Skip to content
OpenAdvisories

Archive

28 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /28 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-19295 Public exploit

    Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

    IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allo…

    IBM Langflow OSS
  • Critical 9.8
    CVE-2026-19286 Public exploit

    Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

    IBM Langflow OSS
  • Critical 9.8
    CVE-2026-82329 Exploited Public exploit Scanner template EPSS 14%

    Potential authentication bypass leading to administrative access in Artifactory

    JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

    jfrog artifactory
    KEV Sep 2, 2026
  • Critical 9.1
    CVE-2026-55511 Public exploit

    Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

    Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and…

    yamcs yamcs org.yamcs:yamcs-core Maven
  • Critical 9.4
    CVE-2026-82078 Exploited Public exploit EPSS 63%

    PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

    An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approv…

    PaperCut PaperCut MF/NG
    KEV Aug 31, 2026
  • Critical 10.0
    CVE-2026-82222 Public exploit Scanner template

    WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability

    Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.

    Liquid Web / StellarWP GiveWP
  • Critical 9.8
    CVE-2026-76581 Public exploit

    WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion

    The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` A…

    WPMU DEV WPMU DEV Dashboard Web / CMS
  • Critical 9.2
    CVE-2026-82090 Public exploit

    Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM.  JavaScript code can al…

    getpocket Pocket