Skip to content
OpenAdvisories

Archive

12 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /12 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-73519 Public exploit

    WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret

    WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack…

    wolfsoftwaresystemsltd WolfStack
  • Critical 9.4
    CVE-2026-73296 Public exploit

    Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure

    Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP s…

    Microsoft UFO
  • High 8.3
    CVE-2026-73292 Public exploit

    Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

    Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, a…

    semaphoreui semaphore github.com/semaphoreui/semaphore Go
  • Medium 5.3
    CVE-2026-66384 Exploited Public exploit

    Authenticated users may write data outside the intended Docker cache path

    An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

    jfrog artifactory
    KEV Aug 27, 2026
  • High 8.9
    CVE-2026-57858 Public exploit

    Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID

    Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID withou…

    Cal.com Cal.com Self-Hosted (Cal.diy)
  • Critical 9.8
    CVE-2026-18366 Public exploit

    Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

    The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, esc…

    Web / CMS