Skip to content
OpenAdvisories

Archive

20 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /20 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 6.7
    CVE-2026-77113 Public exploit

    Path Traversal Vulnerability in apport-unpack

    Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files.

    Canonical Apport
  • Critical 9.8
    CVE-2026-77647 Public exploit

    SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in Augus…

    SPIP SPIP spip spip Debian Ubuntu
  • Critical 10.0
    CVE-2026-69836 Exploited Public exploit

    Microsoft Entra ID Remote Code Execution Vulnerability

    Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

    Microsoft Microsoft Entra
  • High 7.5
    CVE-2026-53587 Public exploit

    libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data

    libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgi…

    libgit2 libgit2 libgit2 libgit2 Debian Ubuntu Azure Linux Alpine
  • Critical 9.3
    CVE-2026-19586 Public exploit

    Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways

    A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote …

    TP-Link Systems ER703WP-4G-Outdoor v1 ER7406 v1 DR3650v v1 Network devices
  • Medium 6.3
    CVE-2026-72844 Public exploit

    Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projections

    The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::add_inductive in src/kernel/inductive.cpp did not type check the nested inductive applications that are repla…

    leanprover lean4
  • High 8.2
    CVE-2026-40345 Public exploit

    deepmerge-ts: Stack exhaustion when merging recursive object graphs

    deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively mergi…

    RebeccaStevens deepmerge-ts langfuse-3-worker langfuse-3 Wolfi npm
  • Critical 9.8
    CVE-2026-63039 Public exploit

    Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.…

    Apache Software Foundation Apache InLong
  • Critical 9.8
    CVE-2026-15706 Public exploit

    Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

    Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS)…

    Baylan Measuring Instruments Industry and Trade Baylan Smart Meter Management Application (BMS)
  • High 8.6
    CVE-2026-76564 Public exploit

    Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

    Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

    phoca.cz Phoca Cart extension for Joomla Web / CMS
  • Medium 5.3
    CVE-2026-76569 Public exploit

    Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4

    Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4

    phoca.cz Phoca Download extension for Joomla Web / CMS
  • Medium 5.3
    CVE-2026-76565 Public exploit

    Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7

    Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7

    phoca.cz Phoca Cart extension for Joomla Web / CMS