CVE-2026 list

CVE-2026 records published in July 2026

Page 10 of 10: records 9,001 to 9,534 of the 9,534 published in July 2026, newest first. The first page carries the figures for July 2026.

CVE-2026 records published in July 2026, newest first: records 9,001 to 9,534 of 9,534
CVE Summary CVSS EPSS Published Signals
CVE-2026-57350WP Debugging WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57349WPeMatico RSS Feed Fetcher WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57348Paid Member Subscriptions WordPress plugin server side request forgery (SSRF)7.2CNA v3.10.3%2026-07-02Fix
CVE-2026-57347Hotel Booking Lite WordPress plugin sensitive data exposure6.5CNA v3.10.4%2026-07-02Fix
CVE-2026-57345Internal Links Manager WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57344Classified Listing WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57343Real Estate 7 WordPress theme cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57342ShortPixel Adaptive Images WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-07-02Fix
CVE-2026-57278GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57277GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57276GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57275GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57274GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57273GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57272GeoVision GeoWebPlayer Websocket Server out-of-bounds read8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57271GeoVision GeoWebPlayer Websocket Server out-of-bounds read8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57270GeoVision GeoWebPlayer Websocket Server out-of-bounds read8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57269GeoVision GeoWebPlayer Websocket Server out-of-bounds read8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57268GeoVision GeoWebPlayer Websocket Server out-of-bounds read8.3CNA v3.10.5%2026-07-02Fix
CVE-2026-57267GeoVision GeoWebPlayer Websocket Server out-of-bounds read8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57266GeoVision GeoWebPlayer Websocket Server out-of-bounds read8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57265GeoVision GeoWebPlayer Websocket Server out-of-bounds read8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57264GeoVision GeoWebPlayer Websocket Server out-of-bounds read8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57100Microsoft Entra Provisioning Service elevation of privilege9.9CNA v3.10.8%2026-07-02Fix
CVE-2026-56842Ubiquiti UniFi Network Application incorrect authorization7.5CNA v3.10.4%2026-07-02Fix
CVE-2026-56841Ubiquiti UniFi Protect Application SQL injection8.8CNA v3.10.5%2026-07-02Fix
CVE-2026-56037Themify Popup WordPress plugin PHP object injection8.8CNA v3.10.5%2026-07-02Fix
CVE-2026-56004openSUSE Build service obs-service-tar_scm: Command injection via mercurial handler10.0CNA v3.10.7%2026-07-02Fix
CVE-2026-55952Erlang OTP TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension8.2CNA v4.00.5%2026-07-02Fix
CVE-2026-55950Erlang OTP DTLS listener crash8.7CNA v4.00.4%2026-07-02Fix
CVE-2026-55794Craft CMS: Potential authenticated remote code execution via referrer redirect8.7CNA v4.00.4%2026-07-02Exploit codeFix
CVE-2026-55792Craft CMS: Sensitive File Disclosure / Server-Side File Read6.0CNA v4.00.4%2026-07-02Fix
CVE-2026-55791Craft CMS: Blind SSRF and arbitrary JavaScript injection6.9CNA v4.00.5%2026-07-02Fix
CVE-2026-55119Ubiquiti UniFi Talk Application improper access control8.1CNA v3.10.4%2026-07-02Fix
CVE-2026-55118Ubiquiti UniFi Network Application improper access control8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-55117Ubiquiti UniFi Access Application path traversal8.6CNA v3.10.6%2026-07-02Fix
CVE-2026-55116Ubiquiti Dream Machines improper access control9.8v3.10.4%2026-07-02Fix
CVE-2026-55115Ubiquiti UniFi Protect Application server-side request forgery9.9v3.10.5%2026-07-02Fix
CVE-2026-55114Ubiquiti UniFi Network Application improper access control8.8CNA v3.10.5%2026-07-02Fix
CVE-2026-55113Ubiquiti UniFi Talk Application server-side request forgery7.5CNA v3.10.4%2026-07-02Fix
CVE-2026-55112Ubiquiti Dream Machines improper access control8.8v3.10.4%2026-07-02Fix
CVE-2026-55111Ubiquiti UniFi Protect Floodlight path traversal7.5CNA v3.10.5%2026-07-02Fix
CVE-2026-55110Ubiquiti UniFi OS Server permissive cross-domain policy6.1NVD v3.10.3%2026-07-02Fix
CVE-2026-54998Microsoft Exchange Online elevation of privilege8.8CNA v3.10.8%2026-07-02Fix
CVE-2026-54891Erlang/OTP TLS client handshake vulnerability6.3CNA v4.00.1%2026-07-02Fix
CVE-2026-54887Erlang OTP DTLS server cookie bypass during startup window due to empty initial cookie secret6.3CNA v4.00.2%2026-07-02Fix
CVE-2026-54886SSH SFTP server denial of service via extended channel data infinite loop5.3CNA v4.00.3%2026-07-02Fix
CVE-2026-54431Improper Data Validation in liboauth25.1CNA v4.00.2%2026-07-02Fix
CVE-2026-54430Server-Site Request Forgery in liboauth25.1CNA v4.00.2%2026-07-02Fix
CVE-2026-54409Ubiquiti UniFi Protect Application improper initialization8.1v3.10.4%2026-07-02Fix
CVE-2026-54408Ubiquiti UniFi Protect Application improper access control9.8v3.10.6%2026-07-02Fix
CVE-2026-54407Ubiquiti UniFi Protect Application improper access control8.6CNA v3.10.5%2026-07-02Fix
CVE-2026-54406Ubiquiti UniFi Network Application path traversal8.7CNA v3.10.6%2026-07-02Fix
CVE-2026-54405Ubiquiti UniFi Network Application improper input validation7.5CNA v3.10.5%2026-07-02Fix
CVE-2026-54404Ubiquiti UniFi OS Server SQL injection8.8CNA v3.10.5%2026-07-02Fix
CVE-2026-54403Ubiquiti UniFi OS Server path traversal8.6CNA v3.10.8%2026-07-02Fix
CVE-2026-54402Ubiquiti UniFi OS Server improper input validation8.8NVD v3.11.8%2026-07-02Fix
CVE-2026-54401Ubiquiti UniFi OS Server server-side request forgery8.8v3.10.4%2026-07-02Fix
CVE-2026-54400Ubiquiti UniFi Access Application improper access control9.1CNA v3.10.5%2026-07-02Fix
CVE-2026-53422Erlang OTP response discrepancy2.3CNA v4.00.3%2026-07-02Fix
CVE-2026-53358Linux kernel L2CAP channel close path vulnerability8.8CNA v3.10.2%2026-07-02Fix
CVE-2026-53357Linux kernel L2CAP socket listen cleanup use-after-free8.0CNA v3.10.3%2026-07-02Fix
CVE-2026-52830fast-mcp-telegram bearer token session validation path traversal9.4CNA v3.10.6%2026-07-02Fix
CVE-2026-52192UTT nv518G gohead service denial of service7.5CISA ADP v3.10.6%2026-07-02
CVE-2026-52191UTT nv518G nv518GV3v3.2.7-210919-161313 buffer overflow7.5CISA ADP v3.10.6%2026-07-02
CVE-2026-52189UTT nv518G nv518GV3v3.2.7-210919-161313 buffer overflow7.5CISA ADP v3.10.6%2026-07-02
CVE-2026-52188UTT nv518G nv518GV3v3.2.7-210919-161313 buffer overflow6.5CISA ADP v3.10.4%2026-07-02
CVE-2026-52187UTT nv518G nv518GV3v3.2.7-210919-161313 buffer overflow7.5CISA ADP v3.10.6%2026-07-02
CVE-2026-50748Ubiquiti UniFi Access Application improper input validation9.9CNA v3.11.6%2026-07-02Fix
CVE-2026-50747Ubiquiti UniFi Talk Application SQL injection9.9CNA v3.10.5%2026-07-02Fix
CVE-2026-50746Ubiquiti UniFi Connect Application improper access control10.0CNA v3.11.7%2026-07-02Fix
CVE-2026-50722The Libreswan Project libreswan IKEv2 denial of service7.5CNA v3.10.3%2026-07-02Fix
CVE-2026-50721The Libreswan Project libreswan IKEv1 denial of service7.5CNA v3.10.4%2026-07-02Fix
CVE-2026-50282Craft CMS: Unauthorized Deletion of Destination Folders during Forced Moves4.9CNA v4.00.4%2026-07-02Fix
CVE-2026-50281Craft CMS: Mass assignment7.1CNA v4.00.4%2026-07-02Fix
CVE-2026-50280Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check6.0CNA v4.00.4%2026-07-02Fix
CVE-2026-50279Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap7.6CNA v4.00.4%2026-07-02Fix
CVE-2026-49779Tax Exempt for WooCommerce WordPress plugin path traversal6.5CNA v3.10.4%2026-07-02Fix
CVE-2026-45499Microsoft Azure OpenAI elevation of privilege9.9CNA v3.10.8%2026-07-02Fix
CVE-2026-44941libzypp path traversal via keyhint in repomd.xml8.4CNA v3.10.5%2026-07-02Fix
CVE-2026-44935Rancher Fleet vulnerable to cross namespace secret disclosure9.9CNA v3.10.5%2026-07-02Fix
CVE-2026-42382Audrey WordPress theme local file inclusion8.1CNA v3.10.5%2026-07-02
CVE-2026-41106Microsoft 365 Copilot elevation of privilege9.3CNA v3.10.7%2026-07-02Fix
CVE-2026-39448NOWPayments for WooCommerce WordPress plugin broken access control7.5CNA v3.10.3%2026-07-02Fix
CVE-2026-38972Rizone Soft Notepad3 uncontrolled search path7.8CISA ADP v3.10.2%2026-07-02
CVE-2026-38971ArduPilot Arduplane out-of-bounds read9.1CISA ADP v3.10.7%2026-07-02
CVE-2026-38970pdfcpu PDF object parser uncontrolled recursion7.5CISA ADP v3.10.6%2026-07-02
CVE-2026-38968ntopng insufficient randomness9.8CISA ADP v3.10.6%2026-07-02Fix
CVE-2026-33592FindServers memory exhaustion in open625417.5CNA v3.10.5%2026-07-02
CVE-2026-27436Five Star Business Profile and Schema WordPress plugin arbitrary code execution9.1CNA v3.10.7%2026-07-02Fix
CVE-2026-27433Motors WordPress theme broken access control6.5CNA v3.10.3%2026-07-02Fix
CVE-2026-27430TheFox WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02
CVE-2026-27426Automotive Car Dealership Business WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02
CVE-2026-27425Automotive Listings WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02
CVE-2026-27419Zegen WordPress theme arbitrary file upload9.9CNA v3.10.5%2026-07-02
CVE-2026-27414Werkstatt WordPress theme PHP object injection8.8CNA v3.10.5%2026-07-02
CVE-2026-27412Pearl - Corporate Business WordPress theme local file inclusion8.1CNA v3.10.5%2026-07-02
CVE-2026-27408NativeChurch WordPress theme cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-27404LMS WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02
CVE-2026-27402Kids Life Children School WordPress theme cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02
CVE-2026-27060ARMember Premium WordPress plugin PHP object injection8.8CNA v3.10.5%2026-07-02Fix
CVE-2026-26145Microsoft Azure Synapse elevation of privilege4.8CNA v3.10.7%2026-07-02Fix
CVE-2026-14449u5CMS POST-based reflected XSS via the thanks parameter in form components6.4CNA v4.00.4%2026-07-02
CVE-2026-14336Eclipse CSI server-side request forgery8.2CNA v3.10.3%2026-07-02
CVE-2026-14249Request a Quote Form WordPress plugin unauthenticated code injection via path parameter7.5CNA v3.10.6%2026-07-02Fix
CVE-2026-14029Groundhogg WordPress plugin authenticated (Custom+) SQL injection via select parameter6.5CNA v3.10.6%2026-07-02Fix
CVE-2026-13743Improper verification of cryptographic signature in CubeSpace CW0057 Reaction Wheel3.3CNA v4.00.2%2026-07-02Fix
CVE-2026-13728WatchGuard Firebox Hard-coded Fallback Encryption Key in Access Portal Resource Credential Database5.9CNA v4.00.2%2026-07-02Fix
CVE-2026-13722WatchGuard Firebox Firmware Image Validation Bypass in WatchGuard Fireware OS8.6CNA v4.00.3%2026-07-02Fix
CVE-2026-13704GiveWP WordPress plugin authenticated (Give Worker+) stored cross-site scripting via Sequioa form6.4CNA v3.10.4%2026-07-02Fix
CVE-2026-13459JetFormBuilder WordPress plugin authorization bypass5.3CNA v3.10.6%2026-07-02Fix
CVE-2026-13384WatchGuard Firebox wgagent out-of-bounds write8.6CNA v4.00.7%2026-07-02Fix
CVE-2026-13383WatchGuard Firebox ikestubd out-of-bounds write8.6CNA v4.00.7%2026-07-02Fix
CVE-2026-13377WatchGuard Firebox stored cross-site-scripting (XSS) vulnerability in SIP Proxy Configuration4.8CNA v4.00.3%2026-07-02Fix
CVE-2026-13376WatchGuard Firebox stored cross-site-scripting (XSS) vulnerability in spamBlocker module4.8CNA v4.00.3%2026-07-02Fix
CVE-2026-13375WatchGuard Fireware OS Autotask Technology Integration module stored cross-site scripting4.8CNA v4.00.3%2026-07-02Fix
CVE-2026-13374WatchGuard Fireware OS ConnectWise Technology Integration module stored cross-site scripting4.8CNA v4.00.3%2026-07-02Fix
CVE-2026-13373WatchGuard Fireware OS Tigerpaw Technology Integration module stored cross-site scripting4.8CNA v4.00.3%2026-07-02Fix
CVE-2026-13371WatchGuard Firebox Management Web UI denial of service via unsafe deserialization6.9CNA v4.00.6%2026-07-02Fix
CVE-2026-13369Ninja Forms - File Uploads WordPress plugin unauthenticated arbitrary file read7.5CNA v3.10.6%2026-07-02Fix
CVE-2026-13368WatchGuard Firebox race condition and use-after-free in Mobile VPN with IKEv2 LDAP Authentication9.2CNA v4.00.9%2026-07-02Fix
CVE-2026-13357Houzez Property Feed WordPress plugin SQL injection4.9CNA v3.10.5%2026-07-02Fix
CVE-2026-13252RSS Aggregator by Feedzy WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-02Fix
CVE-2026-13251Perfmatters WordPress plugin unauthenticated arbitrary file read via s parameter7.5CNA v3.10.9%2026-07-02Fix
CVE-2026-13132GeoVision GeoWebPlayer Websocket Server out-of-bounds read8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-13131GeoVision GeoWebPlayer Websocket Server out-of-bounds read8.3CNA v3.10.4%2026-07-02Fix
CVE-2026-13125GeoVision GeoWebPlayer Websocket Server function vulnerability8.8CNA v3.10.4%2026-07-02
CVE-2026-13084Null pointer dereference in WatchGuard Fireware OS iked Process8.7CNA v4.00.6%2026-07-02Fix
CVE-2026-13079WatchGuard Mobile VPN with SSL Windows Client local privilege escalation7.3CNA v4.00.1%2026-07-02Fix
CVE-2026-13054WatchGuard Firebox arbitrary file write via path traversal in Management Web UI8.6CNA v4.00.6%2026-07-02Fix
CVE-2026-13053WatchGuard Firebox Authenticated out-of-bounds write in Management CLI command handler8.6CNA v4.00.6%2026-07-02Fix
CVE-2026-13050WatchGuard Firebox networkd out-of-bounds write8.6CNA v4.00.6%2026-07-02Fix
CVE-2026-12657LatePoint WordPress plugin unauthenticated insecure direct object reference to arbitrary creation5.3CNA v3.10.7%2026-07-02Fix
CVE-2026-12472Kirki WordPress plugin missing authorization unauthenticated arbitrary email content injection5.3CNA v3.10.6%2026-07-02Fix
CVE-2026-12413The Libreswan Project libreswan IKEv2 denial of service via malformed fragmentation7.5CNA v3.10.6%2026-07-02Fix
CVE-2026-12168Little Orbit GameFirst Anti-Cheat GFAC_Sys_x64.sys driver communication port privilege escalation7.8CISA ADP v3.10.2%2026-07-02
CVE-2026-12167Little Orbit GameFirst Anti-Cheat GFAC_Sys_x64.sys driver communication port vulnerability7.8CISA ADP v3.10.1%2026-07-02
CVE-2026-12166Little Orbit GameFirst Anti-Cheat GFAC_Sys_x64.sys driver null pointer dereference5.5CISA ADP v3.10.2%2026-07-02Exploit code
CVE-2026-12134JoomSport WordPress plugin missing authorization arbitrary Group Creation/Modification4.3CNA v3.10.4%2026-07-02Fix
CVE-2026-12122Kirki WordPress plugin missing authorization unauthenticated sensitive information exposure5.3CNA v3.10.5%2026-07-02Fix
CVE-2026-11965User Registration and Membership WordPress plugin unauthenticated Paid Membership bypass6.5CISA ADP v3.10.3%2026-07-02Fix
CVE-2026-11946GetEndpoints memory exhaustion in open625417.5CNA v3.10.5%2026-07-02
CVE-2026-11896My Calendar WordPress plugin insecure direct object reference5.3CNA v3.10.5%2026-07-02Fix
CVE-2026-11781Adminify WordPress plugin Contributor+ sensitive information disclosure via Global Search AJAX2.7CISA ADP v3.10.3%2026-07-02Fix
CVE-2026-11600Envo's Templates and Widgets for Elementor and WooCommerce WordPress plugin unauthorized access4.3CNA v3.10.4%2026-07-02Fix
CVE-2026-11592Email Subscribers and Newsletters WordPress plugin authorization bypass4.3CNA v3.10.5%2026-07-02Fix
CVE-2026-11578Fluent Forms WordPress plugin form Manager+ Cross-Form Submission Entry deletion via IDOR2.7CISA ADP v3.10.3%2026-07-02Fix
CVE-2026-10104Product Video Gallery for Woocommerce WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-07-02Exploit codeFix
CVE-2026-10089Insert Pages WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-02Fix
CVE-2026-10077YOOtheme Pro WordPress theme Author+ stored XSS via UIkit data attributes6.8CISA ADP v3.10.4%2026-07-02Fix
CVE-2026-9834WP Database Backup WordPress plugin OS command injection7.2CNA v3.12.7%2026-07-02Fix
CVE-2026-9563Eclipse Parsson resource exhaustion7.5CNA v3.10.6%2026-07-02Fix
CVE-2026-9272Progress Flowmon ADS SQL injection8.7CNA v4.00.4%2026-07-02Fix
CVE-2026-9188Appointment Bookings for Zoom GoogleMeet and more WordPress plugin insecure direct object reference5.3CNA v3.10.5%2026-07-02Fix
CVE-2026-9145CRM Perks Database for Contact Form 7, WPforms, Elementor forms path traversal6.5CNA v3.10.4%2026-07-02Fix
CVE-2026-8699Stored cross-site scripting (XSS) in TP-Link Archer C5 Web Management interface7.0CNA v4.00.3%2026-07-02Fix
CVE-2026-8482Stormshield Network Security information leak in NSRPC client history4.3CNA v3.10.2%2026-07-02
CVE-2026-8441WP Review Slider Pro WordPress plugin unauthenticated SQL injection via notinstring parameter7.5CNA v3.10.5%2026-07-02Fix
CVE-2026-8247WatchGuard Firebox admd out-of-bounds write7.7CNA v4.00.4%2026-07-02Fix
CVE-2026-8147Authorization bypass in MLflow/MLflow8.1CNA v3.00.5%2026-07-02Fix
CVE-2026-8079Progress Flowmon PDF generation incorrect authorization8.7CNA v4.00.3%2026-07-02Fix
CVE-2026-7311TinyPNG WordPress plugin arbitrary file deletion8.1CNA v3.11.0%2026-07-02Fix
CVE-2026-5821Image Optimizer WordPress plugin arbitrary file deletion8.1CNA v3.10.7%2026-07-02Fix
CVE-2026-5524Divi Form Builder WordPress plugin arbitrary file upload9.8CNA v3.13.5%2026-07-02NucleiFix
CVE-2026-5348Academy LMS WordPress plugin insecure direct object reference5.3CNA v3.10.5%2026-07-02Fix
CVE-2026-4772Stored XSS in TR7's WAF-ASP5.4CNA v3.10.2%2026-07-02Fix
CVE-2026-4770DOM-based XSS in TR7's WAF-ASP4.6CNA v3.10.2%2026-07-02Fix
CVE-2026-4767Improper access control in TR7's WAF-ASP9.8CNA v3.10.6%2026-07-02Fix
CVE-2026-58593NodeBB ActivityPub Author spoofing via Unvalidated attributedTo Mapped to Local User8.7CNA v4.00.3%2026-07-01
CVE-2026-58592Ladybird Web-Reachable code execution8.9CNA v4.00.5%2026-07-01
CVE-2026-58521SQLi in Cargo extension via year range filter6.9CNA v4.00.5%2026-07-01Fix
CVE-2026-58520The Wikimedia Foundation Mediawiki open redirect6.9CNA v4.00.3%2026-07-01Fix
CVE-2026-58519Stored XSS through Cargo's map format6.9CNA v4.00.2%2026-07-01Fix
CVE-2026-58518The Wikimedia Foundation Mediawiki cross-site request forgery6.9CNA v4.00.1%2026-07-01Fix
CVE-2026-58517The Wikimedia Foundation Mediawiki blocked users can create and edit WikiLambda objects6.9CNA v4.00.3%2026-07-01Fix
CVE-2026-58457Shenzhen Aitemi M300 MT02 unauthenticated OS command injection via protocol.csp9.3CNA v4.02.9%2026-07-01Exploit code
CVE-2026-58454JAIOTlink C492A-W6 RCE via /Anyka/config endpoint7.7CNA v4.00.8%2026-07-01
CVE-2026-58453JAIOTlink C492A-W6 hard-coded credentials via anyka_ipc9.3CNA v4.01.9%2026-07-01
CVE-2026-58452JAIOTlink C492A-W6 OS command injection via SetMAC endpoint8.7CNA v4.02.7%2026-07-01
CVE-2026-58451Horde IMP path traversal via Compose.php img src7.1CNA v4.00.6%2026-07-01Fix
CVE-2026-58399antonio-castellon module-auth @acastellon/auth has an authentication bypass8.7CNA v4.01.0%2026-07-01Fix
CVE-2026-58263Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier7.2CNA v3.10.3%2026-07-01Fix
CVE-2026-58127PACSgear MediaWriter unauthenticated RCE via .NET Remoting TCP service9.3CNA v4.01.9%2026-07-01
CVE-2026-58126PACSgear PACS Scan Unauthenticated RCE via .NET Remoting TCP service9.3CNA v4.01.8%2026-07-01
CVE-2026-58038Wikimedia Foundation timeline stored XSS through javascript URLs in SVGs generated by EasyTimeline0.0CNA v4.00.3%2026-07-01Fix
CVE-2026-58037Wikimedia Foundation MediaWiki log entry formatting cross-site scripting0.0CNA v4.00.3%2026-07-01Fix
CVE-2026-58036Wikimedia Foundation MediaWiki information disclosure2.1CNA v4.00.3%2026-07-01Fix
CVE-2026-58035Wikimedia Foundation MediaWiki stored XSS0.0CNA v4.00.3%2026-07-01Fix
CVE-2026-58034Wikimedia Foundation CheckUser stored XSS0.0CNA v4.00.3%2026-07-01Fix
CVE-2026-58033Wikimedia Foundation MediaWiki information disclosure5.3CNA v4.00.4%2026-07-01Fix
CVE-2026-58032Wikimedia Foundation MediaWiki error message API cross-site scripting5.3CNA v4.00.3%2026-07-01Fix
CVE-2026-58031Wikimedia Foundation MediaWiki ApiSandbox vulnerability0.0CNA v4.00.3%2026-07-01Fix
CVE-2026-58030Wikimedia Foundation SyntaxHighlight_GeSHi SyntaxHighlight stored XSS5.3CNA v4.00.3%2026-07-01Fix
CVE-2026-58029Wikimedia Foundation MediaWiki full account takeover from BotPasswords and OAuth5.3CNA v4.00.4%2026-07-01Fix
CVE-2026-58028Wikimedia Foundation MediaWiki API output formatting cross-site scripting0.0CNA v4.00.3%2026-07-01Fix
CVE-2026-58027Wikimedia Foundation AbuseFilter information disclosure5.3CNA v4.00.4%2026-07-01Fix
CVE-2026-58026Wikimedia Foundation MediaWiki information disclosure0.0CNA v4.00.4%2026-07-01Fix
CVE-2026-58025Wikimedia Foundation MediaWiki remote code execution via unsafe deserialization in LogItem Import5.9CNA v4.00.5%2026-07-01Exploit codeFix
CVE-2026-58024Wikimedia Foundation MediaWiki API identification of users on private wikis5.1CNA v4.00.4%2026-07-01Fix
CVE-2026-57963Mozilla Thunderbird chat UI manipulation by injection6.5CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-57962Mozilla Thunderbird denial of service via malicious LDAP address-book server5.3CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-57737Shortcodes and extra features for Phlox WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-07-01Fix
CVE-2026-57736HubSpot WordPress plugin sensitive data exposure7.4CNA v3.10.3%2026-07-01Fix
CVE-2026-57723VikBooking Hotel Booking Engine and PMS WordPress plugin CSRF to arbitrary file deletion7.4CNA v3.10.2%2026-07-01Fix
CVE-2026-57722Enable Media Replace WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2026-07-01Fix
CVE-2026-57721ApplyOnline WordPress plugin broken access control5.3CNA v3.10.3%2026-07-01Fix
CVE-2026-57720ThumbPress WordPress plugin broken access control4.3CNA v3.10.3%2026-07-01Fix
CVE-2026-57692PrivateContent WordPress plugin privilege escalation9.8CNA v3.10.5%2026-07-01Fix
CVE-2026-57517Control Web Panel blind SQL injection via userRes parameter9.3CNA v4.01.0%2026-07-01Exploit codeFix
CVE-2026-57516Ray unsafe deserialization RCE via WebDataset Reader8.6CNA v4.00.9%2026-07-01Fix
CVE-2026-56152Incorrect authorization in Kibana leading to information disclosure5.3CNA v3.10.3%2026-07-01
CVE-2026-56151Improper input validation in Kibana leading to denial of service6.5CNA v3.10.5%2026-07-01Fix
CVE-2026-56150Allocation of resources without limits or throttling in Fleet Server leading to denial of service6.5CNA v3.10.5%2026-07-01Fix
CVE-2026-56149Allocation of resources without limits or throttling in Elasticsearch leading to denial of service4.9CNA v3.10.5%2026-07-01Fix
CVE-2026-56148Uncontrolled recursion in Elasticsearch leading to denial of service6.5CNA v3.10.5%2026-07-01Fix
CVE-2026-56016CGI::Session::ID::md5 versions for Perl generate predictable session ids from low-entropy sources5.9CISA ADP v3.10.5%2026-07-01Fix
CVE-2026-55886Jodit Editor: Prototype pollution in Jodit via Jodit.modules.Helpers.set6.3CNA v4.00.5%2026-07-01Fix
CVE-2026-55793Craft CMS: Stored XSS via Structure entry title in table view5.9CNA v4.00.4%2026-07-01Fix
CVE-2026-55790Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget7.4CNA v4.00.5%2026-07-01Fix
CVE-2026-55688AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore4.0CNA v3.10.3%2026-07-01Fix
CVE-2026-55661TinaCMS rich-text rendering does not sanitize link/image URLs, allowing stored XSS4.8CNA v4.00.4%2026-07-01Fix
CVE-2026-55660TinaCMS cross-origin postMessage handlers cross-site scripting7.6CNA v4.00.3%2026-07-01Fix
CVE-2026-55628ImageMagick: Policy Bypass in concatenate operation due to missing checks5.5CNA v3.10.1%2026-07-01Fix
CVE-2026-55597ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments5.5CNA v3.10.1%2026-07-01Fix
CVE-2026-55595ImageMagick: Infinite loop in connected-components when providing invalid arguments4.7CNA v3.10.1%2026-07-01Fix
CVE-2026-55594ImageMagick: Stack overflow in MVG decoder due to missing depth check5.3CNA v3.10.2%2026-07-01Fix
CVE-2026-55577ImageMagick: Heap buffer overflow in ImageMagick MVG decoder5.9CNA v3.10.2%2026-07-01Fix
CVE-2026-55510ImageMagick 8BIM profile parser use-after-free5.5CNA v3.10.1%2026-07-01Fix
CVE-2026-55153mchange-commons-java JNDI object factory unsafe deserialization7.1CNA v3.10.6%2026-07-01Fix
CVE-2026-54908Pion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message6.3CNA v4.00.5%2026-07-01Fix
CVE-2026-54903Oj: Integer overflow in Oj.load 2GB String Handling6.3CNA v4.00.3%2026-07-01Fix
CVE-2026-54902Oj SAJ parser cached keys use-after-free6.3CNA v4.00.4%2026-07-01Fix
CVE-2026-54901Oj parser class references use-after-free6.3CNA v4.00.3%2026-07-01Fix
CVE-2026-54900Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling6.3CNA v4.00.4%2026-07-01Exploit codeFix
CVE-2026-54899Oj parser symbol key cache use-after-free6.3CNA v4.00.3%2026-07-01Fix
CVE-2026-54898Oj SAJ parser callbacks use-after-free2.1CNA v4.00.1%2026-07-01Fix
CVE-2026-54897ohler55 Oj Doc iterators use-after-free2.1CNA v4.00.1%2026-07-01Fix
CVE-2026-54896Oj: Heap buffer overflow in Oj.dump Exception Serialization via Large Indent2.1CNA v4.00.1%2026-07-01Fix
CVE-2026-54786Wasmtime: Leak in WASIp1 `fd_renumber` implementation2.3CNA v4.00.4%2026-07-01Fix
CVE-2026-54756Jodit Editor: Prototype pollution via Jodit.configure / ConfigMerge6.3CNA v4.00.5%2026-07-01Fix
CVE-2026-54720Silverstripe Framework: Possible XSS attack through media embed5.4CNA v3.10.3%2026-07-01Fix
CVE-2026-54712OpenTelemetry Javaagent RMI context propagation allows resource exhaustion5.3CNA v3.10.5%2026-07-01Fix
CVE-2026-54704OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords6.5CNA v3.10.4%2026-07-01Fix
CVE-2026-54592Oj: Stack buffer overflow in Oj::Doc#each_child via Deeply Nested Input7.5CNA v3.10.3%2026-07-01Fix
CVE-2026-54502Oj: Stack buffer overflow in Oj.dump via Large Indent6.3CNA v4.00.3%2026-07-01Fix
CVE-2026-54500Oj: Intern.c form_attr has an uninitialized stack read5.3CNA v3.10.2%2026-07-01Fix
CVE-2026-54428Apache HttpComponents Core: HPackDecoder Unlimited Header List Size before SETTINGS ACK7.5CISA ADP v3.10.9%2026-07-01Fix
CVE-2026-54399Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration7.5CISA ADP v3.10.9%2026-07-01Fix
CVE-2026-54263Wagtail: Reflected XSS in dynamic image URL generator view7.3CNA v3.10.4%2026-07-01Fix
CVE-2026-54262Wagtail: Pages translations can be created without page permissions when using simple_translation4.3CNA v3.10.3%2026-07-01Fix
CVE-2026-54261Wagtail: Improper permission handling in image preview6.5CNA v3.10.3%2026-07-01Fix
CVE-2026-54260Wagtail: Denial of service via unbounded filter specs in the image preview4.3CNA v3.10.4%2026-07-01Fix
CVE-2026-54259Wagtail: Improper restriction handling on Documents and Images chosen endpoints4.3CNA v3.10.3%2026-07-01Fix
CVE-2026-54164API Platform Core: Missing IRI type check enables resource type confusion6.5CNA v3.10.3%2026-07-01Fix
CVE-2026-54074@tinacms/cli: Remote code execution7.8CNA v3.10.3%2026-07-01Fix
CVE-2026-53909Arbitrary file upload in MCO6.5v3.10.4%2026-07-01
CVE-2026-53908MyComplianceOffice MCO password reset and username reminder information disclosure4.3v3.10.4%2026-07-01
CVE-2026-53907Stored Cross‑Site Scripting in MCO5.4v3.10.2%2026-07-01
CVE-2026-53906Path disclosure and path traversal in MCO8.2v3.10.5%2026-07-01
CVE-2026-53905Unauthorized access to Administrator ACL view in MCO7.1v3.10.3%2026-07-01
CVE-2026-53904Account denial of service in MCO7.1v3.10.3%2026-07-01
CVE-2026-53903Insecure direct object reference in MCO8.1v3.10.4%2026-07-01
CVE-2026-53902Privilege escalation in MCO6.5NVD v3.10.3%2026-07-01
CVE-2026-53492containerd CRI checkpoint restore CDI annotation smuggling8.4CNA v4.00.4%2026-07-01Fix
CVE-2026-53489containerd arbitrary host CRI log file read via symlink following in CRI checkpoint restore8.2CNA v4.00.2%2026-07-01Fix
CVE-2026-53488containerd CRI plugin restart-monitor logger vulnerability9.4CNA v4.00.2%2026-07-01Fix
CVE-2026-53467ImageMagick: Information disclosure in MNG decoder because allocated memory is left unchanged5.3CNA v3.10.2%2026-07-01Fix
CVE-2026-53466ImageMagick: Heap buffer over-read in XCF decoder due to integer conversion overflow6.5CNA v3.10.2%2026-07-01Fix
CVE-2026-53356Linux kernel i915 physical buffer object access vulnerability7.8CNA v3.10.1%2026-07-01Fix
CVE-2026-53355Linux kernel RDS IB connection teardown null pointer dereference9.8CNA v3.10.4%2026-07-01Fix
CVE-2026-53354Linux kernel TLB invalidation broadcast handling vulnerability8.8CNA v3.10.1%2026-07-01Fix
CVE-2026-53353Linux kernel HSR self-node lookup vulnerability5.5v3.10.2%2026-07-01Fix
CVE-2026-53352Linux kernel signal job control race condition4.7NVD v3.10.1%2026-07-01Fix
CVE-2026-53351Linux kernel ptrace core dump register set vulnerability5.5v3.10.1%2026-07-01Fix
CVE-2026-53350Linux kernel wm_adsp firmware control removal null pointer dereference5.5NVD v3.10.1%2026-07-01Fix
CVE-2026-53349Linux kernel netfilter conntrack expectation handler vulnerability5.5NVD v3.10.1%2026-07-01Fix
CVE-2026-53348Linux kernel SDCA function unregistration null pointer dereference5.5v3.10.1%2026-07-01Fix
CVE-2026-53347Linux kernel virtio GPU driver removal denial of service5.5v3.10.2%2026-07-01Fix
CVE-2026-53346Linux kernel shadow call stack boot patching out-of-bounds read7.1v3.10.2%2026-07-01Fix
CVE-2026-53345Linux kernel KVM memory dirty tracking memory leak5.5v3.10.1%2026-07-01Fix
CVE-2026-53344Linux kernel mcp23s08 null pointer dereference5.5v3.10.1%2026-07-01Fix
CVE-2026-53343Linux kernel KASAN VMAP stack shadow access denial of service5.5v3.10.2%2026-07-01Fix
CVE-2026-53342Linux kernel ARM64 page table allocation vulnerability5.5v3.10.2%2026-07-01Fix
CVE-2026-53341Linux kernel file handle decoding use-after-free7.8CNA v3.10.1%2026-07-01Fix
CVE-2026-53340Linux kernel i.MX I2C driver denial of service5.5v3.10.2%2026-07-01Fix
CVE-2026-53339Linux kernel Qualcomm CCI I2C driver null pointer dereference5.5v3.10.2%2026-07-01Fix
CVE-2026-53338Linux kernel Airoha QDMA driver null pointer dereference5.5v3.10.2%2026-07-01Fix
CVE-2026-53337Linux kernel bonding driver ioctl handler null pointer dereference5.5NVD v3.10.1%2026-07-01Fix
CVE-2026-53336Linux kernel ONIE TLV NVMEM layout driver denial of service5.5v3.10.2%2026-07-01Fix
CVE-2026-53335Linux kernel DAMON_LRU_SORT null pointer dereference5.5v3.10.2%2026-07-01Fix
CVE-2026-53334Linux kernel DAMON_RECLAIM null pointer dereference5.5v3.10.2%2026-07-01Fix
CVE-2026-53333Linux kernel mincore swap entry handling vulnerability5.5v3.10.2%2026-07-01Fix
CVE-2026-53332Linux kernel SLIMbus qcom-ngd-ctrl driver vulnerability5.5v3.10.1%2026-07-01Fix
CVE-2026-53331Linux kernel SLIMbus qcom-ngd-ctrl driver deadlock5.5v3.10.1%2026-07-01Fix
CVE-2026-53330Linux kernel drm/amd/display out-of-bounds read7.1NVD v3.10.1%2026-07-01Fix
CVE-2026-53329Linux kernel AMD display driver vector allocator vulnerability7.0CNA v3.10.1%2026-07-01Fix
CVE-2026-53328Linux kernel sched_ext cgroup migration vulnerability5.5v3.10.2%2026-07-01Fix
CVE-2026-53327Linux kernel debugobjects subsystem improper locking5.5v3.10.1%2026-07-01Fix
CVE-2026-53326Linux kernel debugobjects subsystem deadlock5.5v3.10.1%2026-07-01Fix
CVE-2026-52190UTT nv518G nv518GV3v3.2.7-210919-161313 buffer overflow7.5CISA ADP v3.10.6%2026-07-01
CVE-2026-52186UTT nv518G nv518GV3v3.2.7-210919-161313 SQL injection9.8CISA ADP v3.10.8%2026-07-01
CVE-2026-51947Pivotal CRM conversion service insecure deserialization9.8CISA ADP v3.11.1%2026-07-01
CVE-2026-51946GoAdminGroup GoAdmin SQL injection6.5CISA ADP v3.10.4%2026-07-01
CVE-2026-50521Microsoft Edge (Chromium-based) remote code execution8.3CNA v3.10.8%2026-07-01Fix
CVE-2026-50284Craft CMS asset folder deletion missing authorization7.1CNA v4.00.4%2026-07-01Fix
CVE-2026-50283Craft CMS: Unauthorized Deletion of Source Assets during File Replacement5.3CNA v4.00.4%2026-07-01Fix
CVE-2026-50195Linux Foundation containerd CRI checkpoint import vulnerability5.6CNA v4.00.3%2026-07-01Fix
CVE-2026-50160hoppscotch mass assignment via Onboarding endpoint allows Unauthenticated JWT_SECRET Overwrite10.0CNA v3.11.7%2026-07-01Nuclei
CVE-2026-50043Seiko Solutions SkyBridge MB-A100/MB-A110 OS command improper neutralization8.6CNA v4.01.7%2026-07-01
CVE-2026-49858API Platform Core JSON:API and HAL normalizers vulnerability5.9CNA v3.10.3%2026-07-01Fix
CVE-2026-49119Gradio path traversal via FileExplorer.preprocess8.7CNA v4.00.9%2026-07-01Fix
CVE-2026-49091Improper output neutralization for logs in Kibana leading to log injection8.0CNA v3.10.3%2026-07-01Fix
CVE-2026-49090Uncontrolled resource consumption in Elasticsearch leading to denial of service6.5CNA v3.10.4%2026-07-01Fix
CVE-2026-49088Insertion of sensitive information into log file in Kibana leading to information disclosure4.4CNA v3.10.3%2026-07-01Fix
CVE-2026-49087Allocation of resources without limits or throttling in Kibana leading to denial of service6.5CNA v3.10.5%2026-07-01Fix
CVE-2026-47262containerd image-triggered runtime DoS via unbounded group parsing5.3CNA v4.00.3%2026-07-01Fix
CVE-2026-46680containerd user ID handling bypass allows runAsNonRoot evasion7.3CNA v4.00.2%2026-07-01Exploit codeFix
CVE-2026-44042UltraVNC repeater wi_uudecode off-by-one in base64 decode boundary check3.7NVD v3.10.5%2026-07-01
CVE-2026-44041UltraVNC vncWc2Mb calls wcslen before validating that the wide string is NUL-terminated6.5NVD v3.10.4%2026-07-01
CVE-2026-44040UltraVNC vncauth.c uses time-seeded libc rand to generate VNC authentication challenge bytes6.5NVD v3.10.4%2026-07-01
CVE-2026-41579Linux Foundation runc container rootfs setup symlink following3.3CNA v3.10.2%2026-07-01Fix
CVE-2026-41121Dell Device Management Agent link following7.3CNA v3.10.2%2026-07-01Fix
CVE-2026-38891gazebo_ros_diff_drive.cpp component of gazebo_plugins v3.9.0 An improper input validation7.5CISA ADP v3.10.5%2026-07-01
CVE-2026-38142Tenda AC18 fast_setting_internet_set endpoint command injection6.5CISA ADP v3.11.1%2026-07-01
CVE-2026-36912AP4_AtomSampleTable::GetSample function of Aleksoid1978 MPC-BE null pointer dereference7.5CISA ADP v3.10.5%2026-07-01
CVE-2026-36911Aleksoid1978 MPC-BE CStreamSwitcherOutputPin::DecideBufferSize function division by zero5.5CISA ADP v3.10.1%2026-07-01
CVE-2026-36910Aleksoid1978 MPC-BE BaseSplitterFile::Read function vulnerability5.5CISA ADP v3.10.2%2026-07-01
CVE-2026-36909AP4_TkhdAtom::GetTrackId function of Aleksoid1978 MPC-BE null pointer dereference6.2CISA ADP v3.10.2%2026-07-01
CVE-2026-34117Guardian Language-System Unauthenticated OS command injection9.3CNA v4.00.9%2026-07-01
CVE-2026-34116Guardian Language-System Unauthenticated OS command injection via id parameter in transcribe.php9.3CNA v4.00.9%2026-07-01
CVE-2026-34115Guardian Language-System Unauthenticated OS command injection9.3CNA v4.00.9%2026-07-01
CVE-2026-34114Guardian Language-System Unauthenticated OS command injection via id parameter in translate_text.php9.3CNA v4.00.9%2026-07-01
CVE-2026-34113Guardian Language-System Unauthenticated OS command injection via id parameter in speech_text.php9.3CNA v4.00.9%2026-07-01
CVE-2026-34112Guardian Language-System Unauthenticated OS command injection via id parameter in speechmac.php9.3CNA v4.00.9%2026-07-01
CVE-2026-34111Guardian Language-System Unauthenticated OS command injection via id parameter in speechmac_text.php9.3CNA v4.00.9%2026-07-01
CVE-2026-34110Guardian Language-System Unauthenticated OS command injection via id parameter in complex_start.php9.3CNA v4.00.9%2026-07-01
CVE-2026-34109Guardian Language-System Unauthenticated OS command injection via id parameter in speech.php9.3CNA v4.00.9%2026-07-01
CVE-2026-34108Guardian Language-System Unauthenticated OS command injection via id parameter in text.php9.3CNA v4.00.9%2026-07-01
CVE-2026-34107Guardian Language-System Unauthenticated OS command injection via id parameter in translate.php9.3CNA v4.00.9%2026-07-01
CVE-2026-34106Guardian Language-System Unauthenticated OS command injection via id parameter in subtitles.php9.3CNA v4.00.9%2026-07-01
CVE-2026-34105Guardian Language-System SQL injection via id parameter in translate_text.php8.7CNA v4.00.5%2026-07-01
CVE-2026-34104Guardian Language-System SQL injection via name parameter in designer.php8.7CNA v4.00.5%2026-07-01
CVE-2026-34103Guardian Language-System SQL injection via id parameter in subtitles.php8.7CNA v4.00.5%2026-07-01
CVE-2026-34102Guardian Language-System SQL injection via id parameter in job_info_get.php8.7CNA v4.00.5%2026-07-01
CVE-2026-34101Guardian Language-System SQL injection via id parameter in text_file.php8.7CNA v4.00.5%2026-07-01
CVE-2026-34100Guardian Language-System SQL injection via id parameter in media.php8.7CNA v4.00.5%2026-07-01
CVE-2026-34099Guardian Language-System Unauthenticated SQL injection via id parameter in job_info.php9.3CNA v4.00.6%2026-07-01
CVE-2026-34098Guardian Language-System XSS via id parameter in media.php4.8CNA v4.00.2%2026-07-01
CVE-2026-34097Guardian Language-System XSS via id parameter in text_file.php4.8CNA v4.00.2%2026-07-01
CVE-2026-34096Guardian Language-System XSS via name parameter in designer.php4.8CNA v4.00.2%2026-07-01
CVE-2026-27435Woffice WordPress theme broken access control5.3CNA v3.10.3%2026-07-01Fix
CVE-2026-27409Webba Booking WordPress plugin broken access control5.3CNA v3.10.3%2026-07-01Fix
CVE-2026-24270NVIDIA AIStore framework authentication bypass by spoofing9.8CNA v3.10.8%2026-07-01Fix
CVE-2026-24266NVIDIA Triton Inference Server use-after-free5.9CNA v3.10.7%2026-07-01Fix
CVE-2026-24264NVIDIA Triton Inference Server decompression bomb7.5CNA v3.10.7%2026-07-01Fix
CVE-2026-24260NVIDIA Container Toolkit time-of-check time-of-use race condition8.5CNA v3.10.5%2026-07-01Fix
CVE-2026-24251NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-07-01Fix
CVE-2026-24250NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-07-01Fix
CVE-2026-24249NVIDIA Megatron Bridge code injection7.8CNA v3.10.2%2026-07-01Fix
CVE-2026-24248NVIDIA Megatron Bridge code injection7.8CNA v3.10.2%2026-07-01Fix
CVE-2026-24247NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-07-01Fix
CVE-2026-24246NVIDIA Megatron Bridge unsafe reflection7.8CNA v3.10.4%2026-07-01Fix
CVE-2026-24245NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-07-01Fix
CVE-2026-24244NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-07-01Fix
CVE-2026-24243NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-07-01Fix
CVE-2026-24242NVIDIA Megatron Bridge server-side request forgery7.8CNA v3.10.2%2026-07-01Fix
CVE-2026-24240NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-07-01Fix
CVE-2026-23537Feast: Unauthenticated arbitrary file write9.1CNA v3.11.0%2026-07-01
CVE-2026-20463MediaTek chipset Modem privilege escalation6.7CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-20462MediaTek chipset Telephony memory corruption6.7CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-20461MediaTek chipset Modem out-of-bounds write5.3CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-20460MediaTek chipset Modem information disclosure5.3CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-20459MediaTek chipset Modem crash5.3CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-20458MediaTek chipset Modem memory corruption7.5CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-20457MediaTek chipset Modem crash5.3CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-20244ClamAV DMG File Processing denial of service7.5CNA v3.10.6%2026-07-01Fix
CVE-2026-20243ClamAV ALZ Archive Processing denial of service7.5CNA v3.10.6%2026-07-01Fix
CVE-2026-20217ClamAV PESpin File Format Processing Out-of-bounds memory corruption7.5CNA v3.10.6%2026-07-01Exploit codeFix
CVE-2026-20216ClamAV InstallShield File Format Processing resource exhaustion7.5CNA v3.10.6%2026-07-01Fix
CVE-2026-20215ClamAV 7Zip File Format Processing Out-of-bounds memory corruption7.5CNA v3.10.6%2026-07-01Fix
CVE-2026-20214ClamAV FSG File Format Processing Out-of-bounds memory corruption7.5CNA v3.10.6%2026-07-01Fix
CVE-2026-20213ClamAV PE File Format Processing Out-of-bounds memory corruption7.5CNA v3.10.6%2026-07-01Fix
CVE-2026-20191Cisco Catalyst Center arbitrary file read7.5CNA v3.10.6%2026-07-01Fix
CVE-2026-14440Cloudflare Universal SSL CAA record management protection mechanism failure7.6CNA v4.00.2%2026-07-01
CVE-2026-14439Path traversal in Altium Git service allows remote code execution9.4CNA v4.00.7%2026-07-01Fix
CVE-2026-14432Google Chrome V8 use-after-free8.8CISA ADP v3.10.4%2026-07-01Fix
CVE-2026-14431Google Chrome V8 type confusion8.8CISA ADP v3.10.5%2026-07-01Exploit codeFix
CVE-2026-14430Google Chrome V8 integer overflow8.8CISA ADP v3.10.4%2026-07-01Fix
CVE-2026-14429Google Chrome sandbox escape8.3CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14428Google Chrome sandbox escape8.3CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14427Google Chrome Skia heap-based buffer overflow8.3CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14426Google Chrome V8 use-after-free7.5CISA ADP v3.10.4%2026-07-01Fix
CVE-2026-14425Google Chrome ANGLE use-after-free9.6CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14424Google Chrome Dawn use-after-free9.6CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14423Google Chrome Tint type confusion9.6CISA ADP v3.10.4%2026-07-01Fix
CVE-2026-14422Google Chrome Tint out-of-bounds read8.8CISA ADP v3.10.4%2026-07-01Fix
CVE-2026-14421Google Chrome uninitialized variable use6.5CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14420Google Chrome Dawn out-of-bounds read9.6CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14419Google Chrome Skia use-after-free9.6CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14418Google Chrome uninitialized variable use4.3CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14417Google Chrome Dawn use-after-free9.6CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14416Google Chrome Dawn out-of-bounds read9.6CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14415Google Chrome V8 inappropriate implementation8.8CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14414Google Chrome improper input validation5.3CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14413Google Chrome uninitialized variable use8.3CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14412Google Chrome sandbox escape8.3CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14411Google Chrome sandbox escape9.6CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14410Google Chrome Skia inappropriate implementation4.3CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14409Google Chrome V8 inappropriate implementation7.5CISA ADP v3.10.4%2026-07-01Fix
CVE-2026-14408Google Chrome uninitialized variable use6.5CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14407Google Chrome V8 inappropriate implementation8.8CISA ADP v3.10.4%2026-07-01Fix
CVE-2026-14406Google Chrome V8 out-of-bounds read5.9CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14405Google Chrome uninitialized variable use9.6CISA ADP v3.10.5%2026-07-01Fix
CVE-2026-14404Google Chrome PDFium inappropriate implementation6.5CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14403Google Chrome V8 use-after-free8.8CISA ADP v3.10.4%2026-07-01Fix
CVE-2026-14402Google Chrome uninitialized variable use6.5CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14401Google Chrome sandbox escape8.3CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14400Google Chrome ANGLE out-of-bounds write8.3CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14399Google Chrome uninitialized variable use6.5CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14398Google Chrome ANGLE use-after-free9.6CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14397Google Chrome ANGLE out-of-bounds write9.6CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14396Google Chrome ANGLE out-of-bounds read6.5v3.10.3%2026-07-01Fix
CVE-2026-14395Google Chrome V8 out-of-bounds write8.8CISA ADP v3.10.4%2026-07-01Fix
CVE-2026-14394Google Chrome V8 use-after-free8.8CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14393Google Chrome V8 use-after-free8.8CISA ADP v3.10.4%2026-07-01Fix
CVE-2026-14392Google Chrome Tint out-of-bounds write9.6CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14391Google Chrome ANGLE integer overflow5.3CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14390Google Chrome ANGLE use-after-free9.6CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14389Google Chrome Skia integer overflow8.3CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-14388Google Chrome ANGLE out-of-bounds read6.5CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14387Google Chrome Skia integer overflow9.6CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14386Google Chrome ANGLE out-of-bounds read6.5CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14385Google Chrome ANGLE heap-based buffer overflow8.8CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14384Google Chrome ANGLE out-of-bounds read6.5CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-14383Google Chrome V8 inappropriate implementation8.8CISA ADP v3.10.5%2026-07-01Fix
CVE-2026-14382Google Chrome sandbox escape9.6CISA ADP v3.10.3%2026-07-01Exploit codeFix
CVE-2026-14381Google Chrome WebAppInstalls incorrect security UI6.5v3.10.3%2026-07-01Fix
CVE-2026-14363Cargo Extension: Sqli in Special:Drilldown6.9CNA v4.00.5%2026-07-01Fix
CVE-2026-14358Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title6.9CNA v4.00.3%2026-07-01Fix
CVE-2026-14340GitHub Enterprise Server GitHub App token incorrect authorization5.3CNA v4.00.4%2026-07-01Fix
CVE-2026-14330Red Hat Enterprise Linux 9 pipewire: Pulse server alloca stack overflow5.5CNA v3.10.1%2026-07-01Fix
CVE-2026-14324Red Hat Enterprise Linux 10 pipewire: Raop rtsp null deref6.5CNA v3.10.2%2026-07-01Fix
CVE-2026-14265RCE via deserialization in AWS Advanced JDBC Wrapper7.7CNA v4.00.7%2026-07-01Fix
CVE-2026-14258Red Hat Enterprise Linux 10 dhcpcd: Dhcpcd infinite loop and out-of-bounds read6.5CNA v3.10.4%2026-07-01Fix
CVE-2026-14198@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values9.1CNA v3.10.5%2026-07-01Fix
CVE-2026-14193DVP80ES300T improper validation of array index7.5CNA v3.10.5%2026-07-01
CVE-2026-14191WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader7.8CNA v3.10.4%2026-07-01Exploit codeFix
CVE-2026-14181@fastify/middie standalone engine vulnerable to denial of service7.5CNA v3.10.5%2026-07-01Fix
CVE-2026-13769Overly permissive File Permissions in AWS CLI6.8CNA v4.00.2%2026-07-01Fix
CVE-2026-13760aws-cdk OS command injection in aws-cdk-lib Docker Bundling7.0CNA v4.01.2%2026-07-01Fix
CVE-2026-13733Download Manager WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-01Fix
CVE-2026-13731WPBot WordPress plugin unauthenticated stored cross-site scripting via conversation parameter7.2CNA v3.10.9%2026-07-01NucleiFix
CVE-2026-13707Session fixation attacks on improperly configured OAuth tools0.0CNA v4.00.3%2026-07-01Fix
CVE-2026-13706Wikimedia Foundation UrlShortener improper input validation0.0CNA v4.00.5%2026-07-01Fix
CVE-2026-13603SSRF with API key leak in pretix-oppwa9.0CNA v4.00.4%2026-07-01Fix
CVE-2026-13602pretix session takeover7.7CNA v4.00.4%2026-07-01Fix
CVE-2026-13468Visualizer WordPress plugin missing authorization unauthenticated sensitive information disclosure7.5CNA v3.10.6%2026-07-01Fix
CVE-2026-13454MotoPress Appointment Booking WordPress plugin authenticated (Staff+) SQL injection via s parameter6.5CNA v3.10.5%2026-07-01Fix
CVE-2026-13443Tutor LMS WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-01Fix
CVE-2026-13323Eclipse Open VSX cross-site scripting4.1CNA v3.10.3%2026-07-01Fix
CVE-2026-13246GiveWP WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-01Fix
CVE-2026-13228LatePoint WordPress plugin privilege escalation to Administrator8.8CNA v3.10.6%2026-07-01Fix
CVE-2026-13211Genucenter Disclosure of SNMP Credentials4.3CNA v3.10.2%2026-07-01
CVE-2026-13015WP Google Review Slider WordPress plugin reflected cross-site scripting via place parameter6.1CNA v3.10.4%2026-07-01Fix
CVE-2026-12923Video Gallery WordPress plugin arbitrary function Call via path parameter7.5CNA v3.10.5%2026-07-01Fix
CVE-2026-12904Kadence Blocks WordPress plugin insecure direct object reference4.3CNA v3.10.5%2026-07-01Fix
CVE-2026-12902Kadence Blocks WordPress plugin authorization bypass4.3CNA v3.10.5%2026-07-01Fix
CVE-2026-12754VikBooking Hotel Booking Engine and PMS WordPress plugin reflected cross-site scripting6.1CNA v3.10.4%2026-07-01Fix
CVE-2026-12732LearnPress WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-01Fix
CVE-2026-12579AS228T authentication bypass7.4CNA v3.10.5%2026-07-01
CVE-2026-12577DVP80ES3 improperly implemented security check for standard8.7CNA v4.00.4%2026-07-01
CVE-2026-12576DVP80ES3 improper enforcement of message integrity during transmission in a communication channel7.5CNA v3.10.2%2026-07-01
CVE-2026-12575DVP80ES3 improper resource shutdown or release7.5CNA v3.10.5%2026-07-01
CVE-2026-12480Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras5.5CNA v3.00.2%2026-07-01Fix
CVE-2026-12435Motors WordPress plugin missing authorization authenticated arbitrary post Meta modification4.3CNA v3.10.4%2026-07-01Fix
CVE-2026-12408Slim SEO WordPress plugin insufficient authorization to Private content disclosure4.3CNA v3.10.4%2026-07-01Fix
CVE-2026-12374Cato Networks SDP Client PrivilegedHelperTool XPC service improper certificate validation6.4CNA v4.00.1%2026-07-01Fix
CVE-2026-12224Dokan Pro WordPress plugin privilege escalation8.8CNA v3.10.4%2026-07-01Fix
CVE-2026-12158RegistrationMagic WordPress plugin cross-site request forgery to privilege escalation8.8CNA v3.10.3%2026-07-01Fix
CVE-2026-12142NEX-Forms WordPress plugin unauthenticated stored cross-site scripting via _name[] Array parameter7.2CNA v3.10.5%2026-07-01Fix
CVE-2026-12135FV Flowplayer Video Player WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-01Fix
CVE-2026-12133JoomSport WordPress plugin missing authorization arbitrary Group deletion4.3CNA v3.10.4%2026-07-01Fix
CVE-2026-12127WPForms WordPress plugin CRLF injection5.3CNA v3.10.6%2026-07-01Fix
CVE-2026-12113Appointment Booking Calendar WordPress plugin information disclosure4.3CNA v3.10.4%2026-07-01Fix
CVE-2026-12110Taskbuilder WordPress plugin authenticated (Subscriber+) SQL injection via task_search parameter6.5CNA v3.10.6%2026-07-01Fix
CVE-2026-12090Taskbuilder WordPress plugin SQL injection6.5CNA v3.10.5%2026-07-01Fix
CVE-2026-11988LearnPress WordPress plugin insecure direct object reference6.5CNA v3.10.5%2026-07-01Fix
CVE-2026-11981GiveWP WordPress plugin cross-site request forgery4.3CNA v3.10.2%2026-07-01Fix
CVE-2026-11887Salon Booking System WordPress plugin Subscriber+ Booking Approval bypass4.3CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-11883WebAuthn Provider for Two Factor WordPress plugin 2FA bypass7.2CISA ADP v3.10.6%2026-07-01Fix
CVE-2026-11880Fluent Forms WordPress plugin Subscriber+ Subscription Cancellation via IDOR3.1CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-11823BookingPress Appointment Booking Pro WordPress plugin unauthenticated SQL injection7.5CNA v3.10.5%2026-07-01Fix
CVE-2026-11794Advanced Form Integration WordPress plugin unauthenticated privilege escalation8.1CISA ADP v3.10.4%2026-07-01Fix
CVE-2026-11570User Submitted Posts WordPress plugin unauthenticated stored XSS via Author Name4.2CISA ADP v3.10.2%2026-07-01Fix
CVE-2026-11568Product Configurator for WooCommerce pc_get_data AJAX action information disclosure7.5CISA ADP v3.10.5%2026-07-01Fix
CVE-2026-11562WS Form LITE WordPress plugin Subscriber+ arbitrary settings update4.3CISA ADP v3.10.3%2026-07-01Fix
CVE-2026-11387SMS Alert WordPress plugin unauthenticated privilege escalation via arbitrary password reset9.8CNA v3.12.2%2026-07-01NucleiExploit codeFix
CVE-2026-11380JetWidgets For Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-01Fix
CVE-2026-10750Royal MCP WordPress plugin Subscriber+ insufficient authorization in MCP Tools8.1CISA ADP v3.10.4%2026-07-01Fix
CVE-2026-10540Weak password hash protection in Control-M/Entreprise Manager5.6CNA v4.00.1%2026-07-01Fix
CVE-2026-10539Unauthenticated command injection in Control-M/Server communication command9.5CNA v4.00.4%2026-07-01
CVE-2026-10538Improper deserialization handling in Control-M components8.9CNA v4.00.4%2026-07-01Fix
CVE-2026-10096Qi Blocks WordPress plugin insecure direct object reference4.3CNA v3.10.3%2026-07-01Fix
CVE-2026-10095WP Photo Album Plus WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-01Fix
CVE-2026-9107Kali Forms WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-01Fix
CVE-2026-8857Wikimedia Foundation timeline full RCE using EasyTimeline extension0.0CNA v4.02.1%2026-07-01NucleiFix
CVE-2026-8480Stormshield Network Security administration portal improper certificate validation4.3CNA v3.10.1%2026-07-01
CVE-2026-8387Relative path traversal in allegroai/clearml2.4CNA v3.00.5%2026-07-01Fix
CVE-2026-7840UltraVNC repeater HTTP server global buffer overflow via long URI (pre-auth RCE)9.3CNA v4.02.6%2026-07-01
CVE-2026-7839UltraVNC repeater ships hard-coded default admin password allowing unauthenticated admin access9.1CNA v3.10.7%2026-07-01
CVE-2026-7838UltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason length8.7CNA v4.01.9%2026-07-01
CVE-2026-7831UltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsing7.5CNA v3.10.7%2026-07-01
CVE-2026-7830uvnc UltraVNC MS-Logon II authentication vulnerability7.4CNA v3.10.3%2026-07-01
CVE-2026-7829UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token7.2CNA v3.10.9%2026-07-01
CVE-2026-7828UltraVNC repeater integer overflow in win_log malloc leading to heap overflow5.3CNA v3.11.4%2026-07-01
CVE-2026-7517Custom Payment Gateways for WooCommerce WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-07-01Fix
CVE-2026-6688FatFs buffer overflow via Unbounded LFN Filename Copy7.6CNA v3.10.3%2026-07-01
CVE-2026-6687FatFs stack buffer overflow via Uncapped exFAT Label Length7.6CNA v3.10.3%2026-07-01
CVE-2026-6686FatFs Use of Uninitialized Clusters after Seek Past EOF4.6CNA v3.10.3%2026-07-01
CVE-2026-6684FatFs infinite loop in GPT Partition Scan4.6CNA v3.10.3%2026-07-01Fix
CVE-2026-6683FatFs divide-by-zero in exFAT Sync4.6CNA v3.10.3%2026-07-01
CVE-2026-6682FatFs integer overflow in FAT32 Volume Mount7.6CNA v3.10.3%2026-07-01
CVE-2026-6283Stored XSS in DivvyDrive Information Technologies' DivvyDrive5.4CNA v3.10.2%2026-07-01Fix
CVE-2026-6070WP-BusinessDirectory WordPress plugin unauthenticated arbitrary file deletion9.1CNA v3.10.8%2026-07-01Fix
CVE-2026-5220Stored XSS in DivvyDrive Information Technologies' DivvyDrive6.4CNA v3.10.2%2026-07-01Fix
CVE-2026-5142Foreman: Foreman: Cross-tenant private SSH key disclosure via taxonomy scoping bypass6.5CNA v3.10.4%2026-07-01Fix
CVE-2026-5138Foreman: Foreman: Information disclosure via improper validation of nested request parameters4.3CNA v3.10.4%2026-07-01Fix
CVE-2026-5136Foreman: Foreman: Privilege escalation to administrator-level access8.8CNA v3.10.6%2026-07-01Fix
CVE-2026-5135Foreman: Foreman: Unauthorized modification of host configurations via broken access control6.5CNA v3.10.4%2026-07-01Fix
CVE-2026-5120Race condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 20268.1CNA v3.10.3%2026-07-01
CVE-2026-5051HashiCorp Vault Audit Log Plugin Directory Guard Bypass via Legacy path option4.4CNA v3.10.4%2026-07-01Fix
CVE-2026-2891Poly Voice Devices (CCX, Trio, Edge E) potential denial of service8.2CNA v4.00.4%2026-07-01Fix
CVE-2026-2387Event Organiser WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-01Fix
CVE-2026-1239Ninja Forms WordPress plugin missing authorization unauthenticated sensitive information disclosure7.5CNA v3.10.5%2026-07-01Fix