CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- roocodeinc roo-codeRooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal5.3 Medium
- ebyte na111-m firmwareEbyte NA111-M Improper Restriction of Excessive Authentication Attempts8.7 High
- ebyte na111-m firmwareEbyte NA111-M Cross-Site Request Forgery8.6 High
- ebyte na111-m firmwareEbyte NA111-M Use of GET Request Method With Sensitive Query Strings9.3 Critical
- ebyte na111-m firmwareEbyte NA111-M Use of Client-Side Authentication9.3 Critical
- ebyte ne2-d11 firmwareEbyte NE2-D11 Insufficiently Protected Credentials5.1 Medium
- ebyte na111-m firmwareEbyte NA111-M Cleartext Transmission of Sensitive Information8.7 High
- roocodeinc roo-codeRooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission6.3 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 9 +2 more +4 moreJwcrypto: jwcrypto: denial of service via malformed jwe tokens5.9 Medium
- ebyte na111-m firmwareEbyte NA111-M Missing Authentication for Critical Function9.3 Critical
- cephCeph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation8.1 High
- bendix ec80esp 2nd can, ec80esp 4s/4m, ec80esp 6s/6m +7 more +9 moreStack-based Buffer Overflow in Bendix EC80 Brake ECU7.7 High
- cephCeph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users9.1 Critical
- bendix ec80esp 2nd can, ec80esp 4s/4m, ec80esp 6s/6m +7 more +9 moreOut-of-bounds Write in Bendix EC80 Brake ECU7.1 High
- cephCeph: CephX AES Authentication error8.8 High
- bendix ec80esp 2nd can, ec80esp 4s/4m, ec80esp 6s/6m +7 more +9 moreUse of Hard-coded Credentials in Bendix EC80 Brake ECU5.3 Medium
- roocodeinc roo-codeRooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection5.1 Medium
- payrange apiMissing Authorization in PayRange API8.7 High
- zoneminderZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)9.0 Critical
- zoneminderOS Command Injection in PayRange API8.7 High
- labring fastgptFastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization9.3 Critical
- applied systems engineering ase2000 v2Improper Certificate Validation in ASE 20009.1 Critical
- elated-themes frappeFrappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description5.1 Medium
- dolibarr, dolibarr erp\/crm +1 moreDolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename8.8 High
- dolibarr, dolibarr erp\/crm +1 moreDolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion7.1 High
- dolibarr, dolibarr erp\/crm +1 moreDolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys8.6 High
- amazon diagram-as-codeZip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)6.8 Medium
- roocodeinc roo-codeRooCodeInc Roo-Code README File ExecaTerminalProcess code injection5.3 Medium
- triliumnext triliumTrilium unauthenticated share-search discloses password-protected and hidden shared notes7.5 High
- triliumnext triliumTrilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature8.1 High
- roocodeinc roo-codeRooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection5.1 Medium
pamUbuntupam vulnerabilityNo score- redis, redis software (enterprise) +1 moreRedis TLS pending-data list use-after-free7.5 High
- speechbrainSpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing8.7 High
- roskus prospero flow crmUnrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting4.8 Medium
- triliumnext triliumTrilium: Note Import to RCE via Book Note9.3 Critical
- triliumnext triliumTrilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml9.3 Critical
- the gnu c library glibcPassing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the ...4.9 Medium
- servicenow ai platformUnauthenticated SQL Injection via Dynamic Schema ORDER BY Clause10.0 Critical
- servicenow ai platformUnauthenticated Privilege Escalation via System Configuration Image Upload Processor10.0 Critical
- servicenow ai platformUnauthenticated Remote Code Execution in GraphQL Composite Data API10.0 Critical
- servicenow ai platformSandbox Escape in ServiceNow AI Platform10.0 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreGdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery4.7 Medium
- adobe dng software development kit (sdk), dng software development kit +1 moreDNG SDK | Out-of-bounds Write (CWE-787)5.5 Medium
- adobe dng software development kit (sdk), dng software development kit +1 moreDNG SDK | Out-of-bounds Read (CWE-125)5.5 Medium
- mongodb c# driver, c\# driver +1 moreKMS master key exposure via unredacted credential serialization in driver settings string6.8 Medium
- mongodb c# driver, c\# driver +1 moreConnection-option injection via unescaped settings in the canonical MongoDB URL builder7.1 High
- mongodb c# driver, c\# driver +1 moreNoSQL injection via array replacement bypassing update shape validation in driver write path5.3 Medium
- mongodb c# driver, c\# driver +1 moreNoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation6.9 Medium
- mongodb rust driverCross-database write redirection via unvalidated dotted database name in bulk write namespaces7.1 High
- Show moreLoading…