CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- ceviz informatics inc. web designReflected XSS in Ceviz Informatics's Web Design6.1 Medium
- dayneks software industry and trade inc. e-commerce platformReflected XSS in Dayneks Software's E-Commerce Platform6.1 Medium
- gimp, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreGimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=06.1 Medium
- morganmorgan vulnerable to Log Forging via unescaped Unicode line separators5.3 Medium
- cp plus cp-xr-de21-s routerHardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router8.7 High
- pegasystems pega infinityPega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because…8.8 High
rsyslogSUSESecurity update for rsyslogNo scorersyslogSUSESecurity update for rsyslogNo scorersyslogSUSESecurity update for rsyslogNo score- ericsson codecheckerAuthenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun5.5 Medium
- ericsson codecheckerIncomplete fix for CVE-2025-40843: safe_strcpy is called with PATH_MAX into fullPath+2, writing 2 bytes past the buffer on every CodeChecker log invocation2.0 Low
- le-yan medical practice management systemLe-yan｜Medical Practice Management System - Sensitive Data in URL6.8 Medium
- papercut mf/ng, mf, ng +1 more +3 morePaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector9.4 Critical
- papercut mf/ng, mf, ng +1 more +3 morePaperCut MF/NG: Authentication Bypass8.8 High
- houtini-ai houtini-lmhoutini-ai houtini-lm code_task_files index.ts path traversal5.1 Medium
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form7.2 High
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'5.3 Medium
- wp media rocketWP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint7.2 High
- smub envira gallery – image photo gallery, albums, video gallery, slideshows & moreEnvira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description6.4 Medium
- elixir-lang elixirUnbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir5.9 Medium
- iswalle getnote-mcpiswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal5.3 Medium
- gitoxidelabs gitoxidegitoxide gix-packetline before 0.21.5 Denial of Service7.1 High
- gitoxidelabs gitoxidegitoxide before 0.38.2 Credential Helper Protocol Field Injection2.3 Low
- gitoxidelabs gitoxidegitoxide before 0.33.0 Path Traversal via symlink following6.0 Medium
- gitoxidelabs gitoxidegitoxide before 0.37.1 HTTP Basic credential leak via URL parsing8.7 High
- budibase serverBudibase Server before 3.41.3 SSRF via Query Import7.1 High
- budibase serverBudibase before 3.41.3 Missing Authorization License Management7.2 High
- budibase serverBudibase before 3.41.3 Remote Code Execution via Plugin eval()9.4 Critical
- budibase serverBudibase Server before 3.41.3 SSRF with Credential Leakage8.3 High
- budibase serverBudibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization8.3 High
- budibase serverBudibase backend-core SSRF via incomplete default blacklist7.1 High
- budibase serverBudibase before 3.41.3 Privilege Escalation via User Update API8.6 High
- budibase serverBudibase before 3.41.3 Authorization Bypass via datasources/query8.6 High
- filebrowserfilebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads2.3 Low
- filebrowserfilebrowser through 2.63.23 Stale Share Link via File Rename2.3 Low
- filebrowserFile Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion2.3 Low
- filebrowserfilebrowser through 2.63.23 Denial of Service via named pipes8.2 High
- siyuan-note siyuanSiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU8.4 High
- siyuan-note siyuanSiYuan before v3.8.1 Path Traversal via asset.upload6.9 Medium
- wwbn avideoWWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php5.1 Medium
- wwbn avideoWWBN AVideo through 30.0 Information Disclosure via report4.json.php6.9 Medium
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability10.0 Critical
podmanSUSESecurity update for podmanNo scorepodmanSUSESecurity update for podmanNo scorerekorSUSESecurity update for rekorNo score- wpdeveloper essential addons for elementorWordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability5.3 Medium
- red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +1 moreFfmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor5.4 Medium
- eclipse foundation lyo, the eclipse foundation eclipse lyo +1 moreOAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default9.1 Critical
- digital-peak.com dp calendar extension for joomlaJoomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.07.5 High
- mrvinoth.com all video share extension for joomlaJoomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.05.3 Medium
- Show moreLoading…