By publication date

Exploited and new serious CVEs: August 2026

7,138 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 5 of 72

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2026-67465No exploit	Apache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustionapache · qpid proton-dotnet · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	Aug 5, 2026
30Monitor	CVE-2026-67551No exploit	Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authenticationapache · qpid proton-dotnet · CWE-789 Pre-auth Denial of service	High7.5	—	0.7%	Aug 5, 2026
30Monitor	CVE-2026-67588No exploit	Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustionapache · qpid protonj2 · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	Aug 5, 2026
30Monitor	CVE-2026-67589No exploit	Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authenticationapache · qpid protonj2 · CWE-789 Pre-auth Denial of service	High7.5	—	0.7%	Aug 5, 2026
30Monitor	CVE-2026-68060No exploit	Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authenticationapache · qpid broker-j · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	Aug 5, 2026
30Monitor	CVE-2026-68074No exploit	Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionapache · qpid broker-j · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	Aug 5, 2026
34Monitor	CVE-2026-71190No exploit	In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtrackiopenstack · swift · CWE-1333 Pre-auth Denial of service	High8.7	—	0.8%	Aug 5, 2026
37Monitor	CVE-2026-66747Proof of concept	ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implantzbtlink · cpe2801 firmware · CWE-506 Pre-auth	Critical9.3	—	0.7%	Aug 5, 2026
34Monitor	CVE-2026-71233No exploit	InvoiceNinja - Stored XSS via Invoice/Quote Terms Fieldinvoiceninja · invoiceninja · CWE-79 XSS	High8.7	—	0.3%	Aug 5, 2026
34Monitor	CVE-2026-71236No exploit	Grocy - Stored XSS via HTMLPurifier Output Double-Decodegrocy · grocy · CWE-79 XSS	High8.7	—	0.3%	Aug 5, 2026
39Monitor	CVE-2026-71237No exploit	Miantang IoT-PHP - Unauthenticated SQL Injection in /userloginmiantang · iot-php · CWE-89 Pre-auth Auth bypass SQL injection	Critical9.8	—	0.7%	Aug 5, 2026
39Monitor	CVE-2026-71248No exploit	Inventory-Management-System-PHP - Unauthenticated SQL Injection in Login and Product Deletionharsh21patel · inventory-management-system-php · CWE-89 Pre-auth Auth bypass SQL injection	Critical9.8	—	0.7%	Aug 5, 2026
30Monitor	CVE-2026-66274No exploit	Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflowapache · qpid proton-j · CWE-674 Pre-auth Denial of service	High7.5	—	0.7%	Aug 5, 2026
30Monitor	CVE-2026-67552No exploit	Apache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflowapache · qpid proton-dotnet · CWE-674 Pre-auth Denial of service	High7.5	—	0.7%	Aug 5, 2026
30Monitor	CVE-2026-67590No exploit	Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflowapache · qpid protonj2 · CWE-674 Pre-auth Denial of service	High7.5	—	0.7%	Aug 5, 2026
30Monitor	CVE-2026-67592No exploit	Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming deliveryapache · qpid protonj2 · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	Aug 5, 2026
30Monitor	CVE-2026-68073No exploit	Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflowapache · qpid broker-j · CWE-674 Pre-auth Denial of service	High7.5	—	0.7%	Aug 5, 2026
36Monitor	CVE-2026-70374No exploit	HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generationhashbrowncms · hashbrown-cms · CWE-78 RCE Command injection	High8.8	—	1.8%	Aug 5, 2026
36Monitor	CVE-2026-70375No exploit	HashBrown CMS - OS Command Injection via Git Deployer Branch Fieldhashbrowncms · hashbrown-cms · CWE-78 RCE Command injection	High8.8	—	1.8%	Aug 5, 2026
28Monitor	CVE-2026-54416No exploit	Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklistpluck-cms · pluck cms · CWE-434 File upload	High7.2	—	0.4%	Aug 5, 2026
33Monitor	CVE-2026-55739No exploit	Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletioncrater-invoice · crater · CWE-639 Broken access control (IDOR)	High8.3	—	0.3%	Aug 5, 2026
30Monitor	CVE-2026-59675No exploit	Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Servicesuse · rancher · CWE-770 Pre-auth Denial of service	High7.5	—	0.5%	Aug 5, 2026
30Monitor	CVE-2026-61483No exploit	Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoSapache · lucy · CWE-674 Pre-auth Denial of service	High7.5	—	1.0%	Aug 5, 2026
39Monitor	CVE-2026-61484No exploit	Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoSapache · lucy · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	0.8%	Aug 5, 2026
39Monitor	CVE-2026-61486No exploit	Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed inputapache · lucy · CWE-121 Pre-auth Memory safety	Critical9.8	—	0.8%	Aug 5, 2026
31Monitor	CVE-2026-64567No exploit	btrfs: reject free space cache with more entries than pageslinux · linux · CWE-125 Memory safety	High7.8	—	0.1%	Aug 5, 2026
31Monitor	CVE-2026-64570No exploit	wifi: mac80211: fix fils_discovery double free on alloc failurelinux · linux · CWE-415 Memory safety	High7.8	—	0.1%	Aug 5, 2026
31Monitor	CVE-2026-64574No exploit	wifi: mac80211: tear down new links on vif update error pathlinux · linux · CWE-416 Memory safety	High7.8	—	0.1%	Aug 5, 2026
31Monitor	CVE-2026-64575No exploit	bpf: tcp: fix double sock release on batch realloclinux · linux · CWE-416 Memory safety	High7.8	—	0.1%	Aug 5, 2026
28Monitor	CVE-2026-64576No exploit	nexthop: initialize extack in nh_res_bucket_migrate()linux · linux · CWE-457	High7.1	—	0.1%	Aug 5, 2026
31Monitor	CVE-2026-64580No exploit	xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()linux · linux · CWE-415 Memory safety	High7.8	—	0.1%	Aug 5, 2026
31Monitor	CVE-2026-64581No exploit	xfrm: fix sk_dst_cache double-free in xfrm_user_policy()linux · linux · CWE-362 Race condition	High7.8	—	0.1%	Aug 5, 2026
38Monitor	CVE-2026-70376Proof of concept	Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCEpluck-cms · pluck cms · CWE-352 pre-auth RCE XSS CSRF	Critical9.6	—	0.2%	Aug 5, 2026
30Monitor	CVE-2026-70377No exploit	imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Servicetheotherphil · imagecli · CWE-789 Pre-auth Denial of service	High7.5	—	0.3%	Aug 5, 2026
30Monitor	CVE-2026-70378No exploit	imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panictheotherphil · imagecli · CWE-1284 Pre-auth Denial of service	High7.5	—	0.3%	Aug 5, 2026
30Monitor	CVE-2026-71202No exploit	raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panickosinix · raster · CWE-191 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Aug 5, 2026
21Monitor	CVE-2026-71203Proof of concept	changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schemadgtlmoon · changedetection.io · CWE-306 Pre-auth Auth bypass	Medium5.3	—	0.3%	Aug 5, 2026
24Monitor	CVE-2026-71204Proof of concept	changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcementdgtlmoon · changedetection.io · CWE-284 Broken access control (IDOR)	Medium6.2	—	0.3%	Aug 5, 2026
26Monitor	CVE-2026-71205Proof of concept	changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Forcedgtlmoon · changedetection.io · CWE-307 Pre-auth	Medium6.5	—	0.2%	Aug 5, 2026
33Monitor	CVE-2026-71206Proof of concept	shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotiongo-shiori · shiori · CWE-613	High8.3	—	0.3%	Aug 5, 2026
39Monitor	CVE-2026-71207No exploit	Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypassmrswapnilsahu · stock-inventory-management-system · CWE-89 Pre-auth Auth bypass SQL injection	Critical9.8	—	0.7%	Aug 5, 2026
31Monitor	CVE-2026-71209Proof of concept	audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversaladvplyr · audiobookshelf · CWE-22 Pre-auth Path traversal	High7.5	—	2.2%	Aug 5, 2026
39Monitor	CVE-2026-71214No exploit	NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-servernasa-ammos · plandev (sequencing-server) · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.4%	Aug 5, 2026
28Monitor	CVE-2026-18933No exploit	wp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path Traversalwp-downloadmanager · wp-downloadmanager · CWE-434 Path traversal File upload	High7.2	—	0.4%	Aug 5, 2026
36Monitor	CVE-2026-10059No exploit	Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount tokenred hat · multicluster engine for kubernetes 2.1 · CWE-266	Critical9.1	—	0.6%	Aug 5, 2026
36Monitor	CVE-2026-10090No exploit	Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-adred hat · red hat advanced cluster management for kubernetes 2.11 · CWE-267	Critical9.0	—	0.5%	Aug 5, 2026
34Monitor	CVE-2026-71259No exploit	ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Executionesphome · esphome · CWE-184 RCE	High8.6	—	0.1%	Aug 5, 2026
39Monitor	CVE-2026-71262No exploit	IoTSharp BlobStorageController Missing Authentication and Path Traversaliotsharp · iotsharp · CWE-306 Pre-auth Auth bypass Path traversal	Critical9.8	—	0.6%	Aug 5, 2026
30Monitor	CVE-2026-71265No exploit	Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()domoticz · domoticz · CWE-121 Pre-auth Memory safety	High7.5	—	0.2%	Aug 5, 2026
35Monitor	CVE-2026-71287No exploit	Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injectioncacti · cacti · CWE-89 SQL injection	High8.8	—	0.5%	Aug 5, 2026
30Monitor	CVE-2026-71294Proof of concept	Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actionscotonti · cotonti · CWE-502 Deserialization	High7.6	—	0.3%	Aug 5, 2026
32Monitor	CVE-2026-15979No exploit	Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletionkeywordrush · content egg – affiliate product importer & price comparison · CWE-22 RCE Path traversal	High8.1	—	1.2%	Aug 5, 2026
36Monitor	CVE-2026-16443No exploit	Keycloak-services: keycloak-services: saml broker metadata import disables response signature validationredhat · build of keycloak · CWE-347 Pre-auth Weak crypto	Critical9.1	—	0.3%	Aug 5, 2026
28Monitor	CVE-2026-17506No exploit	Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scriptingbensibley · independent analytics – wordpress analytics plugin · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Aug 5, 2026
30Monitor	CVE-2026-7529No exploit	wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST APIwisemattic · wisecampaign – woocommerce conversions made easy · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.6%	Aug 5, 2026
29Monitor	CVE-2026-25703Proof of concept	Potential information leakage from manager /network/graph API in NeuVectorsuse · neuvector · CWE-202 Pre-auth Auth bypass	High7.3	—	0.8%	Aug 5, 2026
36Monitor	CVE-2026-44945No exploit	Cross-Cluster Impersonation Confused-Deputy Privilege Escalationsuse · rancher · CWE-441	Critical9.1	—	0.5%	Aug 5, 2026
30Monitor	CVE-2026-12609Proof of concept	In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*eclipse · theia · CWE-22 Pre-auth Path traversal	High7.5	—	1.6%	Aug 5, 2026
35Monitor	CVE-2026-60009No exploit	In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled eclipse · theia · CWE-22 Pre-auth Path traversal	High8.8	—	0.4%	Aug 5, 2026
39Monitor	CVE-2026-71231No exploit	IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookiethebradleysanders · iotsmarthome · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.6%	Aug 5, 2026
28Monitor	CVE-2026-71232No exploit	MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCEmagicblack · maccms10 · CWE-94 RCE	High7.2	—	0.5%	Aug 5, 2026
30Monitor	CVE-2026-71234No exploit	Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Tokendocumize · community · CWE-863 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 5, 2026
35Monitor	CVE-2026-71235No exploit	Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engineabsmach · magistrala · CWE-94 RCE SSRF	High8.8	—	0.5%	Aug 5, 2026
36Monitor	CVE-2026-71238No exploit	DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgerydjangocrm · django-crm · CWE-798 Pre-auth Hard-coded credentials CSRF	Critical9.1	—	0.4%	Aug 5, 2026
32Monitor	CVE-2026-71239No exploit	DjangoCRM - Server-Side Template Injection in Mass Mail Message Renderingdjangocrm · django-crm · CWE-1336 RCE SSTI	High8.1	—	0.3%	Aug 5, 2026
30Monitor	CVE-2026-71241No exploit	Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing Historylyric777 · book-management-system · CWE-306 Pre-auth Auth bypass	High7.5	—	0.4%	Aug 5, 2026
33Monitor	CVE-2026-71242No exploit	Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicycrater-invoice · crater · CWE-639 Broken access control (IDOR)	High8.3	—	0.3%	Aug 5, 2026
35Monitor	CVE-2026-71243No exploit	backmeup (npm) - OS Command Injection via Backup Option Valuesadaltas · backmeup · CWE-78 RCE Command injection	High8.8	—	0.5%	Aug 5, 2026
32Monitor	CVE-2026-71252No exploit	toner-management - Unauthenticated State-Changing Admin Actionsraghav993 · toner-management · CWE-862 Pre-auth Broken access control (IDOR)	High8.2	—	0.5%	Aug 5, 2026
32Monitor	CVE-2026-15573No exploit	Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcherredhat · build of keycloak · CWE-551	High8.1	—	0.4%	Aug 5, 2026
32Monitor	CVE-2026-16102No exploit	Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappersredhat · build of keycloak · CWE-551	High8.1	—	0.4%	Aug 5, 2026
30Monitor	CVE-2026-17613No exploit	Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite anpenpot · penpot · CWE-862 Pre-auth Broken access control (IDOR) Denial of service	High7.5	—	0.6%	Aug 5, 2026
30Monitor	CVE-2026-54876No exploit	Client-Side Memory Leak in OCSP Response Checkingopenssl · openssl · CWE-401 Pre-auth Denial of service	High7.5	—	0.5%	Aug 5, 2026
35Monitor	CVE-2026-15572No exploit	Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalationredhat · build of keycloak · CWE-843	High8.8	—	0.6%	Aug 5, 2026
39Monitor	CVE-2026-16442No exploit	Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restrictionredhat · build of keycloak · CWE-346 Pre-auth	Critical9.8	—	0.3%	Aug 5, 2026
39Monitor	CVE-2026-8400No exploit	Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPUibm · websphere application server · CWE-470 Pre-auth	Critical9.8	—	0.4%	Aug 5, 2026
30Monitor	CVE-2026-46581No exploit	In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, aeclipse · mojarra · CWE-22 Pre-auth Path traversal	High7.5	—	0.5%	Aug 5, 2026
30Monitor	CVE-2026-61891No exploit	In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GEeclipse · theia · CWE-22 Pre-auth Path traversal	High7.5	—	0.5%	Aug 5, 2026
31Monitor	CVE-2026-64582No exploit	RDMA/rxe: Fix a use-after-free problem in rxe_mmaplinux · linux · CWE-416 Memory safety	High7.8	—	0.1%	Aug 5, 2026
39Monitor	CVE-2026-71254No exploit	nanoMODBUS Server-Side Out-of-Bounds Write in handle_read_file_record()debevv · nanomodbus · CWE-787 Pre-auth Memory safety	Critical9.8	—	0.5%	Aug 5, 2026
34Monitor	CVE-2026-71255No exploit	nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()debevv · nanomodbus · CWE-787 Pre-auth Memory safety	High8.6	—	0.3%	Aug 5, 2026
39Monitor	CVE-2026-71256No exploit	nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_iddebevv · nanomodbus · CWE-125 Pre-auth Memory safety	Critical9.8	—	0.5%	Aug 5, 2026
34Monitor	CVE-2026-20301No exploit	Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerabilitycisco · ios · CWE-606 Pre-auth Denial of service	High8.6	—	0.5%	Aug 5, 2026
34Monitor	CVE-2026-9077No exploit	Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol featureslangflow · langflow · CWE-807	High8.5	—	0.4%	Aug 5, 2026
31Monitor	CVE-2026-16022No exploit	Command Injection in @oblique/cliswiss federal office of information technology, systems and telecommunication · @oblique/cli · CWE-78 RCE Command injection	High7.8	—	0.8%	Aug 5, 2026
29Monitor	CVE-2026-71226No exploit	Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio pathredhat · hardened images · CWE-416 Memory safety	High7.3	—	0.1%	Aug 5, 2026
31Monitor	CVE-2026-71261No exploit	dr_wav.h W64 CUE Chunk Metadata Parsing Integer Overflow Leading to Heap Buffer Overflow on 32-bit Buildsmackron · dr_libs · CWE-190 Memory safety	High7.8	—	0.1%	Aug 5, 2026
36Monitor	CVE-2026-71263No exploit	FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()cwalter-at · freemodbus · CWE-787 Pre-auth Memory safety	Critical9.1	—	0.5%	Aug 5, 2026
32Monitor	CVE-2026-71264No exploit	WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock Stateaircoookie · wled · CWE-862 Pre-auth Broken access control (IDOR)	High8.2	—	0.3%	Aug 5, 2026
31Monitor	CVE-2026-71266No exploit	tinyobjloader-c Stack Buffer Overflow in MTL Material File Line Parsingsyoyo · tinyobjloader-c · CWE-121 Memory safety	High7.8	—	0.1%	Aug 5, 2026
39Monitor	CVE-2026-71267No exploit	microtar Stack Buffer Overflow in mtar_write_file_header() and mtar_write_dir_header()rxi · microtar · CWE-121 Pre-auth Memory safety	Critical9.8	—	0.5%	Aug 5, 2026
39Monitor	CVE-2026-71268No exploit	OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Writethiagoralves · openplc_v3 · CWE-22 Path traversal	Critical9.9	—	0.5%	Aug 5, 2026
34Monitor	CVE-2026-71270No exploit	Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocessstirling-tools · stirling-pdf · CWE-918 Pre-auth SSRF	High8.6	—	0.4%	Aug 5, 2026
34Monitor	CVE-2026-71271No exploit	Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypassusememos · memos · CWE-918 SSRF	High8.5	—	0.3%	Aug 5, 2026
34Monitor	CVE-2026-71272No exploit	Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()usememos · memos · CWE-367 SSRF Race condition	High8.5	—	0.2%	Aug 5, 2026
34Monitor	CVE-2026-71274No exploit	OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labelsopenshwprojects · openbk7231t_app · CWE-79 Pre-auth XSS	High8.5	—	0.2%	Aug 5, 2026
28Monitor	CVE-2026-71276No exploit	Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameterabsmach · magistrala · CWE-89 SQL injection	High7.1	—	0.3%	Aug 5, 2026
36Monitor	CVE-2026-71277No exploit	rust-iot-platform Authentication Bypass via Non-Validated Authorization Headeriot-ecology · rust-iot-platform · CWE-287 Pre-auth Auth bypass	Critical9.1	—	0.4%	Aug 5, 2026
39Monitor	CVE-2026-71278No exploit	rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluationiot-ecology · rust-iot-platform · CWE-94 pre-auth RCE Auth bypass	Critical9.8	—	0.6%	Aug 5, 2026
32Monitor	CVE-2026-71279No exploit	Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Executionkoenkk · zigbee2mqtt · CWE-22 RCE Path traversal	High8.0	—	0.5%	Aug 5, 2026

CVE-2026-67465
30Monitor
Apache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · qpid proton-dotnetAug 5, 2026
CVE-2026-67551
30Monitor
Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authentication
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · qpid proton-dotnetAug 5, 2026
CVE-2026-67588
30Monitor
Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · qpid protonj2Aug 5, 2026
CVE-2026-67589
30Monitor
Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · qpid protonj2Aug 5, 2026
CVE-2026-68060
30Monitor
Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · qpid broker-jAug 5, 2026
CVE-2026-68074
30Monitor
Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · qpid broker-jAug 5, 2026
CVE-2026-71190
34Monitor
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracki
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
openstack · swiftAug 5, 2026
CVE-2026-66747
37Monitor
ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
zbtlink · cpe2801 firmwareAug 5, 2026
CVE-2026-71233
34Monitor
InvoiceNinja - Stored XSS via Invoice/Quote Terms Field
HighCVSS 8.7No exploitEPSS 0%
- XSS
invoiceninja · invoiceninjaAug 5, 2026
CVE-2026-71236
34Monitor
Grocy - Stored XSS via HTMLPurifier Output Double-Decode
HighCVSS 8.7No exploitEPSS 0%
- XSS
grocy · grocyAug 5, 2026
CVE-2026-71237
39Monitor
Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- SQL injection
miantang · iot-phpAug 5, 2026
CVE-2026-71248
39Monitor
Inventory-Management-System-PHP - Unauthenticated SQL Injection in Login and Product Deletion
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- SQL injection
harsh21patel · inventory-management-system-phpAug 5, 2026
CVE-2026-66274
30Monitor
Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · qpid proton-jAug 5, 2026
CVE-2026-67552
30Monitor
Apache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflow
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · qpid proton-dotnetAug 5, 2026
CVE-2026-67590
30Monitor
Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflow
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · qpid protonj2Aug 5, 2026
CVE-2026-67592
30Monitor
Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · qpid protonj2Aug 5, 2026
CVE-2026-68073
30Monitor
Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · qpid broker-jAug 5, 2026
CVE-2026-70374
36Monitor
HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Command injection
hashbrowncms · hashbrown-cmsAug 5, 2026
CVE-2026-70375
36Monitor
HashBrown CMS - OS Command Injection via Git Deployer Branch Field
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Command injection
hashbrowncms · hashbrown-cmsAug 5, 2026
CVE-2026-54416
28Monitor
Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist
HighCVSS 7.2No exploitEPSS 0%
- File upload
pluck-cms · pluck cmsAug 5, 2026
CVE-2026-55739
33Monitor
Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
crater-invoice · craterAug 5, 2026
CVE-2026-59675
30Monitor
Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
suse · rancherAug 5, 2026
CVE-2026-61483
30Monitor
Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
apache · lucyAug 5, 2026
CVE-2026-61484
39Monitor
Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
apache · lucyAug 5, 2026
CVE-2026-61486
39Monitor
Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
apache · lucyAug 5, 2026
CVE-2026-64567
31Monitor
btrfs: reject free space cache with more entries than pages
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
linux · linuxAug 5, 2026
CVE-2026-64570
31Monitor
wifi: mac80211: fix fils_discovery double free on alloc failure
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
linux · linuxAug 5, 2026
CVE-2026-64574
31Monitor
wifi: mac80211: tear down new links on vif update error path
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
linux · linuxAug 5, 2026
CVE-2026-64575
31Monitor
bpf: tcp: fix double sock release on batch realloc
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
linux · linuxAug 5, 2026
CVE-2026-64576
28Monitor
nexthop: initialize extack in nh_res_bucket_migrate()
HighCVSS 7.1No exploitEPSS 0%
linux · linuxAug 5, 2026
CVE-2026-64580
31Monitor
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
linux · linuxAug 5, 2026
CVE-2026-64581
31Monitor
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
HighCVSS 7.8No exploitEPSS 0%
- Race condition
linux · linuxAug 5, 2026
CVE-2026-70376
38Monitor
Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE
CriticalCVSS 9.6Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
- CSRF
pluck-cms · pluck cmsAug 5, 2026
CVE-2026-70377
30Monitor
imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
theotherphil · imagecliAug 5, 2026
CVE-2026-70378
30Monitor
imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
theotherphil · imagecliAug 5, 2026
CVE-2026-71202
30Monitor
raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
kosinix · rasterAug 5, 2026
CVE-2026-71203
21Monitor
changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
dgtlmoon · changedetection.ioAug 5, 2026
CVE-2026-71204
24Monitor
changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement
MediumCVSS 6.2Proof of conceptEPSS 0%
- Broken access control (IDOR)
dgtlmoon · changedetection.ioAug 5, 2026
CVE-2026-71205
26Monitor
changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
dgtlmoon · changedetection.ioAug 5, 2026
CVE-2026-71206
33Monitor
shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion
HighCVSS 8.3Proof of conceptEPSS 0%
go-shiori · shioriAug 5, 2026
CVE-2026-71207
39Monitor
Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- SQL injection
mrswapnilsahu · stock-inventory-management-systemAug 5, 2026
CVE-2026-71209
31Monitor
audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
- Path traversal
advplyr · audiobookshelfAug 5, 2026
CVE-2026-71214
39Monitor
NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
nasa-ammos · plandev (sequencing-server)Aug 5, 2026
CVE-2026-18933
28Monitor
wp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path Traversal
HighCVSS 7.2No exploitEPSS 0%
- Path traversal
- File upload
wp-downloadmanager · wp-downloadmanagerAug 5, 2026
CVE-2026-10059
36Monitor
Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token
CriticalCVSS 9.1No exploitEPSS 0%
red hat · multicluster engine for kubernetes 2.1Aug 5, 2026
CVE-2026-10090
36Monitor
Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-ad
CriticalCVSS 9.0No exploitEPSS 0%
red hat · red hat advanced cluster management for kubernetes 2.11Aug 5, 2026
CVE-2026-71259
34Monitor
ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution
HighCVSS 8.6No exploitEPSS 0%
- RCE
esphome · esphomeAug 5, 2026
CVE-2026-71262
39Monitor
IoTSharp BlobStorageController Missing Authentication and Path Traversal
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Path traversal
iotsharp · iotsharpAug 5, 2026
CVE-2026-71265
30Monitor
Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
domoticz · domoticzAug 5, 2026
CVE-2026-71287
35Monitor
Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
cacti · cactiAug 5, 2026
CVE-2026-71294
30Monitor
Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions
HighCVSS 7.6Proof of conceptEPSS 0%
- Deserialization
cotonti · cotontiAug 5, 2026
CVE-2026-15979
32Monitor
Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion
HighCVSS 8.1No exploitEPSS 1%
- RCE
- Path traversal
keywordrush · content egg – affiliate product importer & price comparisonAug 5, 2026
CVE-2026-16443
36Monitor
Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
redhat · build of keycloakAug 5, 2026
CVE-2026-17506
28Monitor
Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
bensibley · independent analytics – wordpress analytics pluginAug 5, 2026
CVE-2026-7529
30Monitor
wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wisemattic · wisecampaign – woocommerce conversions made easyAug 5, 2026
CVE-2026-25703
29Monitor
Potential information leakage from manager /network/graph API in NeuVector
HighCVSS 7.3Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
suse · neuvectorAug 5, 2026
CVE-2026-44945
36Monitor
Cross-Cluster Impersonation Confused-Deputy Privilege Escalation
CriticalCVSS 9.1No exploitEPSS 0%
suse · rancherAug 5, 2026
CVE-2026-12609
30Monitor
In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
eclipse · theiaAug 5, 2026
CVE-2026-60009
35Monitor
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Path traversal
eclipse · theiaAug 5, 2026
CVE-2026-71231
39Monitor
IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
thebradleysanders · iotsmarthomeAug 5, 2026
CVE-2026-71232
28Monitor
MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE
HighCVSS 7.2No exploitEPSS 0%
- RCE
magicblack · maccms10Aug 5, 2026
CVE-2026-71234
30Monitor
Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
documize · communityAug 5, 2026
CVE-2026-71235
35Monitor
Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SSRF
absmach · magistralaAug 5, 2026
CVE-2026-71238
36Monitor
DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
- CSRF
djangocrm · django-crmAug 5, 2026
CVE-2026-71239
32Monitor
DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering
HighCVSS 8.1No exploitEPSS 0%
- RCE
- SSTI
djangocrm · django-crmAug 5, 2026
CVE-2026-71241
30Monitor
Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
lyric777 · book-management-systemAug 5, 2026
CVE-2026-71242
33Monitor
Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
crater-invoice · craterAug 5, 2026
CVE-2026-71243
35Monitor
backmeup (npm) - OS Command Injection via Backup Option Values
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
adaltas · backmeupAug 5, 2026
CVE-2026-71252
32Monitor
toner-management - Unauthenticated State-Changing Admin Actions
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
raghav993 · toner-managementAug 5, 2026
CVE-2026-15573
32Monitor
Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
HighCVSS 8.1No exploitEPSS 0%
redhat · build of keycloakAug 5, 2026
CVE-2026-16102
32Monitor
Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
HighCVSS 8.1No exploitEPSS 0%
redhat · build of keycloakAug 5, 2026
CVE-2026-17613
30Monitor
Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite an
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- Denial of service
penpot · penpotAug 5, 2026
CVE-2026-54876
30Monitor
Client-Side Memory Leak in OCSP Response Checking
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
openssl · opensslAug 5, 2026
CVE-2026-15572
35Monitor
Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
HighCVSS 8.8No exploitEPSS 0%
redhat · build of keycloakAug 5, 2026
CVE-2026-16442
39Monitor
Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
redhat · build of keycloakAug 5, 2026
CVE-2026-8400
39Monitor
Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
ibm · websphere application serverAug 5, 2026
CVE-2026-46581
30Monitor
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, a
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
eclipse · mojarraAug 5, 2026
CVE-2026-61891
30Monitor
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GE
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
eclipse · theiaAug 5, 2026
CVE-2026-64582
31Monitor
RDMA/rxe: Fix a use-after-free problem in rxe_mmap
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
linux · linuxAug 5, 2026
CVE-2026-71254
39Monitor
nanoMODBUS Server-Side Out-of-Bounds Write in handle_read_file_record()
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
debevv · nanomodbusAug 5, 2026
CVE-2026-71255
34Monitor
nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Memory safety
debevv · nanomodbusAug 5, 2026
CVE-2026-71256
39Monitor
nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
debevv · nanomodbusAug 5, 2026
CVE-2026-20301
34Monitor
Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · iosAug 5, 2026
CVE-2026-9077
34Monitor
Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features
HighCVSS 8.5No exploitEPSS 0%
langflow · langflowAug 5, 2026
CVE-2026-16022
31Monitor
Command Injection in @oblique/cli
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Command injection
swiss federal office of information technology, systems and telecommunication · @oblique/cliAug 5, 2026
CVE-2026-71226
29Monitor
Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
redhat · hardened imagesAug 5, 2026
CVE-2026-71261
31Monitor
dr_wav.h W64 CUE Chunk Metadata Parsing Integer Overflow Leading to Heap Buffer Overflow on 32-bit Builds
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
mackron · dr_libsAug 5, 2026
CVE-2026-71263
36Monitor
FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Memory safety
cwalter-at · freemodbusAug 5, 2026
CVE-2026-71264
32Monitor
WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
aircoookie · wledAug 5, 2026
CVE-2026-71266
31Monitor
tinyobjloader-c Stack Buffer Overflow in MTL Material File Line Parsing
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
syoyo · tinyobjloader-cAug 5, 2026
CVE-2026-71267
39Monitor
microtar Stack Buffer Overflow in mtar_write_file_header() and mtar_write_dir_header()
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
rxi · microtarAug 5, 2026
CVE-2026-71268
39Monitor
OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write
CriticalCVSS 9.9No exploitEPSS 0%
- Path traversal
thiagoralves · openplc_v3Aug 5, 2026
CVE-2026-71270
34Monitor
Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SSRF
stirling-tools · stirling-pdfAug 5, 2026
CVE-2026-71271
34Monitor
Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass
HighCVSS 8.5No exploitEPSS 0%
- SSRF
usememos · memosAug 5, 2026
CVE-2026-71272
34Monitor
Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()
HighCVSS 8.5No exploitEPSS 0%
- SSRF
- Race condition
usememos · memosAug 5, 2026
CVE-2026-71274
34Monitor
OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels
HighCVSS 8.5No exploitEPSS 0%
- Pre-auth
- XSS
openshwprojects · openbk7231t_appAug 5, 2026
CVE-2026-71276
28Monitor
Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
absmach · magistralaAug 5, 2026
CVE-2026-71277
36Monitor
rust-iot-platform Authentication Bypass via Non-Validated Authorization Header
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
iot-ecology · rust-iot-platformAug 5, 2026
CVE-2026-71278
39Monitor
rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
iot-ecology · rust-iot-platformAug 5, 2026
CVE-2026-71279
32Monitor
Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution
HighCVSS 8.0No exploitEPSS 0%
- RCE
- Path traversal
koenkk · zigbee2mqttAug 5, 2026