CVEs published in August 2026
12,182 vulnerabilities, 1,770 critical, 24 exploited.
- autorius e-goi smart marketing sms and newsletters formsWordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability9.3 Critical
- unknown leadconnectorWordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- techjewel fluent forms pro add on packWordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability7.5 High
- techjewel fluent forms pro add on packWordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability7.5 High
- passionate programmer peter wp data accessWordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability9.3 Critical
- uncodeWordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- icegram email subscribers & newslettersWordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability7.1 High
- syed balkhi charitableWordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability8.5 High
- mapsvgWordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- ukr solution print barcode labels for your woocommerce products/ordersWordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability6.5 Medium
- ellite wallosWallos: OIDC state parameter never validated — login CSRF / account takeover7.5 High
- quantumnous new-apiQuantumNous new-api Revoked API Token token session expiration5.3 Medium
- studio-42 elfinderelFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections5.4 Medium
- ellite wallosMissing Authentication for Critical Function in wallos7.5 High
- honojs @hono/oauth-providers@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking5.4 Medium
- ellite wallosWallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh4.3 Medium
- studio-42 elfinderelFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback8.6 High
- ellite wallosWallos: Cross-user subscription cost inference via replacement_subscription_id4.3 Medium
- msi dragon centerMSI Dragon Center MMIO Write Path NTIOLib_X64.sys MmioWritePath integer overflow9.3 Critical
- livewireLivewire DOM-based cross-site scripting during client-side state handling5.1 Medium
- sdcb chatssdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication6.3 Medium
- sdcb chatssdcb chats fetch-tools Endpoint McpController.cs McpController server-side request forgery5.3 Medium
- mozilla firefox for ios, firefox mobile +1 moreStalled popup navigation could allow address bar origin spoofing in Firefox for iOS5.4 Medium
- zephyrproject zephyrIPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service6.5 Medium
- caoqianming django-vue-admincaoqianming django-vue-admin file access control5.3 Medium
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreGdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf7.0 High
- xibosignage xibo-cmsXibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence4.3 Medium
- doccano auto labeling pipeline module to annotate a document automatically, open source annotation tools for machine learning practitioners +1 moreDoccano Open Source Annotation Tools for Machine Learning Practitioners Bulk-Delete Endpoint category-types LabelList access control5.3 Medium
- doccano auto labeling pipeline module to annotate a document automatically, open source annotation tools for machine learning practitioners +1 moreDoccano Open Source Annotation Tools for Machine Learning Practitioners Project Example Detail Endpoint examples ExampleDetail access control5.3 Medium
- oasdiff oasdiff-actionoasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs8.3 High
- zephyrproject zephyrEthernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion6.5 Medium
flvmetaDebianFLVMeta AMF Object Parsing amf.c amf_object_get null pointer dereference5.3 Medium- zephyrproject zephyrOff-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser5.4 Medium
- opensearch, amazon opensearch service, aws amazon opensearch service +2 moreUnrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination8.7 High
flvmetaDebianFLVMeta AMF String Processing amf.c amf_string_new heap-based overflow5.3 Medium- amd radeon™ pro v620 graphics productsA malicious virtual function can invoke the certain command handlers in the SMU, causing a denial...3.3 Low
- fosrl pangolinPangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint8.6 High
- dibo-software dibootdibo-software diboot Tenant Resource Assignment resource access control5.3 Medium
- amd radeon™ instinct™ mi25 graphics products, radeon™ pro v620 graphics products +1 moreRelease of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged...6.4 Medium
- zephyrproject zephyrI3C IBI work-node free-list data race between ISR and workqueue thread3.1 Low
- dibo-software dibootdibo-software diboot Tenant Administrator Management API admin access control5.3 Medium
- mcphubMCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration8.8 High
- mcphubMCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)7.1 High
- mcphubMCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching8.1 High
- mcphubMCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)7.1 High
- mcphubMCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)9.9 Critical
- mcphubMCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation7.6 High
- mcphubMCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)7.7 High
- dibo-software dibootdibo-software diboot AI Session Endpoint ai-session authorization5.3 Medium
- megaease easeprobeMegaEase EaseProbe Middleware server.go realIP access control6.9 Medium
- Show moreLoading…