CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- jefferson49 sexy polling reloaded extension for joomlaJoomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.18.7 High
- digital-peak.com dp calendar extension for joomlaJoomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.26.9 Medium
- stellarwp givewp – donation plugin and fundraising platformGiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- servmask all-in-one wp migration unlimited extensionAll-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter6.4 Medium
- synology chat serverAn improper neutralization of input during web page generation ('Cross-site Scripting')...6.5 Medium
- synology chat serverA server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5...4.3 Medium
- synology chat serverAn improper neutralization of input during web page generation ('Cross-site Scripting')...9.0 Critical
- linuxptp: vmclock: prevent read-only mappings from becoming writable8.8 High
- tangible loops & logicWordPress Loops & Logic - Reflected XSS6.5 Medium
- linuxof: reserved_mem: prevent OOB when too many dynamic regions are defined8.4 High
- linuxwifi: mac80211: validate individual TWT params before driver setup8.8 High
- linuxBluetooth: ISO: ensure no dangling hcon references in iso_conn8.8 High
- linuxiomap: add a separate bio_set for iomap_split_ioend7.5 High
- linuxmm: mglru: fix stale batch updates after memcg reparenting5.7 Medium
- linuxmm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()7.8 High
- linuxsctp: validate Adaptation Indication parameter length7.5 High
- linuxALSA: pcm: wake linked drain waiters on unlink7.8 High
- linuxigc: remove napi_synchronize() in igc_down()6.7 Medium
- linuxipvs: do not propagate one-packet flag to synced conns9.8 Critical
- linuxio_uring: preserve task restrictions across exec8.4 High
- linuxspi: spi-qpic-snand: write the feature value before executing SET_FEATURE8.4 High
- linuxpower: supply: max17040: handle missing status supplier2.0 Low
- linuxs390/dasd: Fix undersized format-check buffer7.8 High
- linuxs390/zcrypt: Fix wrong domain value verification with EP11 CPRBs7.8 High
- linuxs390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()2.0 Low
- linuxcan: j1939: transport: j1939_session_fresh_new(): initialize receive buffer7.5 High
- linuxcan: softing: fw_parse(): validate firmware record spans7.8 High
- linuxdrm/amd/display: check if dml21_add_phantom_plane() is successful5.7 Medium
- linuxdrm/amd/display: use proper context for loggingNo score
- linuxdrm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE4.8 Medium
- linuxdrm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size7.8 High
- linuxdrm/vmwgfx: enforce cursor size limits for MOB cursors6.8 Medium
- linuxdrm/vmwgfx: validate external BO copy bounds for both stride paths7.8 High
- linuxKVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context5.6 Medium
- linuxdmaengine: idxd: fix double free of wq, engine, and group structs7.0 High
- linuxerofs: ensure valid f_path for page cache sharing5.7 Medium
- linuxhwmon: (ltc4282) Fix reading the minimum alarm voltage7.8 High
- linuxhwmon: (sht3x) Fix unaligned accesses5.7 Medium
- linuxnet: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller9.8 Critical
- linuxidpf: bound interrupt-vector register fill to the allocated array9.3 Critical
- linuxBluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks8.8 High
- linuxscsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE7.5 High
- linuxscsi: ufs: core: Initialize hba->rpmbs list in ufshcdNo score
- linuxtracing/mmiotrace: Add NULL check for mmio_trace_array in logging functionsNo score
- linuxriscv: drop __init from vec_check_unaligned_access_speed_all_cpusNo score
- linuxiommufd/viommu: Release the igroup lock on the vdevice_size error pathNo score
- linuxmm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE4.8 Medium
- linuxmm/util: don't read __page_2 for order-1 folios in snapshot_page()7.1 High
- linuxKVM: s390: pci: Fix NULL dereference on AIBV allocation failure9.3 Critical
- linuxBluetooth: SCO: give the socket its own sco_conn reference8.8 High
- Show moreLoading…