Published threat advisories for August 5, 2026

A vulnerability exists in Nuxt DevTools, a development tool for Vue.js applications, that could allow an unauthenticated attacker to execute arbitrary code on a developer's machine. This is possible because an unauthenticated RPC channel within the DevTools lacks proper security checks. This risk is limited to developm

NVD modified: NVD date unavailable

A command injection vulnerability exists in the PraisonAI Claude GitHub Actions workflow. Attackers can exploit this by using specially crafted branch names in pull requests to execute arbitrary shell code, potentially compromising the GitHub runner and repository. This affects code integrity and access controls within

NVD modified: NVD date unavailable

A vulnerability exists in Jenkins Remoting's deserialization implementation, allowing bypass of the JEP-200 class filter through a fallback path. This could permit agent processes, code on agents, or attackers with specific permissions to execute unauthorized code. This is relevant if your environment uses affected Jen

NVD modified: NVD date unavailable

Cisco Catalyst SD-WAN software has vulnerabilities related to improper link resolution before file access. If reachable, this could allow unauthorized modification or access to system data. Leadership should confirm the relevance and exposure within their environment.

NVD modified: NVD date unavailable

Improper access control vulnerabilities in Cisco Catalyst SD-WAN software could allow an attacker to gain unauthorized access to sensitive functions or data. The specific impact is uncertain, but such flaws are critical for network infrastructure security. Determining reachability and criticality is essential.

NVD modified: NVD date unavailable

Cisco Catalyst SD-WAN software has vulnerabilities due to improper input validation. An attacker could exploit this to gain unauthorized access, potentially disrupting services or affecting system data. Confirming if this technology is used in your environment is the primary concern.

NVD modified: NVD date unavailable

This advisory concerns a critical vulnerability in Cisco IOS XE Software related to improper neutralization of special elements (CWE-74). If reachable, an unauthenticated remote attacker could exploit this issue, potentially leading to arbitrary code execution and a compromise of the device. Cisco has released software

NVD modified: NVD date unavailable

Improper access control flaws in Cisco IOS XE Software could permit an unauthenticated, remote attacker to gain unauthorized access. Cisco IOS XE is critical network infrastructure, making potential vulnerabilities a concern for unauthorized system access or service disruption.

NVD modified: NVD date unavailable

A cross-site scripting vulnerability in Progress MarkLogic Server's Query Console allows remote attackers to execute arbitrary JavaScript in an administrator's browser session if they are lured to a crafted URL. This could lead to credential theft and unauthorized privileged actions. The relevance of this vulnerability

NVD modified: NVD date unavailable

An improper privilege management vulnerability in Progress MarkLogic Server's Hadoop integration allows authenticated users with low-privileged Hadoop roles to escalate privileges and execute privileged operations against the Security database. This could occur if the Hadoop integration is enabled and relevant in your

NVD modified: NVD date unavailable

An authentication bypass in MarkLogic Server's ODBC App Server allows unauthenticated remote attackers to execute queries as any user, including administrators. This vulnerability is concerning if the ODBC App Server is exposed externally.

NVD modified: NVD date unavailable

A critical vulnerability in Progress MarkLogic Server's HTTP App Server may allow unauthenticated attackers to bypass security, hijack sessions, or steal credentials by exploiting how the server interprets HTTP requests. This could lead to unauthorized access and compromise of sensitive information.

NVD modified: NVD date unavailable

An improper privilege management vulnerability in Progress MarkLogic Server's REST API could allow an authenticated, low-privileged user to escalate their privileges and perform privileged operations on the Security database. This is a critical issue that affects systems managing sensitive data and potentially critical

NVD modified: NVD date unavailable

An improper cryptographic signature verification in Progress MarkLogic Server's SAML module allows unauthenticated attackers to impersonate users, including administrators, when SAML single sign-on is enabled. This could lead to unauthorized access to system data and user information.

NVD modified: NVD date unavailable

An improper privilege management vulnerability in Progress MarkLogic Server's REST query interfaces allows an authenticated, low-privileged user to escalate privileges to administrator. This could enable unauthorized data access and the execution of privileged operations.

NVD modified: NVD date unavailable

Flarum contains a vulnerability allowing unauthenticated attackers to reuse expired password reset tokens, potentially granting them access to any user account. This occurs because the reset processing endpoint does not validate token expiry. Readers should care because this could lead to unauthorized authenticated ses

NVD modified: NVD date unavailable

An improper privilege management vulnerability exists in Google SecOps (Chronicle SOAR) that, if exploited by an authenticated attacker using a crafted internal header, could lead to system-level administrative access. This could impact system data and service behavior. The vulnerability has been patched.

NVD modified: NVD date unavailable

A vulnerability in the NASA-AMMOS Asynchronous Network Management System's reference implementation allows unauthenticated network access to its management service. This bypasses security controls, enabling attackers to send unauthorized commands to managed agents and manipulate data. Readers should care because this c

NVD modified: NVD date unavailable

An unauthenticated attacker can achieve arbitrary JavaScript execution in the rust-iot-platform server process by creating and triggering a malicious calc rule. The vulnerability exists in an API endpoint that is reachable without authentication and executes user-supplied scripts without sandboxing. This could allow an

NVD modified: NVD date unavailable

A vulnerability in the rust-iot-platform's API allows unauthorized access by accepting any value in the Authorization header, bypassing authentication checks for protected endpoints. This means any request with a non-empty header could grant access to sensitive operations or data. The platform's security integrity is c

NVD modified: NVD date unavailable

A vulnerability in OpenPLC Runtime allows arbitrary file writes to the filesystem when processing specially crafted Structured Text files, potentially enabling remote code execution. The issue stems from unvalidated file paths within uploaded program files, and the presence of hardcoded default credentials lowers the b

NVD modified: NVD date unavailable

A critical vulnerability exists in the microtar library's header functions, where processing filenames longer than 99 characters can cause a stack buffer overflow. This could potentially lead to code execution or application crashes if an application using the library processes externally supplied, oversized filenames.

NVD modified: NVD date unavailable

A vulnerability exists in FreeModbus's LINUXTCP port concerning an off-by-one bounds check, potentially allowing an unauthenticated attacker to cause a buffer overflow via a crafted Modbus TCP packet. While typically used in isolated industrial networks, if this software is reachable, it could affect system integrity a

NVD modified: NVD date unavailable

A critical vulnerability exists in IoTSharp's Blob Storage Controller, allowing unauthenticated remote attackers to access and manipulate arbitrary files. This path traversal flaw enables unauthorized writing, reading, modification, or deletion of files, potentially leading to remote code execution through the upload o

NVD modified: NVD date unavailable

A critical vulnerability in nanoMODBUS allows an attacker to write to arbitrary memory locations via a malicious Modbus response. This could lead to system compromise if the Modbus server is reachable over a network. Confirming the presence and exposure of this library in your environment is important.

NVD modified: NVD date unavailable

A vulnerability in the nanoMODBUS library allows an unauthenticated attacker to write data outside a designated buffer by sending a crafted network request. This could result in denial of service or remote code execution. Security leaders should confirm if this technology is present in their operational technology envi

NVD modified: NVD date unavailable

This critical vulnerability affects an Inventory Management System built with PHP, allowing unauthenticated attackers to bypass login or delete arbitrary product data through SQL injection. An attacker could gain unauthorized access to sensitive information or cause data loss by exploiting flaws in the system's handlin

NVD modified: NVD date unavailable

DjangoCRM contains hardcoded security keys and leaves debug mode enabled by default. This allows unauthenticated attackers to forge session and password reset tokens, leading to account takeover and potential exposure of sensitive data such as database credentials. The issue arises from publicly accessible source code.

NVD modified: NVD date unavailable

A critical SQL injection vulnerability exists in the IoT-PHP login functionality, allowing unauthenticated attackers to bypass authentication and extract arbitrary data by exploiting unsanitized password input. The login route is reachable via the network, increasing the risk of exploitation.

NVD modified: NVD date unavailable

IOTSmartHome's login functionality is vulnerable to SQL injection, allowing unauthenticated attackers to bypass authentication and extract arbitrary data, including user credentials. This occurs because the `checkCookie()` function improperly handles a decoded cookie, leading to a critical security flaw. Readers should

NVD modified: NVD date unavailable

Zbtlink router firmware contains a hidden remote-control implant that grants unauthenticated root access. This implant phones home over cleartext TCP, allowing any party that can intercept or control this communication to execute arbitrary commands as root. The primary concern is confirming the relevance and exposure o

NVD modified: NVD date unavailable

A privilege escalation vulnerability exists in Rancher's impersonation middleware, allowing an authenticated user with the default global role to obtain full administrative access to the Rancher control plane and all managed clusters. This could lead to unauthorized administrative actions within the Rancher environment

NVD modified: NVD date unavailable

A vulnerability in Red Hat Advanced Cluster Management for Kubernetes' Application Subscription controller allows a user with edit privileges to escalate to full cluster-admin control. This is achieved by creating a subscription pointing to a malicious Helm repository, enabling the controller to apply cluster-scoped re

NVD modified: NVD date unavailable

A flaw in the Multicluster Engine for Kubernetes ClusterCurator controller could allow a tenant administrator with namespace privileges to escalate to cluster-wide administrative authority. This is achieved by creating a specific resource, which inadvertently allows for the minting of a ServiceAccount token with full c

NVD modified: NVD date unavailable

A flaw in Aerie/PlanDev's authorization middleware permits unauthenticated attackers to insert arbitrary expansion rules and write command dictionaries. This could affect spacecraft command generation. The specialized nature of the technology makes its reachability and relevance uncertain.

NVD modified: NVD date unavailable

A vulnerability exists in Typemill's login endpoint that allows unauthenticated attackers to perform unlimited password-guessing attempts when CAPTCHA is disabled, which is the default configuration. This could lead to unauthorized access to user accounts, including administrator accounts. Readers should confirm if the

NVD modified: NVD date unavailable

The Stock-Inventory-Management-System's login script contains a critical vulnerability allowing unauthenticated remote attackers to bypass authentication. This is achievable through SQL injection or by using hardcoded administrative credentials, potentially leading to unauthorized access and control of the inventory ma

NVD modified: NVD date unavailable

A vulnerability exists in Pluck CMS's admin panel where it improperly validates request origins, potentially allowing attackers to trick authenticated administrators into performing unauthorized actions. By manipulating HTTP headers, an attacker could cause forged requests to be accepted, leading to the creation of mal

NVD modified: NVD date unavailable

A stack-based buffer overflow vulnerability exists in the unsupported Apache Lucy search engine library, potentially allowing for unauthorized access and impact to data confidentiality, integrity, and availability. As the project is retired, there are no planned fixes, making it crucial to identify any usage and restri

NVD modified: NVD date unavailable

A deserialization vulnerability exists in the unsupported Apache Lucy search engine library, potentially allowing remote code execution. Since the project is retired, no fix is available, and organizations should identify and restrict access to or replace any instances of this library.

NVD modified: NVD date unavailable

A vulnerability in the Multi Uploader for Gravity Forms WordPress plugin allows unauthenticated attackers to delete any media attachment. This could potentially lead to the destruction of the entire media library, impacting the availability of website content. The issue is reachable via public-facing forms.

NVD modified: NVD date unavailable

The Easy Post Submission plugin for WordPress has a vulnerability that allows unauthenticated attackers to modify post titles, content, and categories, or unpublish posts by setting their status to draft. This is due to a missing capability check in the `create_post()` function when handling the `rbsm_submit_post` AJAX

NVD modified: NVD date unavailable

A critical vulnerability exists in a PostgreSQL service on mobile devices, allowing local attackers to bypass security and gain root access by exploiting misconfigurations and command injection flaws. This service runs with elevated privileges and weak credentials, making it a target for unauthorized system control.

NVD modified: NVD date unavailable

A critical vulnerability exists in the Ajax Load More WordPress plugin that allows unauthenticated attackers to perform SQL injection, potentially extracting sensitive database data. This issue is relevant because it can be exploited remotely and affects public-facing websites.

NVD modified: NVD date unavailable

A WordPress plugin allowing OTP login does not limit verification attempts, enabling unauthenticated users to brute-force one-time codes and take over any account, including administrative ones.

NVD modified: NVD date unavailable

The WordPress Kadence Memberships plugin has a vulnerability allowing unauthenticated attackers to poison password reset links, leading to account takeover by tricking users into clicking a malicious link that leaks reset information to the attacker. This could compromise user and administrator accounts.

NVD modified: NVD date unavailable