CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- No product listedOpen5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion5.3 Medium
- No product listedOpen5GS N1-N2 Message namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denial of service5.3 Medium
- No product listedOpen5GS Transfer Endpoint namf-handler.c null pointer dereference5.3 Medium
- ajcloud ajy ipc firmwareAJCloud AJY IPC Firmware Path Traversal via jdbhttpd8.7 High
- No product listedOpen5GS AMF namf-handler.c amf_namf_comm_decode_ue_mm_context_list memory corruption5.3 Medium
- ash-project ash graphqlIncomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names6.9 Medium
- ash-project ash graphqlCross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read7.1 High
- ash-project ash graphqlQuery-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service8.7 High
- ash-project ash graphqlUnhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment6.9 Medium
- ash-project ash graphqlBroken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification2.3 Low
- ash-project ash graphqlRe-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic2.3 Low
- ash-project ash cloakCloaked plaintext leaks through a non-sensitive action argument in AshCloak2.1 Low
- ash-project ash cloakUnsafe deserialization of decrypted terms enables node DoS in AshCloak5.9 Medium
- forgejoForgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery5.3 Medium
- totolink n600rTOTOLINK N600R Authentication cstecgi.cgi loginAuth random values6.3 Medium
- codekernel queue management systemSourceCodester Queue Management System add_customer.php cross site scripting5.3 Medium
- itsourcecode student management systemsambitraj Student Management System Student Dashboard student_dashboard.php mysqli_query improper authorization5.3 Medium
- linux foundation magmaLinux Foundation Magma gNB Termination ngap_amf.c denial of service5.3 Medium
- linux foundation magmaLinux Foundation Magma NGSetup ngap_amf_handlers.c state issue6.9 Medium
- linux foundation magmaLinux Foundation Magma NGSetupRequest input validation6.9 Medium
- linux foundation magmaLinux Foundation Magma SecurityModeComplete integrity check6.9 Medium
- ash-project ash postgresrename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres7.2 High
- linux foundation magmaLinux Foundation Magma InitialUEMessage information disclosure6.9 Medium
- linux foundation magmaLinux Foundation Magma Registration Complete Message amf_fsm.cpp improper authentication6.9 Medium
- admidioAdmidio before 5.0.12 Broken Access Control via profile_function.php5.3 Medium
- admidioAdmidio before 5.0.12 Authentication Bypass via RSS feeds8.7 High
- admidioAdmidio before 5.0.12 Path Traversal via Photo ZIP Download2.1 Low
- admidioAdmidio before 5.0.12 SQL Injection via relation_type_list8.7 High
- siyuan-note siyuanSiYuan before v3.8.1 Stored XSS via block name9.3 Critical
- siyuan-note siyuanSiYuan before v3.8.1 Stored XSS via confirmDialog9.3 Critical
- siyuan-note siyuanSiYuan before v3.8.1 Information Disclosure via Publish Access6.9 Medium
- siyuan-note siyuanSiYuan before v3.8.1 Missing Authorization via /history and /repo/diff6.9 Medium
- siyuan-note siyuanSiYuan before v3.8.1 Path Traversal via /api/template/render5.9 Medium
- siyuan-note siyuanSiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path7.0 High
- wwbn avideoWWBN AVideo SSRF Filter Bypass via NAT64 Hex Address7.1 High
- wwbn avideoWWBN AVideo Cross-Site Request Forgery via sendEmail.json.php5.3 Medium
- wwbn avideoWWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php5.3 Medium
- wwbn avideoAVideo Unauthenticated Stream Credential Disclosure via Forgeable Token9.2 Critical
- wwbn avideoWWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent8.7 High
- wwbn avideoWWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php6.9 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System sup_searchfrm.php sql injection5.3 Medium
- wger-project wgerwger-project wger Password Reset gym.py reset_user_password cross-site request forgery5.3 Medium
- readestReadest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution8.8 High
- keployKeploy 3.1.0-3.6.25 Unauthenticated TLS Key Exposure8.8 High
- browser-use web-uibrowser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage6.8 Medium
- chatgptnextweb nextchatNextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure8.7 High
- foxit readerjina-ai reader Server-Side Request Forgery via disabled private-address guard8.7 High
- browser-use web-uibrowser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation6.9 Medium
- qubes os osQubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm...7.9 High
- vastsa filecodeboxvastsa FileCodeBox Pickup Limit views.py update_file_usage race condition6.9 Medium
- Show moreLoading…