CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- linuxnet: gro: properly validate BIG TCP aggregation criteria9.8 Critical
- the gnu c library glibcEUC_JISX0213 decoding may hang on crafted input5.9 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion4.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect4.7 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR2.7 Low
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN4.8 Medium
- unknown wp ultimate csv importerWP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields4.1 Medium
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR4.3 Medium
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability4.9 Medium
- unknown booking for appointments and events calendarAmelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval2.7 Low
- unknown 爱采集数据采集和发布插件Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password9.3 Critical
- higheredlab hel online classroom: ai-powered online classroomsHEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass6.5 Medium
- higheredlab hel online classroom: ai-powered online classroomsHEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Settings Update6.5 Medium
- higheredlab hel online classroom: ai-powered online classroomsHEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure7.5 High
- unknown appointment booking calendar plugin and scheduling pluginBookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation7.5 High
- unknown user profile builderProfile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass8.2 High
- unknown user profile builderProfile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export6.6 Medium
- unknown user profile builderProfile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode6.8 Medium
- unknown catfolders document gallery proCatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all5.3 Medium
- mstore api, unknown mstore api +1 moreMStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet6.5 Medium
- mstore api, unknown mstore api +1 moreMStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion6.5 Medium
- tribulant software newslettersNewsletters < 4.17 - Arbitrary Plugin Option Update via CSRF5.4 Medium
- tribulant software newslettersNewsletters < 4.17 - Unauthenticated API Access via Predictable API Key4.8 Medium
- totalprocessing total processing card payments for woocommerceTotal Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure9.1 Critical
- unknown smartaipressSmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image7.7 High
- unknown uix usercenterUix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation9.8 Critical
- unknown rest routesRest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}8.6 High
- unknown memberheroSimple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator9.8 Critical
- cloud foundry bosh-vsphere-cpi-releaseBOSH vSphere CPI Improper Cert Validation7.7 High
- helge17 tuxguitarTuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file8.5 High
- org.mariadb r2dbc-mariadb, mariadb-corporation mariadb-connector-r2dbc +1 moreMariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)5.9 Medium
- org.mariadb r2dbc-mariadb, mariadb-corporation mariadb-connector-r2dbc +1 moreMariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake5.9 Medium
- mapfish mapfish-print, org.mapfish.print.print-lib, org.mapfish.print.print-servlet +2 moremapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types8.6 High
- free5gcfree5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA3.7 Low
- free5gcfree5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI7.5 High
- silverstripe silverstripe-versionedSilverstripe Versioned: XSS in archive admin restore5.4 Medium
- graylog2 graylog2-serverGraylog token revocation endpoint allows authenticated users to delete other users’ access tokens5.3 Medium
- graylog2 graylog2-serverGraylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message7.5 High
- klever-io klever-goKlever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply8.7 High
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets6.5 Medium
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb5.9 Medium
- netapp storagegridCVE-2026-22056 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)2.3 Low
- igel os 11, os 12 +1 moreIGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File6.8 Medium
- igel os 11, os 12 +1 moreIGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration Area8.6 High
- ibm cloud pak for data systemVulnerabilities exists in IBM Cloud Pak for Data System6.2 Medium
- ibm concertMultiple Vulnerabilities in IBM Concert Software9.1 Critical
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement9.9 Critical
- Show moreLoading…