Total
408105 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-65576 | 2026-08-12 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions. | |||||
| CVE-2026-18896 | 2026-08-12 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.php. Executing a manipulation of the argument oldpass can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-65579 | 2026-08-12 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions. | |||||
| CVE-2026-18898 | 2026-08-12 | 9.0 HIGH | 8.8 HIGH | ||
| A security flaw has been discovered in UTT HiPER 1200GW up to v2.5.3-170306. This affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the argument timestart results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-18787 | 2026-08-12 | 9.0 HIGH | 8.8 HIGH | ||
| A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure. | |||||
| CVE-2026-19008 | 2026-08-12 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component apply_patch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-66662 | 2026-08-12 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions. | |||||
| CVE-2026-18785 | 2026-08-12 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Client_getRemoteDataTypes of the file examples/custom_datatype/client_types_custom.c. Executing a manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project closed the issue report, stating that this is not the official way to report a security vulnerability. | |||||
| CVE-2026-18852 | 2026-08-12 | 1.7 LOW | 3.3 LOW | ||
| A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.cpp of the component Filter Parser. Such manipulation leads to improper check for unusual conditions. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-18722 | 2026-08-12 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-65515 | 2026-08-12 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions. | |||||
| CVE-2026-18720 | 2026-08-12 | 5.0 MEDIUM | 5.3 MEDIUM | ||
| A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-65569 | 2026-08-12 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions. | |||||
| CVE-2026-19020 | 2026-08-12 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. | |||||
| CVE-2026-18810 | 2026-08-12 | 7.5 HIGH | 7.3 HIGH | ||
| A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure. | |||||
| CVE-2026-65544 | 2026-08-12 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions. | |||||
| CVE-2026-18819 | 2026-08-12 | 5.0 MEDIUM | 4.3 MEDIUM | ||
| A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project maintainer confirms: "[I]t seems plausible, in that RackTables does not at this time have any CSRF prevention. You may assign a CVE ID to this, but there is no guarantee it will be handled in urgent, or even timely, manner, or at all." | |||||
| CVE-2026-18814 | 2026-08-12 | 8.3 HIGH | 7.2 HIGH | ||
| A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure. | |||||
| CVE-2026-18813 | 2026-08-12 | 8.3 HIGH | 7.2 HIGH | ||
| A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. | |||||
| CVE-2026-66659 | 2026-08-12 | N/A | 9.3 CRITICAL | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9. | |||||