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)9.1 Critical
- seres software sywebUser Enumeration in Seres Software's syWEB5.3 Medium
- seres software sywebReflected XSS in Seres Software's syWEB6.1 Medium
- flowintelFlowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input6.9 Medium
- flowintelFlowintel Fails to Invalidate Active Sessions After Password Change9.1 Critical
- flowintelFlowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes5.1 Medium
- eclipse foundation sw360In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipu…6.0 Medium
- scottchiefbaker doolArbitrary File Overwrite via Symlink Following in dool project2.0 Low
- scottchiefbaker doolFormula Injection in dool project4.6 Medium
- flowintelFlowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments5.3 Medium
- bilpark informatics technologies industry and trade inc. doxbaseReflected XSS in BilPark's DoXBASE6.1 Medium
- flowintelFlowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges8.6 High
- volmarg personal-management-systemVolmarg Personal Management System Path Traversal via get-file Endpoint7.1 High
- hcl software iemHCL IntelliOps Event Management is affected by multiple security vulnerabilities.3.1 Low
- Show moreLoading…