Skip to content
OpenAdvisories

Archive

6 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /6 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-71554 Public exploit

    h2: Duplicate Host header could facilitate request smuggling

    h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP…

    python-hyper h2 open-webui airflow-3 Debian Ubuntu Wolfi PyPI
  • Critical 9.8
    CVE-2026-65400 Exploited Public exploit EPSS 18%

    An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macO…

    Apple macOS macOS
    KEV Aug 18, 2026
  • High 7.8
    CVE-2026-7867 Public exploit

    Udisks2: udisks2: local privilege escalation via as-user option spoofing

    A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  • Medium 5.3
    CVE-2026-64640 Public exploit

    Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

    Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to…

    Apache Software Foundation Apache Polaris apache-polaris PyPI
  • Critical 10.0
    CVE-2026-5430 Exploited Public exploit EPSS 22%

    Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

    The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized acce…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Universal Gateway
    KEV Sep 24, 2026
  • High 7.5
    CVE-2026-18649 Public exploit

    Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders

    A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacke…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu
  • High 8.8
    CVE-2024-39024 Public exploit

    In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.

  • High 8.8
    CVE-2026-67687 Public exploit

    Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/ro…

  • Critical 9.8
    CVE-2026-67689 Public exploit

    SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `o…