CVE-2026 records published in July 2026
This page lists the 9,534 CVE-2026 records published in July 2026, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 20 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2026 list filters these records by severity or signal.
- Critical
- 1,25913.2% of these records
- Listed in CISA KEV
- 200.2% of these records
- Reported exploited
- 160.2% of these records
- Detection signal
- 760.8% of these records
- Exploit code
- 2342.5% of these records
- Actionable vendor fix
- 8,18685.9% of these records
Figures as of 2026-10-24 13:48 UTC. Records published in July 2026 have had from about three months to about four months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2026-68771 | ComfyUI unauthenticated RCE via LoadTrainingDataset Pickle deserialization | 9.3CNA v4.0 | 1.1% | 2026-07-31 | Exploit code |
| CVE-2026-68770 | sentence-transformers arbitrary code execution on Local Model Load Despite trust_remote_code=False | 9.3CNA v4.0 | 0.9% | 2026-07-31 | Fix |
| CVE-2026-67822 | Tenda W6-S /goform/wifiSSIDset endpoint stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2026-07-31 | |
| CVE-2026-67607 | LightFTP race condition DoS via worker_thread_cleanup | 8.2CNA v4.0 | 0.4% | 2026-07-31 | |
| CVE-2026-67350 | Serendipity open redirect via exit.php | 2.1CNA v4.0 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-65981 | coturn mobility ticket session resume authorization bypass | 7.1CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-65841 | Jodit has cross-site scripting | 5.3CNA v4.0 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-65636 | YAML injection via unescaped newlines in ymlr document comments | 2.1CNA v4.0 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-65313 | ANDRITZ HIPASE-250 use of hard-coded VNC credentials in the engineering-workstation provisioning | 8.1CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-65311 | ANDRITZ HIPASE-250 missing authentication for logging-configuration endpoint | 5.3CNA v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-65310 | ANDRITZ HIPASE-250 missing authentication and permissive CORS policy | 7.5CNA v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-65309 | ANDRITZ HIPASE-250 storage of passwords in a reversible format | 7.5CNA v3.1 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-64607 | Apache HttpComponents Client content-encoding decoding vulnerability | 5.3CISA ADP v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-63223 | CodeIgniter4 CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules | 9.8CNA v3.1 | 0.8% | 2026-07-31 | Exploit codeFix |
| CVE-2026-63222 | CodeIgniter4 CodeIgniter: Path traversal in UploadedFile::move when using client-provided filenames | 7.5CNA v3.1 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-63221 | CodeIgniter4 CodeIgniter: SQL injection is possible | 9.4CNA v3.1 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-63220 | CodeIgniter4 CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure | 4.8CNA v3.1 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-62999 | Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape | 7.5CNA v3.1 | 0.4% | 2026-07-31 | |
| CVE-2026-62959 | Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`) | 8.2CNA v4.0 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-62391 | Apache Kyuubi: Kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases | 8.1CISA ADP v3.1 | 0.8% | 2026-07-31 | Fix |
| CVE-2026-62324 | xdan Jodit sanitizeHTMLElement method cross-site scripting | 5.4CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-62323 | Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored | 6.3CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-59232 | Stored cross-site scripting in Prospero Flow CRM lead name field | 5.3CNA v4.0 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-59231 | Server-side request forgery in Pentestify PDF export via unvalidated image URLs | 5.3CNA v4.0 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-58048 | WebPros cPanel SQL injection | 9.4CNA v4.0 | 0.6% | 2026-07-31 | Exploit codeFix |
| CVE-2026-58047 | WebPros cPanel HTTP request smuggling | 5.6CNA v4.0 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-58039 | Node.js Node improper access control | 3.3CNA v3.0 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-57232 | Contao: Server-side request forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader module | 3.1CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-56673 | ComfyUI: Path traversal in LoadImage | 7.5CNA v3.1 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-56672 | Comfy-Org ComfyUI /userdata endpoint stored cross-site scripting | 8.2CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-56671 | ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read | 7.5CNA v3.1 | 1.0% | 2026-07-31 | Fix |
| CVE-2026-56670 | ComfyUI: Stored XSS via SVG file upload on the /view endpoint | 8.2CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-56571 | HCL iControl error handling vulnerability | 3.7CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-56570 | HCL iControl login form information disclosure | 3.7CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-56569 | HCL iControl configuration files information disclosure | 4.0CNA v3.1 | 0.1% | 2026-07-31 | Fix |
| CVE-2026-56568 | HCL iControl client-side API error messages information disclosure | 3.7CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-56567 | HCL iControl configuration files information disclosure | 5.1CNA v3.1 | 0.1% | 2026-07-31 | Fix |
| CVE-2026-55825 | Contao: Possible path traversal in job download URIs | 3.1CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-55824 | Contao crawler leaks auth credentials to external hosts | 2.6CNA v3.1 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-55502 | Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials | 7.1CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-55499 | Cloudreve file event stream incorrect authorization | 4.3CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-55497 | Cloudreve: Server crash | 6.5CNA v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-55496 | Cloudreve user search endpoint information disclosure | 4.3CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-55495 | Cloudreve: Path traversal in WOPI PUT_RELATIVE allows arbitrary file creation in Owner Account | 4.3CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-55100 | hashi-vault-js has a path traversal and query parameter injection | 8.7CNA v4.0 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-54909 | Pion STUN vulnerable to remote denial of service | 5.3CNA v3.1 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-54787 | sigstore-go fails to check signature timestamps against a signing key's validity period | 3.1CNA v3.1 | 0.1% | 2026-07-31 | Fix |
| CVE-2026-54785 | gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode | 6.2CNA v3.1 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-54768 | WPGraphQL password reset mutation vulnerability | 6.9CNA v4.0 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-54737 | @phun-ky/defaults-deep has a prototype pollution issue via Unsafe Recursive Property Merging | 7.3CNA v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-54729 | HackingRepo dssrf-js dssrf: Any users using DNS is impacted by SSRF | 8.7CNA v4.0 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-54725 | bank-vaults vault-secrets-webhook admission webhook server-side request forgery | 9.6CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-54707 | OnionShare Receive mode writes uploaded files even when file uploads are disabled | 5.4CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-54706 | OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files | 4.8CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-53599 | REDAXO Mediapool file upload vulnerability | 7.5CNA v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-53573 | core-geonetwork has an open redirect Bypass | 4.8CNA v4.0 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-53551 | free5GC AUSF: Null byte injection in supiOrSuci causes HTTP 500 internal service failure | 6.9CNA v4.0 | 0.7% | 2026-07-31 | Fix |
| CVE-2026-53510 | Savon::Model evaluates WSDL operation names as Ruby source | 8.1CNA v3.1 | 0.7% | 2026-07-31 | Fix |
| CVE-2026-53505 | Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS | 7.5CNA v3.1 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-53504 | Thumbor has Regex denial of service (ReDoS) in `convolution` filter | 7.5CNA v3.1 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-53503 | Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS | 7.5CNA v3.1 | 0.8% | 2026-07-31 | Fix |
| CVE-2026-53502 | Thumbor has path traversal via post-validation URL decoding bypass in file_loader | 8.7CNA v4.0 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-53501 | Thumbor has HMAC validation bypass via multiple .replace calls when removing URL signature | 8.2CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-53500 | Thumbor ALLOWED_SOURCES hostname allowlist server-side request forgery | 8.2CNA v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-52857 | Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM | 5.5CNA v3.1 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-52856 | Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service | 7.5CNA v3.1 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-52855 | Wings exposes node configuration secrets through egg configuration-file templating | 9.9CNA v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-52371 | xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 server-side request forgery | 6.5CISA ADP v3.1 | 0.4% | 2026-07-31 | |
| CVE-2026-52232 | FS S3150-8T2F Switch logo.asp page reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2026-07-31 | |
| CVE-2026-52134 | libiec61850 GOOSE payload parser authentication bypass | 9.8CISA ADP v3.1 | 0.8% | 2026-07-31 | Exploit code |
| CVE-2026-51953 | FeehiCMS session management privilege escalation | 7.4CISA ADP v3.1 | 0.4% | 2026-07-31 | |
| CVE-2026-51785 | Hugo Leisink Hiawatha code injection | 9.8CISA ADP v3.1 | 1.1% | 2026-07-31 | |
| CVE-2026-50986 | totadministrativemandate payment validation controller cross-site request forgery | 8.8CISA ADP v3.1 | 0.2% | 2026-07-31 | |
| CVE-2026-46594 | Reflected XSS in PHP Poll Script | 5.1CNA v4.0 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-46593 | Authenticated SQL injection in PHP Poll Script | 8.6CNA v4.0 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-45377 | Decidim: Private exports can be downloaded through reusable links | 6.5CNA v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-45376 | Decidim: Admin user search allows SQL injection through similarity-based sorting | 5.5CNA v3.1 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-45330 | Decidim: Verification admins can access supplied IDs from other organisations | 4.9CNA v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-45086 | Decidim: Forms admin question editor lacks authorization | 5.4CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-44615 | Apache Zeppelin path traversal in NotebookRepo note and folder path composition | 6.5CISA ADP v3.1 | 0.8% | 2026-07-31 | Fix |
| CVE-2026-43833 | Advantech ADAM-3600 upload functionality stack-based buffer overflow | 5.3CISA ADP v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-43832 | Advantech ADAM-3600 Cookie parsing methods stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-43831 | Advantech ADAM-3600 log message functionality stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-43830 | Advantech ADAM-3600 firmware upgrade file verification process command injection | 9.8CISA ADP v3.1 | 2.5% | 2026-07-31 | Fix |
| CVE-2026-43829 | Advantech ADAM-3600 password functionality stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-38713 | TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600 and WR6500 command injection | 9.8CISA ADP v3.1 | 2.8% | 2026-07-31 | |
| CVE-2026-38711 | TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600 and WR6500 command injection | 9.8CISA ADP v3.1 | 2.8% | 2026-07-31 | |
| CVE-2026-38710 | TR1200 and TR3000 system.setclock interface command injection | 7.2CISA ADP v3.1 | 2.3% | 2026-07-31 | |
| CVE-2026-38708 | TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600 and WR6500 command injection | 9.8CISA ADP v3.1 | 2.8% | 2026-07-31 | |
| CVE-2026-34641 | Adobe Premiere Pro out-of-bounds write | 7.8CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-34497 | FMS Employee vulnerable to HTML injection | 4.8CNA v4.0 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-34495 | FMS Employee vulnerable to XSS | 4.8CNA v4.0 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-34490 | Xaap Android Data Stored in Unencrypted Database | 4.8CNA v4.0 | 0.1% | 2026-07-31 | Fix |
| CVE-2026-28145 | MasterStudy LMS WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-28144 | WP Maps WordPress plugin sensitive data exposure | 4.3CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-25552 | TryGhost Ghost-CLI ghost CLI IP spoofing via X-Forwarded-For header | 6.3CNA v4.0 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-21662 | FMS Employee allows upload of Unrestricted files | 4.8CNA v4.0 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-18481 | AWS Ops Wheel stored XSS in Participant URL field leads to account takeover via Session Token Theft | 6.2CNA v4.0 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-18452 | Rich Source|DMS+ (Non-Mobile) use of hard-coded credentials | 10.0CNA v4.0 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-18446 | fast-uri vulnerable to host confusion via backslash authority introducer | 7.5CNA v3.1 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-18437 | MailerPress WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-18436 | MailerPress WordPress plugin missing authorization unauthenticated arbitrary modification | 5.3CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-18394 | AWS strands-agents-tools incorrect authorization | 6.9CNA v4.0 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-18358 | gnome-remote-desktop RDP server denial of service | 7.5CNA v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-18321 | Buffer copy without checking size of input (Classic buffer overflow) in NTPsec | 4.7CNA v3.1 | 0.1% | 2026-07-31 | Fix |
| CVE-2026-18218 | Red Hat Keycloak token revocation policy missing authorization | 4.2CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-18217 | Red Hat Keycloak SAML HTTP-redirect binding vulnerability | 3.4CNA v3.1 | 0.3% | 2026-07-31 | |
| CVE-2026-18215 | Red Hat Keycloak Microsoft identity provider token exchange improper authentication | 6.8CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-18214 | Red Hat Keycloak Google identity provider token exchange missing authorization | 6.8CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-18211 | Red Hat Keycloak secure-client-uris client policy executor improper input validation | 4.2CNA v3.1 | 0.3% | 2026-07-31 | |
| CVE-2026-18209 | Red Hat Keycloak OIDC redirect URI validation vulnerability | 3.4CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-18208 | Red Hat Keycloak token introspection endpoint missing authorization | 6.5CNA v3.1 | 0.3% | 2026-07-31 | |
| CVE-2026-18206 | Red Hat Keycloak client policy host improper input validation | 3.7CNA v3.1 | 0.3% | 2026-07-31 | |
| CVE-2026-18203 | Red Hat Keycloak group policy evaluation incorrect authorization | 6.5CNA v3.1 | 0.3% | 2026-07-31 | |
| CVE-2026-18157 | Yggdrasil-worker-package-manager: Yggdrasil-worker-package-manager: Remote code execution | 7.8CNA v3.1 | 0.4% | 2026-07-31 | |
| CVE-2026-18141 | Aap-gateway: Aap-gateway: Authentication bypass in event-driven ansible via forged HTTP header | 8.2CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-17567 | Fluent Forms WordPress plugin unauthenticated sensitive information exposure | 5.3CNA v3.1 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-17566 | pgAdmin.org pgAdmin 4 Import/Export Data tool OS command injection | 9.4CNA v4.0 | 0.7% | 2026-07-31 | Exploit codeFix |
| CVE-2026-17561 | Unauthenticated RCE in Innotim Software's Logsign SIEM | 9.8CNA v3.1 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-17351 | pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement | 9.4CNA v4.0 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-17350 | pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers | 5.3CNA v4.0 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-17349 | pgAdmin 4 adhoc server clone insecure direct object reference | 9.3CNA v4.0 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-17348 | pgadmin.org pgAdmin 4 missing authentication | 6.9CNA v4.0 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-17347 | pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution | 7.7CNA v4.0 | 0.7% | 2026-07-31 | Fix |
| CVE-2026-17346 | pgAdmin 4: SQL injection | 8.7CNA v4.0 | 0.6% | 2026-07-31 | Fix |
| CVE-2026-16843 | Hikvision DS-3WAP521-SI OS command injection | 7.2CNA v3.1 | 0.9% | 2026-07-31 | |
| CVE-2026-16504 | VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities | 9.8CISA ADP v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-16503 | VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities | 9.1CISA ADP v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-16236 | Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin arbitrary file upload | 8.8CNA v3.1 | 1.2% | 2026-07-31 | Fix |
| CVE-2026-16105 | Red Hat Keycloak role management API missing authorization | 4.9CNA v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-15722 | Red Hat Directory Server stack-based buffer overflow | 7.5CNA v3.1 | 0.8% | 2026-07-31 | Fix |
| CVE-2026-15381 | WP Go Maps WordPress plugin unauthenticated SQL injection via Markers REST filter | 3.7CISA ADP v3.1 | 0.3% | 2026-07-31 | Reported exploitedFix |
| CVE-2026-15258 | Product Feed Manager for WooCommerce WordPress plugin Contributor+ SQL injection via Feed Filter | 8.1CISA ADP v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-15227 | Checkmk missing authorization allows Editing of Foreign Reports | 5.3CNA v4.0 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-15209 | JS Help Desk support ticket endpoint insecure direct object reference | 6.5CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-15048 | Geeky Bot plugin chat history AJAX action missing authorization | 7.5CISA ADP v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-14931 | JS Help Desk WordPress plugin Contributor+ user email disclosure | 6.5CISA ADP v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-14930 | JS Help Desk front-end request dispatcher missing authorization | 7.5CISA ADP v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-14929 | JS Help Desk ticket reply update incorrect authorization | 4.3CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-14928 | JS Help Desk WordPress plugin sensitive information disclosure | 6.5CISA ADP v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-14927 | FluentCart WordPress plugin unauthenticated order PII disclosure via Print Routes | 3.7CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-14922 | WP Photo Album Plus WordPress plugin Subscriber+ stored XSS via Photo comment | 6.1CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-14921 | Ultimate Addons for WPBakery Page Builder WordPress plugin stored XSS | 6.1CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-14919 | ShopMonitor.io WordPress plugin unauthenticated Administrator account takeover | 9.8CISA ADP v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-14862 | Support Genix ticket attachment download missing authorization | 3.7CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-14849 | Paid Member Subscriptions WordPress plugin unauthenticated sensitive information exposure | 3.7CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-14847 | Paid Member Subscriptions WordPress plugin Subscriber+ Payment data disclosure via IDOR | 4.3CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-14845 | NewStatPress WordPress plugin unauthenticated stored XSS via Top post widget | 6.1CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-14843 | Events Made Easy WordPress plugin unauthenticated Person data modification via IDOR | 5.3CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-14834 | Mailgun for WordPress plugin unauthenticated arbitrary Mailgun List Subscription via add_list AJAX | 6.5CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-14833 | Lightbox with PhotoSwipe WordPress plugin Author+ stored XSS via data-lbwps-caption attribute | 6.8CISA ADP v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-14830 | FlxWoo WordPress plugin unauthenticated Payment bypass | 7.5CISA ADP v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-14554 | The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks. | 6.5CISA ADP v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-14541 | Authentication bypass and Audience Confusion in MCP Toolbox OAuth Provider | 8.0CNA v4.0 | 0.3% | 2026-07-31 | |
| CVE-2026-14540 | Server-side request forgery via Unrestricted HTTP Redirection in MCP Toolbox | 8.0CNA v4.0 | 0.1% | 2026-07-31 | |
| CVE-2026-14539 | Denial of service via Unrestricted Payload Buffering in MCP Toolbox | 6.6CNA v4.0 | 0.2% | 2026-07-31 | |
| CVE-2026-14538 | BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox | 5.7CNA v4.0 | 0.2% | 2026-07-31 | |
| CVE-2026-14537 | Authorization bypass in MCP Toolbox Legacy HTTP endpoints | 8.1CNA v4.0 | 0.3% | 2026-07-31 | |
| CVE-2026-14483 | Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin unauthenticated arbitrary file upload | 9.8CNA v3.1 | 4.0% | 2026-07-31 | NucleiExploit codeFix |
| CVE-2026-14333 | Demi backup directory information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-14319 | GiveWP WordPress plugin unauthenticated Recurring Donor information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-14317 | GiveWP WordPress plugin unauthenticated Payment Gateway Restriction bypass | 5.3CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-13609 | Frontend Admin by DynamiApps WordPress plugin unauthenticated stored cross-site scripting | 8.8CISA ADP v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-13393 | ElementsKit Lite WordPress plugin Subsite stored XSS | 3.5CISA ADP v3.1 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-13392 | ElementsKit Lite WordPress plugin Subsite PHP code injection | 7.2CISA ADP v3.1 | 0.7% | 2026-07-31 | Fix |
| CVE-2026-12721 | Kirki WordPress plugin unauthenticated SQL injection | 8.6CISA ADP v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-12720 | Kirki WordPress plugin unauthenticated PHP object injection | 7.5CISA ADP v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-12697 | wpForo Forum WordPress plugin Subscriber+ Cross-User AI Chat Message deletion via IDOR | 5.4CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-12695 | miniOrange 2FA WordPress plugin 2FA bypass via Attacker-Controlled ga_secret | 8.1CISA ADP v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-12376 | Academy LMS WordPress plugin sensitive information disclosure | 4.3CISA ADP v3.1 | 0.3% | 2026-07-31 | |
| CVE-2026-12251 | Ultimate Member WordPress plugin unauthenticated privilege escalation via role Selection field | 8.1CISA ADP v3.1 | 0.4% | 2026-07-31 | Fix |
| CVE-2026-11770 | Red Hat 389 Directory Server CleanAllRUV replication status-check LDAP injection | 7.5CNA v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-10686 | Zephyr IPv6 forwarding denial of service | 5.8CNA v3.1 | 0.5% | 2026-07-31 | Fix |
| CVE-2026-10685 | Zephyr Bluetooth GATT client use-after-free | 7.6CNA v3.1 | 0.3% | 2026-07-31 | Fix |
| CVE-2026-10079 | Red Hat Advanced Cluster Security for Kubernetes insufficient verification of data authenticity | 8.5CNA v3.1 | 0.2% | 2026-07-31 | |
| CVE-2026-9044 | Command injection vulnerability in OpenVPN of TP-Link Archer AXE75 | 8.5CNA v4.0 | 2.5% | 2026-07-31 | Fix |
| CVE-2026-8155 | BuddyPress WordPress plugin Subscriber+ Private Messages disclosure via IDOR | 5.4CISA ADP v3.1 | 0.2% | 2026-07-31 | Fix |
| CVE-2026-68563 | Red Hat ansible-collection-redhat-leapp information disclosure | 5.5CNA v3.1 | 0.1% | 2026-07-30 | |
| CVE-2026-68562 | Red Hat ansible-collection-redhat-leapp Leapp report information disclosure | 6.2CNA v3.1 | 0.4% | 2026-07-30 | |
| CVE-2026-68503 | LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard | 9.8CNA v3.1 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-68502 | grisuno LazyOwn Socket.IO input event command dispatcher remote code execution | 9.8CNA v3.1 | 1.0% | 2026-07-30 | Fix |
| CVE-2026-68501 | Sylius Mollie Plugin insecure direct object reference | 6.5CNA v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-68500 | Sylius Mollie Plugin: Payment status forgery via the payment webhook | 7.5CNA v3.1 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-68499 | uhop node-re2 global String.prototype.match matching cursor infinite loop | 6.2CNA v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-67596 | CSL 1010 M2M 3G WiFi Module weak encryption via Router.cfg | 6.9CNA v4.0 | 0.1% | 2026-07-30 | |
| CVE-2026-67594 | Spikster missing authentication via API Route Group | 9.3CNA v4.0 | 0.8% | 2026-07-30 | |
| CVE-2026-67550 | node-re2 regex exec and match methods out-of-bounds read | 5.7CNA v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-67530 | WACRM: SSRF via the automation `send_webhook` action | 6.4CNA v3.1 | 0.3% | 2026-07-30 | |
| CVE-2026-67529 | OpenProject time entries and cost entries APIs information disclosure | 4.3CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-67528 | OpenProject: Improper access control | 4.3CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-67527 | OpenProject: Improper access control | 7.6CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-67351 | Serendipity authentication bypass via Username Collision | 8.7CNA v4.0 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-67349 | OpenCost Unauthenticated Helm Values Exposure and Admin Bypass | 8.7CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-67348 | julep-ai julep get_execution_details endpoint insecure direct object reference | 8.6CNA v4.0 | 0.4% | 2026-07-30 | |
| CVE-2026-67347 | Vendure Cross-Channel authorization bypass via StockLocation and Asset Update | 6.1CNA v4.0 | 0.5% | 2026-07-30 | |
| CVE-2026-67346 | Swarms server-side request forgery via DNS Rebinding Bypass | 7.7CNA v4.0 | 0.5% | 2026-07-30 | |
| CVE-2026-67345 | MaxKey DefaultRedirectResolver OAuth Authorization Code Theft | 8.5CNA v4.0 | 0.6% | 2026-07-30 | |
| CVE-2026-67248 | A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM | 8.8v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-67247 | A path traversal vulnerability was found in the IHM Log handling of ADM | 6.5NVD v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-67246 | A path traversal vulnerability was found in the Wallpaper component of ADM | 6.5v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-67245 | A path traversal vulnerability was found in the VPN Clients on the ADM | 8.1v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-67244 | A format string vulnerability was found in the Notification OAuth settings of ADM | 7.2v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-67208 | Juggle Unauthenticated RCE via Exposed H2 console | 9.3CNA v4.0 | 4.3% | 2026-07-30 | Nuclei |
| CVE-2026-67207 | wolfcms wolf CMS authorization bypass via BackupRestoreController | 8.7CNA v4.0 | 0.5% | 2026-07-30 | |
| CVE-2026-67206 | wolfcms wolf CMS authenticated RCE via FileManagerController file upload | 8.7CNA v4.0 | 2.1% | 2026-07-30 | Exploit code |
| CVE-2026-66803 | Microsoft Azure Cosmos DB remote code execution | 10.0CNA v3.1 | 0.9% | 2026-07-30 | Fix |
| CVE-2026-66756 | Apache Tika: Unpack endpoint in tika-server allows configuration with unsecureFeatures=false | 6.9CNA v4.0 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-66755 | Apache Tika: Arbitrary Local File Read in ISArchiveParser | 5.9CNA v4.0 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-66720 | MZ Automation libiec61850 out-of-bounds read | 7.1CNA v4.0 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-66421 | OpenClaw Dashboard stored XSS via lastMessage Session field | 8.8CNA v4.0 | 0.6% | 2026-07-30 | Exploit code |
| CVE-2026-66420 | Ylianst MeshCentral WebSocket origin validation vulnerability | 8.6CNA v4.0 | 0.2% | 2026-07-30 | |
| CVE-2026-66418 | OpenClaw Dashboard stored XSS via Failed Login Username field | 9.3CNA v4.0 | 0.6% | 2026-07-30 | Exploit code |
| CVE-2026-66416 | Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware | 8.6CNA v4.0 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-66415 | Leantime server-side request forgery and local file inclusion in Blueprints::import | 8.4CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-66414 | Leantime open redirect in Login controller via redirectUrl parameter | 5.1CNA v4.0 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-66369 | MZ Automation libiec61850 out-of-bounds read | 7.1CNA v4.0 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-66364 | MZ Automation libiec61850 out-of-bounds read | 7.1CNA v4.0 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-66360 | MZ Automation libiec61850 out-of-bounds read | 8.7CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-66349 | MZ Automation libiec61850 out-of-bounds read | 6.9CNA v4.0 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-66066 | Rails Active Storage arbitrary file read | 9.5CNA v4.0 | 27.9% | 2026-07-30 | Reported exploitedMetasploitEmerging ThreatsExploit codeKCVFix |
| CVE-2026-65835 | Capsule TenantResource controller privilege escalation | 6.6CNA v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-65834 | Capsule node admission webhook denial of service | 6.8CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-65635 | Boruta dynamic client registration allows creation of over-privileged OAuth clients | 8.3CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-65423 | o6 Automation open62541 integer overflow or wraparound | 8.7CNA v4.0 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-65421 | MZ Automation libiec61850 out-of-bounds read | 7.1CNA v4.0 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-64870 | MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation | 5.3CNA v4.0 | 0.4% | 2026-07-30 | |
| CVE-2026-64816 | RapidRAW NTLMv2 credential leak via UNC Path in lutPath | 7.1CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-64635 | Veeam Service Provider Console weak password recovery | 5.3CNA v3.1 | 0.3% | 2026-07-30 | |
| CVE-2026-63559 | o6 Automation open62541 integer overflow or wraparound | 8.7CNA v4.0 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-63550 | MZ Automation libiec61850 out-of-bounds read | 7.1CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-63362 | o6 Automation open62541 integer underflow | 8.2CNA v4.0 | 1.8% | 2026-07-30 | Fix |
| CVE-2026-63035 | o6 Automation open62541 use-after-free | 7.2CNA v4.0 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-63033 | MZ Automation lib60870 out-of-bounds read | 6.9CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-62946 | ImageMagick JNX decoder vulnerability | 5.1CNA v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-62845 | Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers | 4.7CNA v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-62663 | Banks: Arbitrary file read via path traversal in Media Filters (image/audio/video/document) | 7.5CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-62363 | ImageMagick: Heap Buffer Over-Write in fx operation | 5.0CNA v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-62246 | Clastix Kamaji tenant datastore schema derivation improper isolation | 8.5CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-61893 | MZ Automation lib60870 out-of-bounds read | 6.9CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-61536 | masci Banks tool import path resolution code injection | 7.5CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-61526 | AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler | 6.1CNA v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-60075 | Date::Manip versions for Perl allow CPU exhaustion | 7.5CISA ADP v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-60074 | Date::Manip date parsing improper input validation | 7.5CISA ADP v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-59952 | Valibot: Record issue paths can make flatten throw for inherited object property names | 6.9CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-59881 | AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate | 6.9CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-59328 | Cross-site scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips | 4.2CNA v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-59327 | Cleartext storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations | 4.4CNA v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-59326 | HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server | 3.3CNA v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-59310 | Broadcom VMware vCenter path traversal | 9.8CNA v3.1 | 2.6% | 2026-07-30 | KEVExploit codeFix |
| CVE-2026-59309 | VMware vCenter VMware Directory Service authentication bypass | 9.8CNA v3.1 | 0.6% | 2026-07-30 | Reported exploitedFix |
| CVE-2026-58222 | Red Hat Enterprise Linux 10 LDAP injection | 8.8CNA v3.1 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-58218 | Red Hat Enterprise Linux 10 samba: Dns signing DoS via tkey name cache exhaustion | 5.3CNA v3.1 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-58216 | Red Hat Enterprise Linux 10 Samba's Kerberos Key Distribution Center's out-of-bounds read | 5.3CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-58066 | Rocket.Chat improper authentication | 9.8CNA v3.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-58046 | WebPros Plesk improper neutralization | 9.9CNA v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-58043 | Node.js Node improper access control | 8.4v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-58040 | Node.js Node improper certificate host validation | 6.3CNA v3.0 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-57862 | Kanboard SSRF Filter Bypass via Hexadecimal IP Notation | 8.4CNA v4.0 | 0.4% | 2026-07-30 | |
| CVE-2026-57859 | e107 Second-order code execution via eval-based deserialization in e_array::unserialize | 7.7CNA v4.0 | 0.7% | 2026-07-30 | |
| CVE-2026-56850 | Node.js Node improper authentication | 4.4v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-56847 | Node.js permission model trace events vulnerability | 6.1v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-56758 | MZ Automation libiec61850 out-of-bounds read | 6.9CNA v4.0 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-56428 | Bosch BSH ELP (Electronic Platform) Modules incorrect user management | 8.1CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-55777 | GoAccess: Out-of-bounds heap read in parse_ios via crafted User-Agent leads to remote crash/DoS | 5.3CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-55768 | GoAccess WebSocket server denial of service | 8.7CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-54885 | Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching | 6.9CNA v4.0 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-54722 | HackingRepo dssrf-js dssrf: There a critical security bug with remove_at_symbol_in_string | 8.7CNA v4.0 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-54715 | GoAccess: Heap out-of-bounds write in parse_browser | 7.1CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-54522 | MessagePack::Buffer#clear use-after-free that enables Cross-Buffer Disclosure | 2.1CNA v4.0 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-54368 | CentreStack SQL injection via x-glad-filter header | 8.7CNA v4.0 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-54367 | CentreStack Unauthenticated API authorization bypass | 8.8CNA v4.0 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-54366 | CentreStack XXE via SharePoint Storage Configuration | 8.7CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-54365 | CentreStack Unauthenticated User Creation via deserialization in GSNamespace.dll | 8.7CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-54364 | CentreStack Session injection via SelectProvider.aspx | 6.9CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-54363 | CentreStack hard-coded key Token Forgery RCE | 9.3CNA v4.0 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-53431 | Boruta accepts expired JWT client assertions due to missing exp claim validation | 9.1CNA v4.0 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-52680 | Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write | 9.8CISA ADP v3.1 | 1.1% | 2026-07-30 | Fix |
| CVE-2026-52539 | Outstatic CMS JWT signing secret hard-coded credentials | 9.1CISA ADP v3.1 | 0.5% | 2026-07-30 | |
| CVE-2026-48910 | Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing | 6.5CISA ADP v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-48499 | Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache | 9.3CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-48449 | Adobe Campaign Classic (ACC) incorrect authorization | 10.0CNA v3.1 | 1.2% | 2026-07-30 | Fix |
| CVE-2026-48448 | Adobe Campaign Classic improper neutralization of special elements used in an SQL command | 8.6CNA v3.1 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-47882 | Spring Boot DevTools remote secret generated with a non-cryptographic PRNG | 8.3CNA v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-47876 | VMware ESX VMXNET3 out-of-bounds write | 9.3CNA v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-47873 | Spring Tools for Eclipse Boot Dashboard Docker integration vulnerability | 8.0CNA v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-47858 | Spring Tools for Eclipse live information startup mode is vulnerable for remote code execution | 8.0CNA v3.1 | 0.3% | 2026-07-30 | Exploit codeFix |
| CVE-2026-44617 | Apache Zeppelin: LDAP filter injection in LdapRealm incomplete fix of | 6.5CISA ADP v3.1 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-44616 | Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction | 6.5CISA ADP v3.1 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-44613 | Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling | 6.1CISA ADP v3.1 | 0.4% | 2026-07-30 | Exploit codeFix |
| CVE-2026-44108 | Phoenix Contact CHARX SEC-3150 firewall bypass during shutdown | 9.3CNA v4.0 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-44107 | Phoenix Contact CHARX SEC-3150 Exposed Reboot via Modbus | 8.7CNA v4.0 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-44106 | Phoenix Contact CHARX SEC-3150 init-script for user-applications privilege escalation | 8.5CNA v4.0 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-44105 | Phoenix Contact CHARX SEC-3150 cleartext password in logs | 5.8CNA v4.0 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-44104 | Phoenix Contact CHARX SEC-3150 ControllerAgent does not perform validation of firmware | 9.3CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-44103 | Phoenix Contact CHARX SEC-3150 JupiCore does not perform validation of firmware | 6.9CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-44102 | Phoenix Contact CHARX SEC-3150 OCPP firmware download is not properly locked | 6.9CNA v4.0 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-44101 | Phoenix Contact CHARX SEC OCPP Agent service missing authentication | 9.3CNA v4.0 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-44100 | Phoenix Contact CHARX SEC-3150 JupiCore charging point reconfiguration without auth | 8.8CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-44099 | Phoenix Contact CHARX SEC-3150 local privilege escalation via pppd password injection | 8.5CNA v4.0 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-44098 | Phoenix Contact CHARX SEC-3150 OS command injection in OCPP agent via charge_box_id | 8.8CNA v4.0 | 1.7% | 2026-07-30 | Fix |
| CVE-2026-44097 | Phoenix Contact CHARX SEC-3150 file upload | 5.3CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-44096 | Phoenix Contact CHARX SEC-3150 udhcpc privilege escalation | 8.5CNA v4.0 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-44095 | Phoenix Contact CHARX SEC-3150 local privilege escalation via Network scripts | 8.5CNA v4.0 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-44094 | Phoenix Contact CHARX SEC-3150 fallback to second RAUC slot with default credentials | 8.3CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-44093 | Phoenix Contact CHARX SEC-3150 init-script for user-applications local privilege escalation | 8.5CNA v4.0 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-44092 | Phoenix Contact CHARX SEC-3150 CRLF injection | 8.8CNA v4.0 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-44091 | Phoenix Contact CHARX SEC-3150 creation of a new configuration by posting a malicious ID to MQTT | 8.8CNA v4.0 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-44090 | Phoenix Contact CHARX SEC-3150 missing authentication for MQTT Broker | 9.3CNA v4.0 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-41709 | VMware ESX administrative operation logging vulnerability | 2.7CNA v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-41703 | VMware ESX out-of-bounds read | 7.6CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-41187 | Calico Tier authorization bypass via DeleteCollection | 6.2CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-41186 | Unauthenticated Go pprof exposure in Calico debug server | 6.0CNA v4.0 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-38709 | TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600 and WR6500 command injection | 9.8CISA ADP v3.1 | 2.8% | 2026-07-30 | |
| CVE-2026-35847 | dnsmgr CheckUils.php ping function command injection | 9.8CISA ADP v3.1 | 0.7% | 2026-07-30 | |
| CVE-2026-28814 | Apache JSPWiki: Pre-Authentication arbitrary Wiki Markup Rendering | 7.5CISA ADP v3.1 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-28813 | Apache JSPWiki cross-site request forgery | 8.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-28812 | Apache JSPWiki: UserManager does not sanity-check user database at startup | 9.8CISA ADP v3.1 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-28811 | Apache JSPWiki: Error Handling Reveals Error Details | 7.5CISA ADP v3.1 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-28323 | SolarWinds Web Help Desk SAML authentication bypass | 9.8CNA v3.1 | 1.0% | 2026-07-30 | Fix |
| CVE-2026-23985 | Apache Superset: Regular expression denial of service (ReDoS) in SQL parser | 5.3CNA v4.0 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-23981 | Apache Superset: Improper authorization in Chart Update allowing Dashboard Modification | 5.3CNA v4.0 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-22622 | Eaton PADM one of the session management interface improper input validation | 8.8CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-22621 | Eaton PADM one of the session management interface improper input validation | 8.3CNA v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-22620 | Eaton PADM authentication component improper input validation | 8.6CNA v3.1 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-18382 | Red Hat Cost Management Metrics Operator koku-metrics-operator server-side request forgery | 6.8CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-18381 | Red Hat Cost Management Metrics Operator koku-metrics-operator server-side request forgery | 7.6CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-18378 | Red Hat Cost Management Metrics Operator koku-metrics-operator server-side request forgery | 7.6CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-18369 | Red Hat Certificate System dogtag-pki: Pki-core: Redhat-pki: Pki: Acme http-01 validation SSRF | 5.8CNA v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-18363 | Weak password recovery mechanism in osTicket by Enhancesoft LLC | 9.1CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-18362 | DFIR-IRIS missing brute force Protection in User Authentication | 5.9CNA v3.1 | 0.4% | 2026-07-30 | |
| CVE-2026-18361 | DFIR-IRIS stored XSS in Datastore upload | 7.6CNA v3.1 | 0.3% | 2026-07-30 | |
| CVE-2026-18360 | DFIR-IRIS stored XSS in Custom attributes | 7.6CNA v3.1 | 0.3% | 2026-07-30 | |
| CVE-2026-18353 | Eclipse CSI unauthenticated SSRF in PIA via OIDC issuer allowlist bypass | 8.8CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-18245 | Incomplete fix for code injection in Amazon @aws-amplify/codegen-ui-react | 6.4CNA v4.0 | 1.0% | 2026-07-30 | Fix |
| CVE-2026-18188 | A format string vulnerability was found in the Rsync Backup on the ADM | 8.1v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-18187 | A format string vulnerability was found in the Internal Backup on the ADM | 8.1v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-18186 | A stored format string vulnerability was found in the FTP Backup on the ADM | 8.1v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-18140 | aws-smithy-json unknown-key skip path of the uncontrolled recursion | 8.7CNA v4.0 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-18064 | NASA Core Flight System (cFS) Health and Safety (HS) Application null pointer dereference | 8.2CNA v4.0 | 0.6% | 2026-07-30 | |
| CVE-2026-18019 | Google Chrome Media side-channel information leak | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-18018 | Google Chrome Updater inappropriate implementation | 4.0CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-18017 | Google Chrome Dawn use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-18016 | Google Chrome Chrome for iOS insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-18015 | Google Chrome Tint inappropriate implementation | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-18014 | Google Chrome improper input validation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-18013 | Google Chrome Chrome for iOS inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-18012 | Google Chrome PDFium use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-18011 | Google Chrome Chrome for iOS inappropriate implementation | 2.4CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-18010 | Google Chrome Passwords inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-18009 | Google Chrome spoofing | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-18008 | Google Chrome settings inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-18007 | Google Chrome Input inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-18006 | Google Chrome Google Lens inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-18005 | Google Chrome WebXR inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-18004 | Google Chrome Speech insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-18003 | Google Chrome Chrome for iOS inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-18002 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-18001 | Google Chrome WebGL inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-18000 | Google Chrome USB insufficient policy enforcement | 3.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17999 | Google Chrome race condition | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17998 | Google Chrome extensions incorrect security UI | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17997 | Google Chrome Passwords inappropriate implementation | 3.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17996 | Google Chrome Browser inappropriate implementation | 6.2CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17995 | Google Chrome Dawn out-of-bounds read | 8.1CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17994 | Google Chrome Media inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17993 | Google Chrome race condition | 7.0CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17992 | Google Chrome uninitialized variable use | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17991 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17990 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17989 | Google Chrome V8 type confusion | 8.8CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17988 | Google Chrome improper input validation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17987 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17986 | Google Chrome Bluetooth insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17985 | Google Chrome Speech insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17984 | Google Chrome Browser inappropriate implementation | 3.3CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17983 | Google Chrome Global Media Controls inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17982 | Google Chrome improper input validation | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17981 | Google Chrome Blink inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17980 | Google Chrome UI inappropriate implementation | 3.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17979 | Google Chrome race condition | 7.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17978 | Google Chrome WebCodecs side-channel information leak | 5.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17977 | Google Chrome origin validation error | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17976 | Google Chrome extensions insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17975 | Google Chrome IME inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17974 | Google Chrome DevTools insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17973 | Google Chrome Views inappropriate implementation | 5.5CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17972 | Google Chrome Chrome for iOS inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17971 | Google Chrome Frame inappropriate implementation | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17970 | Google Chrome spoofing | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17969 | Google Chrome Passwords inappropriate implementation | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17968 | Google Chrome uninitialized variable use | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17967 | Google Chrome Chrome for iOS use-after-free | 8.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17966 | Google Chrome Views inappropriate implementation | 6.2CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17965 | Google Chrome Chrome for iOS incorrect security UI | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17964 | Google Chrome UI incorrect security UI | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17963 | Google Chrome SVG inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17962 | Google Chrome Blink inappropriate implementation | 6.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17961 | Google Chrome Session inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17960 | Google Chrome Chrome for iOS insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17959 | Google Chrome Network inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17958 | Google Chrome Views inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17957 | Google Chrome CORS inappropriate implementation | 3.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17956 | Google Chrome Scheduling inappropriate implementation | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17955 | Google Chrome spoofing | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17954 | Google Chrome origin validation error | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17953 | Google Chrome WebView insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17952 | Google Chrome V8 inappropriate implementation | 7.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17951 | Google Chrome WebRTC heap-based buffer overflow | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17950 | Google Chrome Safebrowsing inappropriate implementation | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17949 | Google Chrome uninitialized variable use | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17948 | Google Chrome V8 type confusion | 7.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17947 | Google Chrome WebSockets use-after-free | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17946 | Google Chrome uninitialized variable use | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17945 | Google Chrome UI misrepresentation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17944 | Google Chrome Chrome for iOS inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17943 | Google Chrome parser inappropriate implementation | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17942 | Google Chrome SVG side-channel information leak | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17941 | Google Chrome Chrome for iOS inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17940 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17939 | Google Chrome spoofing | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17938 | Google Chrome FullScreen inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17937 | Google Chrome improper input validation | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17936 | Google Chrome DevTools inappropriate implementation | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17935 | Google Chrome Codecs heap-based buffer overflow | 8.8CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17934 | Google Chrome improper input validation | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17933 | Google Chrome DOMStorage inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17932 | Google Chrome DataTransfer use-after-free | 5.5CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17931 | Google Chrome DevTools inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17930 | Google Chrome privilege escalation | 7.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17929 | Google Chrome improper input validation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17928 | Google Chrome DataTransfer inappropriate implementation | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17927 | Google Chrome DevTools insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17926 | Google Chrome improper input validation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17925 | Google Chrome Cast inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17924 | Google Chrome DNS use-after-free | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17923 | Google Chrome protection mechanism failure | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17922 | Google Chrome Enterprise inappropriate implementation | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17921 | Google Chrome improper input validation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17920 | Google Chrome V8 use-after-free | 8.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17919 | Google Chrome Enterprise insufficient policy enforcement | 6.8CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17918 | Google Chrome Sync use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17917 | Google Chrome Chrome for iOS insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17916 | Google Chrome settings insufficient policy enforcement | 7.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17915 | Google Chrome WebView inappropriate implementation | 5.4CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17914 | Google Chrome Skia side-channel information leak | 5.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17913 | Google Chrome Chrome for iOS inappropriate implementation | 5.4CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17912 | Google Chrome Chrome for iOS inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17911 | Google Chrome SVG insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17910 | Google Chrome NFC insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17909 | Google Chrome improper input validation | 5.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17908 | Google Chrome sandbox escape | 5.8CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17907 | Google Chrome Network side-channel information leak | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17906 | Google Chrome sandbox escape | 5.8CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17905 | Google Chrome SurfaceCapture inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17904 | Google Chrome NFC insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17903 | Google Chrome Chromecast insufficient policy enforcement | 5.4CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17902 | Google Chrome Editing inappropriate implementation | 3.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17901 | Google Chrome improper input validation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17900 | Google Chrome Enterprise inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17899 | Google Chrome DevTools insufficient policy enforcement | 8.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17898 | Google Chrome DevTools use-after-free | 7.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17897 | Google Chrome ORB inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17896 | Google Chrome DevTools use-after-free | 7.5CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17895 | Google Chrome DataTransfer inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17894 | Google Chrome Views use-after-free | 8.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17893 | Google Chrome sandbox escape | 5.8CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17892 | Google Chrome WebXR inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17891 | Google Chrome ANGLE use-after-free | 5.8CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17890 | Google Chrome sandbox escape | 5.8CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17889 | Google Chrome uninitialized variable use | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17888 | Google Chrome sandbox escape | 7.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17887 | Google Chrome TabStrip use-after-free | 7.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17886 | Google Chrome Enterprise use-after-free | 8.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17885 | Google Chrome Paint inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17884 | Google Chrome WebRTC object lifecycle issue | 8.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17883 | Google Chrome Headless inappropriate implementation | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17882 | Google Chrome protection mechanism failure | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17881 | Google Chrome WebXR integer overflow | 8.8CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17880 | Google Chrome Autofill inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17879 | Google Chrome Autofill inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17878 | Google Chrome CSS inappropriate implementation | 6.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17877 | Google Chrome Chromoting inappropriate implementation | 8.4CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17876 | Google Chrome Payments inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17875 | Google Chrome PDFium use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17874 | Google Chrome Chrome for iOS inappropriate implementation | 5.4CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17873 | Google Chrome Chrome for iOS insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17872 | Google Chrome improper signature verification | 6.1CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17871 | Google Chrome Passwords inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17870 | Google Chrome improper input validation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17869 | Google Chrome WebXR out-of-bounds read | 8.1CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17868 | Google Chrome USB insufficient policy enforcement | 8.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17867 | Google Chrome sandbox escape | 7.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17866 | Google Chrome Tab type confusion | 5.8CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17865 | Google Chrome Crypto inappropriate implementation | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17864 | Google Chrome Updater inappropriate implementation | 7.8CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17863 | Google Chrome Browser inappropriate implementation | 7.8CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17862 | Google Chrome Tracing use-after-free | 7.8CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17861 | Google Chrome privilege escalation | 7.8CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17860 | Google Chrome improper input validation | 3.3CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17859 | Google Chrome Favicons inappropriate implementation | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17858 | Google Chrome uninitialized variable use | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17857 | Google Chrome Network inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17856 | Google Chrome Network inappropriate implementation | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17855 | Google Chrome race condition | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17854 | Google Chrome WebMCP insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17853 | Google Chrome DevTools inappropriate implementation | 6.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17852 | Google Chrome Media Router inappropriate implementation | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17851 | Google Chrome Autofill side-channel information leak | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17850 | Google Chrome Permissions inappropriate implementation | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17849 | Google Chrome Chrome for iOS inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17848 | Google Chrome Codecs integer overflow | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17847 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17846 | Google Chrome Media inappropriate implementation | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17845 | Google Chrome CSS inappropriate implementation | 6.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17844 | Google Chrome improper input validation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17843 | Google Chrome CSS inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17842 | Google Chrome Chrome for iOS inappropriate implementation | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17841 | Google Chrome race condition | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17840 | Google Chrome Passwords incorrect security UI | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17839 | Google Chrome Chrome for iOS inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17838 | Google Chrome Chrome for iOS incorrect security UI | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17837 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17836 | Google Chrome V8 use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17835 | Google Chrome Chrome for iOS inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17834 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17833 | Google Chrome Passwords inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17832 | Google Chrome ANGLE use-after-free | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17831 | Google Chrome spoofing | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17830 | Google Chrome Chrome for iOS inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17829 | Google Chrome Passwords insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17828 | Google Chrome Chrome for iOS inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17827 | Google Chrome CSS inappropriate implementation | 6.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17826 | Google Chrome Chrome for iOS inappropriate implementation | 3.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17825 | Google Chrome Passwords insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17824 | Google Chrome ServiceWorker insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17823 | Google Chrome WebXR insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17822 | Google Chrome race condition | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17821 | Google Chrome extensions insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17820 | Google Chrome Autofill insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17819 | Google Chrome WebAppInstalls inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17818 | Google Chrome Network inappropriate implementation | 6.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17817 | Google Chrome ReportingAndNEL inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17816 | Google Chrome Speech insufficient policy enforcement | 7.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17815 | Google Chrome GuestView insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17814 | Google Chrome improper input validation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17813 | Google Chrome Chrome for iOS insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17812 | Google Chrome DigitalCredentials inappropriate implementation | 5.4CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17811 | Google Chrome ANGLE use-after-free | 7.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17810 | Google Chrome uninitialized variable use | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17809 | Google Chrome sandbox escape | 5.8CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17808 | Google Chrome uninitialized variable use | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17807 | Google Chrome V8 use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17806 | Google Chrome sandbox escape | 5.8CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17805 | Google Chrome Glic insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17804 | Google Chrome Media use-after-free | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17803 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17802 | Google Chrome GPU side-channel information leak | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17801 | Google Chrome ANGLE out-of-bounds read | 9.6CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17800 | Google Chrome MediaRecording inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17799 | Google Chrome improper input validation | 5.4CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17798 | Google Chrome Cast inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17797 | Google Chrome CSS inappropriate implementation | 6.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17796 | Google Chrome WebXR side-channel information leak | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17795 | Google Chrome GetUserMedia inappropriate implementation | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17794 | Google Chrome improper input validation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17793 | Google Chrome messages inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17792 | Google Chrome Credential Management inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17791 | Google Chrome spoofing | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17790 | Google Chrome uninitialized variable use | 4.3CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17789 | Google Chrome improper input validation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17788 | Google Chrome Blink inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17787 | Google Chrome DevTools inappropriate implementation | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17786 | Google Chrome privilege escalation | 8.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17785 | Google Chrome uninitialized variable use | 4.3CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17784 | Google Chrome Audio use-after-free | 8.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17783 | Google Chrome Loader inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17782 | Google Chrome Chrome for iOS incorrect security UI | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17781 | Google Chrome extensions inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17780 | Google Chrome Isolated Web Apps inappropriate implementation | 6.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17779 | Google Chrome Site Isolation inappropriate implementation | 5.4CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17778 | Google Chrome extensions use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17777 | Google Chrome Autofill inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17776 | Google Chrome sandbox escape | 5.8CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17775 | Google Chrome PresentationAPI inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17774 | Google Chrome improper input validation | 7.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17773 | Google Chrome improper input validation | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17772 | Google Chrome WebGL out-of-bounds read | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17771 | Google Chrome uninitialized variable use | 4.3CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17770 | Google Chrome Media out-of-bounds read | 5.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17769 | Google Chrome improper input validation | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17768 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17767 | Google Chrome improper input validation | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17766 | Google Chrome improper input validation | 3.3CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17765 | Google Chrome WebProtect inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17764 | Google Chrome FedCM inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17763 | Google Chrome GPU inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17762 | Google Chrome Chrome for iOS inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17761 | Google Chrome improper input validation | 5.4CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17760 | Google Chrome NoStatePrefetch side-channel information leak | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17759 | Google Chrome uninitialized variable use | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17758 | Google Chrome Dawn heap-based buffer overflow | 9.6CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17757 | Google Chrome uninitialized variable use | 4.3CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17756 | Google Chrome Presentation insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17755 | Google Chrome extensions incorrect security UI | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17754 | Google Chrome Blink inappropriate implementation | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17753 | Google Chrome Autofill inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17752 | Google Chrome Views use-after-free | 8.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17751 | Google Chrome AdFilter inappropriate implementation | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17750 | Google Chrome ANGLE use-after-free | 7.1CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17749 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17748 | Google Chrome extensions inappropriate implementation | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17747 | Google Chrome spoofing | 4.2CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17746 | Google Chrome GPU use-after-free | 5.8CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17745 | Google Chrome Skia out-of-bounds read | 5.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17744 | Google Chrome File Input inappropriate implementation | 7.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17743 | Google Chrome ControlledFrame insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17742 | Google Chrome Payments insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17741 | Google Chrome sandbox escape | 7.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17740 | Google Chrome uninitialized variable use | 4.3CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17739 | Google Chrome extensions insufficient policy enforcement | 4.2CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17738 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17737 | Google Chrome Bluetooth use-after-free | 5.0CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17736 | Google Chrome sandbox escape | 5.8CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17735 | Google Chrome sandbox escape | 8.7CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17734 | Google Chrome Autofill inappropriate implementation | 5.4CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17733 | Google Chrome QUIC inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17732 | Google Chrome SVG inappropriate implementation | 3.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17731 | Google Chrome Autofill inappropriate implementation | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17730 | Google Chrome Autofill side-channel information leak | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17729 | Google Chrome V8 use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17728 | Google Chrome extensions inappropriate implementation | 5.4CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17727 | Google Chrome WebGL out-of-bounds write | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17726 | Google Chrome WebGL integer overflow | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17725 | Google Chrome V8 type confusion | 8.8CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17724 | Google Chrome race condition | 4.2CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17723 | Google Chrome Media use-after-free | 8.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17722 | Google Chrome WebView object lifecycle issue | 8.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17721 | Google Chrome ANGLE out-of-bounds write | 9.6CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17720 | Google Chrome Passwords insufficient policy enforcement | 3.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17719 | Google Chrome Input use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17718 | Google Chrome ANGLE use-after-free | 9.6CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17717 | Google Chrome ANGLE integer overflow | 9.6CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17716 | Google Chrome Updater use-after-free | 8.4CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17715 | Google Chrome Passwords inappropriate implementation | 3.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17714 | Google Chrome uninitialized variable use | 6.5CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17713 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17712 | Google Chrome race condition | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17711 | Google Chrome race condition | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17710 | Google Chrome MHTML inappropriate implementation | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17709 | Google Chrome race condition | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17708 | Google Chrome Audio use-after-free | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17707 | Google Chrome uninitialized variable use | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17706 | Google Chrome improper input validation | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17705 | Google Chrome libxml integer overflow | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17704 | Google Chrome ANGLE use-after-free | 9.6CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17703 | Google Chrome Chrome for iOS insufficient policy enforcement | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17702 | Google Chrome Skia inappropriate implementation | 3.1CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17701 | Google Chrome out-of-bounds read | 9.6CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17700 | Google Chrome improper input validation | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17699 | Google Chrome Views use-after-free | 8.6CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17698 | Google Chrome improper input validation | 7.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17697 | Google Chrome ANGLE type confusion | 9.6CISA ADP v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-17696 | Google Chrome Media side-channel information leak | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17695 | Google Chrome ANGLE inappropriate implementation | 9.6CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17694 | Google Chrome DOM use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17693 | Google Chrome FileSystem insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17692 | Google Chrome DataTransfer use-after-free | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17691 | Google Chrome ANGLE out-of-bounds write | 9.6CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17690 | Google Chrome improper input validation | 6.5CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17689 | Google Chrome uninitialized variable use | 4.3CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17688 | Google Chrome Input use-after-free | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17687 | Google Chrome ANGLE type confusion | 9.6CISA ADP v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-17686 | Google Chrome improper input validation | 8.1CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17685 | Google Chrome Autofill use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17684 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17683 | Google Chrome ANGLE inappropriate implementation | 6.5CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17682 | Google Chrome ANGLE integer overflow | 9.6CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17681 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17680 | Google Chrome Color heap-based buffer overflow | 9.6CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17679 | Google Chrome improper input validation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17678 | Google Chrome ANGLE out-of-bounds read | 8.8CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17677 | Google Chrome ANGLE inappropriate implementation | 8.8CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17676 | Google Chrome ANGLE inappropriate implementation | 9.6CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17675 | Google Chrome ANGLE out-of-bounds write | 9.6CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17674 | Google Chrome HTML inappropriate implementation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17673 | Google Chrome QUIC integer overflow | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17672 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17671 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17670 | Google Chrome Views use-after-free | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17669 | Google Chrome Chrome for iOS inappropriate implementation | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17668 | Google Chrome uninitialized variable use | 6.5CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17667 | Google Chrome uninitialized variable use | 6.5CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17666 | Google Chrome missing cryptographic step | 9.1CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17665 | Google Chrome V8 use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17664 | Google Chrome improper input validation | 6.5CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17663 | Google Chrome sandbox escape | 8.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17662 | Google Chrome Prefetch insufficient policy enforcement | 4.3CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17661 | Google Chrome Loader use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17660 | Google Chrome sandbox escape | 8.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17659 | Google Chrome SiteIsolation inappropriate implementation | 4.2CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-17658 | Google Chrome V8 use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-17657 | Google Chrome Navigation use-after-free | 8.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17656 | Google Chrome Ozone use-after-free | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17655 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17654 | Google Chrome race condition | 7.8CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-17653 | Google Chrome Skia use-after-free | 8.3CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-17652 | Google Chrome Views use-after-free | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17651 | Google Chrome sandbox escape | 9.6CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17650 | Google Chrome Compositing use-after-free | 8.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-17544 | PHP out-of-bounds write in bccomp via crafted operand and scale | 8.1CNA v4.0 | 0.4% | 2026-07-30 | Exploit codeFix |
| CVE-2026-17543 | PHP SQL injection in ext-pgsql via E'...' backslash breakout | 8.1CNA v4.0 | 0.3% | 2026-07-30 | Exploit codeFix |
| CVE-2026-16971 | DFIR-IRIS missing brute force Protection in OTP Validation | 5.9CNA v3.1 | 0.3% | 2026-07-30 | |
| CVE-2026-16970 | DFIR-IRIS Insufficient Logout Implementation | 4.2CNA v3.1 | 0.2% | 2026-07-30 | |
| CVE-2026-16969 | DFIR-IRIS stored XSS in Assets | 7.6CNA v3.1 | 0.3% | 2026-07-30 | |
| CVE-2026-16727 | ASUS Armoury Crate race condition | 7.3CNA v4.0 | 0.1% | 2026-07-30 | |
| CVE-2026-16610 | Admin and Site Enhancements (ASE) Pro WordPress plugin unauthenticated remote code execution | 9.8CNA v3.1 | 1.1% | 2026-07-30 | Fix |
| CVE-2026-16531 | Red Hat Enterprise Linux 10 pcp: Pcp: Arbitrary file creation | 5.3CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-16530 | Red Hat Enterprise Linux 10 pcp: Pcp: Remote denial of service and information leakage | 6.5CNA v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-16529 | Red Hat Enterprise Linux 10 pcp: Pcp: Denial of service due to signed integer overflow | 7.5CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-16527 | PCP pmproxy /store endpoint missing authentication | 7.3CNA v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-16526 | Red Hat Enterprise Linux 10 pcp: Pcp: Privilege escalation to root via linux_sockets pmda | 8.8CNA v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-16524 | Red Hat Enterprise Linux 10 pcp: Pcp linux_sockets pmda: Arbitrary command execution | 7.8CNA v3.1 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-16308 | IBM Enterprise Build of Quarkus is affected by a DoS | 7.5CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-16092 | Improved Save Button WordPress plugin Second-order SQL injection | 6.5CNA v3.1 | 0.4% | 2026-07-30 | |
| CVE-2026-15978 | LM-SYS SGLang weight broadcasting endpoints missing authentication | 7.5CISA ADP v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-15977 | SGLang /server_info endpoint information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-15976 | LM-SYS SGLang model weight loading endpoint deserialization of untrusted data | 9.8CISA ADP v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-15974 | LM-SYS SGLang multimodal generation endpoint server-side request forgery | 6.5CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-15971 | LM-SYS SGLang dumper subsystem eval injection | 9.8CISA ADP v3.1 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-15969 | LM-SYS SGLang LoRA adapter loading endpoint deserialization of untrusted data | 9.8CISA ADP v3.1 | 1.0% | 2026-07-30 | Fix |
| CVE-2026-15929 | LG Electronics SmartShare SQL command improper neutralization | 7.1CNA v4.0 | 0.3% | 2026-07-30 | |
| CVE-2026-15658 | foreUP customer REST API insecure direct object reference | 8.1CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-15657 | foreUP customer REST API information disclosure | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-15435 | IBM App Connect Enterprise is vulnerable to arbitrary file write | 9.8CNA v3.1 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-15397 | Subscriptions for WooCommerce WordPress plugin missing authorization | 7.2CNA v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-15382 | Ultimate Addons for WPBakery Page Builder icon font deletion vulnerability | 6.5CISA ADP v3.1 | 0.4% | 2026-07-30 | Reported exploitedFix |
| CVE-2026-15257 | RegistrationMagic WordPress plugin unauthenticated form Submission and user Profile modification | 5.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-15255 | RegistrationMagic WordPress plugin unauthenticated form Submission disclosure via IDOR | 5.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-15252 | Search Atlas SEO WordPress plugin Subscriber+ Google Indexing API access | 5.4CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-15250 | LatePoint WordPress plugin unauthenticated Booking object mass assignment via Public Booking Funnel | 5.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-15240 | Customer Switching for WooCommerce WordPress plugin privilege escalation to Administrator | 7.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-15235 | Hotel Booking Lite WordPress plugin sensitive data disclosure | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-15153 | WP Hotel Booking WordPress plugin Hotel Manager+ SQL injection via Booking List Search | 6.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-15054 | Bit Form WordPress plugin unauthenticated Inactive form Submission | 3.7CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-14980 | IBM WebSphere Application Server Liberty is affected by a cross-site request forgery | 8.3CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-14923 | Sync Post With Other Site WordPress plugin Contributor+ arbitrary page Creation/Modification | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-14602 | Remote API WordPress plugin unauthenticated PHP object injection via remote-api Query parameter | 9.0CISA ADP v3.1 | 0.7% | 2026-07-30 | |
| CVE-2026-14592 | WP Real IP-based Access Control WordPress plugin unauthenticated stored XSS via acl_ctrl_addr | 6.1CISA ADP v3.1 | 0.3% | 2026-07-30 | |
| CVE-2026-14522 | IBM App Connect Enterprise OS command injection | 8.8CNA v3.1 | 1.0% | 2026-07-30 | Fix |
| CVE-2026-14519 | IBM App Connect Enterprise path traversal | 7.5CNA v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-14356 | FleekDash V2 WordPress plugin missing authorization authenticated Administrator account takeover | 8.8CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-14318 | GiveWP WordPress plugin GiveWP Worker+ stored XSS via Donation form Template settings | 6.8CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-14310 | Tutor LMS WordPress plugin Subscriber+ Cross-Course Q&A content disclosure and Reply injection | 5.4CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-14305 | WP Delicious WordPress plugin unauthenticated arbitrary post Meta update via recipe_likes | 5.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-14239 | Tourmaster WordPress plugin stored XSS via CSRF | 7.1CISA ADP v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-14231 | LifterLMS WordPress plugin Subscriber+ sensitive information disclosure via select2_query_posts | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-14227 | Insufficient session expiration in MikroTik RouterOS | 6.9CNA v4.0 | 0.4% | 2026-07-30 | |
| CVE-2026-14226 | Easy Appointments WordPress plugin sensitive information disclosure | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-14223 | Easy Appointments customer details endpoint insecure direct object reference | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-14222 | Easy Appointments WordPress plugin Contributor+ Connection deletion via missing authorization | 3.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-14221 | Easy Appointments WordPress plugin Appointment data disclosure and modification | 3.8CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-14207 | LifterLMS WordPress plugin Instructor+ stored XSS via Featured Pricing information | 6.1CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-14188 | Easy Appointments customer listing handler information disclosure | 2.7CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-13584 | Mitsubishi Electric MELSEC MX Controller CC-Link IE TSN communication protocol vulnerability | 7.1CNA v4.0 | 0.2% | 2026-07-30 | |
| CVE-2026-13444 | IBM Langflow Chroma vector store information disclosure | 8.1CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-13435 | IBM Langflow OSS python Interpreter sandbox bypass leading to sensitive data exposure | 9.9CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-13395 | Online Scheduling and Appointment Booking System front-end booking requests SQL injection | 8.6CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-13379 | OpenVPN out-of-bounds read | 5.1CNA v4.0 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-13345 | Essential Addons for Elementor WooCommerce product comparison table vulnerability | 5.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-13344 | Essential Addons for Elementor - Lite WordPress plugin stored XSS | 4.8CISA ADP v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-13330 | Animation Addons for Elementor WordPress plugin Author+ stored XSS via SVG upload | 6.1CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-13178 | Eventin WordPress plugin unauthenticated Payment bypass via order Status manipulation | 7.5CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-13145 | WP Travel WordPress plugin Subscriber+ Booking PII disclosure via IDOR | 4.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-13143 | WP Travel WordPress plugin unauthenticated Payment bypass via Forged PayPal IPN | 5.3CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-13117 | OpenVPN use-after-free | 6.0CNA v4.0 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-12996 | OpenVPN A use-after-free | 6.0CNA v4.0 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-12947 | IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes | 7.5CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-12946 | IBM Langflow OSS remote code execution in CUGA Component CodeAgent | 9.9CNA v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-12945 | IBM Langflow OSS API endpoints improper access control | 7.1CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-12943 | This Power Hardware Management Console update is being released to address | 9.8CNA v3.1 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-12942 | IBM Langflow OSS API endpoints path traversal | 7.5CNA v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-12940 | IBM Langflow OSS MCP stdio launcher command injection | 9.8CNA v3.1 | 0.9% | 2026-07-30 | Exploit codeFix |
| CVE-2026-12932 | OpenVPN tls-crypt-v2 client key extraction memory leak | 7.1CNA v4.0 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-12733 | IBM DataPower Gateway affected by denial of service | 7.5CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-12722 | Authentication bypass in FTC Software's E-Commerce Management Panel | 8.2CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-12687 | ProfileGrid WordPress plugin unauthenticated privilege escalation via Unrestricted Group ID | 7.5CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-12562 | Toptech Systems RCU II+ and Multiload II+ missing authentication for critical function | 8.7CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-12500 | WP Travel Engine WordPress plugin unauthenticated Trip Difficulty Level option update | 7.5CISA ADP v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-12118 | IBM webMethods Integration insecure deserialization | 9.8CNA v3.1 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-11980 | Code execution in IBM Desktop App | 7.3CNA v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-11904 | IBM Verify Identity Access information disclosure | 5.3CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-11897 | IBM WebSphere Application Server Liberty HTTP/2 request handling denial of service | 7.5CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-11885 | Power System update in Buffer Copy | 8.4CNA v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-11881 | Fluent Forms WordPress plugin Contributor+ stored XSS via Date/Time field | 6.1CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-11870 | Hide My WP Ghost WordPress plugin IP Address spoofing | 5.4CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-11867 | DynamiApps Frontend Admin taxonomy term management missing authorization | 6.5CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-11782 | Points and Rewards for WooCommerce wallet and points update action improper access control | 5.9CISA ADP v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-11771 | OpenVPN stack-based buffer overflow | 7.0CNA v4.0 | 0.7% | 2026-07-30 | Fix |
| CVE-2026-11707 | IBM Tivoli System Automation Application Manager cross-site scripting | 9.3CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-11536 | IBM WebSphere Application Server is affected by a remote code execution | 8.5CNA v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-11383 | IBM WebSphere Application Server administrative console cross-site scripting | 5.4CNA v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-10842 | IBM WebSphere Application Server Liberty authentication bypass | 7.5CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-10700 | IBM Langflow file handling API insecure direct object reference | 6.5CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-10695 | IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries | 6.2CNA v3.1 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-10569 | IBM DevOps Deploy / IBM UrbanCode Deploy is susceptible to an exposure of sensitive information | 4.3CNA v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-10545 | IBM Planning Analytics Local is affected by open redirect | 7.5CNA v3.1 | 0.4% | 2026-07-30 | Fix |
| CVE-2026-10535 | IBM Db2 db2flacc setgid helper buffer overflow | 8.4CNA v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-10031 | SFTPGo permission bypass via Symbolic Link Creation | 5.3CNA v4.0 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-9322 | IBM WebSphere Application Server denial of service | 7.5CNA v3.1 | 0.6% | 2026-07-30 | Fix |
| CVE-2026-7849 | Phoenix Contact CHARX SEC-3150 command injection in SCM (idledisconnect parameter) | 9.3CNA v4.0 | 0.8% | 2026-07-30 | Fix |
| CVE-2026-7260 | PHP stack overflow in phar with circular symlinks | 5.4CNA v4.0 | 0.1% | 2026-07-30 | Fix |
| CVE-2026-6540 | Tigera Calico L7 policy bypass via unnormalized HTTP path matching | 7.9CNA v4.0 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-5846 | Hard-coded cryptographic key in Watchfire Controllers | 7.6CNA v4.0 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-5582 | FuseWP WordPress plugin cross-site request forgery to Sync Rule Status Toggle | 4.3CNA v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-5219 | CSRF in Softtr's E-Commerce Pack | 8.3CNA v3.1 | 0.2% | 2026-07-30 | Fix |
| CVE-2026-4978 | SQLi in UMAI Vision's Traffic Analysis System | 9.8CNA v3.1 | 0.5% | 2026-07-30 | Fix |
| CVE-2026-1982 | Persian Elementor WordPress plugin unauthenticated Price manipulation via ZarinPal widget | 5.3CNA v3.1 | 0.3% | 2026-07-30 | Fix |
| CVE-2026-1360 | BuddyPress WordPress plugin authenticated (Subscriber+) PHP object injection via XProfile field data | 7.5CNA v3.1 | 1.2% | 2026-07-30 | |
| CVE-2026-67595 | VaahCMS Malicious JavaScript Supply Chain via security-otp.blade.php | 9.2CNA v4.0 | 0.8% | 2026-07-29 | Reported exploited |
| CVE-2026-67439 | OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output | 4.3CNA v3.1 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-67438 | OliveTin OS command injection via Custom regex: Argument Type Bypassing Shell Safety Check | 6.6CNA v3.1 | 1.6% | 2026-07-29 | Fix |
| CVE-2026-67437 | OliveTin: Unauthenticated DoS via OAuth2 State memory exhaustion (Unbounded Map Growth) | 7.5CNA v3.1 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-67436 | Linuxfabrik monitoring-plugins: SSRF and auth-token disclosure | 8.3CNA v4.0 | 0.4% | 2026-07-29 | |
| CVE-2026-67435 | Linuxfabrik monitoring-plugins url fetch function information disclosure | 6.0CNA v4.0 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-67433 | Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration | 5.8CNA v4.0 | 0.1% | 2026-07-29 | |
| CVE-2026-67432 | Model Context Protocol Ruby SDK StreamableHTTPTransport denial of service | 7.5CNA v3.1 | 0.8% | 2026-07-29 | Fix |
| CVE-2026-67431 | modelcontextprotocol ruby-sdk MCP Ruby SDK: Ruby SSE Session Poisoning | 8.3CNA v4.0 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-67430 | Model Context Protocol Ruby SDK StreamableHTTPTransport memory leak | 5.3CNA v3.1 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-67429 | flytohub flyto-core flyto2 Core: Arbitrary file write | 10.0CNA v3.1 | 0.8% | 2026-07-29 | Fix |
| CVE-2026-67428 | FlytoHub Flyto2 Core HTTP-emitting modules server-side request forgery | 8.5CNA v3.1 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-67427 | FlytoHub Flyto2 Core variable resolver information disclosure | 8.6CNA v3.1 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-67426 | FlytoHub Flyto2 Core verification service server-side request forgery | 9.3CNA v3.1 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-67425 | flytohub flyto-core flyto2 Core: LLM/API keys leak to an attacker-controlled base_url | 8.6CNA v3.1 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-67424 | FlytoHub Flyto2 Core HTTP modules server-side request forgery | 8.5CNA v3.1 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-67217 | cJSON JSON Patch Non-Atomic Application Destroys Data before Validation | 6.9CNA v4.0 | 0.4% | 2026-07-29 | |
| CVE-2026-67216 | cJSON cJSON_Compare Exponential Complexity denial of service | 7.5v3.1 | 0.6% | 2026-07-29 | |
| CVE-2026-67215 | cJSON JSON Patch copy/add uncontrolled recursion stack exhaustion | 8.7CNA v4.0 | 0.7% | 2026-07-29 | |
| CVE-2026-67214 | nanoid infinite loop via Negative Size in non-secure module | 7.5NVD v3.1 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-67213 | nanoid infinite loop via Zero Size in customAlphabet and customRandom | 7.5NVD v3.1 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-67201 | vlang v SSRF Bypass via Parser Differential in net.urllib and net.http | 7.7CNA v4.0 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-67194 | Courier IMAP Mail Server stack overflow DoS via Nested SEARCH Queries | 7.1CNA v4.0 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-67193 | Xlight FTP Server information disclosure via user command | 6.9CNA v4.0 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-67192 | Xlight FTP Server Pre-Auth stack buffer overflow via SSH GCM Cipher | 9.2CNA v4.0 | 1.0% | 2026-07-29 | Fix |
| CVE-2026-67191 | Xlight FTP Server Pre-Auth heap buffer overflow via SSH parser | 9.3CNA v4.0 | 1.0% | 2026-07-29 | Fix |
| CVE-2026-66724 | Permission bypass via Undocumented HTTP Methods in MWDB Core | 5.3CNA v4.0 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-66723 | Missing authentication requirement in Remote Instances proxy API in MWDB Core | 7.0CNA v4.0 | 0.8% | 2026-07-29 | Fix |
| CVE-2026-66490 | Joomla Extension Balbooa.com stored cross-site scripting via a comment avatar in Gridbox | 6.1CISA ADP v3.1 | 0.3% | 2026-07-29 | |
| CVE-2026-66489 | Joomla Extension Balbooa.com Various unauthenticated file system disclosure in Gridbox | 5.3CISA ADP v3.1 | 0.3% | 2026-07-29 | |
| CVE-2026-66488 | Joomla Extension Balbooa.com Payment bypass in Gridbox | 5.3CISA ADP v3.1 | 0.3% | 2026-07-29 | |
| CVE-2026-66400 | Grav Login plugin insufficient session expiration | 6.3CNA v4.0 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-65975 | pydantic-ai UI adapters incorrect authorization | 6.5CNA v3.1 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-65947 | Joomla Extension Balbooa.com Various CSRF vectors in the admin interface in Gridbox | 7.3CISA ADP v3.1 | 0.2% | 2026-07-29 | |
| CVE-2026-65946 | Joomla Extension Rolandd.com XSS vectors in AJAX endpoint handlers Ro Csvi | 6.1CISA ADP v3.1 | 0.3% | 2026-07-29 | |
| CVE-2026-65944 | Joomla Extension Rolandd.com CSRF vectors in AJAX endpoint handlers Ro Csvi | 8.8CISA ADP v3.1 | 0.2% | 2026-07-29 | |
| CVE-2026-65943 | Joomla Extension Rolandd.com Unauthenticated directory creation Ro Csvi | 7.5CISA ADP v3.1 | 0.4% | 2026-07-29 | |
| CVE-2026-65891 | joomlacontenteditor.net Joomla Content Editor file rename function improper input validation | 6.5CISA ADP v3.1 | 0.3% | 2026-07-29 | Exploit code |
| CVE-2026-65890 | Joomla Extension Balbooa.com unauthenticated SQL injection in Gridbox | 9.8NVD v3.1 | 0.5% | 2026-07-29 | |
| CVE-2026-65889 | Joomla Extension Balbooa.com Unauthenticated recursive directory deletion in Gridbox | 7.5NVD v3.1 | 0.4% | 2026-07-29 | |
| CVE-2026-65888 | Joomla Extension Balbooa.com account takeover vulnerability in Gridbox | 9.8NVD v3.1 | 0.5% | 2026-07-29 | |
| CVE-2026-65887 | Joomla Extension Balbooa.com Unauthenticated arbitrary password reset in Gridbox | 9.8NVD v3.1 | 0.5% | 2026-07-29 | |
| CVE-2026-65886 | Joomla Extension Balbooa.com unauthenticated arbitrary file read in Gridbox | 7.5NVD v3.1 | 0.6% | 2026-07-29 | |
| CVE-2026-65885 | Joomla Extension Balbooa.com authenticated arbitrary file upload in Gridbox | 8.8NVD v3.1 | 0.5% | 2026-07-29 | Reported exploitedKCV |
| CVE-2026-65884 | Joomla Extension Balbooa.com privilege escalation in Gridbox | 9.8NVD v3.1 | 0.5% | 2026-07-29 | Reported exploitedKCV |
| CVE-2026-65883 | Joomla Extension Aimy-extensions.com RCE via PHP object injection in Aimy Captcha-less Form Guard | 9.8NVD v3.1 | 0.8% | 2026-07-29 | Exploit code |
| CVE-2026-65325 | Apache Traffic Server HTTP/2 origin connection reuse improper certificate validation | 6.3CNA v4.0 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-65324 | Apache Traffic Server HTTP/2 and HTTP/3 dechunking memory exhaustion | 8.2CNA v4.0 | 0.7% | 2026-07-29 | Fix |
| CVE-2026-65100 | Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode | 6.3CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-64685 | ImageMagick: Heap buffer over-read in BGR decoder due to mising end-of-file check | 5.3CNA v3.1 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-64560 | Linux kernel POSIX CPU timers use-after-free | 7.8CNA v3.1 | 0.5% | 2026-07-29 | Exploit codeFix |
| CVE-2026-64559 | Linux kernel s390 pkey VERIFYPROTK ioctl vulnerability | 7.8CNA v3.1 | 0.1% | 2026-07-29 | Fix |
| CVE-2026-64558 | Linux kernel s390 pkey PCKMO handler vulnerability | 7.8CNA v3.1 | 0.1% | 2026-07-29 | Fix |
| CVE-2026-64557 | Linux kernel Bluetooth L2CAP socket layer use-after-free | 8.8CNA v3.1 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-64556 | Linux kernel perf event group management vulnerability | 7.8CNA v3.1 | 0.1% | 2026-07-29 | Fix |
| CVE-2026-63242 | Three Learning Koollab LMS business logic vulnerability | 4.3CNA v3.1 | 0.3% | 2026-07-29 | |
| CVE-2026-63241 | Three Learning Koollab LMS insecure direct object reference | 3.1CNA v3.1 | 0.2% | 2026-07-29 | |
| CVE-2026-63240 | Three Learning Koollab LMS information disclosure | 4.3CNA v3.1 | 0.3% | 2026-07-29 | |
| CVE-2026-63239 | Three Learning Koollab LMS hard-coded AWS IAM credentials vulnerability | 5.4CNA v3.1 | 0.2% | 2026-07-29 | |
| CVE-2026-63238 | Three Learning Koollab LMS authentication bypass | 6.5CNA v3.1 | 0.3% | 2026-07-29 | |
| CVE-2026-63237 | Three Learning Koollab LMS TOTP two-factor authentication bypass | 4.8CNA v3.1 | 0.2% | 2026-07-29 | |
| CVE-2026-63236 | Three Learning Koollab LMS improper access control | 3.7CNA v3.1 | 0.3% | 2026-07-29 | |
| CVE-2026-63235 | Three Learning Koollab LMS improper access control | 3.7CNA v3.1 | 0.3% | 2026-07-29 | |
| CVE-2026-63234 | Three Learning Koollab LMS SQL injection and unsafe deserialisation | 9.9CNA v3.1 | 0.5% | 2026-07-29 | |
| CVE-2026-63233 | Three Learning Koollab LMS SQL injection and unsafe deserialisation | 9.9CNA v3.1 | 0.5% | 2026-07-29 | |
| CVE-2026-63232 | Three Learning Koollab LMS SQL injection and unsafe deserialisation | 9.9CNA v3.1 | 0.5% | 2026-07-29 | |
| CVE-2026-63231 | Three Learning Koollab LMS post-authentication SQL injection | 8.1CNA v3.1 | 0.4% | 2026-07-29 | |
| CVE-2026-63230 | Three Learning Koollab LMS pre-authentication error-based SQL injection | 9.1CNA v3.1 | 0.5% | 2026-07-29 | |
| CVE-2026-63229 | Three Learning Koollab LMS pre-authentication blind SQL injection | 9.1CNA v3.1 | 0.5% | 2026-07-29 | |
| CVE-2026-63228 | Three Learning Koollab LMS unrestricted image upload vulnerability | 2.6CNA v3.1 | 0.2% | 2026-07-29 | |
| CVE-2026-63227 | Unrestricted SCORM file upload | 9.9CNA v3.1 | 0.6% | 2026-07-29 | |
| CVE-2026-63119 | Model Context Protocol Ruby SDK stdio transport resource exhaustion | 6.2CNA v3.1 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-63118 | modelcontextprotocol ruby-sdk MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding protection | 6.9CNA v4.0 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-62995 | joserfc accepts JWT with padding, leading to JWT malleability | 2.3CNA v4.0 | 0.1% | 2026-07-29 | Fix |
| CVE-2026-62343 | ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided | 4.7CNA v3.1 | 0.1% | 2026-07-29 | Fix |
| CVE-2026-60113 | AIT-DSN missing authentication via SLE API Routes | 9.3CNA v4.0 | 0.8% | 2026-07-29 | Fix |
| CVE-2026-60112 | AIT-GUI missing authentication via Sessions.create | 9.3CNA v4.0 | 0.8% | 2026-07-29 | Fix |
| CVE-2026-59920 | Netty: STOMP CONNECT Frame header injection | 6.5CNA v3.1 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-59919 | Netty: HAProxy V1 Protocol CRLF injection via AF_UNIX Address | 5.5CNA v3.1 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-59901 | Netty Bzip2Decoder: Infinite loop in RLE State Machine leads to Event-Loop Thread Hang | 8.7CNA v4.0 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-59900 | Netty HTTP/2 to HTTP/1.x translation vulnerability | 6.9CNA v4.0 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-59899 | Netty HttpContentEncoder resource exhaustion | 6.9CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-59898 | Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation | 6.3CNA v4.0 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-59247 | Insufficient verification of Hex package metadata in Gleam | 7.6CNA v4.0 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-59243 | Apache Airflow FAB provider Azure AD OAuth login improper signature verification | 9.8CISA ADP v3.1 | 0.6% | 2026-07-29 | Exploit codeFix |
| CVE-2026-58189 | Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification | 8.2CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-58188 | Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins | 8.4CNA v4.0 | 0.8% | 2026-07-29 | Fix |
| CVE-2026-58187 | Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service | 6.3CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-58186 | Apache Traffic Server: Webp_transform plugin decodes unsafely and mislabels degraded responses | 8.2CNA v4.0 | 0.7% | 2026-07-29 | Fix |
| CVE-2026-58185 | Apache Traffic Server: Use-after-free in the intercept plugin | 8.2CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-58184 | Apache Traffic Server: Header_rewrite plugin cookie handling can corrupt memory | 8.3CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-58183 | Apache Traffic Server: Prefetch plugin can crash on attacker-influenced input | 8.2CNA v4.0 | 0.7% | 2026-07-29 | Fix |
| CVE-2026-58182 | Apache Traffic Server: Ts_lua plugin has initialization and resource-handling errors | 8.2CNA v4.0 | 0.7% | 2026-07-29 | Fix |
| CVE-2026-58181 | Apache Traffic Server: Uri_signing and url_sig plugins can exhaust the stack or crash | 8.2CNA v4.0 | 0.7% | 2026-07-29 | Fix |
| CVE-2026-58180 | Apache Traffic Server: Txn_box plugin overflows the stack from attacker input | 8.2CNA v4.0 | 0.7% | 2026-07-29 | Fix |
| CVE-2026-58179 | Apache Traffic Server: Regex_remap plugin overflows the stack from attacker input | 9.2CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-58178 | Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery | 8.2CNA v4.0 | 0.7% | 2026-07-29 | Fix |
| CVE-2026-58177 | Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework | 8.3CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-58175 | Apache Traffic Server: HostDB SRV handling leaks memory | 8.2CNA v4.0 | 0.7% | 2026-07-29 | Fix |
| CVE-2026-58164 | Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free | 8.3CNA v4.0 | 0.7% | 2026-07-29 | Fix |
| CVE-2026-58163 | Apache Traffic Server on-disk cache deserialization of untrusted data | 8.3CNA v4.0 | 0.7% | 2026-07-29 | Fix |
| CVE-2026-58162 | Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates | 8.4CNA v4.0 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-58161 | Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server | 9.2CNA v4.0 | 0.7% | 2026-07-29 | Fix |
| CVE-2026-58160 | Apache Traffic Server: Out-of-bounds reads while parsing DNS responses | 6.3CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-58159 | Apache Traffic Server: Listener and ACL handling allow access-control bypass | 7.0CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-58158 | Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow | 8.2CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-58157 | Apache Traffic Server: Improper server-session reuse can expose data across client connections | 6.9CNA v4.0 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-58156 | Apache Traffic Server: URL and port parsing errors allow access-control bypass | 6.3CNA v4.0 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-58155 | Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling | 9.2CNA v4.0 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-58154 | Apache Traffic Server: Memory-safety errors in MIME and header parsing | 9.2CNA v4.0 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-58153 | Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely | 6.3CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-58152 | Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory | 6.9CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-58151 | Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server | 8.7CNA v4.0 | 0.7% | 2026-07-29 | Fix |
| CVE-2026-58150 | Apache Traffic Server HTTP request smuggling | 7.8CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-57834 | Apache Traffic Server: Malformed chunked message body allows request smuggling | 7.0CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-56390 | Arbitrary Output Location Change in GNU Bison | 6.3v3.1 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-56389 | Arbitrary command execution in GNU Bison | 8.6v3.1 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-55995 | Double free in the iSNS attribute decoder in open-iscsi | 8.7CNA v4.0 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-54735 | Prebid-server's request forgery vulnerability allows for possible host environment data extraction | 10.0CNA v3.1 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-54727 | proot-distro has a Container Isolation Bypass via Crafted Restore Archive | 8.2CNA v3.1 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-54705 | Mathlive's Lack of Escaping of HTML allows for XSS | 6.3CNA v3.1 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-54693 | ZITADEL Users can Self-Verify Email/Phone via API | 8.2CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-54680 | kube-logging logging-operator command injection | 9.9CNA v3.1 | 0.8% | 2026-07-29 | Fix |
| CVE-2026-54666 | swagger-typescript-api vulnerable to code injection | 8.3CNA v3.1 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-54664 | swagger-typescript-api vulnerable to code injection via unescaped enum string values | 8.3CNA v3.1 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-54663 | swagger-typescript-api vulnerable to server-side request forgery via spec `$ref` | 6.1CNA v3.1 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-54662 | swagger-typescript-api vulnerable to code injection | 8.3CNA v3.1 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-54661 | swagger-typescript-api vulnerable to code injection | 8.3CNA v3.1 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-54660 | swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref` | 7.4CNA v3.1 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-54574 | `proot-distro install` has a Symlink Escape (arbitrary host File Write) via Malicious Tar Archive | 8.2CNA v3.1 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-54249 | Pydantic AI Vercel AI adapter file uploads server-side request forgery | 6.8CNA v3.1 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-54082 | veraPDF-validation PDFAValidator XML external entity injection | 6.5CNA v3.1 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-54081 | veraPDF Parser DoS via PostScript Type 1 Font Programs | 6.9CNA v4.0 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-54080 | veraPDF Parser DoS via PostScript CMap Streams | 6.9CNA v4.0 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-54079 | veraPDF validation XXE via XFA | 8.7CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-54078 | veraPDF validation XXE via Rich Text | 8.7CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-52791 | fuse-overlayfs release- preserves SUID/SGID bits after truncate/open(O_TRUNC) | 2.0CNA v4.0 | 0.1% | 2026-07-29 | Fix |
| CVE-2026-50782 | Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack. | 7.5CISA ADP v3.1 | 0.6% | 2026-07-29 | |
| CVE-2026-50642 | so-fancy diff-so-fancy Terminal Escape injection in diff‑so‑fancy | 4.8CNA v4.0 | 0.2% | 2026-07-29 | |
| CVE-2026-50641 | Plaintext password storage in Streamsoft Business Intelligence | 7.1CNA v4.0 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-50622 | Apache Atlas: Missing authorization on Admin endpoints | 8.8CISA ADP v3.1 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-50558 | Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive | 5.9CNA v3.1 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-46678 | Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of) | 6.8CNA v3.1 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-44944 | Iscsiuio control-socket authentication bypass in open-iscsi | 8.5CNA v4.0 | 0.1% | 2026-07-29 | Fix |
| CVE-2026-44943 | Remote limited file-write as root via discovery in open-iscsi | 6.9CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-41939 | Care Everywhere Gateway hard-coded credentials RCE via WildFly | 9.3CNA v4.0 | 1.1% | 2026-07-29 | |
| CVE-2026-41920 | Apache Traffic Server: SNI to host header matching policy is not properly enforced | 7.0CNA v4.0 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-40272 | Vulnerability in the QNX libtraceparser Impacts QNX Software Development Platform | 7.0CNA v3.1 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-35226 | Out-of-bounds write in CODESYS PROFINET controller | 7.1CNA v4.0 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-33930 | Apache Traffic Server: Buffer overflow via host field that has a long string value | 8.2CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-33385 | OpenSolution QuickCMS blind SQL injection in Quick.CMS | 5.1CNA v4.0 | 0.4% | 2026-07-29 | |
| CVE-2026-33267 | Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata | 7.7CNA v4.0 | 0.6% | 2026-07-29 | Exploit codeFix |
| CVE-2026-24033 | Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing | 6.9CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-23904 | Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy | 7.3CISA ADP v3.1 | 0.9% | 2026-07-29 | Fix |
| CVE-2026-22068 | Apache Traffic Server: Regex mappings match with malicious domain names | 6.9CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-20316 | Cisco Secure Firewall Management Center use of hard-coded password | 5.3CNA v3.1 | 35.1% | 2026-07-29 | KEVKCVFix |
| CVE-2026-18266 | Dify AI Workflow oauth_redirect_url open redirect | 5.4CNA v3.0 | 0.3% | 2026-07-29 | |
| CVE-2026-18257 | Improper certificate validation in S2OPC | 5.6CNA v3.1 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-18255 | Quay: Quay: Global read-only superuser can view robot account tokens | 7.2CNA v3.1 | 0.8% | 2026-07-29 | Fix |
| CVE-2026-18236 | Google-ADK incorrect authorization | 9.3CNA v4.0 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-18220 | binutils BFD DLX ELF backend out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2026-07-29 | Exploit codeFix |
| CVE-2026-18207 | Red Hat Keycloak client policy group matching improper authorization | 6.5CNA v3.1 | 0.3% | 2026-07-29 | |
| CVE-2026-18201 | Red Hat Keycloak identity provider organization linking missing authorization | 5.5CNA v3.1 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-18197 | Link Library cross-site scripting | 6.1NVD v3.1 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-18192 | Vacron|IP Camera arbitrary file read | 7.1CNA v4.0 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-18191 | Vacron|IP Camera hidden functionality | 9.3CNA v4.0 | 0.7% | 2026-07-29 | Fix |
| CVE-2026-18174 | @fastify/forwarded vulnerable to improper input validation | 5.3CNA v3.1 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-18072 | Advanced Responsive Video Embedder for Rumble WordPress plugin authentication bypass | 9.8CNA v3.1 | 3.0% | 2026-07-29 | NucleiFix |
| CVE-2026-18022 | pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems | 8.8CNA v3.1 | 0.6% | 2026-07-29 | Fix |
| CVE-2026-17550 | DWG or DXF File Parsing out-of-bounds read in Autodesk AutoCAD | 5.5CNA v3.1 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-17166 | Event Booking Manager for WooCommerce WordPress plugin authorization bypass | 4.3CNA v3.1 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-17162 | WowStore WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-17161 | WowStore WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-16751 | Ente Museum Server authorization bypass | 6.5CISA ADP v3.1 | 0.4% | 2026-07-29 | |
| CVE-2026-16729 | undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields | 4.8CNA v3.1 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-16728 | undici vulnerable to downstream response desynchronization via retry interceptor | 4.8CNA v3.1 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-16655 | Fluent Forms WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.5% | 2026-07-29 | Fix |
| CVE-2026-16597 | GTM4WP WordPress plugin unauthenticated stored cross-site scripting via WooCommerce Billing fields | 7.2CNA v3.1 | 0.4% | 2026-07-29 | Fix |
| CVE-2026-16553 | Insufficiently protected credentials in GitLab | 5.4CNA v3.1 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-16543 | Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision | 7.1CNA v4.0 | 0.2% | 2026-07-29 | Fix |
| CVE-2026-16465 | DWG or DXF File Parsing out-of-bounds read in Autodesk AutoCAD | 6.1CNA v3.1 | 0.3% | 2026-07-29 | Fix |
| CVE-2026-16463 | DXF File Parsing heap-based overflow in Autodesk AutoCAD | 7.8CNA v3.1 | 0.3% | 2026-07-29 | Fix |