| Aug 31 | Red Hat WebKitGTK: memory corruption WebKitGTKHigh8.8Aug 31 | WebKitGTK | High8.8 | No fix yet |
| Aug 31 | HP ImageDiags: privilege escalation HP ImageDiagsHigh7.0Aug 31 | HP ImageDiags | High7.0 | <5.0.0.36 |
| Aug 31 | Red Hat GDB: out-of-bounds writeGDBHigh7.0Aug 31 | GDB | High7.0 | No fix yet |
| Aug 31 | AMD: double free AMDMedium6.4Aug 31 | AMD | Medium6.4 | No fix yet |
| Aug 31 | AMD: denial of serviceAMDLow3.3Aug 31 | AMD | Low3.3 | No fix yet |
| Aug 31 | Red Hat RESTEasy: XML external entityRESTEasyHigh7.5Aug 31 | RESTEasy | High7.5 | No fix yet |
| Aug 31 | Tenable Kubio AI Website Builder: improper input validation Kubio AI Website BuilderMedium6.9Aug 31 | Kubio AI Website Builder | Medium6.9 | 2.9.1 |
| Aug 31 | Red Hat build of Quarkus: denial of serviceRed Hat build of QuarkusHigh7.5Aug 31 | Red Hat build of Quarkus | High7.5 | No fix yet |
| Aug 31 | Red Hat Qute template engine: template injectionQute template engineHigh8.8Aug 31 | Qute template engine | High8.8 | 3.27.5.SP1+1 more |
| Aug 31 | Samsung rlottie: uncontrolled recursion rlottieMedium5.5Aug 31 | rlottie | Medium5.5 | 8de0d9e6ca80ffef654965505981727b9fa06a51 |
| Aug 31 | OpenSearch SQL Plugin - Unrestricted Java Deserialization in Cursor Pagination AWSUnratedAug 31 | AWS | Unrated | No fix yet |
| Aug 31 | Google Cloud Build: improper authorization Google Cloud BuildCritical9.4Aug 31 | Google Cloud Build | Critical9.4 | 2026-06-24 |
| Aug 31 | Red Hat Enterprise Linux 10: resource exhaustionRed Hat Enterprise Linux 10High7.5Aug 31 | Red Hat Enterprise Linux 10 | High7.5 | No fix yet |
| Aug 31 | Dell Technologies PowerStore: missing authentication PowerStoreCritical9.8Aug 31 | PowerStore | Critical9.8 | 500T 4.1.0.6-2771237 or later+2 more |
| Aug 31 | Nokia NSP: cross-site scripting NSPMedium5.4Aug 31 | NSP | Medium5.4 | No fix yet |
| Aug 31 | Nokia NSP: open redirectNSPMedium5.3Aug 31 | NSP | Medium5.3 | No fix yet |
| Aug 31 | Nokia WaveSuite: improper access controlWaveSuiteHigh7.6Aug 31 | WaveSuite | High7.6 | No fix yet |
| Aug 30 | Unpacking a crafted image layer with an invalid length extended-attribute name crashes the unpacking process AppleMediumAug 30 | Apple | Medium | 0.41.0+1 more |
| Aug 30 | Unpacking a crafted image layer with a long(invalid) file name crashes the unpacking processAppleMediumAug 30 | Apple | Medium | 0.41.0+1 more |
| Aug 30 | Loading an OCI image layout can read host files through a symlinkAppleMediumAug 30 | Apple | Medium | 0.41.0+1 more |
| Aug 30 | `RegistryClient` follows the `WWW-Authenticate` realm without validating its host or schemeAppleMediumAug 30 | Apple | Medium | 0.41.0 |
| Aug 30 | Apple: path traversalAppleHighAug 30 | Apple | High | 0.41.0+1 more |
| Aug 30 | ## Impact An attacker who can choose a container or exec id may be able to...AppleHighAug 30 | Apple | High | 0.41.0 |
| Aug 29 | Arbitrary host filesystem & Docker-socket mounts via MCP server `mounts` GitHubCritical9.6Aug 29 | GitHub | Critical9.6 | No fix yet |
| Aug 29 | VMware bosh-vsphere-cpi-release: improper certificate validation bosh-vsphere-cpi-releaseHigh7.7Aug 29 | bosh-vsphere-cpi-release | High7.7 | 98.0.6 |
| Aug 28 | SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read seaweedfsHigh7.7Aug 28 | seaweedfs | High7.7 | 0.0.0-20260612000715-b44cf51fe931 |
| Aug 28 | seaweedfs: improper authorizationseaweedfsMedium4.3Aug 28 | seaweedfs | Medium4.3 | 0.0.0-20260614205536-b13463880c1f |
| Aug 28 | Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens GraylogMediumAug 28 | Graylog | Medium | 6.3.12+2 more |
| Aug 28 | Fortigate syslog message parser can be exploited to modify or delete fields from the original messageGraylogHigh7.5Aug 28 | Graylog | High7.5 | 6.3.12+2 more |
| Aug 28 | Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fieldsGraylogMedium5.0Aug 28 | Graylog | Medium5.0 | 7.1.4 |
| Aug 28 | MongoDB BI Connector: null pointer dereference BI ConnectorHigh8.3Aug 28 | BI Connector | High8.3 | 2.14.31 |
| Aug 28 | An unauthenticated party able to reach the port of a MongoDB Connector for BIBI ConnectorHigh8.7Aug 28 | BI Connector | High8.7 | 2.14.31 |
| Aug 28 | MongoDB BI Connector: improper certificate validationBI ConnectorHigh8.7Aug 28 | BI Connector | High8.7 | 2.14.31 |
| Aug 28 | A network-reachable clientBI ConnectorHigh8.7Aug 28 | BI Connector | High8.7 | 2.14.31 |
| Aug 28 | MongoDB BI Connector ODBC Driver: stack buffer overflowBI Connector ODBC DriverHigh8.7Aug 28 | BI Connector ODBC Driver | High8.7 | 1.4.10 |
| Aug 28 | MongoDB BI Connector ODBC Driver: stack buffer overflowBI Connector ODBC DriverMedium6.0Aug 28 | BI Connector ODBC Driver | Medium6.0 | 1.4.10 |
| Aug 28 | IBM Concert: SQL injection ConcertCritical9.1Aug 28 | Concert | Critical9.1 | No fix yet |
| Aug 28 | IBM Cloud Pak for Data System: denial of serviceCloud Pak for Data SystemMedium6.2Aug 28 | Cloud Pak for Data System | Medium6.2 | No fix yet |
| Aug 28 | IBM Langflow OSS: path traversalLangflow OSSHigh7.5Aug 28 | Langflow OSS | High7.5 | No fix yet |
| Aug 28 | IBM Langflow OSS: information disclosureLangflow OSSHigh8.2Aug 28 | Langflow OSS | High8.2 | No fix yet |
| Aug 28 | IBM Langflow OSS: remote code executionLangflow OSSCritical9.8Aug 28 | Langflow OSS | Critical9.8 | No fix yet |
| Aug 28 | IBM Langflow OSS: improper authorizationLangflow OSSMedium6.4Aug 28 | Langflow OSS | Medium6.4 | No fix yet |
| Aug 28 | IBM Langflow OSS: privilege escalationLangflow OSSCritical9.9Aug 28 | Langflow OSS | Critical9.9 | No fix yet |
| Aug 28 | NetApp StorageGRID: denial of service StorageGRIDLow2.3Aug 28 | StorageGRID | Low2.3 | No fix yet |
| Aug 28 | IBM AIX: privilege escalationAIXHigh7.0Aug 28 | AIX | High7.0 | No fix yet |
| Aug 28 | IBM Administration Runtime Expert for i: information disclosureAdministration Runtime Expert for iHigh7.5Aug 28 | Administration Runtime Expert for i | High7.5 | No fix yet |
| Aug 28 | IBM Administration Runtime Expert for i: privilege escalationAdministration Runtime Expert for iCritical9.9Aug 28 | Administration Runtime Expert for i | Critical9.9 | No fix yet |
| Aug 28 | IBM Langflow OSS: server-side request forgeryLangflow OSSMedium4.3Aug 28 | Langflow OSS | Medium4.3 | No fix yet |
| Aug 28 | IBM Langflow OSS: remote code executionLangflow OSSHigh8.8Aug 28 | Langflow OSS | High8.8 | No fix yet |
| Aug 28 | IBM Langflow OSS: information disclosureLangflow OSSHigh8.2Aug 28 | Langflow OSS | High8.2 | No fix yet |
| Aug 28 | IBM Integrated Analytics System: information disclosureIntegrated Analytics SystemMedium5.9Aug 28 | Integrated Analytics System | Medium5.9 | No fix yet |
| Aug 28 | IBM Integrated Analytics System: information disclosureIntegrated Analytics SystemMedium5.9Aug 28 | Integrated Analytics System | Medium5.9 | No fix yet |
| Aug 28 | IBM Concert: improper certificate validationConcertMedium5.9Aug 28 | Concert | Medium5.9 | No fix yet |
| Aug 28 | JFrog artifactory: improper authentication artifactoryCritical9.8Aug 28 | artifactory | Critical9.8 | 7.111.21+3 more |
| Aug 28 | Red Hat file-psd plugin: out-of-bounds readfile-psd pluginMedium6.1Aug 28 | file-psd plugin | Medium6.1 | No fix yet |
| Aug 28 | MongoDB BI Connector: SQL injectionBI ConnectorHigh8.5Aug 28 | BI Connector | High8.5 | 2.14.31 |
| Aug 28 | MongoDB BI Connector Transition Readiness Report: CSV injectionBI Connector Transition Readiness ReportMedium5.8Aug 28 | BI Connector Transition Readiness Report | Medium5.8 | 1.1.3 |
| Aug 28 | MongoDB BI Connector Transition Readiness Report: cross-site scriptingBI Connector Transition Readiness ReportMedium6.9Aug 28 | BI Connector Transition Readiness Report | Medium6.9 | 1.1.3 |
| Aug 28 | MongoDB BI Connector: SQL injectionBI ConnectorMedium5.7Aug 28 | BI Connector | Medium5.7 | 2.14.31 |
| Aug 28 | MongoDB BI Connector Transition Readiness Report: cross-site scriptingBI Connector Transition Readiness ReportMedium4.8Aug 28 | BI Connector Transition Readiness Report | Medium4.8 | 1.1.3 |