CVEs published in August 2026

CVE-2026-76986Medium

Improper neutralization of input during web page generation in Apache Wicket

CVE-2026-76985Medium

Improper neutralization of input during web page generation in Apache Wicket

CVE-2026-76983Medium

Improper neutralization of input during web page generation in Apache Wicket

CVE-2026-76984Medium

Improper neutralization of input during web page generation in Apache Wicket

CVE-2026-76982Medium

Improper neutralization of input during web page generation in Apache Wicket

CVE-2026-75802Medium

Apache Wicket: AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values

CVE-2026-71378Medium

Apache Wicket: ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin

CVE-2026-71257High

Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload

CVE-2026-70449Medium

Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve

CVE-2026-58301Medium

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data

CVE-2026-41012High

BOSH: Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and…

CVE-2026-9548Critical

improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks in DSM

CVE-2026-9491Critical

server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information

CVE-2026-40541Critical

improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM

CVE-2026-59889Medium

FasterXML Jackson Databind Vulnerability in NetApp Products

CVE-2026-59250High

Erlang/OTP Vulnerability in NetApp Products

CVE-2026-49431High

CVE-2026-49430High

CVE-2026-49429High

CVE-2026-22056Low

Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)

CVE-2026-78616Medium

Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate

CVE-2026-78498Medium

server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems

CVE-2026-78195Medium

Cross-Site Scripting (XSS) vulnerability in the WatchGuard Dimension Backup Historical Data feature allows an authenticated administrator user to execute arbitrary JavaScript in another user's browser

CVE-2026-78612High

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests

CVE-2026-78103Medium

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes

CVE-2026-78615Medium

Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL

CVE-2026-78613High

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests

CVE-2026-78495Medium

server-side request forgery (SSRF) vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems

CVE-2026-78617Medium

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts

CVE-2026-78047Medium

stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user

CVE-2026-78610High

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection

CVE-2026-78499Medium

server-side request forgery (SSRF) vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems

CVE-2026-78174Critical

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log

CVE-2026-78618Medium

business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request

CVE-2026-78500Medium

blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems

CVE-2026-13108High

WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service

CVE-2026-78614High

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests

CVE-2026-19315Critical

type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic

CVE-2026-19314High

integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic

CVE-2026-19317High

out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic

CVE-2026-78011High

integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic

CVE-2026-78010High

stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic

CVE-2026-13086Critical

stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code

CVE-2026-19313Critical

heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic

CVE-2026-19316High

double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic

CVE-2026-78009High

out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic

CVE-2026-19318Critical

stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic

CVE-2026-78008High

buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic

CVE-2026-81851Medium

Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service

CVE-2026-59315Medium

Spring Cloud: The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads.

CVE-2026-59314Low

Spring Framework: Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response sp…

CVE-2026-59313Critical

Spring Framework: Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent…

CVE-2026-59306Low

Spring Cloud: Potential for deserialization of untrusted types in Spring Cloud Stream.

CVE-2026-59305Low

Spring Cloud: Partition interceptor may be improperly added while sending message.

CVE-2026-59304Low

Spring Cloud: Improper caching of the original content type in Spring Cloud Stream Avro.

CVE-2026-59303Low

Spring Cloud: Dynamic destination cache size is not properly bound in Spring Cloud Stream.

CVE-2026-59302Low

Spring Cloud: Potential for logging sensitive data in Spring Cloud Stream.

CVE-2026-59301Low

Spring Cloud: Potential for logging sensitive data in Spring Cloud Function Azure.

CVE-2026-59300Low

Spring Cloud: Potential for logging sensitive data in Spring Cloud Function AWS.

CVE-2026-59299Low

Spring Cloud: Composition lookup can potentially poison base function in Spring Cloud Function.

CVE-2026-59298Low

Spring Cloud: Potential for improper filtering of HTTP headers in Spring Cloud Function.

CVE-2026-59297Low

Spring Cloud: Implementation of isSecure call of ServerlessHttpServletRequest does not verify the actual scheme.

CVE-2026-59291Low

Spring Cloud: Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function.

CVE-2026-59284High

Spring Cloud: There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.

CVE-2026-59283Critical

Spring Framework: Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnera…

CVE-2026-59282High

Spring Framework: Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths ont…

CVE-2026-59281Medium

Spring Framework: Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then re…

CVE-2026-59277Low

org.springframework.security/spring-security-core: Spring Security: Information disclosure due to incomplete internal network classification

CVE-2026-59276Medium

org.springframework.security/spring-security-core: Spring Security: Information disclosure via timing attack in sensitive value comparison

CVE-2026-4398Medium

Authorization Bypass Through User-Controlled Key in GitLab

CVE-2026-59280Medium

Spring Framework: Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a cont…

CVE-2026-59272Medium

RabbitMQ: Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exp…

CVE-2026-75871High

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header, resulting in disclosure of Google Cloud Vertex cloud service credentials and private signing keys

CVE-2026-19889High

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an externally-controlled endpoint via crafted model metadata, resulting in the disclosure of Google Vertex AI or AWS Bedrock cloud service credentials

CVE-2026-74848High

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX

CVE-2026-75005High

Inefficient Algorithmic Complexity vulnerability in Apache APISIX

CVE-2026-75020High

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX

CVE-2026-59355Medium

Spring Authorization Server: Open Redirect via request_uri parameter

CVE-2026-59354Critical

Spring Security: In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registra…

CVE-2026-59271Medium

RabbitMQ: When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thr…

CVE-2026-47893High

Spring Framework: Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by…

CVE-2026-47892Critical

Spring Framework: WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header pr…

CVE-2026-47891Critical

Spring Framework: Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the…

CVE-2026-47890Critical

Spring Framework: Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view…

CVE-2026-47889High

Spring Framework: WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite…

CVE-2026-47888High

Spring Framework: Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.

CVE-2026-47887Medium

Spring Framework: Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a…

CVE-2026-47886High

Spring Framework: Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial…

CVE-2026-47885High

Spring Framework: The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set t…

CVE-2026-47884Critical

Spring Framework: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping…

CVE-2026-47883Medium

Spring Framework: UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns.

CVE-2026-59270Critical

Spring Security: Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative cre…

CVE-2026-47894Medium

Spring Cloud: Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the config…

CVE-2026-47879High

Spring Cloud: Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto…

CVE-2026-47877High

Spring Security: Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding.

CVE-2026-45694Medium

Proxmox: LibreNMS is a network monitoring system

CVE-2026-47842Medium

org.springframework.security/spring-security-core: Spring Security: Information disclosure via deterministic AES/CBC encryption

CVE-2026-47841High

Spring Security: application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a di…

CVE-2026-47837Medium

Spring Cloud: Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to S…

CVE-2026-47836High

Spring Cloud: The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repos…