Skip to content
OpenAdvisories

Archive

1 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /1 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.2
    CVE-2026-18556 Exploited Public exploit EPSS 44%

    Unauthenticated administrative account takeover

    Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

    N-able N-central
    KEV Aug 4, 2026
  • High 7.2
    CVE-2026-67340 Public exploit

    ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

    ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a Jav…

    ArcadeData arcadedb com.arcadedb:arcadedb-engine Maven
  • Critical 9.8
    CVE-2026-15964 Public exploit

    Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change

    The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_a…

    britcoder Single Sign On For TNG Web / CMS
  • Medium 5.3
    CVE-2026-14840 Public exploit

    YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing

    The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and…

    Web / CMS
  • High 7.2
    CVE-2026-13157 Public exploit

    Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload

    The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administ…

    Web / CMS
  • High 7.2
    CVE-2026-13158 Public exploit

    Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload

    The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site admi…

    Web / CMS