Skip to content
OpenAdvisories

Archive

August 2026

Vulnerabilities first published in this month (UTC), newest first.

← July 2026 2026 / August September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

136 results · Clear filters · Feed

  • High 8.1
    CVE-2026-18830 Public exploit

    Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

    Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this…

    AWS Amazon Bedrock AgentCore harness
  • High 8.7
    CVE-2026-69263 Public exploit

    Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYL…

    FlowiseAI Flowise flowise flowise-components npm
  • High 7.5
    CVE-2026-56848 Public exploit

    A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…

    Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  • High 7.8
    CVE-2026-64563 Public exploit

    rhashtable: clear stale iter->p on table restart

    In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when resuming a walk. When iter->walker.tbl is valid, it re-validates iter->p against the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-64561 Public exploit

    KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.2
    CVE-2026-6837 Public exploit

    A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware version…

    Zyxel WAX650S firmware Network devices
  • High 7.5
    CVE-2026-56846 Public exploit

    A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…

    Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  • High 7.2
    CVE-2026-67599 Public exploit

    ClearOS 7.9 OS Command Injection via Log Viewer filter parameter

    ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell …

    ClearFoundation ClearOS
  • High 7.4
    CVE-2026-67598 Public exploit

    Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

    Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, a…

    emlog emlog
  • High 7.0
    CVE-2026-18718 Public exploit

    Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project State

    Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-…

    National Security Agency ghidra
  • High 8.2
    CVE-2026-18577 Exploited Public exploit Scanner template EPSS 15%

    Incomplete patch leads to administrative account takeover

    An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

    N-able N-central
    KEV Aug 3, 2026
  • High 7.5
    CVE-2026-16540 Public exploit

    Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

    The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on…

    Web / CMS
  • High 8.2
    CVE-2026-18556 Exploited Public exploit EPSS 44%

    Unauthenticated administrative account takeover

    Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

    N-able N-central
    KEV Aug 4, 2026
  • High 7.2
    CVE-2026-67340 Public exploit

    ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

    ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a Jav…

    ArcadeData arcadedb com.arcadedb:arcadedb-engine Maven
  • High 7.2
    CVE-2026-13157 Public exploit

    Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload

    The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administ…

    Web / CMS
  • High 7.2
    CVE-2026-13158 Public exploit

    Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload

    The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site admi…

    Web / CMS