Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
12,374 results · Feed
-
High 8.6
LibreNMS Virtualisation Discovery Module RCE
LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.
-
Low 2.7
FMTSWriteUseIntelLib: FMTS SMM IHISI Buffer Overflow
SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow.
-
High 8.8
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary …
-
High 8.8
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the in…
-
High 8.8
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the in…
-
Critical 9.8
Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, pas…
-
High 7.1
CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack.
-
High 7.5
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker…
-
High 7.5
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker…
-
Critical 9.8
An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows atta…
-
Critical 9.8
Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. Thi…
-
High 7.5
Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted re…
-
High 7.5
Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint.
-
High 7.5
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker…
-
Critical 9.1
An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can lead to unexpected…
-
High 7.5
An issue was discovered in openRISC OR1200 commit 83ac6b. An inaccurate update of program counter (PC) values when SPR …
-
High 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows…
-
Medium 6.5
A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms…
-
Critical 9.8
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_…
-
Critical 9.8
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support …
-
Critical 9.8
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql par…
-
Critical 9.8
The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechani…
-
Medium 4.6
tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints …
-
Medium 6.5
libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid index…
-
Critical 9.8
Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update…
-
High 7.5
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize t…
-
High 7.5
In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitr…
-
Medium 6.8
An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /…
-
Critical 9.1
The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 i…
-
Critical 9.8
DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' para…
-
Critical 9.1
Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().
-
High 7.5
yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new …
-
Critical 9.8
The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnera…
-
Critical 9.8
In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an ar…
-
Critical 9.8
JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groov…
-
High 7.5
AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid …
-
Critical 9.8
disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fe…
-
Medium 6.8
Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/we…
-
Critical 9.8
In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which …
-
Medium 6.1CVE-2026-39275 Public exploit
Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary cod…