Skip to content
OpenAdvisories

Archive

3 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /3 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-69243 Public exploit

    AIOHTTP: HTTP request smuggling via WebSocket upgrade

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to exec…

    aio-libs aiohttp open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.2
    CVE-2026-67599 Public exploit

    ClearOS 7.9 OS Command Injection via Log Viewer filter parameter

    ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell …

    ClearFoundation ClearOS
  • High 7.4
    CVE-2026-67598 Public exploit

    Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

    Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, a…

    emlog emlog
  • High 7.0
    CVE-2026-18718 Public exploit

    Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project State

    Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-…

    National Security Agency ghidra
  • Critical 9.8
    CVE-2026-41452 Public exploit Scanner template

    Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup

    Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpR…

    krayin laravel-crm
  • Medium 6.2
    CVE-2026-15430 Public exploit

    CVE-2026-15430

    Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected l…

    Wellbia XIGNCODE3
  • Critical 10.0
    CVE-2026-69084 Public exploit Scanner template

    SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

    SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go
  • Critical 10.0
    CVE-2026-69083 Public exploit

    SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent

    SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via u…

    siyuan-note siyuan github.com/siyuan-note/siyuan/kernel Go
  • Critical 9.3
    CVE-2026-18574 Public exploit

    Authentication Bypass in Check Point Security Management Server

    An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the S…

    Check Point Security Management Server Multi-Domain Security Management Server Network devices
  • Medium 6.5
    CVE-2026-63563 Public exploit

    Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication…

    Toshiba Tec Sharp Sharp MFPs Toshiba Tec MFPs
  • Medium 6.9
    CVE-2026-8794 Public exploit

    PaperCut NG/MF: User enumeration via timing attack

    PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes …

    PaperCut PaperCut NG/MF
  • Medium 6.9
    CVE-2026-8793 Public exploit

    PaperCut NG/MF: Insufficient brute-force protection

    PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering acc…

    PaperCut PaperCut NG/MF
  • Critical 9.3
    CVE-2026-58062 Public exploit

    Stapled OCSP response accepted without binding to the checked certificate

    In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) a…

    Legion of the Bouncy Castle BC-JAVA BC-LTS-JAVA BC-FJA Debian Ubuntu Wolfi
  • Medium 6.1
    CVE-2026-38444 Public exploit

    osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value i…

  • Critical 9.8
    CVE-2026-52102 Public exploit

    An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to ex…