17 August 2026

18 results · Clear filters · Feed

• Medium 4.3
  CVE-2026-65351 Public exploit

  This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…

  Apple macOS iOS and iPadOS visionOS macOS iOS Browsers Debian
  Aug 17, 2026
• Medium 6.5
  CVE-2026-65330 Public exploit

  The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequo…

  Apple macOS iOS and iPadOS watchOS macOS iOS
  Aug 17, 2026
• Medium 5.4
  CVE-2026-64788 Public exploit

  The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe…

  Apple macOS iOS and iPadOS watchOS macOS iOS
  Aug 17, 2026
• High 7.5
  CVE-2026-65343 Public exploit

  A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6…

  Apple macOS iOS and iPadOS watchOS macOS iOS
  Aug 17, 2026
• Medium 6.6
  CVE-2026-65349 Public exploit

  An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1…

  Apple macOS iOS and iPadOS watchOS macOS iOS
  Aug 17, 2026
• Critical 9.3
  CVE-2026-64849 Exploited Public exploit Scanner template EPSS 10%

  MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

  MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflo…

  MLflow MLflow mlflow PyPI
  Aug 17, 2026

  KEV Aug 19, 2026
• High 7.5
  CVE-2026-71518 Public exploit

  Typemill < 2.26.0 Authorization Bypass via Media File Download Route

  Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms …

  typemill typemill
  Aug 17, 2026
• High 7.1
  CVE-2026-54356 Public exploit

  Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

  Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASI…

  Budibase budibase @budibase/server npm
  Aug 17, 2026
• Medium 5.1
  CVE-2026-52886 Public exploit

  Notepad++: session.xml backupFilePath starts_with Bypass

  Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::starts_with against the expected backup directory without path normalization, allowing parent-director…

  notepad-plus-plus notepad-plus-plus
  Aug 17, 2026
• High 7.1
  CVE-2026-19650 Public exploit

  Cross-Site Request Forgery (CSRF) in GitLab

  GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via G…

  GitLab GitLab Web / CMS
  Aug 17, 2026
• Critical 9.4
  CVE-2026-19478 Public exploit Scanner template

  Improper Control of Generation of Code ('Code Injection') in GitLab

  GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete publ…

  GitLab GitLab Web / CMS
  Aug 17, 2026
• Medium 6.5
  CVE-2026-59903 Public exploit

  Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

  Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a…

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Aug 17, 2026
• Critical 9.1
  CVE-2026-75045 Public exploit

  In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download datab…

  JetBrains YouTrack
  Aug 17, 2026
• Low 3.1
  CVE-2026-19975 Public exploit

  Azuriom CMS Money Transfer ProfileController.php transferMoney toctou

  A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the component Money Transfer Handler. This manipulation causes time-of-check time-of-use. The a…

  Azuriom CMS
  Aug 17, 2026
• Medium 4.7
  CVE-2026-19971 Public exploit

  LB-Link WR1210M Backup Endpoint backup.cgi main missing authentication

  A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The ven…

  LB-LINK WR1210M
  Aug 17, 2026
• Critical 9.8
  CVE-2026-67919 Public exploit

  An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri …

  Aug 17, 2026
• Critical 9.8
  CVE-2026-38165 Public exploit

  A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.…

  Aug 17, 2026
• Critical 9.8
  CVE-2026-68004 Public exploit

  An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP pu…

  Aug 17, 2026