Skip to content
OpenAdvisories

Archive

14 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /14 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 7.8
    CVE-2026-69414 Public exploit

    Microsoft Defender Elevation of Privilege Vulnerability

    Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".

    Microsoft Microsoft Malware Protection Engine
  • Critical 10.0
    CVE-2026-73678 Public exploit

    MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()

    MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ e…

    MindsDB Minds Platform
  • Critical 9.9
    CVE-2026-19681 Public exploit

    Command Injection

    An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying op…

    Tenable Security Center
  • High 8.8
    CVE-2026-19679 Public exploit

    Improper Input Validation

    An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.

    Tenable Security Center
  • Medium 6.8
    CVE-2026-73847 Public exploit

    Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover

    Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page …

    emlog emlog
  • Critical 9.9
    CVE-2026-19626 Public exploit

    Remote Code Execution

    A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-s…

    Tenable Security Center
  • High 7.5
    CVE-2026-73633 Public exploit

    Apache Struts: Unbounded read of a JSON request body

    Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single r…

    Apache Software Foundation Apache Struts
  • High 8.8
    CVE-2026-73673 Public exploit

    Netis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication

    Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.c…

    Netis Netis NC63 Wireless AC1200 Router
  • Medium 6.9
    CVE-2026-72815 Public exploit

    go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header

    go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rat…

    go-chi chi golang-github-go-chi-chi golang-github-go-chi-chi Debian Ubuntu Go
  • High 7.2
    CVE-2026-19794 Public exploit

    WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting

    The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web …

    gamerz WP-Stats Web / CMS
  • Medium 6.8
    CVE-2026-14290 Public exploit

    Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute

    The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the brows…

    Web / CMS