CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities6.4 Medium
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement9.8 Critical
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities8.2 High
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities7.5 High
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities8.2 High
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement8.8 High
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities4.3 Medium
- ibm administration runtime expert for iIBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].9.9 Critical
- ibm administration runtime expert for iIBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].7.5 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.0 High
- ibm concertMultiple Vulnerabilities in IBM Concert Software5.9 Medium
- ibm integrated analytics systemIBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service component5.9 Medium
- ibm integrated analytics systemIBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto component5.9 Medium
- zephyrproject zephyrWireGuard keepalive transport-data messages accepted without Poly1305 authentication3.7 Low
- zephyrproject zephyrZephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijack6.5 Medium
- basekick-labs arcArc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset6.9 Medium
- tp-link systems inc. tl-mr100 v3.20http_gdpr_decrypt Pre-Authentication Stack-Based Buffer Overflow8.7 High
- mongodb bi connector odbc driverMongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values6.0 Medium
- klever-io klever-goKlever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits8.7 High
- mongodb bi connector odbc driverBI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption8.7 High
- privatebinPrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI0.0 None
- mongodb bi connectorMongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion8.7 High
- privatebinPrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction4.3 Medium
- tp-link system inc. tl-wr841n v14Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N5.3 Medium
- tp-link system inc. tl-wr841n v14Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N5.3 Medium
- tp-link system inc. tl-wr841n v14Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841N5.3 Medium
- mongodb bi connectorBI Connector Optional Client Certificate Verification Allows Unauthenticated Connections8.7 High
- mongodb bi connectorMongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service8.7 High
- expressjs multermulter vulnerable to Denial of Service via oversized array index in field names7.5 High
- mongodb bi connectorMongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service8.3 High
- expressjs multermulter vulnerable to Denial of Service via crafted multipart field names7.5 High
- expressjs multermulter vulnerable to file size limit bypass via async fileFilter race condition3.7 Low
- expressjs multermulter vulnerable to Denial of Service via file descriptor leak on aborted uploads7.5 High
- mongodb bi connectorMongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output8.5 High
- mongodb bi connectorMongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output5.6 Medium
- mongodb mongosql transition readiness tool, bi connector transition readiness report +1 moreMongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports6.9 Medium
- mongodb mongosql transition readiness tool, bi connector transition readiness report +1 moreMongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports5.8 Medium
- mongodb bi connector transition readiness report, mongosql transition readiness tool +1 moreMongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata4.8 Medium
aiirPyPIAIIR verification and policy gates could report success without enforcing the control (fail-open)6.9 Medium- guno1928 alos-httpALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server7.5 High
- pimcorePimcore: Remote Code Execution via DataObject Class-Definition Field Name9.9 Critical
- pimcorePimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column9.3 Critical
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`7.5 High
- plone plone.app.eventplone.app.event: Denial of service via iCalendar import9.1 Critical
- nousresearch hermes-agentHermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference9.0 Critical
- nousresearch hermes-agentHermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool7.6 High
- plone plone.app.portletsplone.app.portlets: Denial of service via RSS feed portlet9.1 Critical
- powsybl powsybl-corePowSyBl: Command Injection in LocalCommandExecutor-s7.1 High
- phpsysinfophpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers7.5 High
- jfrog artifactoryPotential authentication bypass leading to administrative access in Artifactory9.8 Critical
- Show moreLoading…