Skip to content
OpenAdvisories

Archive

2 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /2 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.2
    CVE-2026-18577 Exploited Public exploit Scanner template EPSS 15%

    Incomplete patch leads to administrative account takeover

    An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

    N-able N-central
    KEV Aug 3, 2026
  • Critical 9.8
    CVE-2026-65321 Public exploit

    PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

    PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_h…

    laughingman7743 PyAthena
  • Medium 6.5
    CVE-2026-68582 Public exploit

    Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

    Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path witho…

    go-vikunja vikunja code.vikunja.io/api Go
  • High 7.5
    CVE-2026-16540 Public exploit

    Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

    The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on…

    Web / CMS
  • Medium 6.5
    CVE-2026-9335 Public exploit

    Improper Handling of HDF5 ExternalLinks in keras-team/keras

    A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe…

    Keras keras-team/keras keras keras Debian Ubuntu PyPI