CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- nasa cfsNASA cFS SBN TCP sbn_tcp_if.c OS_read buffer overflow5.3 Medium
- tangiblewp myhome coreMyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token9.8 Critical
- nasa trickNASA Trick TCP Socket JSONVariableServerThread.cpp parse_request stack-based overflow6.9 Medium
- ash-project ash sqliteJSON path injection via unescaped get_path segments in AshSqlite2.1 Low
- erlef oidccEncrypted ID token or JARM response accepted without a nested signature in erlef oidcc7.6 High
- ash-project ash paper trailAlgorithmic-complexity denial of service in AshPaperTrail full-diff list tracking2.1 Low
- ash-project ash paper trailSensitive fields nested in embedded values are not redacted in AshPaperTrail versions5.9 Medium
- ash-project ash paper trailSensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail5.9 Medium
- ljharb qsqs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)6.3 Medium
- ljharb qsqs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property6.3 Medium
- code-projects student information systemPHPGurukul Student Information System student_edit1.php sql injection5.3 Medium
- macrozheng mallmacrozheng mall Payment Status Endpoint paySuccess behavioral workflow5.3 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System emp_del.php sql injection5.3 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System emp_edit.php sql injection5.3 Medium
- addify custom user registration fields for woocommerceCustom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout9.8 Critical
- cyberlord92 saml single sign on – sso loginSAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning7.5 High
- usememos memosMemos through 0.30.0 SSRF via Omitted CGNAT Address Range6.9 Medium
- iflytek astron-agentiFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check8.6 High
- sudo project sudoSudo through 1.9.17p2 Intercept Policy Bypass via execveat8.5 High
- kubeedgeKubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints8.8 High
- documensoDocumenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf8.7 High
- jeremyevans rodauthRodauth before 2.47.0 TOTP Code Reuse via Drift Window5.1 Medium
- jeremyevans rodauthRodauth before 2.47.0 Authentication Bypass via jwt_refresh5.1 Medium
- jeremyevans rodauthRodauth before 2.47.0 CSRF Protection Bypass via Content-Type4.9 Medium
- jeremyevans rodauthRodauth before 2.47.0 Open Redirect via Return-to Path4.9 Medium
- jeremyevans rodauthRodauth before 2.46.0 Authentication Bypass via webauthn_login9.4 Critical
- pac4jpac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest6.9 Medium
- pac4jpac4j-core before 6.5.6 Open Redirect via Backslash Logout5.3 Medium
- pac4jpac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check8.6 High
- pac4jpac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution6.9 Medium
- pac4jpac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token8.6 High
- coderaiser cloudcmdCloud Commander before 19.20.2 Directory Traversal via REST and Markdown9.3 Critical
- slican ipxPlaintext storage of a password in WebCTI8.2 High
- mirage cohttpThe cohttp package before 6.3.0 for OCaml allows directory traversal.8.7 High
- dadrus heimdallIn MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers...5.8 Medium
- ncopa su-execsu-exec through 0.3 Privilege Escalation via Numeric User ID8.5 High
- argoproj-labs argocd-mcpargocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP10.0 Critical
- omnivore-app omnivoreOmnivore before android-0.227.0 Authentication Bypass via Apple Sign-in9.3 Critical
- iot-ecology rust-iot-platformrust-iot-platform Cleartext Password Storage via User Model8.7 High
- iot-ecology rust-iot-platformrust-iot-platform Authentication Bypass via Missing Request Guards9.3 Critical
- getformwork formworkFormwork < 2.3.11 Stored XSS via Referer Header5.3 Medium
- bookstackapp bookstackBookStack before 26.05.4 Remote Code Execution via Book Cover8.7 High
- cockpit-hq cockpitCockpit CMS before 2.14.1 Account Enumeration via Auth Timing6.9 Medium
- shinobi systems shinobiShinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key9.3 Critical
- skyvernSkyvern before 1.0.45 Sandbox Escape via TextPromptBlock8.7 High
- bdthemes sigmaforms pro – ai generated formsSigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field9.8 Critical
- macrozheng mallmacrozheng mall Order Submission submit race condition2.3 Low
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreDTLS Retransmits Handshake Messages From a Stale Buffer Offset8.2 High
u-bootDebian,u-boot-nezhaUbuntu +1 more[Unknown description]No scoreu-bootDebian,u-boot-nezhaUbuntu +1 more[Unknown description]No score- Show moreLoading…