Total
14231 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-70589 | 1 Ghost | 1 Ghost | 2026-08-05 | 4.8 Medium |
| Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1. | ||||
| CVE-2026-21548 | 1 Unisoc | 4 T8100, T8200, T8300 and 1 more | 2026-08-05 | 7.5 High |
| In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System execution privileges needed. | ||||
| CVE-2026-21549 | 1 Unisoc | 4 T8100, T8200, T8300 and 1 more | 2026-08-05 | 7.5 High |
| In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed | ||||
| CVE-2026-21550 | 1 Unisoc | 4 T8100, T8200, T8300 and 1 more | 2026-08-05 | 7.5 High |
| In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed | ||||
| CVE-2026-21551 | 1 Unisoc | 4 T8100, T8200, T8300 and 1 more | 2026-08-05 | 7.5 High |
| In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed | ||||
| CVE-2026-21552 | 1 Unisoc | 4 T8100, T8200, T8300 and 1 more | 2026-08-05 | 7.5 High |
| In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed | ||||
| CVE-2026-21553 | 1 Unisoc | 4 T8100, T8200, T8300 and 1 more | 2026-08-05 | 7.5 High |
| In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed | ||||
| CVE-2026-21554 | 1 Unisoc | 1 Udx710 | 2026-08-05 | 7.5 High |
| In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed | ||||
| CVE-2026-21555 | 1 Unisoc | 1 Udx710 | 2026-08-05 | 7.5 High |
| In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed | ||||
| CVE-2026-62658 | 1 Netgear | 5 Rax43, Rax45, Rax50 and 2 more | 2026-08-05 | N/A |
| A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to the device to run unauthorized commands or code on the router. | ||||
| CVE-2026-62659 | 1 Netgear | 1 Wax333 | 2026-08-05 | N/A |
| A security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone already logged in and connected to the local network to make unauthorized changes to the device's settings | ||||
| CVE-2026-11835 | 1 Caliptra | 1 Core Rom | 2026-08-05 | N/A |
| Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware to be modified between verification and loading into ICCM. Attestation continues to report the originally verified image digest, masking the compromise. Exploitation requires a compromised MCU firmware with AXI manager access to unprotected SRAM reachable by Caliptra. This issue affects Core ROM: 2.1.0 through 2.1.1. | ||||
| CVE-2026-18801 | 1 Openmeter | 1 Openmeter | 2026-08-05 | N/A |
| OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation. OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected. | ||||
| CVE-2026-15757 | 1 Netgear | 1 Dgnd3700 | 2026-08-05 | N/A |
| A security flaw was discovered in the NETGEAR DGND3700v1 that could allow someone on the same local WiFi network to send unauthorized commands to the device. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices. | ||||
| CVE-2026-13001 | 2 Eric Teubert, Wordpress | 2 Podlove Podcast Publisher, Wordpress | 2026-08-05 | 9.8 Critical |
| The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2026-12898 | 2 Wordpress, Yaniiliev | 2 Wordpress, All In One Wp Migration And Backup | 2026-08-05 | 6.5 Medium |
| The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory. | ||||
| CVE-2026-69185 | 1 Socket | 1 Socket.io | 2026-08-05 | 7.5 High |
| Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6. | ||||
| CVE-2026-11883 | 2026-08-05 | 7.2 High | ||
| The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request. | ||||
| CVE-2026-3644 | 1 Python | 2 Cpython, Python | 2026-08-05 | 7.5 High |
| The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output(). | ||||
| CVE-2026-43813 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-08-05 | 7.1 High |
| A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A maliciously crafted app may be able to bypass code signing enforcement. | ||||