Skip to content
OpenAdvisories

Archive

25 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /25 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-77680 Public exploit

    Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix

    An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7…

    Red Hat Red Hat Enterprise Linux 10 libsoup3 libsoup3 Linux Debian Ubuntu
  • High 8.8
    CVE-2026-79266 Public exploit

    Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineer…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • High 8.8
    CVE-2026-78938 Public exploit

    Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Medium 5.5
    CVE-2026-64705 Public exploit

    A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS S…

    Apple macOS iOS and iPadOS macOS iOS
  • Medium 4.8
    CVE-2026-26211 Public exploit

    Ekushey Project Manager CRM 5.0 Stored XSS via System Name Field

    Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, a…

    Creativeitem Ekushey Project Manager CRM
  • Critical 9.8
    CVE-2026-19912 Public exploit

    CVE-2026-19912

    The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose res…

    Kaltura Kaltura HTML5 Video Player, html5 library
  • High 7.5
    CVE-2026-63072 Public exploit

    Heap Buffer Overflow in CMS Key Unwrapping

    Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impa…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Critical 9.8
    CVE-2026-79657 Public exploit

    NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization

    NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace funct…

    nltk nltk nltk nltk Debian Ubuntu PyPI
  • High 8.8
    CVE-2026-19949 Public exploit

    All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

    The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient prepara…

    servmask All-in-One WP Migration and Backup Web / CMS
  • High 7.0
    CVE-2026-75037 Public exploit

    Polkit authentication bypass in LACT

    Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566.

    ilya-zlobintsev LACT
  • Medium 6.3
    CVE-2026-56096 Public exploit

    Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

    The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field…

    TYPO3 Extension "Apache Solr for TYPO3 - Enterprise Search" Web / CMS
  • Medium 6.1
    CVE-2026-17089 Public exploit

    Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter

    The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output …

    netweblogic Events Manager – Calendar, Bookings, Tickets, and more! Web / CMS
  • Critical 9.8
    CVE-2026-56705 Public exploit

    Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection

    Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root,…

    vrana adminer adminer adminer Debian Ubuntu
  • Medium 4.0
    CVE-2026-39113 Public exploit

    Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3…

    sqlite3 sqlite3 sqlite Debian Ubuntu