Skip to content
OpenAdvisories

Archive

26 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /26 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 8.1
    CVE-2026-43621 Public exploit

    Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

    Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the …

    SimpleMachines SMF
  • High 8.7
    CVE-2026-65647 Public exploit

    Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as …

    WebPros Plesk Site Import Plesk Migrator
  • Critical 9.8
    CVE-2026-60004 Exploited Public exploit Scanner template EPSS 24%

    Gitea: Remote Code Execution via diffpatch Git Hook Installation

    Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

    Gitea Gitea code.gitea.io/gitea gitea Alpine Wolfi Go
    KEV Aug 25, 2026
  • Critical 9.8
    CVE-2026-80428 Public exploit

    ILIAS PHP Object Injection via Shibboleth Logout

    ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering d…

    ILIAS-eLearning e.V. ILIAS
  • Critical 9.8
    CVE-2026-80587 Public exploit

    mptcp: avoid combining some incoming suboptions

    In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-80521 Public exploit

    af_unix: Unlink scc_entry in unix_del_edge().

    In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--' 2) Run the followin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.6
    CVE-2026-54523 Public exploit

    Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

    Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply…

    kyverno kyverno kyverno-init-container-1.18 github.com/kyverno/kyverno Wolfi Go
  • Critical 9.8
    CVE-2026-18080 Public exploit

    ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment

    The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension vali…

    wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce Web / CMS
  • Critical 9.1
    CVE-2026-77542 Public exploit

    A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabili…

    Ubiquiti UID Enterprise Agent Network devices
  • High 7.5
    CVE-2026-16444 Public exploit

    Improper Validation of File Paths in TeamViewer Desktop Clients

    Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipbo…

    TeamViewer Full Client, Host, QuickSupport (v14 for Windows) Full Client, Host, QuickSupport (v14 for macOS) Full Client, Host, QuickSupport (v13 for Linux) Linux Windows macOS
  • Critical 9.8
    CVE-2026-18431 Public exploit

    Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

    The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input val…

    ThemeFusion Avada (Fusion) Builder Avada | Website Builder For WordPress & WooCommerce Web / CMS
  • Critical 9.8
    CVE-2026-19632 Public exploit Scanner template

    TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure

    The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible f…

    Cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation Web / CMS
  • Medium 6.1
    CVE-2026-39275 Public exploit

    Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary cod…

    cockpit Ubuntu
  • High 7.5
    CVE-2026-36851 Public exploit

    Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration.