CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- google cloud buildGoogle Cloud Build Comment Control Bypass via Webhook Suppression9.4 Critical
- yaojingang geoflowyaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting5.3 Medium
- valkey-io valkeyvalkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free2.1 Low
- pretix venuelessDefault webserver configuration with incorrect CSP6.4 Medium
- apache shiroApache Shiro: Server-side POST request may be steered to an alternate host5.9 Medium
- No product listedPowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery6.9 Medium
- jeecgboot jeewx-bootjeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload5.1 Medium
- colorful igamecenterColorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub_11504 privileges management9.3 Critical
- code-projects simple inventory systemcode-projects Simple Inventory System User Registration register.php cross site scripting5.3 Medium
- nokia nspAn Open Re-direct Vulnerability in Nokia NSP5.3 Medium
- nokia nspA Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP5.4 Medium
- nokia wavesuiteAn Insufficient Role-based Access Control Vulnerability in WaveSuite7.6 High
- growi, inc. growiGROWI contains a vulnerability with an authorization bypass through user-controlled key in the...5.3 Medium
- growi, inc. growiGROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an...6.9 Medium
- code-projects simple inventory systemcode-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosure6.9 Medium
- dell powerstore 1000t, powerstore 1200t, powerstore 3000t +10 more +12 moreDell PowerStore contains a Missing Authentication for Critical Function vulnerability. An...9.8 Critical
- o6 automation gmbh open62541open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free6.9 Medium
- unknown 爱采集数据采集和发布插件Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch5.3 Medium
- code-projects employee leave managing systemcode-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting5.1 Medium
libgpg-erroropenSUSESecurity update for libgpg-errorNo scorelibgpg-errorSUSESecurity update for libgpg-errorNo scorelibgpg-errorSUSESecurity update for libgpg-errorNo score- soarkey studentmanagement, 学生信息管理系统 +1 moreSoarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization6.9 Medium
- soarkey studentmanagement, 学生信息管理系统 +1 moreSoarkey StudentManagement/学生信息管理系统 CourseDao.java CourseDao.course_ranking sql injection5.3 Medium
- systerel s2opcSysterel S2OPC subscription_mgr.c use after free5.3 Medium
- systerel s2opcSysterel S2OPC String Array Range Writing sopc_builtintypes.c set_range_matrix_on_string_array out-of-bounds5.3 Medium
- totolink nr1800xTOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow9.4 Critical
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System Password Recovery passwordrecover.php find_phone sql injection6.9 Medium
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System Product Category Filter index.php loadResultList sql injection6.9 Medium
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injection6.9 Medium
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System Product Detail index.php loadResultList sql injection6.9 Medium
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection6.9 Medium
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection6.9 Medium
- ash-project ash phoenixAshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data2.3 Low
- ash-project ash phoenixBroken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain7.6 High
- ash-project ash phoenixAshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant6.3 Medium
- ash-project ash phoenixAshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message2.3 Low
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System inv_edit.php sql injection5.3 Medium
- kamailioKamailio AVP cxdx_avp.c get_4bytes out-of-bounds5.3 Medium
- ash-project ash adminPath traversal in AshAdmin file uploads via unsanitized client filename8.3 High
- ash-project ash adminAshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle2.3 Low
- cozmoslabs profile builder pluginCozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload6.9 Medium
- ash-project ash adminAshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass2.1 Low
- ash-project ash adminQuery-parameter injection in AshAdmin row-action links via unencoded string primary keys2.0 Low
- ash-project ash adminStored XSS in AshAdmin relationship typeahead via unescaped label_field content8.4 High
- ash-project ash adminAshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)8.3 High
- ash-project ash adminAshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain8.3 High
- barebones bbeditBareBones BBEdit Lasso Language Tokenizer infinite loop5.3 Medium
- barebones bbeditBareBones BBEdit Java Language recursion5.3 Medium
- seacmsSeaCMS Comment Cache member.php del_pl path traversal5.3 Medium
- Show moreLoading…