What are the security flaws of SHA?

I have been researching SHA algorithms extensively, specifically SHA1, SHA2-256, SHA2-512, SHA3-256, and SHA3-512, and have found many instances of successful collision attacks as well as methods.

In my list are the following:

• Brute Force attacks
  • Birthday attacks
  • Yuval's Birthday attack (improved birthday attack with different conditions)
• Reduced round attacks
  • Successful on attacks on all SHA algorithms, SHA1, SHA-2, and Keccak ("Parent" function of SHA-3)
• Chosen Prefix attacks
  • Successful on SHA1, more info: https://shattered.io/.

As well as attacks that defeat the security provided by algorithms in application.

• Length extension attacks
  • SHA-3 is invulnerable due to the concatenation of capacity during permutations of Keccak sponge function.

I have excluded Brute force attacks (when not about finding collisions), including dictionary attacks, as well as rainbow tables since these are vulnerabilities created by something external to the algorithm itself.

I agree with your list but I would also consider adding comments in terms of how detrimental these attacks are to the actual security of the algorithms in terms of application. For example, successful reduced round attacks are not as worrying as they might seem since every additional round of an algorithm provides exponential amounts of added security, meaning that "breaking" a 42 round SHA256 algorithm does not breach any of the security provided by the full-round SHA256.

Additionally, actually "breaking" an algorithm doesn't completely make it insecure, in practice, since successful attacks often take up massive amounts of resources and time (breaking SHA1 took over 1.5 years and a collective of computers to break). So even if SHA1 is "insecure" it is still theoretically safe enough to use since it is infeasible to compute a collision in a reasonable amount of time and with a limited amount of resources.

It might be worth noting the actual math behind the infeasibility of computing hash collisions in terms of preimage hashes too. It is one thing to find a collision where two hashes collide and to find a hash that collides with a pre-existing hash. Security is actually measured in terms of bit length, so theoretically it would take 2^n computations to find a collision in a n bit hashing algorithm. You can find more about ways of measuring security in hashing algorithms here.