Skip to content
OpenAdvisories

Archive

August 2026

Vulnerabilities first published in this month (UTC), newest first.

← July 2026 2026 / August September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

87 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-63563 Public exploit

    Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication…

    Toshiba Tec Sharp Sharp MFPs Toshiba Tec MFPs
  • Medium 6.9
    CVE-2026-8794 Public exploit

    PaperCut NG/MF: User enumeration via timing attack

    PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes …

    PaperCut PaperCut NG/MF
  • Medium 6.9
    CVE-2026-8793 Public exploit

    PaperCut NG/MF: Insufficient brute-force protection

    PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering acc…

    PaperCut PaperCut NG/MF
  • Medium 6.1
    CVE-2026-38444 Public exploit

    osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value i…

  • Medium 6.5
    CVE-2026-68582 Public exploit

    Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

    Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from the URL path witho…

    go-vikunja vikunja code.vikunja.io/api Go
  • Medium 6.5
    CVE-2026-9335 Public exploit

    Improper Handling of HDF5 ExternalLinks in keras-team/keras

    A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe…

    Keras keras-team/keras keras keras Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2026-14840 Public exploit

    YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing

    The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and…

    Web / CMS