Skip to content
OpenAdvisories

Archive

21 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /21 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-55168 Public exploit

    Runtipi: Authenticated arbitrary file write via backup restore symlink planting

    Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant use…

    runtipi runtipi
  • Critical 9.8
    CVE-2026-76904 Public exploit Scanner template

    GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

    GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `…

    geotools geotools org.geotools.jdbc:gt-jdbc-postgis Maven
  • High 8.6
    CVE-2026-74252 Public exploit

    Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

    Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting (XSS) through the guest checkout billing address fields. An unauthenticated att…

    j2commerce.com J2Store extension for Joomla Web / CMS
  • Medium 5.3
    CVE-2026-67358 Public exploit

    Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

    Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order.…

    j2commerce.com J2Store extension for Joomla Web / CMS
  • High 7.8
    CVE-2026-74583 Public exploit

    net/sched: cls_route: fix fastmap use-after-free on filter

    In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The read…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-74580 Public exploit

    vhost: reset the vring metadata cache on vring reconfiguration

    In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cach…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.4
    CVE-2026-77812 Public exploit

    Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE

    DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly applicat…

    DJI Mini 3 Pro Mavic 3 Mavic 3 Pro
  • Critical 9.8
    CVE-2026-77806 Public exploit Scanner template

    SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in Augus…

    SPIP SPIP spip spip Debian Ubuntu
  • Medium 5.3
    CVE-2026-13736 Public exploit

    NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API

    The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible…

    Web / CMS