CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
perlAlmaLinux,liburi-perlDebian,perl-Algorithm-DiffAlmaLinux +237 more +239 moreURI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep6.5 Medium- ben group tubebuddy for youtube extensionBEN Group TubeBuddy for YouTube Extension tubebuddymaster1.js TBGlobal.GetToken data authenticity5.3 Medium
- toggl oü track extensionToggl OÜ Toggl Track Extension postMessage origin validation5.3 Medium
- zephyrproject zephyrSiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt6.4 Medium
- extension.vn 2fa authenticator extensionextension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure4.8 Medium
- vidiq vision for youtube extensionvidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure5.3 Medium
- flatpakFlatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream7.2 High
- flatpakIn Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to...7.4 High
- inbox foundry activeinbox extensionInbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials6.9 Medium
- red hat build of apache camel 3.33.3.sp1, build of apache camel 4 for quarkus 3, build of apicurio registry 3 +14 more +16 moreResteasy-core: resteasy sourceprovider remote unauthenticated file read7.5 High
- ieungsoft ultra ramdisk proieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management9.3 Critical
- extend themes kubio ai website builderWordPress Kubio AI Website Builder - Denial Of Service6.9 Medium
- hclsoftware connectionsHCL Connections is vulnerable to an information disclosure vulnerability3.1 Low
- unknown typoraTypora Mermaid Rendering cross site scripting5.3 Medium
- ebyte na111-m firmwareEbyte NA111-M Missing Authorization8.7 High
- ebyte na111-m firmwareEbyte NA111-M Use of a Broken or Risky Cryptographic Algorithm9.3 Critical
- armink struct2jsonarmink struct2json JSON Deserialization s2jdef.h S2J_STRUCT_GET_string_ELEMENT null pointer dereference6.9 Medium
- ebyte na111-m firmwareEbyte NA111-M Weak Authentication9.3 Critical
- ebyte ne2-d11 firmwareEbyte NA111-M Cleartext Storage of Sensitive Information7.1 High
- fahad mahmood keep backup dailyKeep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process8.7 High
- nasa earthdata-searchNASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery6.9 Medium
- tranquil it waptWAPT Server SQL Injection via /api/v3/hosts Endpoint7.1 High
- nasa earthdata-searchNASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery6.9 Medium
- suse yast2-auth-clientyast2-auth-client: OS command injection via unsanitized Organizational Unit / dnsHostName in AD join8.7 High
- profilepress membership team profilepressProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE9.2 Critical
- edimax br-6214kEdimax BR-6214K asp_setPing Endpoint ping.asp system os command injection5.1 Medium
- wp legal pages cookie notice for gdpr, ccpa & eprivacy consentWordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability10.0 Critical
- digitální a informační agentura (dia) eobčanka-identifikaceCommand Injection vulnerability in eObčanka-Identifikace9.3 Critical
- suse yast2-samba-clientyast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied)7.5 High
- edimax br-6214kEdimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injection5.1 Medium
- code-projects online shopping systemcode-projects Online Shopping System Search Functionality action.php sql injection6.9 Medium
- code-projects online shopping systemcode-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting5.3 Medium
- joomshaper.com helix ultimate extension for joomlaJoomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.105.1 Medium
- joomshaper.com helix ultimate extension for joomlaJoomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.105.1 Medium
- joomshaper.com helix ultimate extension for joomlaJoomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.108.9 High
- tubitak bilgem software technologies research institute pardus boot repairOS Command Injection in TÜBİTAK BİLGEM's Pardus Boot Repair7.8 High
- red hat build of quarkus 3.27.5.sp1, build of quarkus 3.33.3.sp1 +1 moreIo.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals7.5 High
- joomshaper.com helix ultimate extension for joomlaJoomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.118.6 High
- joomshaper.com helix ultimate extension for joomlaJoomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.105.3 Medium
- miniorgange.com custom api for joomla (free) extension for joomla, import export users for joomla (free) extension for joomla, joomai - ai assistant for joomla (free) extension for joomla +20 more +22 moreJoomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions8.8 High
- tbc technology inc. kitlogisticInformation Disclosure in TBC Technology's KitLogistic7.5 High
- itsourcecode student management systemsambitraj Student Management System Password aca.sql cleartext storage5.1 Medium
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change...8.8 High
- cyber-iii student-management-systemsambitraj Student-Management-System aca.sql default password6.9 Medium
- apache wicketApache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue6.1 Medium
- apache wicketApache Wicket: XSS in Palette via getAdditionalAttributes5.1 Medium
- cyber-iii student-management-systemsambitraj Student-Management-System session_start cookie httponly flag6.3 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System inv_searchfrm.php sql injection5.3 Medium
- tenda ac18Tenda AC18 Telnet telnet missing authentication10.0 Critical
- ankara hosting site management panelSQLi in Ankara Hosting's Site Management Panel8.8 High
- Show moreLoading…