Skip to content
OpenAdvisories

Archive

5 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /5 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 8.4
    CVE-2026-17583 Public exploit

    Thermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integrity Check

    The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes.

    Thermo Fisher Applied Biosystems SeqStudio Genetic Analyzer Data Collection Software Applied Biosystems GeneMapper ID-X Software ABI PRISM 3100/3100-Avant Data Collection Software Ubuntu
  • High 8.6
    CVE-2026-18953 Public exploit

    Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server

    Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the s…

    AWS aws-transform-mcp-server
  • High 8.5
    CVE-2026-17633 Public exploit

    Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

    IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection.

    IBM Langflow OSS
  • High 8.8
    CVE-2026-20200 Public exploit

    Cisco Integrated Management Controller Argument Injection and Remote Code Execution Vulnerability

    A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.  T…

    Cisco Cisco Unified Computing System (Standalone) Network devices
  • High 7.7
    CVE-2026-71294 Public exploit

    Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions

    Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restr…

    cotonti cotonti
  • High 7.1
    CVE-2026-71211 Public exploit

    mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

    MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/serv…

    MLflow MLflow mlflow PyPI
  • High 8.2
    CVE-2026-71206 Public exploit

    shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion

    Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists i…

    go-shiori shiori
  • High 8.8
    CVE-2026-18322 Public exploit

    Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator

    The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the `havePermissions()` function in `classes/frame.php`, where `array_merge()` o…

    supsysticcom Smart Popup by Supsystic Web / CMS
  • High 7.5
    CVE-2025-70962 Public exploit

    Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials…