Skip to content
OpenAdvisories

Archive

19 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /19 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 8.5
    CVE-2026-75616 Public exploit

    Command Injection in Router Web Management Interface

    An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary …

    TP-Link Systems Archer C20 v6 Network devices
  • Critical 9.8
    CVE-2026-18315 Public exploit Scanner template

    TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter

    The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus …

    themetechmount TrueBooker – Appointment Booking and Scheduler System Web / CMS
  • Critical 9.0
    CVE-2026-32475 Public exploit Scanner template

    WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.

    Elementor Elementor Pro
  • Critical 9.0
    CVE-2026-72530 Exploited Public exploit

    A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.…

    TrueConf TrueConf Server
    KEV Aug 20, 2026
  • High 7.7
    CVE-2026-67363 Public exploit

    Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2

    Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recom…

    balbooa.com Balbooa Forms extension for Joomla Web / CMS
  • Critical 9.3
    CVE-2026-19490 Exploited Public exploit EPSS 33%

    NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490

    Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

    NetScaler ADC Gateway
    KEV Sep 9, 2026
  • High 8.8
    CVE-2026-19489 Public exploit

    Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 thr…

    NetScaler ADC Gateway
  • Critical 9.8
    CVE-2026-66613 Public exploit

    WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability

    Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.

    Crocoblock. Jetimpex JetEngine
  • Critical 9.0
    CVE-2026-18937 Public exploit Scanner template

    Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection

    The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code o…

    Web / CMS
  • Medium 6.8
    CVE-2026-15253 Public exploit

    Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title

    The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that…

    Web / CMS
  • Critical 9.9
    CVE-2026-51366 Public exploit

    SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary …

  • High 7.5
    CVE-2026-51367 Public exploit

    An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the …