Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2026

7,237 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 4 of 73

  • CVE-2026-18753
    36Monitor

    Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager)

    CriticalCVSS 9.1No exploitEPSS 0%

    geovision inc. · gv-as1620 (as-manager)Aug 4, 2026

  • CVE-2026-18754
    36Monitor

    Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)

    CriticalCVSS 9.1No exploitEPSS 0%

    geovision inc. · gv-as1620 (gv-cloud)Aug 4, 2026

  • CVE-2026-18755
    29Monitor

    GV-ASManager DLL hijacking vulnerability

    HighCVSS 7.3No exploitEPSS 0%

    geovision inc. · gv-asmanagerAug 4, 2026

  • CVE-2026-67243
    34Monitor

    freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability.

    HighCVSS 8.6No exploitEPSS 0%

    refirio · freo2Aug 4, 2026

  • CVE-2026-14175
    39Monitor

    Unrestricted File Upload in Bilin Software's HUMANIST Digital Human Resources

    CriticalCVSS 9.8No exploitEPSS 0%

    bilin software and informatics consultancy inc. · humanist digital human resourcesAug 4, 2026

  • CVE-2026-14804
    36Monitor

    Hardcoded Cryptographic Key in Bilin Software's HUMANIST Digital Human Resources

    CriticalCVSS 9.1No exploitEPSS 0%

    bilin software and informatics consultancy inc. · humanist digital human resourcesAug 4, 2026

  • CVE-2026-14838
    29Monitor

    Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources

    HighCVSS 7.4No exploitEPSS 0%

    bilin software and informatics consultancy inc. · humanist digital human resourcesAug 4, 2026

  • CVE-2026-15721
    39Monitor

    Query Console SQL Injection Leading to Sensitive Data Disclosure in Bilin Software's HUMANIST Digital Human Resources

    CriticalCVSS 9.8No exploitEPSS 0%

    bilin software and informatics consultancy inc. · humanist digital human resourcesAug 4, 2026

  • CVE-2026-69251
    37Monitor

    Flowise RCE via TypeORM DataSource

    CriticalCVSS 9.0Proof of conceptEPSS 2%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-18801
    37Monitor

    Stored Clickhouse SQL Injection Through Customer Usage Attribution

    CriticalCVSS 9.3No exploitEPSS 0%

    openmeter · openmeterAug 4, 2026

  • CVE-2026-10709
    31Monitor

    FBX BinaryReadSectionHeader Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK

    HighCVSS 7.8No exploitEPSS 0%

    autodesk · fbx software development kitAug 4, 2026

  • CVE-2026-10710
    31Monitor

    FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK

    HighCVSS 7.8No exploitEPSS 0%

    autodesk · fbx software development kitAug 4, 2026

  • CVE-2026-18806
    28Monitor

    Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer

    HighCVSS 7.1No exploitEPSS 0%

    tübi̇tak bi̇lgem software technologies research institute · pardus-image-writerAug 4, 2026

  • CVE-2026-58080
    35Monitor

    In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`.

    HighCVSS 8.8No exploitEPSS 0%

    eclipse · miloAug 4, 2026

  • CVE-2026-60007
    36Monitor

    In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding a

    CriticalCVSS 9.1No exploitEPSS 0%

    eclipse · miloAug 4, 2026

  • CVE-2026-62927
    34Monitor

    In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculati

    HighCVSS 8.7No exploitEPSS 0%

    eclipse · miloAug 4, 2026

  • CVE-2026-63252
    34Monitor

    In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel

    HighCVSS 8.7No exploitEPSS 0%

    eclipse · miloAug 4, 2026

  • CVE-2026-70369
    35Monitor

    Koha - SQL Injection in reports/acquisitions_stats.pl

    HighCVSS 8.8No exploitEPSS 0%

    koha community · kohaAug 4, 2026

  • CVE-2026-70370
    35Monitor

    Koha - SQL Injection in reports/catalogue_stats.pl

    HighCVSS 8.8No exploitEPSS 0%

    koha community · kohaAug 4, 2026

  • CVE-2026-70371
    35Monitor

    Koha - SQL Injection in reports/issues_avg_stats.pl

    HighCVSS 8.8No exploitEPSS 0%

    koha community · kohaAug 4, 2026

  • CVE-2026-70372
    35Monitor

    Koha - SQL Injection in reports/bor_issues_top.pl

    HighCVSS 8.8No exploitEPSS 0%

    koha community · kohaAug 4, 2026

  • CVE-2026-70373
    35Monitor

    Koha - SQL Injection in reports/issues_stats.pl

    HighCVSS 8.8No exploitEPSS 0%

    koha community · kohaAug 4, 2026

  • CVE-2026-17070
    35Monitor

    Vault Credential Confusion via Authorization Bypass in HAVELSAN's Liman MYS

    HighCVSS 8.8No exploitEPSS 0%

    havelsan inc. · liman mysAug 4, 2026

  • CVE-2026-18650
    35Monitor

    Missing Authorization Leading to Root Code Execution in HAVELSAN's Liman MYS

    HighCVSS 8.8No exploitEPSS 0%

    havelsan inc. · liman mysAug 4, 2026

  • CVE-2026-61514
    37Monitor

    Puwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 23456

    CriticalCVSS 9.3No exploitEPSS 0%

    puwell technology inc. · ip cameraAug 4, 2026

  • CVE-2026-61515
    38Monitor

    Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShell

    CriticalCVSS 9.3No exploitEPSS 2%

    puwell technology inc. · ip cameraAug 4, 2026

  • CVE-2017-20241
    37Monitor

    Keysight IxChariot Endpoint heap-based buffer overflow

    CriticalCVSS 9.3No exploitEPSS 1%

    keysight · ixchariotAug 4, 2026

  • CVE-2017-20242
    37Monitor

    Keysight IxChariot Endpoint stack-based buffer overflow

    CriticalCVSS 9.3No exploitEPSS 1%

    keysight · ixchariotAug 4, 2026

  • CVE-2026-67195
    34Monitor

    Perspective 5.0.0 RCE via eval() Expression Injection

    HighCVSS 8.7No exploitEPSS 1%

    perspective-dev · perspectiveAug 4, 2026

  • CVE-2026-67198
    34Monitor

    Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcher

    HighCVSS 8.7No exploitEPSS 0%

    perspective-dev · perspectiveAug 4, 2026

  • CVE-2026-67199
    28Monitor

    Perspective 5.0.0 DoS via Loop Expression Evaluation

    HighCVSS 7.1No exploitEPSS 0%

    perspective-dev · perspectiveAug 4, 2026

  • CVE-2026-67200
    34Monitor

    Perspective 5.0.0 Path Traversal via cwd_static_file_handler

    HighCVSS 8.7No exploitEPSS 0%

    perspective-dev · perspectiveAug 4, 2026

  • CVE-2026-67618
    28Monitor

    marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

    HighCVSS 7.1No exploitEPSS 0%

    marimo-team · marimoAug 4, 2026

  • CVE-2026-68494
    34Monitor

    jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

    HighCVSS 8.7No exploitEPSS 0%

    fasterxml · jackson-coreAug 4, 2026

  • CVE-2026-69250
    34Monitor

    Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

    HighCVSS 8.5No exploitEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-49435
    37Monitor

    Keysight IxChariot-related products stack-based buffer overflow

    CriticalCVSS 9.3No exploitEPSS 1%

    keysight · hawkeyeAug 4, 2026

  • CVE-2026-68743
    28Monitor

    Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1

    HighCVSS 7.1No exploitEPSS 0%

    fedoraproject · sssdAug 4, 2026

  • CVE-2026-21366
    31Monitor

    Integer Overflow or Wraparound in Data Network Stack & Connectivity

    HighCVSS 7.8No exploitEPSS 0%

    qualcomm · lemans au lgit firmwareAug 4, 2026

  • CVE-2026-24079
    32Monitor

    Missing Authentication for Critical Function in Data Modem

    HighCVSS 8.1No exploitEPSS 0%

    qualcomm · ar8035 firmwareAug 4, 2026

  • CVE-2026-24080
    31Monitor

    Buffer Copy Without Checking Size of Input in Biometrics

    HighCVSS 7.8No exploitEPSS 0%

    qualcomm · qam8295p firmwareAug 4, 2026

  • CVE-2026-24083
    31Monitor

    Untrusted Pointer Dereference in Automotive Security

    HighCVSS 7.8No exploitEPSS 0%

    qualcomm · qam8295p firmwareAug 4, 2026

  • CVE-2026-24084
    30Monitor

    Insecure Security Identifier Mechanism in Multi-Mode Call Processor

    HighCVSS 7.5No exploitEPSS 0%

    qualcomm · sdx57m firmwareAug 4, 2026

  • CVE-2026-25288
    29Monitor

    Buffer Over-read in WLAN Firmware

    HighCVSS 7.4No exploitEPSS 0%

    qualcomm · orne firmwareAug 4, 2026

  • CVE-2026-25289
    38Monitor

    Stack-based Buffer Overflow in WLAN Firmware

    CriticalCVSS 9.6No exploitEPSS 0%

    qualcomm · sm7550p firmwareAug 4, 2026

  • CVE-2026-25292
    30Monitor

    Improper Validation of Syntactic Correctness of Input in Automotive Linux OS

    HighCVSS 7.6No exploitEPSS 0%

    qualcomm · sm6225p firmwareAug 4, 2026

  • CVE-2026-69098
    37Monitor

    kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    cinnamon · kotaemonAug 4, 2026

  • CVE-2026-69100
    34Monitor

    LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution

    HighCVSS 8.7No exploitEPSS 1%

    dromara · lamp-cloudAug 4, 2026

  • CVE-2026-69110
    37Monitor

    OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music

    CriticalCVSS 9.3No exploitEPSS 0%

    microck · opencode-studioAug 4, 2026

  • CVE-2026-69252
    28Monitor

    Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

    HighCVSS 7.2No exploitEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-69253
    36Monitor

    Flowise Sandbox Escape to RCE

    CriticalCVSS 9.0No exploitEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-69254
    37Monitor

    Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-70479
    30Monitor

    Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

    HighCVSS 7.7No exploitEPSS 0%

    openwebui · open webuiAug 4, 2026

  • CVE-2026-70481
    21Monitor

    Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

    MediumCVSS 5.4Proof of conceptEPSS 0%

    openwebui · open webuiAug 4, 2026

  • CVE-2026-70482
    35Monitor

    Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

    HighCVSS 8.8No exploitEPSS 0%

    openwebui · open webuiAug 4, 2026

  • CVE-2026-70485
    28Monitor

    Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

    HighCVSS 7.1No exploitEPSS 0%

    openwebui · open webuiAug 4, 2026

  • CVE-2026-45538
    39Monitor

    OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy

    CriticalCVSS 9.8No exploitEPSS 0%

    opensips · opensipsAug 4, 2026

  • CVE-2026-67979
    36Monitor

    Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute a

    CriticalCVSS 9.1No exploitEPSS 0%

    Aug 4, 2026

  • CVE-2026-70494
    32Monitor

    Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

    HighCVSS 8.1No exploitEPSS 0%

    openwebui · open webuiAug 4, 2026

  • CVE-2025-29296
    40Plan

    H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R

    CriticalCVSS 9.8No exploitEPSS 2%

    Aug 4, 2026

  • CVE-2026-15307
    34Monitor

    Server-side file-write and request forgery via spatial lookups

    HighCVSS 8.7No exploitEPSS 1%

    djangoproject · djangoAug 4, 2026

  • CVE-2026-15314
    28Monitor

    Authenticated Denial-of-Service Vulnerability in TP-Link Tapo P110

    HighCVSS 7.1No exploitEPSS 0%

    tp-link · tapo p110 firmwareAug 4, 2026

  • CVE-2026-18787
    30Monitor

    GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injection

    HighCVSS 7.4No exploitEPSS 3%

    gl.inet · ax1800Aug 4, 2026

  • CVE-2026-48121
    26Monitor

    @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access

    MediumCVSS 6.7Proof of conceptEPSS 0%

    langchain-ai · langgraphjsAug 4, 2026

  • CVE-2026-56848
    30Monitor

    A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is execut

    HighCVSS 7.5Proof of conceptEPSS 0%

    nodejs · nodeAug 4, 2026

  • CVE-2026-58067
    34Monitor

    A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.

    HighCVSS 8.7No exploitEPSS 0%

    veeam · service provider consoleAug 4, 2026

  • CVE-2026-58071
    32Monitor

    A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administ

    HighCVSS 8.2No exploitEPSS 0%

    veeam · service provider consoleAug 4, 2026

  • CVE-2026-58072
    36Monitor

    A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execu

    CriticalCVSS 9.0No exploitEPSS 0%

    veeam · service provider consoleAug 4, 2026

  • CVE-2026-58073
    38Monitor

    A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's

    CriticalCVSS 9.5Proof of conceptEPSS 0%

    veeam · service provider consoleAug 4, 2026

  • CVE-2026-58074
    34Monitor

    A vulnerability allowing a high-privileged user to execute arbitrary code on the server.

    HighCVSS 8.6No exploitEPSS 0%

    veeam · oneAug 4, 2026

  • CVE-2026-58075
    34Monitor

    A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privil

    HighCVSS 8.7No exploitEPSS 0%

    veeam · oneAug 4, 2026

  • CVE-2026-63455
    39Monitor

    Authentication bypass via spoofed HTTP headers Orchestrator REST API

    CriticalCVSS 9.8No exploitEPSS 0%

    hewlett packard enterprise (hpe) · edgeconnect sd-wan orchestratorAug 4, 2026

  • CVE-2026-63456
    39Monitor

    Authentication bypass via spoofed HTTP headers Orchestrator REST API

    CriticalCVSS 9.8No exploitEPSS 0%

    hewlett packard enterprise (hpe) · edgeconnect sd-wan orchestratorAug 4, 2026

  • CVE-2026-64631
    34Monitor

    A vulnerability allowing a low-privileged user to inject SQL and extract database contents.

    HighCVSS 8.6No exploitEPSS 0%

    veeam · oneAug 4, 2026

  • CVE-2026-64633
    40Plan

    A vulnerability allowing remote unauthenticated code execution on the agent host.

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    veeam · oneAug 4, 2026

  • CVE-2026-64634
    33Monitor

    A vulnerability allowing local privilege escalation to the Reporter service context.

    HighCVSS 8.4No exploitEPSS 0%

    veeam · oneAug 4, 2026

  • CVE-2026-69255
    36Monitor

    Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

    CriticalCVSS 9.2No exploitEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-69256
    37Monitor

    Flowise: Remote Code Execution Vulnerability in CSVAgent

    CriticalCVSS 9.4No exploitEPSS 1%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-69257
    30Monitor

    Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

    HighCVSS 7.6No exploitEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-69258
    35Monitor

    Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

    HighCVSS 8.8No exploitEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-69259
    37Monitor

    Flowise RCE via SQLite Record Manager Node

    CriticalCVSS 9.4No exploitEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-69262
    28Monitor

    Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

    HighCVSS 7.1No exploitEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-69263
    34Monitor

    Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

    HighCVSS 8.7Proof of conceptEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-18830
    34Monitor

    Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

    HighCVSS 8.6Proof of conceptEPSS 0%

    aws · amazon bedrock agentcore harnessAug 4, 2026

  • CVE-2026-24253
    32Monitor

    NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write.

    HighCVSS 8.2No exploitEPSS 0%

    nvidia · dynamoAug 4, 2026

  • CVE-2026-24254
    39Monitor

    NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write.

    CriticalCVSS 9.8No exploitEPSS 0%

    nvidia · dynamoAug 4, 2026

  • CVE-2026-24255
    30Monitor

    NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submit

    HighCVSS 7.5No exploitEPSS 0%

    nvidia · dynamoAug 4, 2026

  • CVE-2026-47487
    28Monitor

    NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, wr

    HighCVSS 7.1No exploitEPSS 0%

    nvidia · triton inference serverAug 4, 2026

  • CVE-2026-47612
    30Monitor

    NVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker may cause improper limitation of a pathnam

    HighCVSS 7.5No exploitEPSS 0%

    nvidia · dynamoAug 4, 2026

  • CVE-2026-47613
    30Monitor

    NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause improper limitation of a pathname to a restricted directory by

    HighCVSS 7.5No exploitEPSS 0%

    nvidia · dynamoAug 4, 2026

  • CVE-2026-47614
    30Monitor

    NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery.

    HighCVSS 7.5No exploitEPSS 0%

    nvidia · dynamoAug 4, 2026

  • CVE-2026-47615
    30Monitor

    NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a mul

    HighCVSS 7.5No exploitEPSS 0%

    nvidia · dynamoAug 4, 2026

  • CVE-2026-47616
    30Monitor

    NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery.

    HighCVSS 7.5No exploitEPSS 0%

    nvidia · dynamoAug 4, 2026

  • CVE-2026-47617
    30Monitor

    NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery via

    HighCVSS 7.5No exploitEPSS 0%

    nvidia · dynamoAug 4, 2026

  • CVE-2026-47618
    30Monitor

    NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause server-side request forg

    HighCVSS 7.5No exploitEPSS 0%

    nvidia · dynamoAug 4, 2026

  • CVE-2026-47619
    32Monitor

    NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure.

    HighCVSS 8.1No exploitEPSS 0%

    nvidia · dynamoAug 4, 2026

  • CVE-2026-47623
    32Monitor

    NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data.

    HighCVSS 8.2No exploitEPSS 0%

    nvidia · dynamoAug 4, 2026

  • CVE-2026-69264
    37Monitor

    Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

    CriticalCVSS 9.4No exploitEPSS 1%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-70470
    38Monitor

    Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

    CriticalCVSS 9.5No exploitEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2026-45084
    34Monitor

    OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state

    HighCVSS 8.7No exploitEPSS 0%

    opensips · opensipsAug 4, 2026

  • CVE-2026-45100
    36Monitor

    OpenSIPS: Buffer Overflow in Base64 Encode Transformation

    CriticalCVSS 9.1No exploitEPSS 0%

    opensips · opensipsAug 4, 2026