Skip to content
OpenAdvisories

Archive

28 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /28 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.8
    CVE-2026-18729 Public exploit

    Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

    IBM Langflow OSS
  • High 7.5
    CVE-2026-77078 Public exploit

    multer vulnerable to Denial of Service via crafted multipart field names

    multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a…

    multer multer multer node-multer Debian npm
  • High 7.5
    CVE-2026-55584 Public exploit

    phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

    phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticate…

    phpsysinfo phpsysinfo phpsysinfo phpsysinfo/phpsysinfo Debian Ubuntu Packagist
  • High 8.6
    CVE-2026-82286 Public exploit

    gpt-crawler Arbitrary File Write via outputFileName Parameter

    gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overw…

    BuilderIO gpt-crawler
  • High 8.8
    CVE-2026-81578 Exploited Public exploit Scanner template EPSS 85%

    PaperCut MF/NG: Authentication Bypass

    An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion o…

    PaperCut PaperCut MF/NG
    KEV Aug 31, 2026
  • High 7.5
    CVE-2026-78071 Public exploit

    Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0

    Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar.

    digital-peak.com DP Calendar extension for Joomla Web / CMS
  • High 8.8
    CVE-2026-80724 Public exploit

    ptp: vmclock: prevent read-only mappings from becoming writable

    In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Usersp…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2026-50979 Public exploit

    A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allo…