Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
343 results · Clear filters · Feed
-
High 7.3CVE-2026-82957 Public exploit
hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url re…
-
Critical 9.8CVE-2026-82226 Public exploit
WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.
-
High 7.1CVE-2026-82221 Public exploit
WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.
-
Critical 10.0CVE-2026-81780 Public exploit
WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
-
High 8.1CVE-2026-72001 Public exploit
Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint
Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected r…
-
Critical 9.8CVE-2026-38577 Public exploit
Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.
-
Medium 5.3CVE-2026-79483 Public exploit
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHisto…
-
Critical 9.9CVE-2026-82592 Public exploit
D-Link DIR-825M Disk Formatting Handler Endpoint formDiskFormat sub_46725C stack-based overflow
A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the file /boafrm/formDiskFormat of the component Disk Formatting Handler Endpoint. The manipulation of the argument partition results in stack-based buffer overflow…
-
High 7.5CVE-2026-56718 Public exploit
AJCloud AJY IPC Firmware Path Traversal via jdbhttpd
AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the…
-
Critical 9.1CVE-2026-82539 Public exploit
TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption
A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function setMacFilterRules of the file cstecgi.cgi of the component MAC Filtering. Executing a manipulation of the argument desc can lead to memory corruption. The attack…
-
High 7.8CVE-2026-82474 Public exploit
Sudo through 1.9.17p2 Intercept Policy Bypass via execveat
Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enf…
-
Medium 6.6CVE-2026-76547 Public exploit
Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export
The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a f…
-
Critical 9.9CVE-2026-19295 Public exploit
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allo…
-
Critical 9.8CVE-2026-19286 Public exploit
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.
-
High 8.8CVE-2026-18729 Public exploit
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
-
High 7.5CVE-2026-77078 Public exploit
multer vulnerable to Denial of Service via crafted multipart field names
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a…
-
High 7.5CVE-2026-55584 Public exploit
phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticate…
-
Critical 9.8
Potential authentication bypass leading to administrative access in Artifactory
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
KEV Sep 2, 2026 -
Critical 9.1CVE-2026-55511 Public exploit
Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and…
-
High 8.6CVE-2026-82286 Public exploit
gpt-crawler Arbitrary File Write via outputFileName Parameter
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overw…
-
Critical 9.4
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approv…
KEV Aug 31, 2026 -
High 8.8
PaperCut MF/NG: Authentication Bypass
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion o…
KEV Aug 31, 2026 -
Critical 10.0CVE-2026-82222 Public exploit
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.
-
High 7.5CVE-2026-78071 Public exploit
Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0
Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar.
-
Medium 6.9CVE-2026-78070 Public exploit
Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2
Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles.
-
High 8.8CVE-2026-80724 Public exploit
ptp: vmclock: prevent read-only mappings from becoming writable
In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Usersp…
-
Critical 9.8CVE-2026-76581 Public exploit
WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` A…
-
Medium 6.8CVE-2026-12513 Public exploit
Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to…
-
Critical 9.2CVE-2026-82090 Public exploit
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can al…
-
Medium 6.1CVE-2026-50980 Public exploit
Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote…
-
High 8.1CVE-2026-50979 Public exploit
A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allo…
-
Medium 6.5CVE-2026-51376 Public exploit
An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAG…
-
High 8.8CVE-2026-76060 Public exploit
OS Command Injection in PayRange API
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events…
-
High 8.8CVE-2026-10036 Public exploit
SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpoint…
-
High 8.8CVE-2026-76639 Public exploit
Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal
Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP por…
-
Medium 6.0CVE-2026-25250 Public exploit
EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boo…
-
Critical 9.4CVE-2026-77991 Public exploit
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.
-
Medium 6.1CVE-2026-47883 Public exploit
Spring Framework Open Redirect in UrlHandlerFilter
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
-
Critical 9.8CVE-2026-47884 Public exploit
Spring Framework Improper Path Limitation in XsltView
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - …
-
Critical 9.8CVE-2026-37071 Public exploit
Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.…