Total
378872 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-60113 | 1 Nasa | 1 Ait Dsn | 2026-08-18 | N/A | 9.8 CRITICAL |
| AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links. | |||||
| CVE-2026-11383 | 3 Ibm, Linux, Microsoft | 7 Aix, I, Tivoli System Automation Application Manager and 4 more | 2026-08-18 | N/A | 5.4 MEDIUM |
| IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console. | |||||
| CVE-2026-11707 | 3 Ibm, Linux, Microsoft | 7 Aix, I, Tivoli System Automation Application Manager and 4 more | 2026-08-18 | N/A | 9.3 CRITICAL |
| IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page. | |||||
| CVE-2026-69414 | 1 Microsoft | 1 Malware Protection Engine | 2026-08-18 | N/A | 7.8 HIGH |
| Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ". We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the update is available. | |||||
| CVE-2026-61899 | 1 Apache | 1 Tapestry | 2026-08-18 | N/A | 7.5 HIGH |
| Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue. | |||||
| CVE-2026-7163 | 1 Redhat | 1 Multicluster Engine For Kubernetes | 2026-08-18 | N/A | 6.1 MEDIUM |
| A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub. The credentials download endpoint (GET /v2/clusters/{cluster_id}/credentials, which returns the kubeadmin password) and the kubeconfig download endpoint are operational in AUTH_TYPE=local mode, the only authentication mode available in on-premises ACM/MCE hub deployments. The local authenticator unconditionally grants full administrative access to any request bearing a valid JWT, with no per-endpoint restrictions. A valid local JWT is embedded as a plaintext query parameter in InfraEnvStatus.ISODownloadURL and is readable by any user who has get rights on an InfraEnv object in their own namespace. The affected components ship as part of Multicluster Engine (MCE). The Red Hat Advanced Cluster Management (ACM) deployments that include MCE are equally affected. This issue does not affect the hosted SaaS offering (console.redhat.com), which uses a different authentication mode. Successful exploitation gives the attacker the kubeadmin password and kubeconfig for any OpenShift cluster provisioned through the affected hub, granting unrestricted root-level administrative access to those spoke clusters. | |||||
| CVE-2026-75874 | 2026-08-18 | N/A | N/A | ||
| Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154. | |||||
| CVE-2026-75783 | 2026-08-18 | 8.3 HIGH | 9.6 CRITICAL | ||
| A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used. | |||||
| CVE-2026-75778 | 2026-08-18 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_with_multiple_condition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. | |||||
| CVE-2026-75482 | 2026-08-18 | N/A | 7.5 HIGH | ||
| SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory ('..') references, bypassing the built-in path sanitization. The server binds all interfaces (0.0.0.0), applies wildcard CORS, and requires no authentication. An unauthenticated network client (or a malicious web page via CORS) can use path traversal sequences to read files outside the intended directory. Because the read sink parses targets as trajectory JSON, disclosure is constrained to JSON files shaped like a trajectory, which can contain repository contents, command output, and secrets/API keys. | |||||
| CVE-2026-75110 | 2026-08-18 | N/A | 9.8 CRITICAL | ||
| MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints. | |||||
| CVE-2026-75104 | 2026-08-18 | N/A | 5.5 MEDIUM | ||
| Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance. | |||||
| CVE-2026-75012 | 2026-08-18 | 6.8 MEDIUM | 6.5 MEDIUM | ||
| A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Password Configuration Handler. The manipulation leads to null pointer dereference. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. | |||||
| CVE-2026-74990 | 2026-08-18 | N/A | N/A | ||
| Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. | |||||
| CVE-2026-74989 | 2026-08-18 | N/A | N/A | ||
| Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154. | |||||
| CVE-2026-74988 | 2026-08-18 | N/A | N/A | ||
| Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. | |||||
| CVE-2026-74987 | 2026-08-18 | N/A | N/A | ||
| Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. | |||||
| CVE-2026-74986 | 2026-08-18 | N/A | N/A | ||
| Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. | |||||
| CVE-2026-74985 | 2026-08-18 | N/A | N/A | ||
| Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. | |||||
| CVE-2026-74984 | 2026-08-18 | N/A | N/A | ||
| Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. | |||||