CVEs published August 23, 2026
42 CVEs were published on August 23, 2026: 6 critical, 5 high.
- Published
- 42
- Critical
- 6
- High
- 5
- Medium
- 29
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- EmilStenstrom justhtml · justhtml
- 10
- code-projects Barangay Resident Profiling Management System
- 3
- SourceCodester Class and Exam Timetabling System
- 3
- Brave
- 2
- ggml-org llama.cpp
- 2
- sambitraj Student-Management-System
- 2
- SourceCodester Stock Management System
- 2
- Tenda CH22
- 2
- vas3k TaxHacker
- 2
- Apache-AppSamurai
- 1
Critical 6
- CVE-2026-78183DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_floatDBD-Pg
- CVE-2026-8445justhtml before 1.12.0 Sanitizer Bypass via MarkdownEmilStenstrom justhtml · justhtml
- CVE-2026-7808justhtml before 1.16.0 Multiple Security Issues via SanitizationEmilStenstrom justhtml · justhtml
- CVE-2026-5388justhtml before 1.15.0 Multiple Security IssuesEmilStenstrom justhtml · justhtml
- CVE-2026-78155Untrusted Search Path in StackGresOnGres StackGres
- CVE-2026-13598RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to AdministratorRestrictMate
High 5
- CVE-2026-9769justhtml before 1.10.0 Denial of Service via deeply nested HTMLEmilStenstrom justhtml · justhtml
- CVE-2026-4671justhtml before 1.18.0 Denial of Service via CSS SelectorEmilStenstrom justhtml · justhtml
- CVE-2026-10053Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabGitLab
- CVE-2026-77115Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM ParametersBrave
- CVE-2026-78136chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data.chirpmyradio CHIRP
Medium, low and unrated 31
- CVE-2026-78156Open5GS S6a Authentication-Information-Request hss-s6a-path.c hss_ogs_diam_s6a_air_cb heap-based overflowOpen5GS
- CVE-2026-78148ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereferenceggml-org llama.cpp
- CVE-2026-78147ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserializationggml-org llama.cpp
- CVE-2026-78145CTFd __init__.py _is_safe_url redirectCTFd
- CVE-2026-78144code-projects Barangay Resident Profiling Management System Boarder Management boarders.php authorizationcode-projects Barangay Resident Profiling Management System
- CVE-2026-78143code-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injectioncode-projects Barangay Resident Profiling Management System
- CVE-2026-78142code-projects Barangay Resident Profiling Management System Restore/Delete archived_records.php authorizationcode-projects Barangay Resident Profiling Management System
- CVE-2026-78141Tenda CH22 exeCommand formexeCommand command injectionTenda CH22
- CVE-2026-78140Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engineDromara UJCMS
- CVE-2026-19565Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKeyApache-AppSamurai
- CVE-2026-75922Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request lineReverse-Proxy
- CVE-2026-8630justhtml before 1.12.0 Mutation XSS via Raw Text ElementsEmilStenstrom justhtml · justhtml
- CVE-2026-77088justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-spanEmilStenstrom justhtml · justhtml
- CVE-2026-74793justhtml before 3.11.0 XSS via selectedcontent projectionEmilStenstrom justhtml
- CVE-2026-6827justhtml before 1.17.0 Multiple Cross-Site Scripting VulnerabilitiesEmilStenstrom justhtml · justhtml
- CVE-2026-5751justhtml before 1.14.0 Mutation XSS via custom sanitization policiesEmilStenstrom justhtml · justhtml
- CVE-2026-5389justhtml before 1.13.0 XSS via code fence breakoutEmilStenstrom justhtml · justhtml
- CVE-2026-78115SourceCodester Class and Exam Timetabling System User Account Update edit_user_account.php improper authorizationSourceCodester Class and Exam Timetabling System
- CVE-2026-78112itsourcecode Hospital Management System Project in PHP viewservicetype.php sql injectionitsourcecode Hospital Management System Project in PHP
- CVE-2026-77116Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via PreviewBrave
- CVE-2026-77003Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_maskContent Mask
- CVE-2026-14853WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing AuthorizationWooCommerce Bookings
- CVE-2026-78063Tenda CH22 editFileName formeditFileName command injectionTenda CH22
- CVE-2026-78062vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentialsvas3k TaxHacker
- CVE-2026-78061vas3k TaxHacker Email Sync imap-client.ts buildImapConfig server-side request forgeryvas3k TaxHacker
- CVE-2026-78060SourceCodester Stock Management System getOrderReport.php cross site scriptingSourceCodester Stock Management System
- CVE-2026-78059SourceCodester Stock Management System printOrder.php cross site scriptingSourceCodester Stock Management System
- CVE-2026-78057sambitraj Student-Management-System Management Mutation sql injectionsambitraj Student-Management-System
- CVE-2026-78056sambitraj Student-Management-System Dashboard sql injectionsambitraj Student-Management-System
- CVE-2026-78055SourceCodester Class and Exam Timetabling System BSIT2.php cross site scriptingSourceCodester Class and Exam Timetabling System
- CVE-2026-78054SourceCodester Class and Exam Timetabling System BSIS1.php cross site scriptingSourceCodester Class and Exam Timetabling System