Skip to content
OpenAdvisories

Archive

27 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /27 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • High 8.8
    CVE-2026-76060 Public exploit

    OS Command Injection in PayRange API

    An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events…

    ZoneMinder zoneminder zoneminder zoneminder Debian Ubuntu
  • High 8.8
    CVE-2026-10036 Public exploit

    SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing

    SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpoint…

    speechbrain speechbrain
  • High 8.8
    CVE-2026-76639 Public exploit

    Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal

    Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP por…

    Unitree Robotics G1 EDU
  • Medium 6.0
    CVE-2026-25250 Public exploit

    EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boo…

    eazsolution EazyFix
  • Critical 9.4
    CVE-2026-77991 Public exploit

    Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1

    Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.

    joomlaeventmanager.net JEM - Joomla Event Manager extension for Joomla Web / CMS
  • Medium 6.1
    CVE-2026-47883 Public exploit

    Spring Framework Open Redirect in UrlHandlerFilter

    UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

    Spring Spring Framework libspring-java Ubuntu
  • Critical 9.8
    CVE-2026-47884 Public exploit

    Spring Framework Improper Path Limitation in XsltView

    Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - …

    Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  • Critical 9.8
    CVE-2026-37071 Public exploit

    Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.…

  • Medium 5.3
    CVE-2026-37067 Public exploit

    Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unaut…

  • Critical 9.8
    CVE-2026-37072 Public exploit

    Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updat…

  • Medium 6.5
    CVE-2026-37070 Public exploit

    Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated…

  • Medium 5.3
    CVE-2026-37064 Public exploit

    User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker…

  • Medium 6.5
    CVE-2026-37066 Public exploit

    Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Ma…

  • Medium 5.3
    CVE-2026-37069 Public exploit

    Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Mana…

  • Medium 5.3
    CVE-2026-37073 Public exploit

    Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated …

  • High 8.1
    CVE-2026-37068 Public exploit

    Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allo…

  • Critical 9.1
    CVE-2026-37065 Public exploit

    Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&a…

  • Critical 9.8
    CVE-2026-26897 Public exploit

    An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain…