CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- tenda ac1206Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication10.0 Critical
- tenda ac1206Tenda AC1206 Web UI telnet TendaTelnet missing authentication10.0 Critical
- quarkus quarkus-qute, red hat build of apache camel 3.33.3.sp1, build of apache camel 4 for quarkus 3 +3 more +5 moreIo.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine8.8 High
- john james jacoby bbpressWordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability5.3 Medium
- d-link dns-340l, dns-345 +1 moreD-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection9.4 Critical
- z-galaxy zbus polkitzbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID7.3 High
- apache wicketApache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel5.1 Medium
- apache wicketApache Wicket: XSS in MetaDataHeaderItem via addTagAttribute5.1 Medium
- apache wicketApache Wicket: XSS in Button via its model object5.1 Medium
- apache wicketApache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel5.1 Medium
freerdp3Ubuntufreerdp3 vulnerabilitiesNo score- apache wicketApache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener4.6 Medium
- apache wicketApache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed7.5 High
- d-link dns-320l, dns-327l, dns-340l +1 more +3 moreD-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection9.4 Critical
- apache wicketApache Wicket: Path traversal in resource style/variation/locale5.3 Medium
- d-link dns-327l, dns-340l +1 moreD-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection9.4 Critical
- samsung open source rlottieUncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with...5.5 Medium
- d-link dns-320l, dns-327l, dns-340l +1 more +3 moreD-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection9.4 Critical
- d-link dns-340l, dns-345 +1 moreD-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection9.4 Critical
- apconw aix-dbAix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown5.1 Medium
- yacy search serverYaCy Search Server through 1.941 XML External Entity Injection via Parsers8.7 High
- dataeaseDataEase before 2.10.26 Access Control Bypass via Share Tickets5.3 Medium
- dataeaseDataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints5.3 Medium
- ilias-elearning e.v. iliasILIAS Arbitrary File Read via SOAP addFile7.1 High
- phison electronics corporation ps3111-s11 controller firmwarePhison PS3111-S11 Controller Firmware Signature Verification Bypass9.3 Critical
- d-link dsm-g600D-Link DSM-G600 Multipart load_file.cgi out-of-bounds write8.7 High
- diem-project diemdiem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload5.3 Medium
- diem-project diemdiem-project diem Administrative Console actions.class.php executeCommand os command injection5.1 Medium
libhtml-formfu-perlDebian,perl-HTML-FormFuMageia +1 moreHTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements7.5 High- valkey-io valkeyvalkey-io valkey Module Timer module.c moduleTimerHandler double free4.8 Medium
- iobit unlockerIObit Unlocker IRP_MJ_DEVICE_CONTROL IObitUnlocker.sys ZwTerminateProcess privileges management4.6 Medium
- zte zxdu68 s202 v5.0Unauthenticated RCE Vulnerability in ZTE ZXDU68 S202 V5.0 Product9.6 Critical
- iobit uninstallerIObit Uninstaller IOCTL IUForceDelete.sys IRP_MJ_DEVICE_CONTROL privileges management4.8 Medium
- klaussilveira gitlistklaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service6.9 Medium
- klaussilveira gitlistklaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection6.9 Medium
- red hat build of apache camel for spring boot 4, enterprise linux 10, enterprise linux 8 +6 more +8 moreUndertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite7.5 High
- tooljetToolJet before v3.16.208 Authorization Bypass via organizationId5.1 Medium
- tooljetToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db9.4 Critical
- tooljetToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export5.3 Medium
- tooljetToolJet before v3.16.208 Cross-Workspace Authorization Bypass7.1 High
- tooljetToolJet before v3.16.208 Cross-Organization Data Read via Database Routes8.2 High
- tooljetToolJet before v3.16.208 Cross-Tenant Database Manipulation7.0 High
- tooljetToolJet Database before v3.16.44 Privilege Escalation via join_tables8.2 High
- kerberosmansour hulumiHulumi before v1.3.2 Helper Script Shadowing via Workspace Files8.6 High
- kerberosmansour hulumihulumi before v1.3.2 SCP Template Tag-on-Create Bypass9.3 Critical
- kerberosmansour hulumihulumi before v1.3.2 Privilege Escalation via IAM Policy9.3 Critical
- nodemailerNodemailer CRLF Injection via List-* Header Comments5.3 Medium
- yaojingang geoflowyaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forgery5.1 Medium
- yaojingang geoflowyaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection5.1 Medium
- yaojingang geoflowyaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal5.1 Medium
- Show moreLoading…