Skip to content
OpenAdvisories

Archive

9 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /9 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-12372

    Server-Side Request Forgery (SSRF) in nltk/nltk

    A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in …

    nltk nltk/nltk nltk nltk Debian Ubuntu PyPI
  • Low 3.3
    CVE-2026-19368

    PV-Bhat gemsuite-mcp gemini_search unified-gemini.ts path traversal

    A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the file src/handlers/unified-gemini.ts of the component gemini_search/gemini_reason/gemini_process/gemini_analyze. The manipulation of the argume…

    PV-Bhat gemsuite-mcp
  • Low 2.1
    CVE-2026-70395

    Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash

    Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When manage_relationship is used with…

    ash-project ash ash Hex
  • Low 3.7
    CVE-2026-19361

    macrozheng mall mall-portal getAuthCode password recovery

    A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This …

    macrozheng mall
  • Low 3.1
    CVE-2026-19352

    mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery

    A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forg…

    mifi lossless-cut
  • Low 3.8
    CVE-2026-17011

    Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection

    The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacem…

    Web / CMS
  • Low 2.7
    CVE-2026-16957

    Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure

    The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private k…

    Web / CMS
  • Low 3.3
    CVE-2026-19324

    HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal

    A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes …

    HelloGGX shadcn-vue-mcp