Skip to content
OpenAdvisories

Archive

17 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /17 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-64849 Exploited Public exploit Scanner template EPSS 10%

    MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflo…

    MLflow MLflow mlflow PyPI
    KEV Aug 19, 2026
  • Critical 9.4
    CVE-2026-19478 Public exploit Scanner template

    Improper Control of Generation of Code ('Code Injection') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete publ…

    GitLab GitLab Web / CMS
  • Critical 9.1
    CVE-2026-75045 Public exploit

    In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download datab…

    JetBrains YouTrack
  • Critical 9.8
    CVE-2026-67919 Public exploit

    An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri …

  • Critical 9.8
    CVE-2026-38165 Public exploit

    A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.…

  • Critical 9.8
    CVE-2026-68004 Public exploit

    An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP pu…