By publication date

Exploited and new serious CVEs: August 2026

6,198 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 47 of 62

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-78391No exploit	Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLookransomlook · ransomlook · CWE-79 Pre-auth XSS	High8.8	—	0.4%	Aug 24, 2026
32Monitor	CVE-2026-78414No exploit	Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site namenetwork optix · nx witness vms · CWE-79 pre-auth RCE XSS	High8.0	—	0.3%	Aug 24, 2026
30Monitor	CVE-2025-68825No exploit	HCL Hive is affected by incorrect default permissionshclsoftware · hcl hive · CWE-276 Pre-auth	High7.5	—	0.3%	Aug 24, 2026
34Monitor	CVE-2026-12554No exploit	HP Easy Start for macOS - Security Updatehp inc · hp easy start for macos · CWE-1104 Local privilege escalation	High8.5	—	0.3%	Aug 24, 2026
30Monitor	CVE-2026-12555No exploit	HP Easy Start for macOS - Security Updatehp inc · hp easy start for macos · CWE-379	High7.7	—	0.3%	Aug 24, 2026
30Monitor	CVE-2026-12556No exploit	HP Easy Start for macOS - Security Updatehp inc · hp easy start for macos · CWE-319 Weak crypto	High7.7	—	0.2%	Aug 24, 2026
35Monitor	CVE-2026-13212No exploit	Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor idzephyrproject · zephyr · CWE-129 Pre-auth	High8.8	—	0.3%	Aug 24, 2026
30Monitor	CVE-2026-21752No exploit	HCL Hive is affected by a use of vulnerable third-party componentshclsoftware · hcl hive · CWE-1104 Pre-auth	High7.5	—	0.4%	Aug 24, 2026
29Monitor	CVE-2026-71364No exploit	Awx: project archive extraction allows path traversal file writesred hat · red hat ansible automation platform 2.5 for rhel 8 · CWE-22 RCE Path traversal	High7.2	—	1.7%	Aug 24, 2026
30Monitor	CVE-2026-71366No exploit	Awx: notification backends allow ssrf and credential leakagered hat · red hat ansible automation platform 2.5 for rhel 8 · CWE-918 SSRF	High7.7	—	0.5%	Aug 24, 2026
37Monitor	CVE-2026-76070Proof of concept	Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameternetis systems · nc63 · CWE-121 pre-auth RCE Memory safety	Critical9.3	—	1.3%	Aug 24, 2026
37Monitor	CVE-2026-76071Proof of concept	Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameternetis systems · nc63 · CWE-121 pre-auth RCE Memory safety	Critical9.3	—	1.4%	Aug 24, 2026
34Monitor	CVE-2026-78416No exploit	Authenticated RCE via `condition.config` JSON cleanse bypasscraftcms · cms · CWE-915 RCE	High8.7	—	1.0%	Aug 24, 2026
40Plan	CVE-2025-36939No exploit	Multiple vulnerabilities exist in OpenThread's handling of MLE packets.google · nest wifi router firmware · CWE-121 Pre-auth Memory safety	Critical10.0	—	0.2%	Aug 24, 2026
35Monitor	CVE-2025-36940No exploit	Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (google · android · CWE-416 Memory safety	High8.8	—	0.2%	Aug 24, 2026
30Monitor	CVE-2026-15469Proof of concept	Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800tp-link systems inc. · deco xe75 v3 / xe5300 v3.6/ we10800 v3.6 · CWE-321 Pre-auth Hard-coded credentials	High7.7	—	0.4%	Aug 24, 2026
29Monitor	CVE-2026-18349No exploit	SAMA5D44 Fault Injection Vulnerabilitymicrochip · sama5d4 · CWE-1247	High7.3	—	0.1%	Aug 24, 2026
28Monitor	CVE-2026-19685No exploit	Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete red hat · red hat enterprise linux 10 · CWE-863 Local privilege escalation Broken access control (IDOR)	High7.1	—	0.2%	Aug 24, 2026
26Monitor	CVE-2026-59230Proof of concept	Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headapache · camel · CWE-20 Pre-auth	Medium6.5	—	0.6%	Aug 24, 2026
22Monitor	CVE-2026-60093Proof of concept	Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to thapache · camel · CWE-23 Path traversal	Medium5.5	—	0.2%	Aug 24, 2026
21Monitor	CVE-2026-63621Proof of concept	Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filterapache · camel · CWE-20 Pre-auth	Medium5.3	—	0.5%	Aug 24, 2026
36Monitor	CVE-2026-66906Proof of concept	Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to thapache · camel · CWE-23 Pre-auth Path traversal	Critical9.1	—	0.7%	Aug 24, 2026
30Monitor	CVE-2026-66907Proof of concept	Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the resultapache · camel · CWE-23 Pre-auth Path traversal	High7.5	—	0.8%	Aug 24, 2026
30Monitor	CVE-2026-66908Proof of concept	Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never valiapache · camel · CWE-287 Pre-auth Auth bypass	High7.5	—	0.6%	Aug 24, 2026
39Monitor	CVE-2026-71300Proof of concept	Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injectionapache · camel · CWE-20 Pre-auth	Critical9.8	—	0.7%	Aug 24, 2026
28Monitor	CVE-2026-77914No exploit	rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpointrconfig · rconfig · CWE-22 Path traversal	High7.1	—	0.7%	Aug 24, 2026
37Monitor	CVE-2026-77915No exploit	rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.phprconfig · rconfig · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.7%	Aug 24, 2026
39Monitor	CVE-2026-78329Proof of concept	Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering neveapache · camel · CWE-20 Pre-auth	Critical9.8	—	0.7%	Aug 24, 2026
28Monitor	CVE-2026-78465No exploit	Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bitgimp · gimp · CWE-190 RCE Memory safety	High7.0	—	0.2%	Aug 24, 2026
35Monitor	CVE-2026-16348Proof of concept	Command Injection Vulnerability in VPN connection of Archer BE800tp-link systems inc. · archer be800 v1 · CWE-78 RCE Command injection	High8.5	—	2.1%	Aug 24, 2026
35Monitor	CVE-2026-71904No exploit	DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInformdraytek corporation · vigorap 918r · CWE-78 RCE Command injection	High8.6	—	1.7%	Aug 24, 2026
35Monitor	CVE-2026-71905No exploit	DrayTek VigorAP Multiple Models OS Command Injection via ExportSettingsdraytek corporation · vigorap 918r · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71906No exploit	DrayTek VigorAP Multiple Models OS Command Injection via setLandraytek corporation · vigorap 918r · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71907No exploit	DrayTek VigorAP Multiple Models OS Command Injection via setcamsetdraytek corporation · vigorap 918r · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71908No exploit	DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_testdraytek corporation · vigorap 918r · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71909No exploit	DrayTek VigorAP Multiple Models OS Command Injection via InquierTimedraytek corporation · vigorap 918r · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71910No exploit	DrayTek VigorAP Multiple Models OS Command Injection via apautotestdraytek corporation · vigorap 918r · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
34Monitor	CVE-2026-71911No exploit	DrayTek VigorAP Multiple Models Buffer Overflow via setLandraytek corporation · vigorap 918r · CWE-120 Memory safety	High8.6	—	0.6%	Aug 24, 2026
34Monitor	CVE-2026-71912No exploit	DrayTek VigorAP Multiple Models Buffer Overflow via apautotestdraytek corporation · vigorap 918r · CWE-120 Memory safety	High8.6	—	0.6%	Aug 24, 2026
35Monitor	CVE-2026-71913No exploit	DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgidraytek corporation · vigorap 918r · CWE-78 RCE Command injection	High8.6	—	1.7%	Aug 24, 2026
38Monitor	CVE-2026-71914No exploit	DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apmdraytek corporation · vigorap 918r · CWE-78 pre-auth RCE Command injection	Critical9.3	—	2.5%	Aug 24, 2026
35Monitor	CVE-2026-71915No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatusdraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71916No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via commandTabledraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	1.7%	Aug 24, 2026
35Monitor	CVE-2026-71917No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via pingtracedraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71918No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupActiondraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71919No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via sysrebootdraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
38Monitor	CVE-2026-71921No exploit	DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgidraytek corporation · vigorswitch g2540xs · CWE-78 pre-auth RCE Command injection	Critical9.3	—	2.7%	Aug 24, 2026
34Monitor	CVE-2026-71922No exploit	DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgidraytek corporation · vigorswitch g2540xs · CWE-476 Pre-auth Memory safety	High8.7	—	0.6%	Aug 24, 2026
35Monitor	CVE-2026-71923No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via auth_setdraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71924No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via getViddraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71925No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via getDetaildraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71926No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via setDevicedraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71927No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevicedraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71928No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevicedraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71929No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProtodraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71930No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via setTimedraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
35Monitor	CVE-2026-71931No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgradedraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	1.7%	Aug 24, 2026
35Monitor	CVE-2026-71933No exploit	DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functionsdraytek corporation · vigorswitch g2540xs · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.5%	Aug 24, 2026
34Monitor	CVE-2026-71934No exploit	DrayTek VigorSwitch Multiple Models Buffer Overflow via pingtracedraytek corporation · vigorswitch g2540xs · CWE-120 Memory safety	High8.6	—	0.6%	Aug 24, 2026
34Monitor	CVE-2026-71935No exploit	DrayTek VigorSwitch Multiple Models Buffer Overflow via webBackupActiondraytek corporation · vigorswitch g2540xs · CWE-120 Memory safety	High8.6	—	0.6%	Aug 24, 2026
34Monitor	CVE-2026-71936No exploit	DrayTek VigorSwitch Multiple Models Buffer Overflow via sysrebootdraytek corporation · vigorswitch g2540xs · CWE-120 Memory safety	High8.6	—	0.6%	Aug 24, 2026
34Monitor	CVE-2026-71937No exploit	DrayTek VigorSwitch Multiple Models Buffer Overflow via poe_schedule_profiledraytek corporation · vigorswitch g2540xs · CWE-120 Memory safety	High8.6	—	0.6%	Aug 24, 2026
34Monitor	CVE-2026-71938No exploit	DrayTek VigorSwitch Multiple Models Buffer Overflow via switch_lan_gvrpdraytek corporation · vigorswitch g2540xs · CWE-120 Memory safety	High8.6	—	0.6%	Aug 24, 2026
34Monitor	CVE-2026-71939No exploit	DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Add ACEdraytek corporation · vigorswitch g2540xs · CWE-120 Memory safety	High8.6	—	0.6%	Aug 24, 2026
34Monitor	CVE-2026-71940No exploit	DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Edit ACEdraytek corporation · vigorswitch g2540xs · CWE-120 Memory safety	High8.6	—	0.6%	Aug 24, 2026
34Monitor	CVE-2026-71941No exploit	DrayTek VigorSwitch Multiple Models Buffer Overflow via diag_logmaildraytek corporation · vigorswitch g2540xs · CWE-120 Memory safety	High8.6	—	0.6%	Aug 24, 2026
34Monitor	CVE-2026-71942No exploit	DrayTek VigorSwitch Multiple Models Buffer Overflow via mail_mailalertdraytek corporation · vigorswitch g2540xs · CWE-120 Memory safety	High8.6	—	0.6%	Aug 24, 2026
35Monitor	CVE-2026-71943No exploit	DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNetdraytek corporation · vigorswitch g2540xs · CWE-78 RCE Command injection	High8.6	—	2.2%	Aug 24, 2026
33Monitor	CVE-2026-76072No exploit	Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Modecontinuedev · continue · CWE-184 Pre-auth	High8.3	—	0.3%	Aug 24, 2026
34Monitor	CVE-2026-76073No exploit	Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Querysethumansignal · label-studio · CWE-639 Broken access control (IDOR)	High8.7	—	0.5%	Aug 24, 2026
37Monitor	CVE-2026-76835No exploit	OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Setoauth2-proxy · oauth2-proxy · CWE-290 Pre-auth Auth bypass	Critical9.3	—	0.4%	Aug 24, 2026
34Monitor	CVE-2026-76836No exploit	AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypassazuracast · azuracast · CWE-94 RCE Deserialization	High8.7	—	0.4%	Aug 24, 2026
33Monitor	CVE-2026-76838No exploit	Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirectshieventsdev · hi.events · CWE-918 SSRF	High8.4	—	0.4%	Aug 24, 2026
35Monitor	CVE-2026-9254Proof of concept	Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devicestp-link systems inc. · archer be800 v1 · CWE-78 pre-auth RCE Command injection	High8.7	—	3.0%	Aug 24, 2026
32Monitor	CVE-2025-26237No exploit	D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can be exploited to run aCWE-77 pre-auth RCE Command injection	High8.1	—	0.3%	Aug 24, 2026
32Monitor	CVE-2025-26238No exploit	In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.CWE-94 pre-auth RCE	High8.1	—	0.3%	Aug 24, 2026
35Monitor	CVE-2026-30864No exploit	Combodo iTop: Reflected XSS in dashboard revertcombodo · itop · CWE-79 XSS	High8.9	—	0.3%	Aug 24, 2026
37Monitor	CVE-2026-39975No exploit	Combodo iTop: Remote code execution using external auth variable valuecombodo · itop · CWE-94 RCE	Critical9.4	—	0.5%	Aug 24, 2026
34Monitor	CVE-2026-40877No exploit	Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferencescombodo · itop · CWE-94 RCE	High8.7	—	0.5%	Aug 24, 2026
34Monitor	CVE-2026-71504No exploit	Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Resetdolibarr · dolibarr · CWE-862 Broken access control (IDOR)	High8.6	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-71505No exploit	Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Routedolibarr · dolibarr · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-71506No exploit	Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpointdolibarr · dolibarr · CWE-863 Broken access control (IDOR)	High7.2	—	0.5%	Aug 24, 2026
28Monitor	CVE-2026-71507No exploit	Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routesdolibarr · dolibarr · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Aug 24, 2026
28Monitor	CVE-2026-71508No exploit	Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpointdolibarr · dolibarr · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Aug 24, 2026
28Monitor	CVE-2026-71509No exploit	Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpointdolibarr · dolibarr · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Aug 24, 2026
30Monitor	CVE-2026-75371No exploit	An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Aug 24, 2026
35Monitor	CVE-2026-78541No exploit	Command Injection in Parent Control of TP-Link Archer BE3600 v1tp-link systems inc. · archer be3600 v1 · CWE-78 RCE Command injection	High8.5	—	2.2%	Aug 24, 2026
27Monitor	CVE-2020-37268Proof of concept	Coq and Rocq Prover Print Assumptions Omits Unsafe Universe Checking Inlined Through Parameter Inlinerocq-prover · rocq · CWE-778	Medium6.8	—	0.1%	Aug 24, 2026
31Monitor	CVE-2026-61419No exploit	Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability.dell · thinos · CWE-284 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	Aug 24, 2026
28Monitor	CVE-2026-71510No exploit	Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameterdolibarr · dolibarr · CWE-863 SQL injection Broken access control (IDOR)	High7.1	—	0.3%	Aug 24, 2026
28Monitor	CVE-2026-71511No exploit	Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpointsdolibarr · dolibarr · CWE-522 Info leak	High7.1	—	0.4%	Aug 24, 2026
27Monitor	CVE-2026-72703Proof of concept	Rocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Callsrocq-prover · rocq · CWE-670	Medium6.8	—	0.1%	Aug 24, 2026
27Monitor	CVE-2026-72704Proof of concept	Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transportrocq-prover · rocq · CWE-670	Medium6.8	—	0.1%	Aug 24, 2026
27Monitor	CVE-2026-72705Proof of concept	Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argumentrocq-prover · rocq · CWE-670	Medium6.8	—	0.1%	Aug 24, 2026
27Monitor	CVE-2026-72711Proof of concept	Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variableleanprover · lean4 · CWE-20	Medium6.8	—	0.1%	Aug 24, 2026
27Monitor	CVE-2026-72714Proof of concept	Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Closerocq-prover · rocq · CWE-459	Medium6.8	—	0.1%	Aug 24, 2026
30Monitor	CVE-2026-75368No exploit	A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service CWE-121 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Aug 24, 2026
28Monitor	CVE-2026-75369No exploit	An out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT OBC software commit CWE-125 Pre-auth Memory safety	High7.1	—	0.2%	Aug 24, 2026
30Monitor	CVE-2026-76098No exploit	Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdownlepture · mistune · CWE-674 Pre-auth Denial of service	High7.5	—	0.4%	Aug 24, 2026
35Monitor	CVE-2026-78551No exploit	RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attemptsransomlook · ransomlook · CWE-307 Pre-auth	High8.8	—	0.6%	Aug 24, 2026

CVE-2026-78391
35Monitor
Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
ransomlook · ransomlookAug 24, 2026
CVE-2026-78414
32Monitor
Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name
HighCVSS 8.0No exploitEPSS 0%
- pre-auth RCE
- XSS
network optix · nx witness vmsAug 24, 2026
CVE-2025-68825
30Monitor
HCL Hive is affected by incorrect default permissions
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
hclsoftware · hcl hiveAug 24, 2026
CVE-2026-12554
34Monitor
HP Easy Start for macOS - Security Update
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
hp inc · hp easy start for macosAug 24, 2026
CVE-2026-12555
30Monitor
HP Easy Start for macOS - Security Update
HighCVSS 7.7No exploitEPSS 0%
hp inc · hp easy start for macosAug 24, 2026
CVE-2026-12556
30Monitor
HP Easy Start for macOS - Security Update
HighCVSS 7.7No exploitEPSS 0%
- Weak crypto
hp inc · hp easy start for macosAug 24, 2026
CVE-2026-13212
35Monitor
Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
zephyrproject · zephyrAug 24, 2026
CVE-2026-21752
30Monitor
HCL Hive is affected by a use of vulnerable third-party components
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
hclsoftware · hcl hiveAug 24, 2026
CVE-2026-71364
29Monitor
Awx: project archive extraction allows path traversal file writes
HighCVSS 7.2No exploitEPSS 1%
- RCE
- Path traversal
red hat · red hat ansible automation platform 2.5 for rhel 8Aug 24, 2026
CVE-2026-71366
30Monitor
Awx: notification backends allow ssrf and credential leakage
HighCVSS 7.7No exploitEPSS 0%
- SSRF
red hat · red hat ansible automation platform 2.5 for rhel 8Aug 24, 2026
CVE-2026-76070
37Monitor
Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter
CriticalCVSS 9.3Proof of conceptEPSS 1%
- pre-auth RCE
- Memory safety
netis systems · nc63Aug 24, 2026
CVE-2026-76071
37Monitor
Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter
CriticalCVSS 9.3Proof of conceptEPSS 1%
- pre-auth RCE
- Memory safety
netis systems · nc63Aug 24, 2026
CVE-2026-78416
34Monitor
Authenticated RCE via `condition.config` JSON cleanse bypass
HighCVSS 8.7No exploitEPSS 1%
- RCE
craftcms · cmsAug 24, 2026
CVE-2025-36939
40Plan
Multiple vulnerabilities exist in OpenThread's handling of MLE packets.
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Memory safety
google · nest wifi router firmwareAug 24, 2026
CVE-2025-36940
35Monitor
Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (
HighCVSS 8.8No exploitEPSS 0%
- Memory safety
google · androidAug 24, 2026
CVE-2026-15469
30Monitor
Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800
HighCVSS 7.7Proof of conceptEPSS 0%
- Pre-auth
- Hard-coded credentials
tp-link systems inc. · deco xe75 v3 / xe5300 v3.6/ we10800 v3.6Aug 24, 2026
CVE-2026-18349
29Monitor
SAMA5D44 Fault Injection Vulnerability
HighCVSS 7.3No exploitEPSS 0%
microchip · sama5d4Aug 24, 2026
CVE-2026-19685
28Monitor
Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete
HighCVSS 7.1No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
red hat · red hat enterprise linux 10Aug 24, 2026
CVE-2026-59230
26Monitor
Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with head
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
apache · camelAug 24, 2026
CVE-2026-60093
22Monitor
Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to th
MediumCVSS 5.5Proof of conceptEPSS 0%
- Path traversal
apache · camelAug 24, 2026
CVE-2026-63621
21Monitor
Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
apache · camelAug 24, 2026
CVE-2026-66906
36Monitor
Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to th
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
apache · camelAug 24, 2026
CVE-2026-66907
30Monitor
Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
apache · camelAug 24, 2026
CVE-2026-66908
30Monitor
Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never vali
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
apache · camelAug 24, 2026
CVE-2026-71300
39Monitor
Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
apache · camelAug 24, 2026
CVE-2026-77914
28Monitor
rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
rconfig · rconfigAug 24, 2026
CVE-2026-77915
37Monitor
rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
rconfig · rconfigAug 24, 2026
CVE-2026-78329
39Monitor
Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering neve
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
apache · camelAug 24, 2026
CVE-2026-78465
28Monitor
Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Memory safety
gimp · gimpAug 24, 2026
CVE-2026-16348
35Monitor
Command Injection Vulnerability in VPN connection of Archer BE800
HighCVSS 8.5Proof of conceptEPSS 2%
- RCE
- Command injection
tp-link systems inc. · archer be800 v1Aug 24, 2026
CVE-2026-71904
35Monitor
DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
draytek corporation · vigorap 918rAug 24, 2026
CVE-2026-71905
35Monitor
DrayTek VigorAP Multiple Models OS Command Injection via ExportSettings
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorap 918rAug 24, 2026
CVE-2026-71906
35Monitor
DrayTek VigorAP Multiple Models OS Command Injection via setLan
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorap 918rAug 24, 2026
CVE-2026-71907
35Monitor
DrayTek VigorAP Multiple Models OS Command Injection via setcamset
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorap 918rAug 24, 2026
CVE-2026-71908
35Monitor
DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorap 918rAug 24, 2026
CVE-2026-71909
35Monitor
DrayTek VigorAP Multiple Models OS Command Injection via InquierTime
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorap 918rAug 24, 2026
CVE-2026-71910
35Monitor
DrayTek VigorAP Multiple Models OS Command Injection via apautotest
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorap 918rAug 24, 2026
CVE-2026-71911
34Monitor
DrayTek VigorAP Multiple Models Buffer Overflow via setLan
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
draytek corporation · vigorap 918rAug 24, 2026
CVE-2026-71912
34Monitor
DrayTek VigorAP Multiple Models Buffer Overflow via apautotest
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
draytek corporation · vigorap 918rAug 24, 2026
CVE-2026-71913
35Monitor
DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
draytek corporation · vigorap 918rAug 24, 2026
CVE-2026-71914
38Monitor
DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
draytek corporation · vigorap 918rAug 24, 2026
CVE-2026-71915
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71916
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via commandTable
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71917
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via pingtrace
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71918
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71919
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71921
38Monitor
DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71922
34Monitor
DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71923
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71924
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via getVid
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71925
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71926
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71927
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71928
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71929
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71930
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via setTime
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71931
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71933
35Monitor
DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71934
34Monitor
DrayTek VigorSwitch Multiple Models Buffer Overflow via pingtrace
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71935
34Monitor
DrayTek VigorSwitch Multiple Models Buffer Overflow via webBackupAction
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71936
34Monitor
DrayTek VigorSwitch Multiple Models Buffer Overflow via sysreboot
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71937
34Monitor
DrayTek VigorSwitch Multiple Models Buffer Overflow via poe_schedule_profile
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71938
34Monitor
DrayTek VigorSwitch Multiple Models Buffer Overflow via switch_lan_gvrp
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71939
34Monitor
DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Add ACE
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71940
34Monitor
DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Edit ACE
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71941
34Monitor
DrayTek VigorSwitch Multiple Models Buffer Overflow via diag_logmail
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71942
34Monitor
DrayTek VigorSwitch Multiple Models Buffer Overflow via mail_mailalert
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-71943
35Monitor
DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
draytek corporation · vigorswitch g2540xsAug 24, 2026
CVE-2026-76072
33Monitor
Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
continuedev · continueAug 24, 2026
CVE-2026-76073
34Monitor
Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
humansignal · label-studioAug 24, 2026
CVE-2026-76835
37Monitor
OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
oauth2-proxy · oauth2-proxyAug 24, 2026
CVE-2026-76836
34Monitor
AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Deserialization
azuracast · azuracastAug 24, 2026
CVE-2026-76838
33Monitor
Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects
HighCVSS 8.4No exploitEPSS 0%
- SSRF
hieventsdev · hi.eventsAug 24, 2026
CVE-2026-9254
35Monitor
Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices
HighCVSS 8.7Proof of conceptEPSS 3%
- pre-auth RCE
- Command injection
tp-link systems inc. · archer be800 v1Aug 24, 2026
CVE-2025-26237
32Monitor
D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can be exploited to run a
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- Command injection
Aug 24, 2026
CVE-2025-26238
32Monitor
In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
Aug 24, 2026
CVE-2026-30864
35Monitor
Combodo iTop: Reflected XSS in dashboard revert
HighCVSS 8.9No exploitEPSS 0%
- XSS
combodo · itopAug 24, 2026
CVE-2026-39975
37Monitor
Combodo iTop: Remote code execution using external auth variable value
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
combodo · itopAug 24, 2026
CVE-2026-40877
34Monitor
Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences
HighCVSS 8.7No exploitEPSS 0%
- RCE
combodo · itopAug 24, 2026
CVE-2026-71504
34Monitor
Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-71505
28Monitor
Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-71506
28Monitor
Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-71507
28Monitor
Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-71508
28Monitor
Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-71509
28Monitor
Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-75371
30Monitor
An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Aug 24, 2026
CVE-2026-78541
35Monitor
Command Injection in Parent Control of TP-Link Archer BE3600 v1
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
tp-link systems inc. · archer be3600 v1Aug 24, 2026
CVE-2020-37268
27Monitor
Coq and Rocq Prover Print Assumptions Omits Unsafe Universe Checking Inlined Through Parameter Inline
MediumCVSS 6.8Proof of conceptEPSS 0%
rocq-prover · rocqAug 24, 2026
CVE-2026-61419
31Monitor
Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
dell · thinosAug 24, 2026
CVE-2026-71510
28Monitor
Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
- Broken access control (IDOR)
dolibarr · dolibarrAug 24, 2026
CVE-2026-71511
28Monitor
Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Info leak
dolibarr · dolibarrAug 24, 2026
CVE-2026-72703
27Monitor
Rocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Calls
MediumCVSS 6.8Proof of conceptEPSS 0%
rocq-prover · rocqAug 24, 2026
CVE-2026-72704
27Monitor
Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport
MediumCVSS 6.8Proof of conceptEPSS 0%
rocq-prover · rocqAug 24, 2026
CVE-2026-72705
27Monitor
Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument
MediumCVSS 6.8Proof of conceptEPSS 0%
rocq-prover · rocqAug 24, 2026
CVE-2026-72711
27Monitor
Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variable
MediumCVSS 6.8Proof of conceptEPSS 0%
leanprover · lean4Aug 24, 2026
CVE-2026-72714
27Monitor
Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close
MediumCVSS 6.8Proof of conceptEPSS 0%
rocq-prover · rocqAug 24, 2026
CVE-2026-75368
30Monitor
A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
Aug 24, 2026
CVE-2026-75369
28Monitor
An out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT OBC software commit
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
Aug 24, 2026
CVE-2026-76098
30Monitor
Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
lepture · mistuneAug 24, 2026
CVE-2026-78551
35Monitor
RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
ransomlook · ransomlookAug 24, 2026