Skip to content
OpenAdvisories

Archive

August 2026

Vulnerabilities first published in this month (UTC), newest first.

← July 2026 2026 / August September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-82329 Exploited Public exploit Scanner template EPSS 14%

    Potential authentication bypass leading to administrative access in Artifactory

    JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

    jfrog artifactory
    KEV Sep 2, 2026
  • Critical 9.4
    CVE-2026-82078 Exploited Public exploit EPSS 63%

    PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

    An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approv…

    PaperCut PaperCut MF/NG
    KEV Aug 31, 2026
  • Critical 9.8
    CVE-2026-74233 Exploited

    Zbtlink MQWrt infosrvd Command Injection

    Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.…

    Zbtlink WE826-T2 WE5926 WE5926-WD
  • Critical 9.8
    CVE-2026-74232 Exploited

    Zbtlink MQWrt yunmgrd Cloud C2 Implant

    Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmwar…

    Zbtlink MoreQuick WE826-T2 MQAC-7620A
  • Critical 9.8
    CVE-2026-60004 Exploited Public exploit Scanner template EPSS 24%

    Gitea: Remote Code Execution via diffpatch Git Hook Installation

    Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

    Gitea Gitea code.gitea.io/gitea gitea Alpine Wolfi Go
    KEV Aug 25, 2026
  • Critical 10.0
    CVE-2026-69836 Exploited Public exploit

    Microsoft Entra ID Remote Code Execution Vulnerability

    Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

    Microsoft Microsoft Entra
  • Critical 9.0
    CVE-2026-72530 Exploited Public exploit

    A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.…

    TrueConf TrueConf Server
    KEV Aug 20, 2026
  • Critical 9.8
    CVE-2026-72529 Exploited

    A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.…

    TrueConf TrueConf Server
    KEV Aug 20, 2026
  • Critical 9.3
    CVE-2026-19490 Exploited Public exploit EPSS 33%

    NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490

    Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

    NetScaler ADC Gateway
    KEV Sep 9, 2026
  • Critical 9.3
    CVE-2026-64849 Exploited Public exploit Scanner template EPSS 10%

    MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflo…

    MLflow MLflow mlflow PyPI
    KEV Aug 19, 2026
  • Critical 9.1
    CVE-2026-71362 Exploited Public exploit Scanner template EPSS 92%

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user in…

    Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Web / CMS
    KEV Sep 24, 2026
  • Critical 10.0
    CVE-2026-72898 Exploited Public exploit Scanner template EPSS 98%

    Metabase SQL injection via password reset endpoint

    Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

    metabase metabase
    KEV Aug 11, 2026
  • Critical 9.8
    CVE-2026-65400 Exploited Public exploit EPSS 18%

    An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macO…

    Apple macOS macOS
    KEV Aug 18, 2026
  • Critical 10.0
    CVE-2026-5430 Exploited Public exploit EPSS 22%

    Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

    The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized acce…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Universal Gateway
    KEV Sep 24, 2026