CVE-2026 list

CVE-2026 records published in July 2026

Page six of 10: records 5,001 to 6,000 of the 9,534 published in July 2026, newest first. The first page carries the figures for July 2026.

CVE-2026 records published in July 2026, newest first: records 5,001 to 6,000 of 9,534
CVE Summary CVSS EPSS Published Signals
CVE-2026-16158@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision8.7CNA v3.10.4%2026-07-18Fix
CVE-2026-16156SourceCodester Class and Exam Timetabling System forexam.php cross-site scripting5.1CNA v4.00.3%2026-07-18
CVE-2026-16155SourceCodester Class and Exam Timetabling System schoolyr.php cross-site scripting5.1CNA v4.00.3%2026-07-18
CVE-2026-16154SourceCodester Class and Exam Timetabling System edit_room1.php SQL injection6.9CNA v4.00.4%2026-07-18
CVE-2026-16152SourceCodester Class and Exam Timetabling System edit_rooma.php SQL injection6.9CNA v4.00.4%2026-07-18
CVE-2026-16151CartoDB carto-api-client filters.ts addFilter prototype pollution5.3CNA v4.00.4%2026-07-18
CVE-2026-16150RobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution5.3CNA v4.00.4%2026-07-18
CVE-2026-16133LiuMengxuan04 MiniCode mcp.ts child_process.spawn command injection2.3CNA v4.01.2%2026-07-18
CVE-2026-16131itsourcecode Hospital Management System prescriptionrecord.php SQL injection5.3CNA v4.00.3%2026-07-18
CVE-2026-16130nearai ironclaw write_file path_utils.rs validate_path link following4.8CNA v4.00.2%2026-07-18
CVE-2026-16129princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist4.8CNA v4.00.3%2026-07-18
CVE-2026-16128zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery6.9CNA v4.00.5%2026-07-18
CVE-2026-16127zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery6.9CNA v4.00.5%2026-07-18
CVE-2026-16126zevorn rt-claw Swarm RPC Receiver swarm.c handle_rpc_request authorization6.9CNA v4.00.5%2026-07-18
CVE-2026-16125zevorn rt-claw http_request net.c claw_net_post server-side request forgery6.9CNA v4.00.5%2026-07-18
CVE-2026-16124nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery5.3CNA v4.00.5%2026-07-18Fix
CVE-2026-16123nextlevelbuilder GoClaw Invoke endpoint tools_invoke.go ToolsInvokeHandler.ServeHTTP authorization5.3CNA v4.00.4%2026-07-18
CVE-2026-16122nextlevelbuilder GoClaw exec_approval.go matchesAllowlist authorization4.8CNA v4.00.3%2026-07-18
CVE-2026-16121nextlevelbuilder GoClaw exec_approval.go isSafeBin improper authorization5.3CNA v4.00.4%2026-07-18
CVE-2026-16120nextlevelbuilder GoClaw exec_approval.go extractBin name resolution5.3CNA v4.00.4%2026-07-18
CVE-2026-16119nextlevelbuilder GoClaw WebSocket Approval endpoint exec_approval.go RequestApproval authorization5.3CNA v4.00.4%2026-07-18
CVE-2026-16117@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters10.0CNA v3.10.4%2026-07-18Fix
CVE-2026-16097Shibby Tomato Scheduler Name sub_42537C stack-based overflow8.7CNA v4.00.8%2026-07-18
CVE-2026-16096Shibby Tomato webmon_recent_domains sub_40BB50 stack-based overflow8.7CNA v4.00.8%2026-07-18
CVE-2026-16095Shibby Tomato rc setup_conntrack out-of-bounds write8.7CNA v4.00.7%2026-07-18
CVE-2026-16088halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal5.1CNA v4.00.5%2026-07-18
CVE-2026-16085Sipeed PicoClaw context builder inclusion of untrusted functionality4.8CNA v4.00.2%2026-07-18
CVE-2026-16084Sipeed PicoClaw web.go web_fetch server-side request forgery6.9CNA v4.00.6%2026-07-18
CVE-2026-16083Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay6.9CNA v4.00.7%2026-07-18
CVE-2026-16082Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou4.8CNA v4.00.1%2026-07-18
CVE-2026-16081Sipeed PicoClaw auth.go cross-site request forgery5.3CNA v4.00.2%2026-07-18
CVE-2026-16077AstrBotDevs AstrBot Filesystem Computer-Use tool fs.py _normalize_rw_path link following4.8CNA v4.00.2%2026-07-18
CVE-2026-16076AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing5.3CNA v4.00.5%2026-07-18
CVE-2026-16075AstrBotDevs AstrBot session-listing API authorization bypass5.3CNA v4.00.4%2026-07-18
CVE-2026-15631@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal8.7CNA v3.10.5%2026-07-18Fix
CVE-2026-12228Stored XSS in Direct messages via Prompt Sharing in parisneo/Lollms5.4NVD v3.10.3%2026-07-18
CVE-2026-11826OpenPLC_v3 heap-based buffer overflow in Modbus Master getData8.7CNA v4.00.8%2026-07-18
CVE-2026-10130QueryWeaver authentication bypass via Email Signup Token Issuance for Existing Accounts8.8CNA v4.00.6%2026-07-18
CVE-2026-9734W3SC Elementor to Zoho CRM WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-07-18
CVE-2026-9323Insecure PRNG and information exposure in urwid Web Display Backend9.2CNA v4.00.7%2026-07-18Fix
CVE-2026-9147uproot code injection via TStreamerInfo Metadata8.5CNA v4.00.2%2026-07-18Exploit codeFix
CVE-2026-63309SurrealDB information disclosure via ORDER BY5.3CNA v4.00.3%2026-07-17Fix
CVE-2026-63308Helm Files.Lines denial of service via Empty Chart files6.5v3.10.5%2026-07-17Fix
CVE-2026-63307Chat2DB insecure direct object reference via GET /API/connection/datasource7.1CNA v4.00.4%2026-07-17Fix
CVE-2026-63101fossasia Open Event Server group followers CSV export endpoint missing authentication8.7CNA v4.00.5%2026-07-17
CVE-2026-63100Maybe missing authorization via HostingsController show/update7.1CNA v4.00.4%2026-07-17
CVE-2026-63099TheHive Broken Object Level Authorization via Attachment Download endpoints7.1CNA v4.00.4%2026-07-17
CVE-2026-63098TheHive unauthenticated information disclosure via /API/status endpoint6.9CNA v4.00.4%2026-07-17
CVE-2026-63097Dendrite syncapi /context Endpoint Post-Leave State Exposure5.3CNA v4.00.3%2026-07-17
CVE-2026-63096Dendrite SSRF via Unauthenticated Legacy Media Download endpoint6.9CNA v4.00.3%2026-07-17
CVE-2026-63095Dendrite improper authorization via POST account/3pid/delete endpoint7.1CNA v4.00.3%2026-07-17
CVE-2026-63094SigNoz SSO OAuth State Manipulation Session Token Theft7.6CNA v4.00.3%2026-07-17Fix
CVE-2026-63093Cursor for Windows RCE via Malicious git.exe in Workspace8.7CNA v4.00.8%2026-07-17
CVE-2026-63030WordPress Core interpretation conflict9.8CNA v3.110.6%2026-07-17KEVNucleiMetasploitEmerging ThreatsExploit codeKCVFix
CVE-2026-62764Apache Accumulo improper handling of insufficient privileges5.7CNA v4.00.8%2026-07-17Fix
CVE-2026-62387Grav CORS Misconfiguration via API plugin7.1CNA v4.00.3%2026-07-17Fix
CVE-2026-62386Grav authentication bypass via token URL parameter8.2CNA v4.00.4%2026-07-17Fix
CVE-2026-62241clawvet Hard-coded JWT Secret Session Forgery9.3CNA v4.00.7%2026-07-17Fix
CVE-2026-62238OpenRemote SQL injection via Crosstab Export8.8NVD v3.10.5%2026-07-17Fix
CVE-2026-62237Grav ReDoS via regex_replace in Sandbox6.0CNA v4.00.3%2026-07-17Fix
CVE-2026-62236getgrav grav grav-plugin-login CSRF via regenerate2FASecret2.3CNA v4.00.1%2026-07-17Fix
CVE-2026-62235Grav Flex-Objects authorization bypass via API2.3CNA v4.00.3%2026-07-17Fix
CVE-2026-62234Grav SSRF via Unrestricted cURL Protocols8.4CNA v4.00.4%2026-07-17Fix
CVE-2026-62233getgrav grav grav-plugin-api privilege escalation via createApiKey8.7CNA v4.00.4%2026-07-17Fix
CVE-2026-62232Grav 2FA Bypass via Secret Regeneration9.1CNA v4.00.4%2026-07-17Fix
CVE-2026-62231Grav API Key Scope Bypass via ApiKeyAuthenticator8.6CNA v4.00.4%2026-07-17Fix
CVE-2026-62230Grav File Access Bypass via Case Variation8.7CNA v4.00.4%2026-07-17Fix
CVE-2026-62229OpenClaw authorization bypass via Glob Matching7.7CNA v4.00.7%2026-07-17Fix
CVE-2026-62228OpenClaw authorization bypass via Node Exec Approvals7.7CNA v4.00.5%2026-07-17Fix
CVE-2026-62227OpenClaw SSRF via Browser Snapshot4.9CNA v4.00.4%2026-07-17Fix
CVE-2026-62226OpenClaw authorization bypass via Browser Act route5.1CNA v4.00.3%2026-07-17Fix
CVE-2026-62225OpenClaw authorization bypass via Skill Command Dispatch2.3CNA v4.00.2%2026-07-17Fix
CVE-2026-62224OpenClaw MS Teams authorization bypass2.3CNA v4.00.3%2026-07-17Fix
CVE-2026-62223OpenClaw authorization bypass via Device-pair7.7CNA v4.00.5%2026-07-17Fix
CVE-2026-62222OpenClaw Untrusted Plugin Loading via Setup-mode7.1CNA v4.00.2%2026-07-17Fix
CVE-2026-62221OpenClaw authorization bypass via allowFrom2.3CNA v4.00.2%2026-07-17Fix
CVE-2026-62220OpenClaw WebSocket Rate Limit Bypass6.3CNA v4.00.5%2026-07-17Fix
CVE-2026-62219OpenClaw authorization bypass via Blank Agent IDs6.0CNA v4.00.3%2026-07-17Fix
CVE-2026-62218OpenClaw authorization bypass via device.pair.approve8.7CNA v4.00.5%2026-07-17Fix
CVE-2026-62217OpenClaw authentication bypass via exec approvals7.7CNA v4.00.4%2026-07-17Fix
CVE-2026-62216OpenClaw Policy Bypass via Media upload2.3CNA v4.00.3%2026-07-17Fix
CVE-2026-62215OpenClaw authentication bypass via HTTP Canvas5.1CNA v4.00.3%2026-07-17Fix
CVE-2026-62214OpenClaw Bot Framework SSRF via serviceUrl Parameter Validation6.0CNA v4.00.4%2026-07-17Fix
CVE-2026-62213OpenClaw token leakage via MS Teams Outbound requests6.0CNA v4.00.4%2026-07-17Fix
CVE-2026-62212OpenClaw authentication bypass via safeFetch5.1CNA v4.00.2%2026-07-17Fix
CVE-2026-62211OpenClaw Credential Redaction Bypass via Trajectory Export4.1CNA v4.00.2%2026-07-17Fix
CVE-2026-62210OpenClaw denial of service via Remote Media URLs6.0CNA v4.00.5%2026-07-17Fix
CVE-2026-62209OpenClaw authorization bypass via agent-mode dispatch7.6CNA v4.00.4%2026-07-17Fix
CVE-2026-62208OpenClaw Authorization Header Forwarding via SSE6.0CNA v4.00.4%2026-07-17Fix
CVE-2026-62207OpenClaw authentication bypass via Admin tools7.7CNA v4.00.6%2026-07-17Fix
CVE-2026-62206OpenClaw authentication bypass via Moderation Actions6.0CNA v4.00.4%2026-07-17Fix
CVE-2026-62205OpenClaw authorization bypass via message actions6.0CNA v4.00.4%2026-07-17Fix
CVE-2026-62203OpenClaw Environment variable injection via rustup7.7CNA v4.00.5%2026-07-17Fix
CVE-2026-62202OpenClaw privilege escalation via Cron7.7CNA v4.00.5%2026-07-17Fix
CVE-2026-62201OpenClaw Network Policy Bypass via exec-server4.9CNA v4.00.4%2026-07-17Fix
CVE-2026-60137WordPress Core SQL injection5.9CNA v3.15.3%2026-07-17KEVMetasploitEmerging ThreatsExploit codeKCVFix
CVE-2026-60060TeraTerm Project TTSSH2 improper length parameter handling5.1CNA v4.00.3%2026-07-17
CVE-2026-60025Joomla extension joomdonation.com User enumeration in Events Booking8.8CISA ADP v3.10.2%2026-07-17
CVE-2026-60024Joomla extension joomdonation.com insecure default configuration Events Booking9.8CISA ADP v3.10.5%2026-07-17
CVE-2026-59695Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain8.3CNA v4.00.5%2026-07-17Fix
CVE-2026-59694Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment8.3CNA v4.00.5%2026-07-17Fix
CVE-2026-59252Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain8.2CNA v4.00.6%2026-07-17Fix
CVE-2026-58317TeraTerm Project TTSSH2 out-of-bounds read5.1CNA v4.00.3%2026-07-17
CVE-2026-58195Agentic-Flow: OS command injection in agentic-flow MCP server tools8.8CNA v3.10.9%2026-07-17Fix
CVE-2026-58149Joomla extension joomdonation.com User enumeration in Events Booking5.3CISA ADP v3.10.3%2026-07-17
CVE-2026-58148Joomla extension chronoengine.com stored XSS in ChronoForms extension for Joomla8.7CNA v4.00.4%2026-07-17
CVE-2026-57980Microsoft Edge (Chromium-based) tampering5.4CNA v3.10.4%2026-07-17Fix
CVE-2026-57860ForgeCode arbitrary code execution via Unvetted .mcp.json in Untrusted Repository8.4CNA v4.00.2%2026-07-17
CVE-2026-56741JLine: Unauthenticated remote DoS via Unbounded Telnet NAWS Terminal Geometry7.5CNA v3.10.9%2026-07-17Fix
CVE-2026-56740JLine: Unauthenticated remote memory exhaustion via Unbounded Telnet NEW-ENVIRON variables7.5CNA v3.10.9%2026-07-17Fix
CVE-2026-56171Microsoft Windows Remote Desktop Protocol (RDP) information disclosure7.1CNA v3.10.7%2026-07-17Fix
CVE-2026-55518Avo association attach endpoint missing authorization9.6CNA v3.10.4%2026-07-17Fix
CVE-2026-55254NCalc: Denial of service via Unbounded and Non-Terminating Factorial Evaluation4.8CNA v3.10.3%2026-07-17Fix
CVE-2026-54498ViewComponent: Around_render HTML-Safety Bypass8.7CNA v3.10.5%2026-07-17Fix
CVE-2026-54497ViewComponent: Reused Component Instances Retain Stale Render Context6.8CNA v3.10.3%2026-07-17Fix
CVE-2026-54496Zcash halo2_gadgets insufficient verification of data authenticity9.3CNA v3.10.3%2026-07-17Fix
CVE-2026-54490faye websocket-driver-node websocket-driver: Resource limit bypass via message compression6.3CNA v4.00.4%2026-07-17Fix
CVE-2026-54466Websocket-driver: Message corruption via abuse of protocol length headers9.2CNA v4.00.4%2026-07-17Fix
CVE-2026-54465Websocket-driver: Memory exhaustion in HTTP header parser6.3CNA v4.00.5%2026-07-17Fix
CVE-2026-54464faye websocket-driver-ruby websocket-driver: Resource limit bypass via message compression6.3CNA v4.00.4%2026-07-17Fix
CVE-2026-54463Websocket-driver: Memory exhaustion via abuse of protocol length headers6.9CNA v4.00.5%2026-07-17Fix
CVE-2026-54335Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__3.7CNA v3.10.4%2026-07-17Fix
CVE-2026-54244Statamic CMS Live Preview incorrect authorization3.5CNA v3.10.3%2026-07-17Fix
CVE-2026-54243Statamic: CSV formula injection in form submission exports6.1CNA v3.10.3%2026-07-17Fix
CVE-2026-54242Statamic: Server-side request forgery via Glide (DNS rebinding)4.9CNA v3.10.2%2026-07-17Fix
CVE-2026-54171Excon: Redact additional sensitive/risky headers when following redirects6.5CNA v3.10.4%2026-07-17Fix
CVE-2026-54163GitHub secure_headers secure Headers: CSP directive injection4.7CNA v3.10.3%2026-07-17Fix
CVE-2026-54159PrestaShop/ps_facetedsearch: PHP object injection in faceted search cache allows unauthenticated RCE10.0CNA v3.10.8%2026-07-17Fix
CVE-2026-53727css_parser read_remote_file server-side request forgery8.9CNA v4.00.5%2026-07-17Fix
CVE-2026-53712SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithms8.2CNA v4.00.3%2026-07-17Fix
CVE-2026-52746JSONata: Malicious inputs to $toMillis function can cause resource exhaustion7.5CNA v3.10.7%2026-07-17Fix
CVE-2026-52584libjxl v.0.11.2 and buffer overflow7.1CISA ADP v3.10.2%2026-07-17Fix
CVE-2026-52348cool-admin-java CrudOption order method SQL injection9.8CISA ADP v3.10.5%2026-07-17
CVE-2026-52203MCMS information disclosure7.5CISA ADP v3.10.5%2026-07-17
CVE-2026-52199UZ801_v2.1 4G LTE Router adbd daemon command injection9.1CISA ADP v3.10.7%2026-07-17
CVE-2026-51833XenForo RSS feed import server-side request forgery7.5CISA ADP v3.10.4%2026-07-17
CVE-2026-51083Proxmox Virtual Environment cloudinit dump API information disclosure6.5CISA ADP v3.10.3%2026-07-17
CVE-2026-51082Proxmox Virtual Environment VNC proxy API race condition7.2CISA ADP v3.10.4%2026-07-17
CVE-2026-51081Proxmox Virtual Environment cross-site scripting6.1CISA ADP v3.10.3%2026-07-17
CVE-2026-51080Proxmox libpve-storage-perl XML external entity injection9.8CISA ADP v3.10.5%2026-07-17Fix
CVE-2026-50289Systeminformation: OS command injection in networkInterfaces8.7CNA v4.03.6%2026-07-17Fix
CVE-2026-50274Datadog dd-trace-go W3C baggage header parser denial of service7.5CNA v3.10.8%2026-07-17Fix
CVE-2026-50273DataDog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS7.5CNA v3.10.8%2026-07-17Fix
CVE-2026-50272DataDog dd-trace-js dd-trace: Improper parsing of W3C baggage headers may lead to DoS7.5CNA v3.10.8%2026-07-17Fix
CVE-2026-50271Datadog dd-trace-py W3C baggage header parser denial of service7.5CNA v3.10.8%2026-07-17Fix
CVE-2026-50197Zalando Skipper OPA authorization filter HTTP request smuggling7.8CNA v4.00.6%2026-07-17Fix
CVE-2026-50185RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set2.0CNA v4.00.2%2026-07-17Fix
CVE-2026-50163oras-go tar archive extraction path traversal7.1CNA v3.10.3%2026-07-17Fix
CVE-2026-50162oras-go has file store write outside workingDir via symlink traversal6.9CNA v4.00.5%2026-07-17Fix
CVE-2026-50151oras-go blob upload vulnerable to credential forwarding via unvalidated Location header7.5CNA v3.10.4%2026-07-17Fix
CVE-2026-49977tarteaucitron.js cookie purge handler improper authorization4.3CNA v3.10.4%2026-07-17Fix
CVE-2026-49852joserfc HMAC signature verification authentication bypass8.7CNA v4.00.2%2026-07-17Fix
CVE-2026-49835Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality5.9CNA v3.10.7%2026-07-17Fix
CVE-2026-49834sigstore-go has a multi-log threshold bypass via single compromised log5.9CNA v3.10.2%2026-07-17Fix
CVE-2026-49485hapifhir org.hl7.fhir.core HAPI FHIR: ReDoS7.5CNA v3.10.7%2026-07-17Fix
CVE-2026-49284SimpleSAMLphp SAML SP assertion consumer service vulnerability7.1CNA v3.10.2%2026-07-17Fix
CVE-2026-49216Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data5.1CNA v4.00.3%2026-07-17Fix
CVE-2026-49215Symfony UX: CSRF Protection Bypass in symfony/ux-live-component Accept header is CORS-Safelisted2.1CNA v4.00.2%2026-07-17Fix
CVE-2026-49212Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding6.9CNA v4.00.2%2026-07-17Fix
CVE-2026-49211Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil6.9CNA v4.00.5%2026-07-17Fix
CVE-2026-49210Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag2.3CNA v4.00.3%2026-07-17Fix
CVE-2026-49209Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests5.3CNA v4.00.6%2026-07-17Fix
CVE-2026-49208Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor6.9CNA v4.00.4%2026-07-17Fix
CVE-2026-48978oras-project oras-go Bearer token authentication client server-side request forgery2.1CNA v4.00.2%2026-07-17Fix
CVE-2026-48819hey-api openapi-ts buildClientParams template prototype pollution4.8CNA v3.10.4%2026-07-17Fix
CVE-2026-48504opentelemetry-rust OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation5.3CNA v3.10.4%2026-07-17Fix
CVE-2026-48487Zeroconf mDNS record parser vulnerability5.3CNA v4.00.5%2026-07-17Fix
CVE-2026-48373Adobe Acrobat Reader heap-based buffer overflow7.8CNA v3.10.3%2026-07-17Fix
CVE-2026-48062CodeIgniter4 CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule9.8CNA v3.10.8%2026-07-17Fix
CVE-2026-48049@hapi/inert: Static-file confinement bypass via sibling-prefix path5.3CNA v3.10.6%2026-07-17Fix
CVE-2026-48045Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood6.5CNA v3.10.4%2026-07-17Fix
CVE-2026-48022@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects6.5CNA v3.10.2%2026-07-17Fix
CVE-2026-48016Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment4.3CNA v3.10.4%2026-07-17Fix
CVE-2026-48015Shopware: Stored XSS via SVG file upload no SVG sanitization4.9CNA v3.10.5%2026-07-17Fix
CVE-2026-48014Shopware: Admin API ACL Bypass in Order State Transition endpoints6.5CNA v3.10.4%2026-07-17Fix
CVE-2026-48010Shopware: Privilege escalation: Non-admin user with user:create ACL can create admin accounts6.5CNA v3.10.5%2026-07-17Fix
CVE-2026-48009Shopware: Admin account takeover via User Recovery hash exposure6.8CNA v3.10.5%2026-07-17Fix
CVE-2026-48008Shopware: Privilege escalation via Sync API Integration Admin Flag Bypass6.5CNA v3.10.5%2026-07-17Fix
CVE-2026-47184Zeroconf: Unbounded DNS record cache allows LAN-local memory exhaustion via multicast flood6.5CNA v3.10.4%2026-07-17Fix
CVE-2026-47183python-zeroconf exception logging vulnerability6.5CNA v3.10.4%2026-07-17Fix
CVE-2026-47180Zeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of service6.5CNA v3.10.4%2026-07-17Fix
CVE-2026-46420shivammathur setup-php Setup PHP: Command injection in Repository-Derived PHP Version Resolution5.6CNA v3.12.0%2026-07-17Exploit codeFix
CVE-2026-45799Square Wire protobuf length-delimited field skipping denial of service7.5CNA v3.10.7%2026-07-17Fix
CVE-2026-45785OpenMcdf directory tree lookup infinite loop6.2CNA v3.10.2%2026-07-17Fix
CVE-2026-45784rust-openssl AES key-wrap padding cipher context out-of-bounds write5.1CNA v4.00.1%2026-07-17Fix
CVE-2026-45704Pimcore: CustomReports Share Bypass7.1CNA v4.00.4%2026-07-17Fix
CVE-2026-45703Pimcore: WordExport authorization bypass for Unauthorized Document Export6.4CNA v3.10.3%2026-07-17Fix
CVE-2026-45309AsyncSSH AuthorizedKeysFile %u expansion path traversal8.2CNA v4.00.6%2026-07-17Fix
CVE-2026-45260Pimcore: Missing authorization in WebDAV MOVE via unchecked asset move handling8.1CNA v3.10.6%2026-07-17Fix
CVE-2026-45162Pimcore: Unsafe PHP deserialization in multiple Locations without allowed_classes Restriction8.0CNA v3.11.0%2026-07-17Fix
CVE-2026-44979@hapi/wreck: Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects6.3CNA v4.00.4%2026-07-17Fix
CVE-2026-44974hapi.js @hapi/content Content-Disposition header parser vulnerability7.7CNA v4.00.5%2026-07-17Fix
CVE-2026-44891Netty: Denial of service via Unbounded headers in StompSubframeDecoder7.5CNA v3.10.7%2026-07-17Fix
CVE-2026-44739Pimcore: SQL injection in Custom Reports Column Configuration8.7CNA v3.10.4%2026-07-17Fix
CVE-2026-44722pyzipper has an encryption bypass for small files encrypted using it6.2CNA v3.10.1%2026-07-17Fix
CVE-2026-44251Wazuh: Size_t underflow in msgs.c ReadSecMSG causes wazuh-remoted DoS and potential heap overflow6.5CNA v3.10.4%2026-07-17Fix
CVE-2026-42168django-pyas2 Partner model command fields OS command injection9.1CISA ADP v3.12.1%2026-07-17
CVE-2026-41993TXOne Networks SafePortAgent Removable Media Validation function improper access control6.7CNA v4.00.2%2026-07-17Fix
CVE-2026-36669ck_upload_handler.php in Feng Office arbitrary file upload9.8CISA ADP v3.10.7%2026-07-17
CVE-2026-22104Improper access control in Hashtopolis server chunk activity component7.1CNA v4.00.5%2026-07-17Fix
CVE-2026-21770HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking6.5CNA v3.10.2%2026-07-17Fix
CVE-2026-21764Insufficient input validation in DevOps Loop3.1CNA v3.10.2%2026-07-17Fix
CVE-2026-21762Missing HTTP Security headers in DevOps Loop3.7CNA v3.10.3%2026-07-17Fix
CVE-2026-21761HCL Software DevOps Loop permissive cross-domain policy4.2CNA v3.10.2%2026-07-17Fix
CVE-2026-21760HCL Software DevOps Loop unauthorized access to Admin Functionality via forced browsing4.6CNA v3.10.2%2026-07-17Fix
CVE-2026-16118Xdgmime: Heap-based buffer overflow in _xdg_mime_magic_parse_magic_line in xdgmimemagic.c7.1CNA v3.10.3%2026-07-17Fix
CVE-2026-16108Red Hat Keycloak default groups endpoint information disclosure4.3CNA v3.10.4%2026-07-17Fix
CVE-2026-16106Red Hat Keycloak admin role management API incorrect authorization4.9CNA v3.10.4%2026-07-17Fix
CVE-2026-16104Red Hat Keycloak authenticator configuration endpoint information disclosure4.3CNA v3.10.5%2026-07-17Fix
CVE-2026-16103Red Hat Keycloak CIBA token redemption vulnerability4.3CNA v3.10.3%2026-07-17
CVE-2026-16093Red Hat Keycloak client policies vulnerability5.4CNA v3.10.4%2026-07-17Fix
CVE-2026-16089Red Hat Keycloak OAuth authorization codes vulnerability5.4CNA v3.10.3%2026-07-17Fix
CVE-2026-16074AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery5.3CNA v4.00.3%2026-07-17
CVE-2026-16073AstrBotDevs AstrBot T2I feature base.py NetworkRenderStrategy.render cross-site scripting5.1CNA v4.00.3%2026-07-17
CVE-2026-16072Red Hat Keycloak organization invitations information disclosure4.9CNA v3.10.4%2026-07-17Fix
CVE-2026-16017mosaxiv clawlet cron Chat tool tool_cron.go remove authorization5.3CNA v4.00.4%2026-07-17
CVE-2026-16016poco-ai poco-claw task.py run_task server-side request forgery6.9CNA v4.00.5%2026-07-17
CVE-2026-16015poco-ai poco-claw executor_manager API tasks.py create_task missing authentication5.3CNA v4.00.6%2026-07-17
CVE-2026-16014code-projects Hospital Bed Management System Login form SQL injection6.9CNA v4.00.4%2026-07-17
CVE-2026-16013liftoff-sr CIPster cipepath.cc deserialize_symbolic out-of-bounds6.9CNA v4.00.7%2026-07-17
CVE-2026-16009itsourcecode Hospital Management System prescriptionorderdetail.php SQL injection5.3CNA v4.00.3%2026-07-17
CVE-2026-16008sagold json-schema-library propertyDependencies.ts parsePropertyDependencies prototype pollution5.3CNA v4.00.5%2026-07-17Fix
CVE-2026-15995IBM Cognos Analytics Agentic AI assistant race condition5.4CNA v3.10.2%2026-07-17Fix
CVE-2026-15982Aimogen Pro WordPress plugin privilege escalation9.8CNA v3.10.5%2026-07-17Fix
CVE-2026-15943Red Hat Keycloak identity provider secret validation vulnerability5.5CNA v3.10.3%2026-07-17
CVE-2026-15783GitHub Enterprise Server delegated bypass rule suite endpoint missing authorization5.3CNA v4.00.4%2026-07-17Fix
CVE-2026-15759ChatHelp WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-17Fix
CVE-2026-15457Kirki WordPress plugin path traversal to arbitrary directory deletion4.9CNA v3.11.1%2026-07-17Fix
CVE-2026-15415Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server6.8CNA v4.00.4%2026-07-17Fix
CVE-2026-15395Kali Forms WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-07-17Fix
CVE-2026-15380Local privilege escalation in Symantec ITMS5.1CNA v4.00.2%2026-07-17Fix
CVE-2026-15379Arbitrary file read as SYSTEM in Symantec ITMS5.1CNA v4.00.1%2026-07-17Fix
CVE-2026-15349weDevs ERP for WooCommerce company location handler missing authorization4.3CNA v3.10.5%2026-07-17Fix
CVE-2026-15343GitHub Enterprise Server Dependabot updater path traversal8.6CNA v4.00.8%2026-07-17Fix
CVE-2026-15322IBM Engineering AI Hub session token URL parameters information disclosure7.5CNA v3.10.5%2026-07-17Fix
CVE-2026-15161Ninja Forms - Excel Export WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-17Fix
CVE-2026-15160Ninja Forms - Excel Export WordPress plugin missing authorization authenticated XLS write4.3CNA v3.10.7%2026-07-17Fix
CVE-2026-15159Ninja Forms WordPress plugin insecure direct object reference4.3CNA v3.10.3%2026-07-17Fix
CVE-2026-15094WP Hotel Booking WordPress plugin reflected cross-site scripting via check_in_date parameter6.1CNA v3.10.7%2026-07-17NucleiFix
CVE-2026-15093IBM Engineering AI Hub open redirect4.3CNA v3.10.4%2026-07-17Fix
CVE-2026-15091IBM Engineering AI Hub cross-site scripting9.3CNA v3.10.6%2026-07-17Fix
CVE-2026-15069IBM Engineering AI Hub OS command injection5.4CNA v3.10.3%2026-07-17Fix
CVE-2026-15007Denial of service vulnerability in GitHub Enterprise Server allowed service disruption5.7CNA v4.00.6%2026-07-17Fix
CVE-2026-14979IBM Engineering Lifecycle Management Jazz Foundation is vulnerable to XML entity expansion attack5.3CNA v3.10.5%2026-07-17Fix
CVE-2026-14971IBM This PowerVM Novalink update is being released to address3.9CNA v3.10.1%2026-07-17Fix
CVE-2026-14956Bricksforge WordPress plugin unauthenticated privilege escalation via Pro Forms fieldIds parameter9.8CNA v3.10.5%2026-07-17Fix
CVE-2026-14871osTicket AJAX ticket-management subsystem incorrect authorization7.1CNA v4.00.4%2026-07-17Exploit codeFix
CVE-2026-14741HTTP::Date versions for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date7.5CISA ADP v3.10.6%2026-07-17Fix
CVE-2026-14503pCloud WP Backup WordPress plugin information disclosure6.5CNA v3.10.5%2026-07-17Fix
CVE-2026-14501IBM Db2 Genius Hub use of a dangerous function4.3CNA v3.10.5%2026-07-17Fix
CVE-2026-14499IBM Langflow OSS Python Interpreter component OS command injection8.8CNA v3.10.7%2026-07-17Fix
CVE-2026-13765LearnPress WordPress plugin missing authorization unauthenticated sensitive information exposure7.5CNA v3.10.7%2026-07-17Fix
CVE-2026-13473IBM Storage Protect Client is vulnerable to heap-based buffer overflow8.1CNA v3.10.7%2026-07-17Fix
CVE-2026-13448IBM Langflow public flow build endpoint remote code execution8.1CNA v3.10.7%2026-07-17Fix
CVE-2026-13446IBM Langflow hard-coded credentials9.8CNA v3.10.4%2026-07-17Fix
CVE-2026-13445IBM Langflow SaveToFile component path traversal8.1CNA v3.10.4%2026-07-17Fix
CVE-2026-13410Dancer::Plugin::Auth::Google versions for Perl have TLS verification disabled8.2CISA ADP v3.10.4%2026-07-17Fix
CVE-2026-13402Royal Elementor Addons WordPress plugin unauthenticated Private Mega Menu Template disclosure5.3CISA ADP v3.10.3%2026-07-17Fix
CVE-2026-13352Paid Membership Plugin WordPress plugin arbitrary file upload8.8CNA v3.11.1%2026-07-17Fix
CVE-2026-13082GD::SecurityImage versions for Perl use rand to generate secrets5.3CISA ADP v3.10.3%2026-07-17
CVE-2026-12715Missing authorization in Firebase Studio allows Cross-Tenant Source Code Theft8.5CNA v4.00.4%2026-07-17Fix
CVE-2026-12705Integrity mechanism of KNX-device FW-files can be bypassed in ABB Update Tool5.9CNA v4.00.2%2026-07-17
CVE-2026-12694Missing authorization in Vimesoft's Enterprise Video Platform9.1CNA v3.10.4%2026-07-17Fix
CVE-2026-12693IDOR in Vimesoft's Enterprise Video Platform9.4CNA v3.10.5%2026-07-17Fix
CVE-2026-12692Improper authentication in Vimesoft's Enterprise Video Platform9.8CNA v3.10.6%2026-07-17Fix
CVE-2026-12691Authentication bypass in Vimesoft's Enterprise Video Platform7.5CNA v3.10.5%2026-07-17Fix
CVE-2026-12393WPS Bookings for WooCommerce WordPress plugin arbitrary Booking order Cancellation via IDOR5.4CISA ADP v3.10.3%2026-07-17Fix
CVE-2026-12283aws-athena-query-federation SQL injection in Amazon Athena Synapse connector6.1CNA v4.00.6%2026-07-17Fix
CVE-2026-11966User Registration and Membership Stripe subscription handler insecure direct object reference5.3CISA ADP v3.10.3%2026-07-17Fix
CVE-2026-11961User Registration and Membership WordPress plugin unauthenticated privilege escalation8.1CISA ADP v3.10.4%2026-07-17Exploit codeFix
CVE-2026-11763IDOR in GIS Informatics' GisLab Laboratory Management System6.5CNA v3.10.4%2026-07-17
CVE-2026-11575PhonePe Payment Solutions WordPress plugin unauthenticated Payment bypass via Forged Callback7.5CISA ADP v3.10.4%2026-07-17Fix
CVE-2026-11324WooCommerce Placetopay Gateway WordPress plugin reflected cross-site scripting via redirect-url6.1CNA v3.10.4%2026-07-17
CVE-2026-10525NEX-Forms WordPress plugin unauthenticated stored XSS via form Submission6.1CISA ADP v3.10.3%2026-07-17Fix
CVE-2026-9810AI Chatbot and Workflow Automation by AIWU WordPress plugin unauthenticated privilege escalation9.8CISA ADP v3.10.5%2026-07-17Fix
CVE-2026-9762IBM Db2 JDBC and SQLJ driver code injection7.8CNA v3.10.2%2026-07-17Fix
CVE-2026-9656HubSpot All-In-One Marketing WordPress plugin sensitive information exposure4.3CNA v3.10.3%2026-07-17Fix
CVE-2026-9602Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods5.7CNA v3.10.4%2026-07-17Fix
CVE-2026-9592SEPPmail Secure Email Gateway and SEPPmail Cloud sensitive information disclosure in HTTP header7.5CNA v4.00.2%2026-07-17
CVE-2026-9588Authenticated stored cross-site scripting (XSS) in Switchvox SMB Web portal7.0CNA v4.00.4%2026-07-17Fix
CVE-2026-9587Authenticated local file inclusion (LFI) in Switchvox SMB Web portal7.1CNA v4.00.4%2026-07-17Fix
CVE-2026-9586Sangoma Switchvox SQL injection9.8NVD v3.119.0%2026-07-17KEVNucleiEmerging ThreatsExploit codeFix
CVE-2026-9585Unauthenticated reflected cross-site scripting (XSS) in Switchvox SMB Web portal8.6CNA v4.00.6%2026-07-17Fix
CVE-2026-9537Mojo::JWT versions for Perl verify HMAC signatures with a non-constant-time string comparison5.3CISA ADP v3.10.3%2026-07-17Fix
CVE-2026-9202IBM Langflow OSS unauthenticated User Registration could lead to remote code execution9.8CNA v3.10.5%2026-07-17Fix
CVE-2026-9198IBM Langflow code injection9.8CNA v3.128.7%2026-07-17KEVNucleiMetasploitEmerging ThreatsExploit codeFix
CVE-2026-9171IBM PowerVM NovaLink WebSphere Application Server resource exhaustion7.5CNA v3.10.5%2026-07-17Fix
CVE-2026-9135IBM Langflow OSS Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation9.9CNA v3.10.8%2026-07-17Fix
CVE-2026-9103IBM Langflow OSS Unauthenticated Superuser Token Issuance via Auto-Login endpoint9.8CNA v3.13.2%2026-07-17NucleiFix
CVE-2026-8861IBM Verify Identity Access information disclosure5.3CNA v3.10.4%2026-07-17Fix
CVE-2026-8859IBM Langflow OSS path traversal in APIRequest component via Content-Disposition header9.9CNA v3.10.6%2026-07-17Fix
CVE-2026-8635IBM Langflow OSS arbitrary code execution in Python Interpreter component9.9CNA v3.10.5%2026-07-17Fix
CVE-2026-8616Fense Proxy and VPN Blocker WordPress plugin unauthorized access5.3CNA v3.10.4%2026-07-17Fix
CVE-2026-8505IBM Langflow OSS authentication bypass in Webhook Endpoints Allowed Unauthorized Flow Execution9.8CNA v3.11.0%2026-07-17Fix
CVE-2026-8481IBM Langflow OSS remote code execution via Code Validation endpoint9.9CNA v3.10.9%2026-07-17Fix
CVE-2026-8476IBM Langflow OSS disk Cache deserialization remote code execution9.9CNA v3.11.0%2026-07-17Fix
CVE-2026-8396XXE in Netcad's NetGIS7.5CNA v3.10.4%2026-07-17Fix
CVE-2026-8297SQLi in GIS Informatics' GisLab Laboratory Management System9.8CNA v3.10.5%2026-07-17
CVE-2026-8075Posting a malicious markdown image crashes the Mattermost Desktop App6.5CNA v3.10.4%2026-07-17Fix
CVE-2026-8056IBM Langflow OSS parameter injection vulnerability in API Graph Execution Engine8.8CNA v3.10.5%2026-07-17Fix
CVE-2026-7872IBM Langflow file component path traversal7.5CNA v3.10.6%2026-07-17Fix
CVE-2026-7771IBM Db2 subquery statement compilation infinite loop5.5CNA v3.10.1%2026-07-17Fix
CVE-2026-7755IBM Langflow OSS MCP Server Configuration Validator Bypass via file upload API8.8CNA v3.10.7%2026-07-17Fix
CVE-2026-7754IBM Langflow OSS SSRF Protection Configuration7.7CNA v3.10.3%2026-07-17Fix
CVE-2026-7667IBM Langflow OSS API Request component Content-Disposition header handling path traversal8.8CNA v3.10.6%2026-07-17Fix
CVE-2026-7488Sensitive data exposure in IKAS Technologies' E-Commerce7.5CNA v3.10.4%2026-07-17
CVE-2026-7364IBM Verify Identity Access and Security Verify Access open redirect3.1CNA v3.10.4%2026-07-17Fix
CVE-2026-7189Sensitive data exposure in Proliz's OBS7.5CNA v3.10.4%2026-07-17Fix
CVE-2026-4942IBM i is affected by Algorithm Downgrade in Transport Layer Security []5.9CNA v3.10.4%2026-07-17Fix
CVE-2026-4938Incorrect authorization in IBM Verify Identity Access and IBM Security Verify Access6.5CNA v3.10.3%2026-07-17Fix
CVE-2026-2594Smart Custom Fields WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-17Fix
CVE-2026-63397Remorses/genql code injection7.1CNA v4.00.5%2026-07-16Fix
CVE-2026-63306stoatchat unauthenticated SSRF via proxy and embed endpoints9.2CNA v4.00.3%2026-07-16Fix
CVE-2026-63305AVideo OS command injection via ffmpeg.json.php9.2CNA v4.02.5%2026-07-16
CVE-2026-63304AVideo OS command injection via listFFmpegProcesses9.2CNA v4.02.5%2026-07-16
CVE-2026-63089wg-easy WireGuard Easy Weak Token Generation information disclosure via OTL route9.0CNA v4.00.4%2026-07-16
CVE-2026-63088stoatchat SSRF via DNS-based IP Blocklist Bypass7.7CNA v4.00.5%2026-07-16Fix
CVE-2026-63087Grafana OnCall Unauthenticated Token Hijack via Plugin Install endpoint9.3CNA v4.00.7%2026-07-16
CVE-2026-63086text-generation-inference SSRF via fetch_image in multimodal chat completions6.9CNA v4.00.4%2026-07-16
CVE-2026-63085Axelor Open Platform authorization bypass via Nested Relational Record Persistence8.7CNA v4.00.5%2026-07-16Fix
CVE-2026-63082Perfect Support Ticketing System broken access control via Agent Assignment5.3CNA v4.00.3%2026-07-16
CVE-2026-63081Ultimate Fosters Perfect Support Ticketing System notes field stored cross-site scripting5.1CNA v4.00.2%2026-07-16
CVE-2026-62994coredns uncaught exception3.7CNA v3.10.5%2026-07-16Fix
CVE-2026-62963Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport8.7CNA v4.00.5%2026-07-16Fix
CVE-2026-62826Microsoft SharePoint server spoofing4.6CNA v3.10.6%2026-07-16Fix
CVE-2026-62309CoreDNS proxyproto plugin null pointer dereference7.5CNA v3.10.7%2026-07-16Fix
CVE-2026-62299CoreDNS rewrite plugin null pointer dereference5.3CNA v3.10.5%2026-07-16Fix
CVE-2026-62290Linux Foundation cert-manager ACME challenge admission validation incorrect authorization7.3CNA v3.10.1%2026-07-16Fix
CVE-2026-61718BunkerWeb cache endpoint missing authorization5.4CNA v3.10.4%2026-07-16Fix
CVE-2026-61389AutomationDirect Productivity Suite out-of-bounds write7.3CNA v4.00.1%2026-07-16Fix
CVE-2026-61378AutomationDirect Productivity Suite divide by zero6.8CNA v4.00.2%2026-07-16Fix
CVE-2026-60140AutomationDirect Productivity Suite out-of-bounds read6.9CNA v4.00.2%2026-07-16Fix
CVE-2026-60073AutomationDirect Productivity Suite out-of-bounds read5.2CNA v4.00.2%2026-07-16Fix
CVE-2026-60063AutomationDirect Productivity Suite out-of-bounds write7.3CNA v4.00.1%2026-07-16Fix
CVE-2026-59867Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref7.1CNA v3.12.4%2026-07-16Fix
CVE-2026-59866Microsoft Kiota: Arbitrary file write + code-injection9.3CNA v4.01.4%2026-07-16Fix
CVE-2026-59865Microsoft Kiota: Command injection9.3CNA v4.04.4%2026-07-16Fix
CVE-2026-59864Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions9.3CNA v4.01.3%2026-07-16Fix
CVE-2026-59863Microsoft Kiota: Workspace-config poisoning: Out-of-repo file write + generation-time SSRF7.0CNA v4.01.4%2026-07-16Fix
CVE-2026-59862Microsoft Kiota: Code Generation Literal injection in the Python Generator7.5CNA v3.11.4%2026-07-16Fix
CVE-2026-59861Microsoft Kiota: Code Generation Literal injection in Kiota Ruby Generator7.5CNA v3.12.0%2026-07-16Fix
CVE-2026-59860Microsoft Kiota: XML Doc-Comment Newline Breakout code injection8.7CNA v4.01.4%2026-07-16Fix
CVE-2026-59859Microsoft Kiota: Code Generation Literal injection in the PHP Generator8.7CNA v4.01.4%2026-07-16Fix
CVE-2026-59249elixir-mint mint HTTP request smuggling6.3CNA v4.00.5%2026-07-16Fix
CVE-2026-59237IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders6.9CNA v4.00.6%2026-07-16Fix
CVE-2026-59117Microsoft Windows Terminal remote code execution7.5CNA v3.10.6%2026-07-16Fix
CVE-2026-58643Microsoft Windows Admin Center spoofing6.1CNA v3.10.4%2026-07-16Fix
CVE-2026-58598Microsoft Windows Backup service elevation of privilege7.0CNA v3.10.2%2026-07-16Fix
CVE-2026-58078Joomla extension themexpert.com unauthenticated SQL injection in Quix Page Builder Pro8.7CNA v4.00.4%2026-07-16
CVE-2026-57896AutomationDirect Productivity Suite out-of-bounds read6.9CNA v4.00.2%2026-07-16Fix
CVE-2026-57206Microsoft SimpleChat plugin validation endpoints missing authentication and authorization8.6CNA v3.11.0%2026-07-16Fix
CVE-2026-57205Microsoft SimpleChat user profile API insecure direct object reference4.3CNA v3.10.9%2026-07-16Fix
CVE-2026-57077YAML::Syck versions for Perl allow an out-of-bounds read7.7CISA ADP v3.10.2%2026-07-16Fix
CVE-2026-57076YAML::Syck versions for Perl allow a heap use-after-free7.8CISA ADP v3.10.2%2026-07-16Fix
CVE-2026-57075YAML::Syck versions for Perl allow an out-of-bounds read9.1CISA ADP v3.10.6%2026-07-16Fix
CVE-2026-57074XML::Bare versions for Perl have an unbounded character lookahead9.1CISA ADP v3.10.6%2026-07-16Fix
CVE-2026-57073HTML::Bare versions for Perl have an unbounded character lookahead9.1CISA ADP v3.10.7%2026-07-16
CVE-2026-56456HCL DFXAnalytics is affected by an Internal file path disclosure5.3CNA v3.10.4%2026-07-16Fix
CVE-2026-56455HCL DFXAnalytics is affected by a buffer overflow vulnerability that can lead to a denial of service5.3CNA v3.10.5%2026-07-16Fix
CVE-2026-56454HCL DFXAnalytics weak cryptographic algorithm5.9CNA v3.10.2%2026-07-16Fix
CVE-2026-56453HCL DFXAnalytics is affected by an account takeover via Response Manipulation5.5CNA v3.10.4%2026-07-16Fix
CVE-2026-55629Whistle: Path traversal8.7CNA v4.00.7%2026-07-16Fix
CVE-2026-55548Space Applications Yamcs packet export endpoint insecure direct object reference4.3CNA v3.10.4%2026-07-16Fix
CVE-2026-55440Microsoft UFO COMMAND_RESULTS handler denial of service6.5CNA v3.11.3%2026-07-16Fix
CVE-2026-55407Buffa: Memory exhaustion denial of service in decode_unknown_field via Unbounded Allocation6.3CNA v4.00.8%2026-07-16Fix
CVE-2026-55406Buffa has a use-after-free in OwnedView via Unsound 'static Lifetime Promotion in Deref5.9CNA v4.00.2%2026-07-16Fix
CVE-2026-55173WWBN AVideo FFmpeg command sanitization OS command injection8.1CNA v3.13.4%2026-07-16
CVE-2026-54733Microsoft o365-moodle moodle-local_o365: Authentication bypass9.3CNA v4.00.9%2026-07-16Fix
CVE-2026-54728bunkerity BunkerWeb Host header handling injection6.1CNA v4.00.4%2026-07-16Fix
CVE-2026-54568Microsoft UFO device info request handler missing authorization4.3CNA v3.11.0%2026-07-16Fix
CVE-2026-54526Argo Workflows artifact garbage collection pod spec patch improper access control8.9CNA v4.00.6%2026-07-16Fix
CVE-2026-54340h2o has HTTP/2 state amplification7.5CNA v3.10.5%2026-07-16Fix
CVE-2026-53598Microsoft Prompty: Arbitrary file read via file reference expansion7.5CNA v3.11.3%2026-07-16Fix
CVE-2026-53597Microsoft Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader8.7CNA v4.01.0%2026-07-16Fix
CVE-2026-53536Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL5.3CNA v4.00.2%2026-07-16Fix
CVE-2026-53535Activepieces: Arbitrary file write in git-sync via path traversal and symlinks5.9CNA v4.00.8%2026-07-16Fix
CVE-2026-53412Zoom Workplace VDI plugin for Windows improper input validation9.8CNA v3.10.5%2026-07-16Fix
CVE-2026-53411Zoom Workplace VDI Plugin for Windows improper input validation7.8CNA v3.10.1%2026-07-16Fix
CVE-2026-53410Zoom Clients for Windows race condition7.0CNA v3.10.1%2026-07-16Fix
CVE-2026-53409Zoom Communications Zoom Rooms improper privilege management7.8CNA v3.10.2%2026-07-16Fix
CVE-2026-53366Linux kernel IPv4 output fragment allocation vulnerability7.8CNA v3.10.2%2026-07-16Fix
CVE-2026-50012Squid: Memory corruption in cache_digest reply handling5.5CNA v3.12.7%2026-07-16Fix
CVE-2026-49998Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass8.2CNA v3.10.3%2026-07-16Fix
CVE-2026-48863openSUSE libsolv EdDSA PGP signature verification stack-based buffer overflow7.5CNA v3.10.8%2026-07-16Fix
CVE-2026-47751Claude Code Action MCP server configuration loading remote code execution5.3CNA v4.00.8%2026-07-16Fix
CVE-2026-47729Squid: Memory disclosure in FTP gateway6.5CNA v3.12.4%2026-07-16Emerging ThreatsExploit codeFix
CVE-2026-47089Cyrus IMAP missing authorization4.3CNA v3.10.3%2026-07-16Fix
CVE-2026-47088Cyrus IMAP buffer over-read3.1CNA v3.10.3%2026-07-16Fix
CVE-2026-47087Cyrus IMAP operation on a released resource3.5CNA v3.10.3%2026-07-16Fix
CVE-2026-47086Cyrus IMAP incorrect authorization3.5CNA v3.10.3%2026-07-16Fix
CVE-2026-47085Cyrus IMAP predictable identifiers4.0CNA v3.10.3%2026-07-16Fix
CVE-2026-47084Cyrus IMAP incorrect authorization6.5CNA v3.10.3%2026-07-16Fix
CVE-2026-47083Cyrus IMAP response discrepancy4.3CNA v3.10.3%2026-07-16Fix
CVE-2026-47082Cyrus IMAP incorrect authorization5.4CNA v3.10.3%2026-07-16Fix
CVE-2026-47081Cyrus IMAP incorrect authorization3.1CNA v3.10.2%2026-07-16Fix
CVE-2026-46687Emlog local file inclusion (LFI)7.7CNA v4.00.4%2026-07-16
CVE-2026-46686Emlog reflected cross-site scripting8.5CNA v4.00.4%2026-07-16
CVE-2026-46621Yamcs: Authenticated remote code execution (RCE) via Jython Algorithm code injection9.1CNA v3.11.1%2026-07-16Fix
CVE-2026-46562Yamcs: Remote code execution via Mission Database algorithm override9.8CNA v3.11.0%2026-07-16Fix
CVE-2026-46515Frogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL execution9.3CNA v4.00.6%2026-07-16Fix
CVE-2026-46514Frogman: Plaintext passwords and secrets persisted to audit log6.5CNA v3.10.5%2026-07-16Fix
CVE-2026-46513Frogman: API tokens stored in plaintext7.4CNA v3.10.4%2026-07-16Fix
CVE-2026-46512Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping9.9CNA v3.10.7%2026-07-16Fix
CVE-2026-46404BigBlueButton: Presentation URL Security Hardening6.8CNA v3.10.4%2026-07-16Fix
CVE-2026-46378Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal6.2CNA v3.10.2%2026-07-16Fix
CVE-2026-46377Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string6.2CNA v3.10.2%2026-07-16Fix
CVE-2026-46353BigBlueButton API checksum bypass via presentationUploadExternalUrl8.1CNA v3.10.5%2026-07-16Fix
CVE-2026-46351BigBlueButton conference session token insufficient randomness8.1CNA v3.10.5%2026-07-16Fix
CVE-2026-46341Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching6.1CNA v3.10.3%2026-07-16Fix
CVE-2026-46338PyMdown Extensions snippets base path restriction path traversal4.3CNA v3.10.4%2026-07-16Fix
CVE-2026-46336Manyfold: Authenticated path traversal via File Rename7.1CNA v3.10.5%2026-07-16Fix
CVE-2026-45795Janssen Project jans jans-auth-server improper signature verification5.3CNA v3.10.3%2026-07-16Fix
CVE-2026-45695Kopia: Unauthenticated RCE via SSH ProxyCommand injection when --insecure --without-password is used9.8CNA v3.11.6%2026-07-16NucleiFix
CVE-2026-45612rz-libdemangle Rust symbol demangler out-of-bounds read5.5CNA v3.10.2%2026-07-16
CVE-2026-45576zrok copy writes attacker-controlled WebDAV paths outside the destination root8.3CNA v4.00.5%2026-07-16Fix
CVE-2026-45568zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths9.9CNA v4.00.5%2026-07-16Fix
CVE-2026-45368Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend8.4CNA v4.00.5%2026-07-16Fix
CVE-2026-45367hapifhir org.hl7.fhir.core HAPI FHIR: ReDoS7.5CNA v3.10.7%2026-07-16Fix
CVE-2026-45336StratonWebDesigners HireFlow hard-coded credentials10.0CNA v3.10.6%2026-07-16Fix
CVE-2026-45334Kirby Panel content lock vulnerability5.3CNA v4.00.4%2026-07-16Fix
CVE-2026-45325Gestor de Oferta: Prototype pollution in @tmlmobilidade/utils setValueAtPath8.2CNA v3.10.5%2026-07-16Fix
CVE-2026-44982CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests7.2CNA v3.10.4%2026-07-16Fix
CVE-2026-44981CrowdSec LAPI: Denial of service via Unbounded Gzip Decompression8.2CNA v4.00.5%2026-07-16Fix
CVE-2026-44970dbt Labs dbt-mcp usage telemetry information disclosure3.1CNA v3.10.4%2026-07-16Fix
CVE-2026-44969dbt Labs dbt-mcp file logging information disclosure2.5CNA v3.10.2%2026-07-16Fix
CVE-2026-44968dbt MCP Server has an argument injection in dbt CLI Tool Wrappers6.3CNA v3.10.2%2026-07-16Fix
CVE-2026-44632Yamcs: Server-Side code injection9.1CNA v3.11.1%2026-07-16Fix
CVE-2026-44596Yamcs: No Rate Limiting on Authentication endpoint6.5CNA v3.12.1%2026-07-16Exploit codeFix
CVE-2026-44595Yamcs: Unauthorized user enumeration via IAM API endpoints4.3CNA v3.11.1%2026-07-16Exploit codeFix
CVE-2026-44453h2o is vulnerable to musl libc stack overflow7.5CNA v3.10.5%2026-07-16Fix
CVE-2026-44452h2o SNI extension parsing out-of-bounds read5.9CNA v3.10.4%2026-07-16Fix
CVE-2026-44436Quicly is vulnerable to connection state corruption7.5CNA v3.10.5%2026-07-16Fix
CVE-2026-44435Quicly: Remote denial of service7.5CNA v3.10.5%2026-07-16Fix
CVE-2026-44434Quicly is vulnerable to stateless reset injection5.3CNA v3.10.2%2026-07-16Fix
CVE-2026-44433Quicly is vulnerable to memory exhaustion5.3CNA v3.10.5%2026-07-16Fix
CVE-2026-44182Jupyter Enterprise Gateway has Kubernetes Manifest injection via Jinja2 Template Rendering10.0CNA v4.00.6%2026-07-16Fix
CVE-2026-44181Jupyter Enterprise Gateway Kubernetes manifest rendering server-side template injection10.0CNA v4.00.8%2026-07-16Fix
CVE-2026-44180Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed9.8CNA v3.10.7%2026-07-16Fix
CVE-2026-44177Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup8.8CNA v4.01.8%2026-07-16NucleiFix
CVE-2026-44176Kirby: `pages.access` permission is not checked during rendering of page drafts6.0CNA v4.00.4%2026-07-16Fix
CVE-2026-44175Kirby: Cross-site scripting (XSS) from list field content in the site frontend8.5CNA v4.00.4%2026-07-16Fix
CVE-2026-44174Kirby: Arbitrary Method Call via REST API search and collection query endpoints8.7CNA v4.00.5%2026-07-16Fix
CVE-2026-44023Docling Core has unsafe remote filename resolution8.6CNA v3.10.4%2026-07-16Fix
CVE-2026-44019docling-project docling-core docling Core has insufficient validation of image reference URIs8.1CNA v3.10.4%2026-07-16Fix
CVE-2026-43978wger trainer-login endpoint privilege escalation8.1CNA v3.10.4%2026-07-16Fix
CVE-2026-43977wger IDOR: Authenticated Users can Read Others' Private Workout Session Data7.5CNA v3.10.4%2026-07-16Fix
CVE-2026-40106Wazuh: Heap-based buffer overflow in syscheck Registry Wildcard Expansion (LPE / DoS)4.7CNA v3.10.1%2026-07-16Fix
CVE-2026-39359Wazuh: Unauthenticated path traversal in authd via Agent Group Name7.5CNA v3.10.4%2026-07-16Fix
CVE-2026-38158/ureport/datasource/previewData component of ureport v2.2.9 SQL injection9.8CISA ADP v3.10.5%2026-07-16
CVE-2026-36425OPSWAT AppRemover ardrv.sys driver improper privilege management6.5CISA ADP v3.10.4%2026-07-16Exploit code
CVE-2026-35149HCL DFXServer is affected by an authentication bypass vulnerability via server response manipulation8.2CNA v3.10.4%2026-07-16Fix
CVE-2026-35148HCL DFXServer is affected by a missing access control6.3CNA v3.10.3%2026-07-16Fix
CVE-2026-35147HCL DFXServer is affected by a broken authentication vulnerability via direct API access8.2CNA v3.10.4%2026-07-16Fix
CVE-2026-35146HCL Software DFXServer inadequate encryption strength6.3CNA v3.10.2%2026-07-16Fix
CVE-2026-35145HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security header vulnerability3.1CNA v3.10.3%2026-07-16Fix
CVE-2026-35143HCL DFXAnalytics is affected by a Missing SameSite attribute vulnerability3.0CNA v3.10.2%2026-07-16Fix
CVE-2026-35142HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability2.6CNA v3.10.3%2026-07-16Fix
CVE-2026-35141HCL DFXAnalytics is affected by a Login Replay Attack vulnerability2.6CNA v3.10.3%2026-07-16Fix
CVE-2026-35140HCL DFXAnalytics is affected by a Missing Secure attribute in Encrypted Session Cookie vulnerability3.0CNA v3.10.3%2026-07-16Fix
CVE-2026-34150Wazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing7.5CNA v3.10.4%2026-07-16Fix
CVE-2026-33754Wazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS)6.5CNA v3.10.4%2026-07-16Fix
CVE-2026-33731WWBN AVideo Authorize.Net webhook handler vulnerability6.5CNA v3.10.2%2026-07-16Fix
CVE-2026-33692AVideo has Unauthenticated .env File Exposure via Official Docker Compose Configuration7.5CNA v3.10.5%2026-07-16Fix
CVE-2026-33434Wazuh: Rate Limit Bypass via /events endpoint4.3CNA v3.10.4%2026-07-16Fix
CVE-2026-23538Feast: Resource exhaustion via websocket endpoint7.5CNA v3.10.9%2026-07-16
CVE-2026-22752Spring Authorization Server Spring Security authentication bypass9.6CNA v3.10.5%2026-07-16Fix
CVE-2026-21729Loki detected_fields query limits results in unbounded memory allocation7.5CNA v3.10.5%2026-07-16Fix
CVE-2026-15997Legion of the Bouncy Castle BC-LTS out-of-bounds write1.7CNA v4.00.1%2026-07-16Fix
CVE-2026-15945Red Hat Keycloak group hierarchy search insecure direct object reference4.3CNA v3.10.3%2026-07-16Fix
CVE-2026-15925Improper TLS Hostname Verification in Snowflake Connector for Python9.2CNA v4.00.3%2026-07-16Fix
CVE-2026-15909RafyMrX TOKO-ONLINE-ROTI add.php authorization5.3CNA v4.00.4%2026-07-16
CVE-2026-15737AWS bedrock-agentcore sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK5.7CNA v4.00.4%2026-07-16Fix
CVE-2026-15727WP Bulk Delete WordPress plugin SQL injection4.9CNA v3.10.6%2026-07-16Fix
CVE-2026-15652Easy Accordion WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-16Fix
CVE-2026-15651WP TripAdvisor Review Slider WordPress plugin SQL injection4.9CNA v3.10.5%2026-07-16Fix
CVE-2026-15610WPBot WordPress plugin missing authorization authenticated arbitrary RAG Document Re-Sync4.3CNA v3.10.4%2026-07-16Fix
CVE-2026-15458SEO Booster WordPress plugin authenticated (Administrator+) SQL injection via sort_field parameter4.9CNA v3.10.4%2026-07-16Fix
CVE-2026-15449TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption5.8CNA v4.00.1%2026-07-16Fix
CVE-2026-15445SEO Booster WordPress plugin authenticated (Administrator+) SQL injection via orderby parameter4.9CNA v3.10.4%2026-07-16Fix
CVE-2026-15422illumos-gate SCTP needs to better-check INIT ACK chunk parameters9.1CNA v4.00.9%2026-07-16Fix
CVE-2026-15407Themify Builder WordPress plugin authorization bypass4.3CNA v3.10.5%2026-07-16Fix
CVE-2026-15352NASA Core Flight System (cFS) Health and Safety (HS) Application null pointer dereference8.2CNA v4.00.6%2026-07-16Fix
CVE-2026-15350The Cache Purger WordPress plugin missing authorization authenticated arbitrary Log deletion4.3CNA v3.10.4%2026-07-16Fix
CVE-2026-15336Catch Themes Demo Import WordPress plugin missing authorization4.3CNA v3.10.4%2026-07-16Fix
CVE-2026-15324SysBasics Customize My Account for WooCommerce WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-07-16Fix
CVE-2026-15306Product Feed Manager For WooCommerce WordPress plugin reflected cross-site scripting6.1CNA v3.10.4%2026-07-16Fix
CVE-2026-15106WPBot WordPress plugin missing authorization unauthenticated arbitrary Chat Session deletion5.3CNA v3.10.5%2026-07-16Fix
CVE-2026-15103WPFunnels WordPress plugin privilege escalation8.8CNA v3.10.6%2026-07-16Fix
CVE-2026-15099WP Delicious WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-16Fix
CVE-2026-15022Tutor LMS WordPress plugin authenticated (Subscriber+) SQL injection via stored Quiz Answer Array6.5CNA v3.10.6%2026-07-16Fix
CVE-2026-15021wpForo Forum WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-16Fix
CVE-2026-15013SAML Single Sign On WordPress plugin unauthenticated authentication bypass9.8CNA v3.11.5%2026-07-16Exploit codeFix
CVE-2026-15008Uncanny Automator WordPress plugin unauthenticated PHP object injection to arbitrary file deletion8.1CNA v3.11.0%2026-07-16Fix
CVE-2026-15005Loco Translate WordPress plugin cross-site request forgery to remote code execution8.8CNA v3.10.3%2026-07-16Fix
CVE-2026-14987GiveWP WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-16Fix
CVE-2026-14890LMSYS SGLang expert-parallel backup subsystem remote code execution9.1CISA ADP v3.11.0%2026-07-16
CVE-2026-14782Booking for Appointments and Events Calendar Amelia WordPress plugin SQL injection4.9CNA v3.10.4%2026-07-16Fix
CVE-2026-14371Lenovo XClarity Integrator for Microsoft Windows Admin Center OS command injection8.8CNA v4.01.2%2026-07-16Fix
CVE-2026-14254Improper restriction of excessive authentication attempts in Delphix Continuous Data8.3CNA v4.00.6%2026-07-16
CVE-2026-13767Quiz and Survey Master (QSM) WordPress plugin SQL injection6.5CNA v3.10.4%2026-07-16Fix
CVE-2026-13755Tickera WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-16Fix
CVE-2026-13754Tickera WordPress plugin authenticated (Staff+) SQL injection via s parameter6.5CNA v3.10.4%2026-07-16Fix
CVE-2026-13741Digits: WordPress Mobile Number Signup and Login plugin privilege escalation8.8CNA v3.10.4%2026-07-16Fix
CVE-2026-13713YAML::Syck versions for Perl allow a use-after-free and double free6.2CISA ADP v3.10.1%2026-07-16Fix
CVE-2026-13401XML::Bare versions for Perl will hang in an infinite loop when parsing malformed attributes7.5CISA ADP v3.10.4%2026-07-16Fix
CVE-2026-13397HTML::Bare versions for Perl will hang in an infinite loop when parsing malformed attributes7.5CISA ADP v3.10.6%2026-07-16
CVE-2026-13104Lenovo App Store execution with unnecessary privileges7.0CNA v4.00.2%2026-07-16Fix
CVE-2026-13103Lenovo App Store path traversal7.0CNA v4.00.2%2026-07-16Fix
CVE-2026-13042RPB Chessboard WordPress plugin unauthenticated stored cross-site scripting via comment content7.2CNA v3.10.4%2026-07-16Fix
CVE-2026-13005MxChat WordPress plugin authenticated (Admin+) stored cross-site scripting via intro_message setting4.4CNA v3.10.3%2026-07-16Fix
CVE-2026-12979FunnelKit WordPress plugin Admin+ arbitrary file deletion via path traversal in Template Importer5.5CISA ADP v3.10.3%2026-07-16Fix
CVE-2026-12978FunnelKit WordPress plugin reflected XSS via Divi Optin form7.1CISA ADP v3.10.3%2026-07-16Fix
CVE-2026-12941MultiVendorX WordPress plugin authenticated (Store Owner+) SQL injection via order_by parameter6.5CNA v3.10.4%2026-07-16Fix
CVE-2026-12907RTMKit site-wide theme builder templates missing authorization2.7CISA ADP v3.10.3%2026-07-16Fix
CVE-2026-12906RTMKit Addons for Elementor WordPress plugin Contributor+ Private post Title disclosure2.7CISA ADP v3.10.3%2026-07-16Fix
CVE-2026-12869Header Footer Builder for Elementor WordPress plugin Contributor+ stored XSS via Template import6.1CISA ADP v3.10.3%2026-07-16Fix
CVE-2026-12753Advance Product Search- Voice and Ajax Search for WooCommerce WordPress plugin SQL injection7.5CNA v3.10.5%2026-07-16Fix
CVE-2026-12684Customer Reviews for WooCommerce media upload AJAX action vulnerability6.5CISA ADP v3.10.4%2026-07-16Fix
CVE-2026-12585Abandoned Cart Lite for WooCommerce WordPress plugin unauthenticated account takeover8.1CISA ADP v3.10.4%2026-07-16Fix
CVE-2026-12525Redux Framework WordPress plugin Subscriber+ privilege escalation to Administrator8.8CISA ADP v3.10.4%2026-07-16Fix
CVE-2026-12510AI Engine WordPress plugin Subscriber+Chatbot Discussion disclosure and takeover via IDOR5.9CISA ADP v3.10.2%2026-07-16Fix
CVE-2026-12492Happy Coders OTP Login for WooCommerce WordPress plugin unauthenticated account takeover9.8CISA ADP v3.10.5%2026-07-16Fix
CVE-2026-12434List category posts WordPress plugin information disclosure4.3CNA v3.10.4%2026-07-16Fix
CVE-2026-12409Landing Page Builder WordPress plugin cross-site request forgery to ulpb_admin_data AJAX action4.3CNA v3.10.2%2026-07-16Fix
CVE-2026-12395WP Job Portal WordPress plugin Subscriber+ SQL injection via Applied Resumes ta parameter6.5CISA ADP v3.10.4%2026-07-16Fix
CVE-2026-12391ubuntu-pro-client local privilege escalation and information disclosure5.0CNA v3.10.2%2026-07-16Fix
CVE-2026-12379Qt Axivion Dashboard OAuth/OIDC implementation open redirect6.8CNA v4.00.2%2026-07-16
CVE-2026-11889SALTO ProAccess Space authorization bypass through user-controlled key7.1CNA v4.00.3%2026-07-16Fix
CVE-2026-11866Appointment Booking Plugin request dispatcher cross-site request forgery5.4CISA ADP v3.10.1%2026-07-16Fix
CVE-2026-11386Canonical ubuntu-pro-client (ubuntu-advantage-tools) input validation and injection9.0CNA v3.10.5%2026-07-16Fix
CVE-2026-11371BetterDocs WordPress plugin unauthenticated stored XSS via AI Doc Summarizer prompt injection6.1CISA ADP v3.10.3%2026-07-16Fix
CVE-2026-10590Lenovo Yoga Pro 7 15IPH11 BIOS missing authentication6.7CNA v4.00.2%2026-07-16Fix
CVE-2026-10589Lenovo Yoga Pro 7 15IPH11 BIOS out-of-bounds write6.8CNA v4.00.2%2026-07-16Fix
CVE-2026-10588Lenovo Yoga Pro 7 15IPH11 BIOS system information disclosure6.7CNA v4.00.2%2026-07-16Fix
CVE-2026-10587Lenovo Yoga Pro 7 15IPH11 BIOS out-of-bounds write6.8CNA v4.00.1%2026-07-16Fix
CVE-2026-9494ubuntu-pro-client information disclosure via Cleartext Bearer token exposure in Process Command Line5.5CNA v3.10.1%2026-07-16Fix
CVE-2026-9046Lenovo Legion Zone insecure inherited permissions7.3CNA v4.00.1%2026-07-16Fix
CVE-2026-7543Breakdance WordPress plugin unauthenticated stored cross-site scripting via Webhook action Details7.2CNA v3.10.3%2026-07-16Fix
CVE-2026-6511Lenovo Smart Connect missing authentication6.8CNA v4.00.1%2026-07-16Fix
CVE-2026-6424ESET, spol. s r.o ESET Endpoint Antivirus use-after-free6.7CNA v4.00.2%2026-07-16Fix
CVE-2026-6423Local privilege escalation via unauthenticated ALPC in ESET Inspect Connector8.5CNA v4.00.2%2026-07-16
CVE-2026-5674Red Hat Enterprise Linux 10 pipewire: Pipewire: Sandbox escape and arbitrary code execution8.8CNA v3.10.2%2026-07-16Fix
CVE-2026-3842QEMU hyperv syndbg out-of-bounds write7.8CNA v3.10.2%2026-07-16Fix
CVE-2026-3031Image::EPEG versions for Perl embeds an unsupported version of the Epeg library9.8CISA ADP v3.10.7%2026-07-16
CVE-2026-1609Org.Keycloak/keycloak-quarkus-server: Keycloak: Unauthorized access8.1CNA v3.10.6%2026-07-16Fix
CVE-2026-63175Cross-Capture Session data leakage due to Shared Mutable State in Looklyloo PlaywrightCapture7.1CNA v4.00.5%2026-07-15
CVE-2026-62948OpenWrt DHCPv6 lease handling cross-site scripting9.6CNA v3.10.6%2026-07-15Fix
CVE-2026-62947OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download4.9CNA v3.10.5%2026-07-15Fix
CVE-2026-62843filebrowser file Browser: Archive builder turns backslash filenames into path traversal (zip-slip)6.8CNA v3.10.4%2026-07-15Fix
CVE-2026-62685filebrowser file Browser: Colliding username normalization gives two users the same home directory8.1CNA v3.10.6%2026-07-15Fix
CVE-2026-62683filebrowser file Browser: Trailing-slash delete leaves a stale public share behind3.1CNA v3.10.3%2026-07-15Fix
CVE-2026-62378RustFS Console: Critical stored XSS in Preview Modal leading to Administrative account takeover9.0CNA v3.10.5%2026-07-15Fix
CVE-2026-62361listmonk subscriber export endpoint SQL injection5.5CNA v3.10.4%2026-07-15Fix
CVE-2026-62355TDengine: Standard User permission unexpect5.4CNA v3.10.2%2026-07-15Fix
CVE-2026-62353TDengine: Authenticated out-of-bounds read in SQL Lexer tGetToken5.4CNA v3.10.3%2026-07-15Fix
CVE-2026-62351TDengine: Unauthenticated remote denial of service via out-of-bounds read in transDecompressMsg7.5CNA v3.10.5%2026-07-15Fix
CVE-2026-62350TDengine: UDF lead to RCE7.2CNA v3.10.5%2026-07-15Fix
CVE-2026-62349TDengine: Off-by-one buffer overflow8.3CNA v3.10.6%2026-07-15Fix
CVE-2026-62348taosdata TDengine missing authorization5.4CNA v3.10.3%2026-07-15Fix
CVE-2026-62314Anubis: Policy bypass via client controlled X-Original-URI header5.8CNA v3.10.3%2026-07-15Fix
CVE-2026-623129Router: Authenticated RCE via Unvalidated MCP plugin arguments8.8CNA v3.11.3%2026-07-15Fix
CVE-2026-62294Flameshot: OCTOU symlink attack via predictable /tmp path in Flameshot Open With5.1CNA v4.00.1%2026-07-15Fix
CVE-2026-61873Grav arbitrary file write via Twig-Processed Filename7.2CNA v4.00.5%2026-07-15Fix
CVE-2026-61872ImageMagick memory leak via TIFF Encoder2.0CNA v4.00.1%2026-07-15Fix
CVE-2026-61871ImageMagick memory leak in ICON decoder6.3CNA v4.00.4%2026-07-15Fix
CVE-2026-61869ImageMagick memory leak in MIFF Encoder2.1CNA v4.00.1%2026-07-15Fix
CVE-2026-61868ImageMagick memory leak in YUV Decoder6.3CNA v4.00.2%2026-07-15Fix
CVE-2026-61867ImageMagick memory leak in TIFF Encoder2.1CNA v4.00.1%2026-07-15Fix
CVE-2026-61866ImageMagick memory leak in JNG encoder7.5v3.10.2%2026-07-15Fix
CVE-2026-61865ImageMagick memory leak in Hough Lines2.1CNA v4.00.1%2026-07-15Fix
CVE-2026-61864ImageMagick memory leak in Log Colorspace2.1CNA v4.00.1%2026-07-15Fix
CVE-2026-61863ImageMagick memory leak in TIFF Encoder7.5v3.10.2%2026-07-15Fix
CVE-2026-61862ImageMagick information disclosure via identify2.1CNA v4.00.1%2026-07-15Fix
CVE-2026-61860ImageMagick use-after-free via freetype6.3CNA v4.00.4%2026-07-15Fix
CVE-2026-61859ImageMagick Policy Bypass via script operation4.8CNA v4.00.2%2026-07-15Fix
CVE-2026-61836Directus: Authorization-dependent response served from unsegmented cache key8.6CNA v3.10.5%2026-07-15Fix
CVE-2026-61835Directus: SSRF Protection Bypass via in File Import7.7CNA v3.10.4%2026-07-15Fix
CVE-2026-61828NixOS Nixpkgs MySQL service module authentication bypass8.5CNA v4.00.2%2026-07-15Fix
CVE-2026-61740LightRAG authentication middleware authentication bypass9.3CNA v4.00.7%2026-07-15Fix
CVE-2026-61736LightRAG: CORS Wildcard + Credentials enables Any-Origin Credentialed requests9.3CNA v3.11.4%2026-07-15NucleiFix
CVE-2026-61684FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT8.8CNA v4.00.5%2026-07-15
CVE-2026-61646FastGPT: Shared axios SSRF guard validates only the initial URL before following redirects6.3CNA v4.00.4%2026-07-15Fix
CVE-2026-61644FastGPT getCollectionQuote endpoint incorrect authorization7.7CNA v3.10.4%2026-07-15Fix
CVE-2026-61643FastGPT: Workflow runtime can execute another user's private HTTP toolset5.9CNA v3.10.3%2026-07-15Fix
CVE-2026-61613Cursor: Cloud Agent Browser sandbox escape7.7CNA v4.00.7%2026-07-15Fix
CVE-2026-61464ImageMagick Heap Buffer Over-Write via X111.0CNA v4.00.1%2026-07-15Fix
CVE-2026-61457Grav remote code execution via file upload Extension Bypass5.3CNA v4.00.8%2026-07-15Fix
CVE-2026-61453Grav XSS via Twig String Concatenation5.1CNA v4.00.2%2026-07-15Fix
CVE-2026-61452Grav Improper Session Invalidation JWT Access Tokens6.9CNA v4.00.3%2026-07-15Fix
CVE-2026-61451Grav Password Reset Token Poisoning via admin_base_url9.4CNA v4.00.4%2026-07-15Fix
CVE-2026-61449Grav decompression bomb via Forged ZIP Size7.1CNA v4.00.3%2026-07-15Fix
CVE-2026-61446PraisonAI remote code execution via Plugin Auto-Discovery8.6CNA v4.00.3%2026-07-15Fix
CVE-2026-61443PraisonAI remote code execution via SkillTools8.6CNA v4.00.8%2026-07-15Fix
CVE-2026-61440PraisonAI Platform authorization bypass via Label endpoints7.1CNA v4.00.4%2026-07-15Fix
CVE-2026-61438PraisonAI remote code execution via Broken AST Sandbox7.0CNA v4.00.3%2026-07-15Fix
CVE-2026-61436PraisonAI Missing Webhook signature verification8.8CNA v4.00.5%2026-07-15Fix
CVE-2026-61435PraisonAI authentication bypass via host header spoofing8.8CNA v4.00.7%2026-07-15Fix
CVE-2026-61433PraisonAI code injection via API deployment generator8.5CNA v4.00.2%2026-07-15Fix
CVE-2026-61430PraisonAI DNS Rebinding SSRF via web_crawl8.4CNA v4.00.3%2026-07-15Fix
CVE-2026-61427PraisonAI authentication bypass via HTTP-stream6.9CNA v4.00.4%2026-07-15Fix
CVE-2026-61371Microsoft AVML output path handling symlink following7.5CISA ADP v3.10.5%2026-07-15
CVE-2026-60087PraisonAI Tool Approval Cache Bypass6.9CNA v4.00.1%2026-07-15Fix
CVE-2026-60085PraisonAI Unenforced Security Policy in Subprocess Sandbox8.7CNA v4.00.4%2026-07-15Fix
CVE-2026-60065F5 NGINX Plus ngx_stream_mqtt_filter_module out-of-bounds read6.3CNA v4.00.4%2026-07-15Fix
CVE-2026-60062F5 NGINX Agent config_dirs directive path traversal5.3CNA v4.00.3%2026-07-15Fix
CVE-2026-60005F5 NGINX ngx_http_slice_module vulnerability8.8CNA v4.00.5%2026-07-15Fix
CVE-2026-59955Apollo ConfigService access key authentication bypass via raw config file appId parsing7.5CNA v3.10.6%2026-07-15Fix
CVE-2026-59954Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching7.5CNA v3.10.6%2026-07-15Fix
CVE-2026-59950MCP Python SDK: WebSocket server transport does not support Host/Origin validation7.6CNA v4.00.2%2026-07-15Fix
CVE-2026-59838Fortinet FortiSIEM cross-site scripting5.3CNA v3.10.2%2026-07-15Fix
CVE-2026-59762F5 BIG-IP HTTP/2 profile denial of service8.7CNA v4.00.6%2026-07-15Fix
CVE-2026-59259n8n permission bypass via Expression Parser Mismatch in External Secrets6.5v3.10.4%2026-07-15Fix
CVE-2026-59258immich Shared Album Editor Ownership takeover via updateUser7.2CNA v4.00.5%2026-07-15Fix
CVE-2026-59255BloodHound missing authorization on Custom Node Management API7.1CNA v4.00.4%2026-07-15
CVE-2026-59254n8n External secrets disclosure via Workflow Node Expressions6.3CNA v4.00.4%2026-07-15Fix
CVE-2026-59236Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection6.9CNA v4.00.6%2026-07-15Fix
CVE-2026-59235Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts8.7CNA v4.00.7%2026-07-15Fix
CVE-2026-58660Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop7.2CNA v4.00.5%2026-07-15Fix
CVE-2026-58659lightning-ai pytorch-lightning PyTorch Lightning arbitrary code execution8.4CNA v4.00.6%2026-07-15Fix
CVE-2026-58658GPUStack unauthenticated information disclosure via Worker endpoints8.8CNA v4.00.5%2026-07-15
CVE-2026-58655Grav Flex Objects server-side template injection via Dynamic Titles8.7CNA v4.01.1%2026-07-15Fix
CVE-2026-58559Huawei HarmonyOS DoS vulnerability in the vibration service6.5CNA v3.10.3%2026-07-15Fix
CVE-2026-58558Huawei HarmonyOS permission control vulnerability in the file system7.8CNA v3.10.1%2026-07-15Fix
CVE-2026-58557Huawei HarmonyOS design defect vulnerability in Expedition mode4.8CNA v3.10.1%2026-07-15Fix
CVE-2026-58556Huawei HarmonyOS permission control vulnerability in the Bluetooth module5.1CNA v3.10.1%2026-07-15Fix
CVE-2026-58555Huawei HarmonyOS permission bypass vulnerability in the card module6.6CNA v3.10.1%2026-07-15Fix
CVE-2026-58554Huawei HarmonyOS permission control vulnerability in the settings module6.6CNA v3.10.1%2026-07-15Fix
CVE-2026-58553Huawei HarmonyOS out-of-bounds read vulnerability in the image codec module4.0CNA v3.10.1%2026-07-15Fix
CVE-2026-58552Huawei HarmonyOS out-of-bounds read vulnerability in the image codec module5.1CNA v3.10.1%2026-07-15Fix
CVE-2026-58551Huawei HarmonyOS out-of-bounds read vulnerability in the image codec module5.1CNA v3.10.1%2026-07-15Fix
CVE-2026-58550Huawei HarmonyOS out-of-bounds read vulnerability in the image codec module4.0CNA v3.10.1%2026-07-15Fix
CVE-2026-58549Huawei HarmonyOS out-of-bounds read vulnerability in the image codec module4.0CNA v3.10.1%2026-07-15Fix
CVE-2026-58077Joomla extension weeblr.com unauthenticated stored XSS in 4Analytics8.7CNA v4.00.4%2026-07-15
CVE-2026-57996phpMyFAQ privilege escalation via Missing SuperAdmin Guard in user/add endpoint8.7CNA v4.00.4%2026-07-15Fix
CVE-2026-57833Joomla extension weeblr.com unauthenticated stored XSS in 4Analytics8.6CNA v4.00.4%2026-07-15
CVE-2026-57832Joomla extension joomdonation.com unauthenticated blind SQL injection in EDocman8.7CNA v4.00.4%2026-07-15
CVE-2026-57831Joomla extension digital-peak.com unauthenticated blind SQL injection in DP Calendar8.7CNA v4.00.4%2026-07-15
CVE-2026-57821Apache Fineract: Office list: SQL injection via Subquery in orderBy8.1CISA ADP v3.10.7%2026-07-15Exploit codeFix
CVE-2026-56764Hono Timing Attack in basicAuth and bearerAuth Middleware6.3CNA v4.00.3%2026-07-15Fix
CVE-2026-56743Cilium NetworkPolicy ipBlock enforcement incorrect authorization5.4CNA v3.10.2%2026-07-15Fix
CVE-2026-56742Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces5.9CNA v3.10.2%2026-07-15Fix
CVE-2026-56687Dell ThinOS 10 unauthorized access7.8CNA v3.10.2%2026-07-15Fix
CVE-2026-566799Router: Mass assignment in PATCH /API/settings allows authenticated authorization downgrade8.7CNA v4.00.5%2026-07-15Fix
CVE-2026-566789Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding6.4CNA v3.10.3%2026-07-15Fix
CVE-2026-56434F5 NGINX SSI module use-after-free8.3CNA v4.00.4%2026-07-15Fix
CVE-2026-56400open-webui remote code execution via CORS Misconfiguration and Session Validation9.6v3.10.5%2026-07-15Fix
CVE-2026-56398open-webui open WebUI stored cross-site scripting via OAuth Picture Claim SVG Data URI9.0v3.10.6%2026-07-15Fix
CVE-2026-56375ImageMagick memory leak in ASHLAR Coder action failure4.8CNA v4.00.1%2026-07-15Fix
CVE-2026-56353n8n authentication bypass in Chat Trigger Node6.3CNA v4.00.3%2026-07-15Fix
CVE-2026-56352n8n arbitrary file read and Execution via ExecuteWorkflow localFile parameter5.3CNA v4.00.3%2026-07-15Fix
CVE-2026-56349n8n Guardrail Node Bypass via Crafted Input6.3CNA v4.00.5%2026-07-15Fix
CVE-2026-56339Capgo Unauthenticated Organization Existence Enumeration via rescind_invitation RPC8.7CNA v4.00.5%2026-07-15Fix
CVE-2026-56287Apache Fineract: Boolean SQL injection in Client Search API leading to Local File Disclosure8.1CISA ADP v3.10.7%2026-07-15Fix
CVE-2026-56087Dell ThinOS 10 protection mechanism failure6.1CNA v3.10.2%2026-07-15Fix
CVE-2026-55723F5 NGINX Ingress Controller configuration generator vulnerability8.7CNA v4.00.5%2026-07-15Fix
CVE-2026-55652Wekan header login IP allowlist authentication bypass9.8CNA v3.10.6%2026-07-15Fix
CVE-2026-55608n8n-MCP multi-tenant workflow version backups incorrect authorization4.2CNA v3.10.3%2026-07-15Fix
CVE-2026-55576MaaAssistantArknights: PR-title expression injection in release-preparation.yml8.8CNA v4.00.5%2026-07-15
CVE-2026-55445Qinglong: Incomplete fix for improper authentication9.3CNA v4.00.7%2026-07-15Fix
CVE-2026-55410NocoBase backup restore schema name allows command injection6.7CNA v3.10.7%2026-07-15Fix
CVE-2026-55399Resource exhaustion vulnerability in the Secure Access publisher5.1CNA v4.00.4%2026-07-15Fix
CVE-2026-55398Memory management vulnerability in Secure Access clients6.9CNA v4.00.4%2026-07-15Fix
CVE-2026-55242ERPNext: Server-side template injection in Batch autonaming8.8CNA v3.10.2%2026-07-15Fix
CVE-2026-55234Wekan card, list and swimlane updates improper access control8.5CNA v3.10.4%2026-07-15Fix
CVE-2026-54563Cloudreve WebDAV path handling path traversal7.1CNA v3.10.3%2026-07-15Fix
CVE-2026-54562Cloudreve remote download workflow server-side request forgery6.5CNA v3.10.4%2026-07-15Fix
CVE-2026-54560Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim7.6CNA v3.10.5%2026-07-15Fix
CVE-2026-54458AVideo: Unauthenticated Stored DOM cross-site scripting9.6CNA v3.10.5%2026-07-15
CVE-2026-54443Dashy: Improper neutralization of script-related HTML tags in a web page (basic XSS)5.9CNA v4.00.4%2026-07-15Fix
CVE-2026-54052n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments9.9CNA v3.10.4%2026-07-15Fix
CVE-2026-53518Better Auth OAuth authorization code exchange race condition7.6CNA v4.00.4%2026-07-15Fix
CVE-2026-53517Better Auth OAuth refresh token rotation race condition8.1CNA v3.10.4%2026-07-15Fix
CVE-2026-53516better-auth better Auth: Account takeover via OAuth auto-link to unverified pre-registered email8.3CNA v3.10.3%2026-07-15Fix
CVE-2026-53515Better Auth SSO provider registration privilege escalation7.1CNA v3.10.4%2026-07-15Fix
CVE-2026-53514Better Auth organization invitation acceptance improper authentication7.7CNA v3.10.2%2026-07-15Fix
CVE-2026-53513@Better-auth/sso provider registration has server-side request forgery9.6CNA v3.10.2%2026-07-15Fix
CVE-2026-53512Better Auth OAuth refresh token endpoint missing authentication9.1CNA v4.00.3%2026-07-15Fix
CVE-2026-53447Wekan cloneBoard method missing authorization6.5CNA v3.10.4%2026-07-15Fix
CVE-2026-53446Wekan: Server-side request forgery (SSRF) via webhook integration URLs6.2CNA v4.00.5%2026-07-15Fix
CVE-2026-53445Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards7.1CNA v4.00.4%2026-07-15Fix
CVE-2026-53444Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin7.6CNA v4.00.4%2026-07-15Fix
CVE-2026-52893Wekan: OIDC account takeover via Unconditional Email-Based Account Merge in onCreateUser hook9.2CNA v4.00.5%2026-07-15Fix
CVE-2026-52892Wekan custom fields REST API privilege escalation6.5CNA v3.10.5%2026-07-15Fix
CVE-2026-52891Wekan: Shell injection via Avatar upload9.9CNA v3.10.8%2026-07-15Fix
CVE-2026-52890Wekan: Arbitrary file read and server DoS via attachment versions.original.path7.1CNA v3.10.5%2026-07-15Fix
CVE-2026-52888NocoBase: Sensitive data exposure via SQL Blacklist Bypass6.8CNA v3.10.5%2026-07-15Fix
CVE-2026-52887NocoBase: SQL injection in /API/myInAppChannels:list filter to PG-superuser RCE10.0CNA v3.10.9%2026-07-15Exploit codeFix
CVE-2026-52870LF Projects MCP Python SDK experimental task handlers missing authorization7.6CNA v3.10.4%2026-07-15Fix
CVE-2026-52869MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal7.1CNA v3.10.5%2026-07-15Fix
CVE-2026-52865F5 NGINX Ingress Controller Ingress and TransportServer resource processing null pointer dereference7.1CNA v4.00.5%2026-07-15Fix
CVE-2026-52843Lightpanda fetch and XMLHttpRequest cookie handling vulnerability9.3CNA v3.10.2%2026-07-15Fix
CVE-2026-52842Lightpanda URL origin parser same-origin policy bypass9.3CNA v3.10.2%2026-07-15Fix
CVE-2026-51380Tenda AC10 v3 buffer overflow9.8CISA ADP v3.10.7%2026-07-15
CVE-2026-50562FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows9.3CNA v4.00.2%2026-07-15
CVE-2026-50183WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section4.7CNA v3.10.3%2026-07-15
CVE-2026-50182AVideo has Unauthenticated reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination6.1CNA v3.10.3%2026-07-15
CVE-2026-50148Metabase: Remote code execution via Snowflake JDBC driver arbitrary file write10.0CNA v3.10.8%2026-07-15Fix
CVE-2026-50147Metabase: Arbitrary file read via MySQL Connection Property injection7.6CNA v3.10.3%2026-07-15Fix
CVE-2026-50144Tencent ncnn param file parser out-of-bounds write7.1CNA v3.10.2%2026-07-15
CVE-2026-50124DataEase: Remote code execution (RCE) via Zip protocol and File Dropper7.1CNA v4.00.6%2026-07-15Fix
CVE-2026-50030DataEase: Arbitrary SQL execution in preview path (direct data disclosure)7.1CNA v4.00.5%2026-07-15Fix
CVE-2026-49997SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted5.4CNA v3.10.3%2026-07-15Fix
CVE-2026-49988Repomix: Attach_packed_output can bypass file-read secret scanning for supported local files6.8CNA v4.00.2%2026-07-15Fix
CVE-2026-49987Repomix: Command injection (RCE) via `--remote-branch` argument injection7.5CNA v4.00.7%2026-07-15Fix
CVE-2026-49867DataEase: Authenticated stored XSS in DataEase Template Static Resources6.3CNA v4.00.5%2026-07-15Fix
CVE-2026-49501Dell PowerScale OneFS improper privilege management6.7CNA v3.10.2%2026-07-15Fix
CVE-2026-49445Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access9.2CNA v3.10.2%2026-07-15Fix
CVE-2026-493539Router: Local-Only Access Gate Bypass in 9router via host Header SpoofING7.5CNA v3.10.4%2026-07-15
CVE-2026-493529Router: Hard-coded Default fallback JWT Secret allows authentication bypass9.8CNA v3.10.6%2026-07-15Exploit codeFix
CVE-2026-49279WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket handler ( Bypass)7.7CNA v4.00.5%2026-07-15
CVE-2026-48799gitroomhq postiz-app postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook7.7CNA v3.10.2%2026-07-15Fix
CVE-2026-48795Incomplete fix for in @adonisjs/bodyparser8.6CNA v3.10.5%2026-07-15Fix
CVE-2026-47703AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle6.3CNA v4.00.1%2026-07-15Fix
CVE-2026-47164Vaultwarden SSO account linking improper access control7.7CNA v3.10.4%2026-07-15Fix
CVE-2026-47160Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass5.8CNA v3.10.4%2026-07-15Fix
CVE-2026-47159Vaultwarden SSO discovery information disclosure6.9CNA v4.00.7%2026-07-15Fix
CVE-2026-47158Vaultwarden: CSRF in SSO Authorization Flow8.3CNA v3.10.3%2026-07-15Fix
CVE-2026-46709Tabby: Drag-and-drop path injection still allows RCE7.8CNA v3.10.3%2026-07-15Fix
CVE-2026-46684DataEase: Unauthorized command execution9.5CNA v4.00.3%2026-07-15Fix
CVE-2026-46485lissy93 dashy dash: Users can write to config despire permissions (OIDC tested)8.2CNA v3.10.4%2026-07-15Fix
CVE-2026-46459Missing authorization in ICU Scandinavia Boomerang5.3CNA v4.00.4%2026-07-15Fix
CVE-2026-46458Credential exposure in ICU Scandinavia Boomerang7.1CNA v4.00.4%2026-07-15Fix
CVE-2026-46421@cap-js/sqlite embedded malicious code9.3CNA v4.00.5%2026-07-15Fix
CVE-2026-463399Router: Unauthenticated remote code execution via unprotected MCP custom plugin routes10.0CNA v3.13.4%2026-07-15NucleiExploit codeFix
CVE-2026-45806Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url7.7CNA v3.10.4%2026-07-15Fix
CVE-2026-45805Penpot: MCP REPL server binds to with unauthenticated /execute endpoint RCE8.8CNA v3.10.4%2026-07-15Exploit codeFix
CVE-2026-45804Diffusers: TOCTOU Trust Remote Code Bypass7.5CNA v3.10.4%2026-07-15Fix
CVE-2026-45793Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs7.5CNA v3.11.0%2026-07-15Fix
CVE-2026-45738Argo CD application link annotations stored cross-site scripting7.3CNA v3.10.6%2026-07-15Fix
CVE-2026-45737Argo CD ServerSideDiff secret redaction information disclosure6.3CNA v3.10.5%2026-07-15Fix
CVE-2026-45535DataEase: Stored SQL injection8.7CNA v4.00.4%2026-07-15Fix
CVE-2026-45534DataEase Redshift data source connector remote code execution9.0CNA v4.00.6%2026-07-15Fix
CVE-2026-45533DataEase: Path traversal8.3CNA v4.00.5%2026-07-15Fix
CVE-2026-45419DataEase: Arbitrary file write8.5CNA v4.00.5%2026-07-15Fix
CVE-2026-45417DataEase: SQL injection8.7CNA v4.00.4%2026-07-15Fix
CVE-2026-45337Better Auth device authorization plugin improper authorization7.6CNA v3.10.2%2026-07-15Fix
CVE-2026-45320DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL injection8.7CNA v4.00.5%2026-07-15Fix
CVE-2026-45313Sandboxie-Plus: Sandboxie APC injection sandbox escape7.7CNA v3.10.2%2026-07-15Fix
CVE-2026-45150zen-browser desktop Zen Browser Missing Fullscreen Security Notification allows origin spoofing6.3CNA v4.00.4%2026-07-15Fix
CVE-2026-44986Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile9.9CNA v3.10.5%2026-07-15Fix
CVE-2026-43637Cornac path traversal via _extract_archive in download.py8.8CNA v4.00.7%2026-07-15Exploit codeFix
CVE-2026-42936SBI SECURITIES HYPER SBI 2 uncontrolled search path8.4CNA v4.00.2%2026-07-15Fix
CVE-2026-42533NGINX Map directive and Regex matching vulnerability9.2CNA v4.00.9%2026-07-15Exploit codeFix
CVE-2026-41580Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)6.1CNA v3.10.3%2026-07-15Fix
CVE-2026-40958Input validation error in Secure Access clients2.3CNA v4.00.4%2026-07-15Fix
CVE-2026-40957Frameable content vulnerability in the Secure Access server login page6.1CNA v4.00.4%2026-07-15Fix
CVE-2026-40956Memory disclosure in Secure Access Clients2.1CNA v4.00.3%2026-07-15Fix
CVE-2026-40955Integer underflow vulnerability in Secure Access clients2.1CNA v4.00.3%2026-07-15Fix
CVE-2026-40954Integer underflow in Secure Access clients2.1CNA v4.00.3%2026-07-15Fix
CVE-2026-40953Heap overflow in Secure Access clients6.7CNA v4.00.1%2026-07-15Fix
CVE-2026-40952Privilge misconfiguration in Secure Access installers8.5CNA v4.00.1%2026-07-15Fix
CVE-2026-40633Dell PowerScale OneFS sensitive information in log files7.8CNA v3.10.2%2026-07-15Fix
CVE-2026-40501CherryHQ cherry-studio Cherry Studio RCE via SearchService nodeIntegration Misconfiguration8.6CNA v4.00.8%2026-07-15
CVE-2026-38974Dulwich paramiko SSH transport improper certificate validation5.3CISA ADP v3.10.3%2026-07-15Fix
CVE-2026-38755BusyBox evalcommand function heap-based buffer overflow7.5CISA ADP v3.10.3%2026-07-15Fix
CVE-2026-38754BusyBox ifsbreakup function heap-based buffer overflow7.5CISA ADP v3.10.4%2026-07-15Fix
CVE-2026-38753BusyBox awk_sub function use-after-free7.5CISA ADP v3.10.2%2026-07-15Fix
CVE-2026-38752BusyBox evaluate function stack-based buffer overflow7.5CISA ADP v3.10.3%2026-07-15Fix
CVE-2026-36590emqx nanomq missing resource release7.5CISA ADP v3.10.6%2026-07-15Exploit code
CVE-2026-35152Apache Fineract: SQL injection in runreports endpoint8.8CISA ADP v3.13.3%2026-07-15Fix
CVE-2026-33684AVideo's privilege escalation5.3CNA v3.10.3%2026-07-15Fix
CVE-2026-33445Memory management vulnerability in Secure Access servers8.7CNA v4.00.4%2026-07-15Fix
CVE-2026-33444Memory management vulnerability in Secure Access servers6.9CNA v4.00.4%2026-07-15Fix
CVE-2026-33443Memory management error in Secure Access servers7.1CNA v4.00.4%2026-07-15Fix
CVE-2026-33213Redash: Open redirect vulnerability in post-login redirect handling6.1CNA v3.10.3%2026-07-15Fix
CVE-2026-30623LiteLLM MCP server configuration command injection9.8CISA ADP v3.15.0%2026-07-15Nuclei
CVE-2026-30618xszyou Fay MCP STDIO server management code injection9.8CISA ADP v3.11.2%2026-07-15
CVE-2026-26719xxl-job-admin v.3.0.0 cross-site scripting6.1CISA ADP v3.10.4%2026-07-15Exploit code
CVE-2026-26718xxl-job-admin web application v.3.0.0 cross-site request forgery9.1CISA ADP v3.10.2%2026-07-15
CVE-2026-26032Apache Ivy: PackagerResolver path traversal5.4CISA ADP v3.10.7%2026-07-15Fix
CVE-2026-20298Sensitive information disclosure through the storage/passwords REST endpoint in Splunk Enterprise5.3CNA v3.10.3%2026-07-15Fix
CVE-2026-20297Path traversal through explicit_appname in the App Install REST endpoint in Splunk Enterprise7.2CNA v3.10.6%2026-07-15Fix
CVE-2026-20296Splunk Enterprise and Cloud Platform deployment server cross-site request forgery8.3CNA v3.10.2%2026-07-15Fix
CVE-2026-20187Cisco RoomOS Security Hardening Release Exceptional Conditions Handling vulnerabilities7.5CNA v3.10.5%2026-07-15Fix
CVE-2026-20158Cisco RoomOS Security Hardening Release Resource Lifetime Management vulnerabilities7.5CNA v3.10.5%2026-07-15Fix
CVE-2026-20157Cisco RoomOS Security Hardening Release missing encryption7.5CNA v3.10.2%2026-07-15Fix
CVE-2026-20156Cisco RoomOS Security Hardening Release Buffer Management vulnerabilities8.1CNA v3.10.5%2026-07-15Fix
CVE-2026-20153Cisco RoomOS Security Hardening Release Input Validation vulnerabilities7.5CNA v3.10.5%2026-07-15Fix
CVE-2026-20150Cisco RoomOS Security Hardening Release Access Control vulnerabilities8.8CNA v3.10.4%2026-07-15Fix
CVE-2026-20146Cisco Identity Services Engine path traversal5.5CNA v3.10.5%2026-07-15
CVE-2026-15921nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory2.1CNA v4.00.3%2026-07-15Fix
CVE-2026-15907H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata SQL injection6.9CNA v4.00.4%2026-07-15
CVE-2026-15895OS command injection in jsii-diff in AWS jsii8.4CNA v4.01.1%2026-07-15Fix
CVE-2026-15809Red Hat OpenShift Container Platform format string7.8CNA v3.10.2%2026-07-15Fix
CVE-2026-15804MetaGuru｜HCM SQL injection8.7CNA v4.00.5%2026-07-15Fix
CVE-2026-15779Samba pam_winbind mkhomedir incorrect permission assignment6.1CNA v3.10.1%2026-07-15Fix
CVE-2026-15746Amazon strands-agents-tools credential disclosure in Strands Agents tools elasticsearch_memory tool6.9CNA v4.00.4%2026-07-15Fix
CVE-2026-15583SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header8.6CNA v3.10.5%2026-07-15Exploit codeFix
CVE-2026-15030ASUS System Control Interface v3 out-of-bounds read5.6CNA v4.00.1%2026-07-15
CVE-2026-15029ASUS System Control Interface v3 untrusted pointer dereference8.4CNA v4.00.2%2026-07-15
CVE-2026-14961Pegatron Tdelo64.sys IOCTL dispatcher privilege escalation6.2CISA ADP v3.10.2%2026-07-15
CVE-2026-14960Pegatron Tdelo64.sys TdeIo device interface improper access control9.8CISA ADP v3.10.5%2026-07-15
CVE-2026-14251Red Hat OpenShift GitOps ClusterRole reconciler missing authorization7.7CNA v3.10.4%2026-07-15
CVE-2026-13585ASUS System Control Interface sensitive information not cleared before reuse8.2CNA v4.00.2%2026-07-15Exploit code
CVE-2026-13385ASUS Router improper certificate validation9.5CNA v4.00.1%2026-07-15
CVE-2026-13230Information disclosure vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC715.3CNA v4.00.4%2026-07-15Fix
CVE-2026-12997Gravity Forms WordPress plugin unauthenticated arbitrary file read7.5CNA v3.10.9%2026-07-15Fix
CVE-2026-12512Quotes Llama WordPress plugin unauthenticated SQL injection via sc parameter8.6CISA ADP v3.10.4%2026-07-15Fix
CVE-2026-12382Red Hat Ansible Automation Platform AAP Gateway Envoy proxy authentication bypass8.2CNA v3.10.5%2026-07-15Fix
CVE-2026-12281Shibboleth HTTP header identity improper authentication8.1CISA ADP v3.10.4%2026-07-15Fix
CVE-2026-11851ASUS Router SQL command improper neutralization5.9CNA v4.00.5%2026-07-15
CVE-2026-11580Kali Forms WordPress plugin Contributor+ arbitrary post Metadata disclosure via IDOR5.5CISA ADP v3.10.3%2026-07-15Fix
CVE-2026-11579Kali Forms WordPress plugin unauthenticated Media upload5.3CISA ADP v3.10.4%2026-07-15Fix
CVE-2026-10673zephyrproject zephyr out-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassembly8.3CNA v3.10.4%2026-07-15Fix
CVE-2026-9770Hard-coded cryptographic key information disclosure vulnerability on TP-Link Kasa EC70 and EC718.6CNA v4.00.3%2026-07-15Fix
CVE-2026-9007Reflected XSS in HCL Notes5.5CNA v4.00.4%2026-07-15
CVE-2026-8920ASUS Aura Wallpaper Service external control of a file path8.5CNA v4.00.1%2026-07-15
CVE-2026-8919ASUS GameSDK permissive cross-domain policy7.2CNA v4.00.4%2026-07-15
CVE-2026-1563Adobe Pega Platform reflected cross-site scripting4.8CNA v4.00.2%2026-07-15Fix
CVE-2026-1562Adobe Pega Platform stored cross-site scripting4.6CNA v4.00.2%2026-07-15Fix
CVE-2026-62659Authenticated users can make unauthorized changes on NETGEAR WAX333 Access Points4.3CNA v4.00.2%2026-07-14Fix
CVE-2026-62658NETGEAR RAX43 improper input validation4.7CNA v4.00.3%2026-07-14Fix
CVE-2026-62657Certificate validation vulnerability in NETGEAR Gaming Router and certain Nighthawk models4.9CNA v4.00.2%2026-07-14Fix
CVE-2026-62656Post-authenticated command injection vulnerability found in certain NETGEAR RAX models5.4CNA v4.00.3%2026-07-14Fix
CVE-2026-62655A DoS vulnerability due to stack overflow exists in certain NETGEAR Orbi models5.7CNA v4.00.3%2026-07-14Fix
CVE-2026-62644Roundcube Webmail authentication bypass by spoofing9.8v3.10.5%2026-07-14Fix
CVE-2026-62643Roundcube Webmail server-side request forgery10.0v3.10.2%2026-07-14Fix
CVE-2026-62642Roundcube Webmail infinite loop6.5v3.10.5%2026-07-14Fix
CVE-2026-62641Roundcube Webmail resource exhaustion6.5v3.10.5%2026-07-14Fix
CVE-2026-62422JetBrains YouTrack missing authentication10.0CNA v3.10.6%2026-07-14Fix
CVE-2026-62393Apache Kylin: Improper authorization in job information retrieval4.3v3.10.5%2026-07-14Fix
CVE-2026-62392Apache Kylin: OS command injection via Async Query API9.8v3.12.5%2026-07-14Fix
CVE-2026-62390Apache Kylin: SQL injection vulnerability in Catalog Cache Refresh API9.8v3.10.7%2026-07-14Fix
CVE-2026-61520SimpleMachines SMF Simple Machines Forum SSRF via image proxy6.3CNA v4.00.4%2026-07-14Fix
CVE-2026-60119Hi.Events XSS via Event Title JSON.stringify injection5.1CNA v4.00.3%2026-07-14Fix
CVE-2026-60118HiEventsDev Hi.Events order creation endpoint missing authorization6.9CNA v4.00.4%2026-07-14Fix
CVE-2026-60114Sustainable Irrigation Platform path traversal via JSON Backup Restore8.7CNA v4.00.5%2026-07-14
CVE-2026-60082DBI versions for Perl do not enforce statement handle consistency with the row9.1CISA ADP v3.10.7%2026-07-14Fix
CVE-2026-60081DBI::ProfileData versions for Perl do not limit the path index7.5CISA ADP v3.10.6%2026-07-14Fix
CVE-2026-59891sigstore-js OCI registry credential lookup credential exposure9.6CNA v3.10.5%2026-07-14Exploit codeFix
CVE-2026-59889FasterXML jackson-databind JsonUnwrapped property deserialization incorrect authorization6.5CNA v3.10.3%2026-07-14Fix
CVE-2026-59888FasterXML jackson-databind record property naming mass assignment6.5CNA v3.10.4%2026-07-14Fix
CVE-2026-59886pyasn1 REAL value decoder resource exhaustion7.5CNA v3.10.6%2026-07-14Fix
CVE-2026-59885pyasn1 object identifier decoder algorithmic complexity7.5CNA v3.10.6%2026-07-14Fix
CVE-2026-59884pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs7.5CNA v3.10.6%2026-07-14Fix
CVE-2026-59841Fortinet FortiSIEMWindowsAgent improper channel restriction6.9CNA v3.10.2%2026-07-14Fix
CVE-2026-59840Fortinet FortiOS A buffer over-read4.1CNA v3.10.3%2026-07-14Fix
CVE-2026-59839Fortinet FortiProxy path traversal5.0CNA v3.10.3%2026-07-14Fix
CVE-2026-59837Fortinet FortiPAM stack-based buffer overflow5.9CNA v3.10.7%2026-07-14Fix
CVE-2026-59836Fortinet FortiClientEMS improper certificate validation6.7CNA v3.10.2%2026-07-14Fix
CVE-2026-59835Fortinet FortiSandbox resource exposure7.7CNA v3.10.4%2026-07-14Fix
CVE-2026-59733rclone serve restic private-repos path traversal8.8CNA v3.10.6%2026-07-14Fix
CVE-2026-59732rclone archive extract allows S3 destination prefix escape via crafted archive paths5.0CNA v3.10.3%2026-07-14Fix
CVE-2026-59674SUSE openSUSE Tumbleweed LPE from suricata user to root due to chown in %post in suricata packaging7.1CNA v4.00.2%2026-07-14Fix
CVE-2026-59246Mint HTTP/2 CONTINUATION frame handling resource exhaustion6.3CNA v4.00.5%2026-07-14Fix
CVE-2026-59205Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply` via output mode mismatch7.5CNA v3.10.4%2026-07-14Fix
CVE-2026-59204Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service8.7CNA v4.00.4%2026-07-14Fix
CVE-2026-59203Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service5.3CNA v3.10.4%2026-07-14Fix
CVE-2026-59200Pillow: Decompression bomb DoS via PdfParser.PdfStream.decode7.5CNA v3.10.4%2026-07-14Fix
CVE-2026-59199Pillow: Heap out-of-bounds write `Image.paste` / `Image.crop` via signed coordinate overflow7.5CNA v3.10.4%2026-07-14Fix
CVE-2026-59198Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images6.5CNA v3.10.3%2026-07-14Fix
CVE-2026-59197Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter`8.2CNA v3.10.4%2026-07-14Fix
CVE-2026-59084Apache Tomcat: EncryptInterceptor requirements not clearly documented9.1CISA ADP v3.10.5%2026-07-14Fix
CVE-2026-59083Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass9.1CISA ADP v3.10.4%2026-07-14Fix
CVE-2026-58647Microsoft PowerBI Report Server spoofing8.0CNA v3.10.5%2026-07-14Fix
CVE-2026-58644Microsoft SharePoint deserialization of untrusted data9.8CNA v3.115.9%2026-07-14KEVNucleiEmerging ThreatsFix
CVE-2026-58640Microsoft Windows NTFS remote code execution7.3CNA v3.10.4%2026-07-14Fix
CVE-2026-58638Microsoft Windows Boot Loader security feature bypass6.0CNA v3.10.2%2026-07-14Fix
CVE-2026-58637Microsoft Windows Client-Side Caching elevation of privilege7.0CNA v3.10.3%2026-07-14Fix
CVE-2026-58636Microsoft PC Manager elevation of privilege7.8CNA v3.10.4%2026-07-14Fix
CVE-2026-58635Microsoft Windows Narrator Braille elevation of privilege7.8CNA v3.10.3%2026-07-14Exploit codeFix
CVE-2026-58634Microsoft Windows Desktop Window Manager elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-58633Microsoft Windows Desktop Window Manager elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-58632Microsoft Windows Win32 Kernel subsystem elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-58631Microsoft Windows Admin Center (WAC) remote code execution7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-58629Microsoft Windows DirectX Graphics Kernel elevation of privilege7.0CNA v3.10.3%2026-07-14Fix
CVE-2026-58628Microsoft Windows Wireless Network Manager elevation of privilege7.8CNA v3.10.2%2026-07-14Fix
CVE-2026-58627Microsoft Windows DHCP server denial of service7.5CNA v3.11.2%2026-07-14Fix
CVE-2026-58626Microsoft Windows Remote Desktop services remote code execution8.8CNA v3.10.9%2026-07-14Fix
CVE-2026-58619Microsoft Windows Sensor Data service elevation of privilege7.0CNA v3.10.3%2026-07-14Fix
CVE-2026-58618Microsoft Excel remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-58617M365 Copilot for iOS elevation of privilege8.1CNA v3.10.8%2026-07-14Fix
CVE-2026-58614Microsoft Windows Kernel security feature bypass5.5CNA v3.10.4%2026-07-14Fix
CVE-2026-58613Microsoft Windows Cloud Files Mini Filter driver elevation of privilege7.8CNA v3.10.4%2026-07-14Fix
CVE-2026-58610Microsoft Windows Media Foundation remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-58609Microsoft Windows Graphics component remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-58608Microsoft Windows Print Spooler remote code execution8.8CNA v3.10.6%2026-07-14Fix
CVE-2026-58602Microsoft Windows Kernel-Mode driver elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-58601Microsoft Windows Virtual Hard Disk (VHD) Miniport driver elevation of privilege Vulernability7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-58595Microsoft Bing App for IOS spoofing8.1CNA v3.10.7%2026-07-14Fix
CVE-2026-58594Microsoft Windows remote Desktop client remote code execution8.8CNA v3.10.8%2026-07-14Fix
CVE-2026-58547Microsoft Windows Universal Plug and Play (UPnP) device host elevation of privilege5.5CNA v3.10.4%2026-07-14Fix
CVE-2026-58546Microsoft Windows Remote Desktop client information disclosure6.5CNA v3.10.9%2026-07-14Fix
CVE-2026-58545Microsoft Windows Kernel security feature bypass5.5CNA v3.10.4%2026-07-14Fix
CVE-2026-58544Microsoft Windows Management services elevation of privilege7.0CNA v3.10.3%2026-07-14Fix
CVE-2026-58543Microsoft Windows universal Print Management service elevation of privilege6.3CNA v3.10.2%2026-07-14Fix
CVE-2026-58542Microsoft Windows Media remote code execution7.8CNA v3.10.4%2026-07-14Fix
CVE-2026-58541Microsoft DWM Core library elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-58540Microsoft Windows Installer elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-58539Microsoft Windows Remote Desktop client information disclosure6.5CNA v3.10.9%2026-07-14Fix
CVE-2026-58538Microsoft Windows Bluetooth service elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-58537Microsoft NAT Helper components (ipnathlp.dll) elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-58536Microsoft Windows Cloud Files Mini Filter driver elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-58535Microsoft Windows Remote Desktop client information disclosure6.5CNA v3.10.9%2026-07-14Fix
CVE-2026-58534Microsoft Windows Input Method Editor (IME) elevation of privilege8.8CNA v3.10.3%2026-07-14Fix
CVE-2026-58533Microsoft Windows Remote Desktop client information disclosure6.5CNA v3.10.9%2026-07-14Fix
CVE-2026-58532Microsoft Windows Kernel elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-58531Microsoft Windows SMB elevation of privilege7.5CNA v3.10.5%2026-07-14Fix
CVE-2026-58530Microsoft Windows Resilient File System (ReFS) remote code execution7.8CNA v3.10.4%2026-07-14Fix
CVE-2026-58529Microsoft Windows Active Directory Federation Services (ADFS) information disclosure7.1CNA v3.11.0%2026-07-14Fix
CVE-2026-58528Microsoft Windows USB Audio class driver information disclosure6.8CNA v3.10.5%2026-07-14Fix
CVE-2026-58527Microsoft Windows Runtime elevation of privilege7.8CNA v3.10.2%2026-07-14Fix
CVE-2026-58526Microsoft Windows Storage elevation of privilege7.0CNA v3.10.2%2026-07-14Fix
CVE-2026-58479Sustainable Irrigation Platform RCE via cli_control plugin command injection9.2CNA v4.04.4%2026-07-14
CVE-2026-58478Sustainable Irrigation Platform SSRF via Node-RED Callback URL6.3CNA v4.00.4%2026-07-14
CVE-2026-58477Sustainable Irrigation Platform mass assignment via HTTP parameters7.5v3.10.5%2026-07-14
CVE-2026-58476Sustainable Irrigation Platform CSRF via Administrative GET requests7.0CNA v4.00.3%2026-07-14
CVE-2026-58475Sustainable Irrigation Platform stored XSS via Program Name6.1v3.10.3%2026-07-14
CVE-2026-58319Apache Doris: Improper authentication in Frontend HTTP API9.1v3.10.7%2026-07-14Fix
CVE-2026-58279Microsoft Azure CycleCloud elevation of privilege6.5CNA v3.10.6%2026-07-14Fix
CVE-2026-58277Microsoft SharePoint elevation of privilege8.8CNA v3.10.9%2026-07-14Fix
CVE-2026-58233Remote code execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)7.6CNA v3.10.6%2026-07-14Fix
CVE-2026-58229Mint HTTP/1 header decoding resource exhaustion8.2CNA v4.00.5%2026-07-14Fix
CVE-2026-57982Microsoft Windows Remote Desktop Protocol (RDP) information disclosure6.5CNA v3.11.0%2026-07-14Fix
CVE-2026-57979Microsoft Windows Remote Desktop Protocol (RDP) information disclosure6.5CNA v3.10.9%2026-07-14Fix
CVE-2026-57976Microsoft Windows Active Directory Domain services denial of service6.5CNA v3.11.1%2026-07-14Fix
CVE-2026-57973Microsoft Windows Subsystem for Linux (WSL2) Kernel tampering6.3CNA v3.10.2%2026-07-14Fix
CVE-2026-57969Microsoft Azure CycleCloud elevation of privilege8.8CNA v3.10.8%2026-07-14Fix
CVE-2026-57968Microsoft Windows Subsystem for Linux (WSL2) Kernel elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-57898Eclipse BaSyx path traversal9.0CNA v3.10.7%2026-07-14Fix
CVE-2026-57108Microsoft .NET denial of service7.5CNA v3.11.2%2026-07-14Fix
CVE-2026-57107Microsoft Windows Admin Center elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-57102Microsoft Visual Studio Code security feature bypass8.8CNA v3.10.8%2026-07-14Fix
CVE-2026-57101Microsoft Visual Studio Code security feature bypass7.1CNA v3.10.5%2026-07-14Fix
CVE-2026-57097Microsoft XML security feature bypass6.4CNA v3.10.5%2026-07-14Fix
CVE-2026-57096Microsoft Windows Routing and Remote Access Service (RRAS) elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-57095Microsoft Windows win32k elevation of privilege6.2CNA v3.10.5%2026-07-14Fix
CVE-2026-57094Microsoft Windows Media Foundation remote code execution8.8CNA v3.10.8%2026-07-14Fix
CVE-2026-57093Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.0CNA v3.10.3%2026-07-14Fix
CVE-2026-57092Microsoft Windows VMSwitch elevation of privilege9.9CNA v3.10.9%2026-07-14Fix
CVE-2026-57091Microsoft Windows File History service elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-57090Microsoft Windows Media Foundation remote code execution8.8CNA v3.10.8%2026-07-14Fix
CVE-2026-57089Microsoft Windows SMB Server Network Transport driver (srvnet.sys) remote code execution7.5CNA v3.10.7%2026-07-14Fix
CVE-2026-57088Microsoft Windows Extensible Storage Engine (ESENT) elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-57087Microsoft Windows Media Foundation remote code execution8.8CNA v3.10.8%2026-07-14Fix
CVE-2026-57085Microsoft Windows Print Spooler information disclosure5.5CNA v3.10.4%2026-07-14Fix
CVE-2026-57084Microsoft Windows File Explorer information disclosure5.5CNA v3.10.5%2026-07-14Fix
CVE-2026-57083Microsoft Windows Media Photo Codec information disclosure5.5CNA v3.10.5%2026-07-14Fix
CVE-2026-56650Microsoft Windows Network File System elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-56649Microsoft Windows Network File System remote code execution5.9CNA v3.10.7%2026-07-14Fix
CVE-2026-56648Microsoft Windows NFS server elevation of privilege7.5CNA v3.10.5%2026-07-14Fix
CVE-2026-56647Microsoft Windows Remote Access Service Infrastructure elevation of privilege8.8CNA v3.10.9%2026-07-14Fix
CVE-2026-56644Microsoft Windows DirectX Graphics Kernel elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-56643Microsoft Windows DirectX Graphics Kernel elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-56642Microsoft Fabric DATA Warehouse remote code execution8.8CNA v3.10.9%2026-07-14Fix
CVE-2026-56451Siemens Opcenter X improper signature verification10.0CNA v4.00.5%2026-07-14Fix
CVE-2026-56197Microsoft Windows Admin Center (WAC) remote code execution8.8CNA v3.11.0%2026-07-14Fix
CVE-2026-56196Microsoft Windows Admin Center (WAC) remote code execution8.8CNA v3.11.0%2026-07-14Fix
CVE-2026-56195Microsoft Office information disclosure5.5CNA v3.10.5%2026-07-14Fix
CVE-2026-56194Microsoft Windows NFS server elevation of privilege8.8CNA v3.10.9%2026-07-14Fix
CVE-2026-56193Microsoft Office information disclosure7.1CNA v3.10.5%2026-07-14Fix
CVE-2026-56192Microsoft Office information disclosure5.5CNA v3.10.6%2026-07-14Fix
CVE-2026-56190Microsoft Windows remote Desktop protocol remote code execution9.8CNA v3.11.0%2026-07-14Exploit codeFix
CVE-2026-56189Microsoft Windows Media Foundation remote code execution7.8CNA v3.10.4%2026-07-14Fix
CVE-2026-56188Microsoft Windows Server Network driver remote code execution9.8CNA v3.10.6%2026-07-14Fix
CVE-2026-56187Microsoft Windows MIDI service module elevation of privileges7.0CNA v3.10.3%2026-07-14Fix
CVE-2026-56186Microsoft Windows Secure Channel information disclosure8.1CNA v3.11.1%2026-07-14Fix
CVE-2026-56185Microsoft Windows Admin Center information disclosure6.5CNA v3.10.8%2026-07-14Fix
CVE-2026-56184Microsoft Windows win32k information disclosure5.5CNA v3.10.5%2026-07-14Fix
CVE-2026-56183Microsoft Windows MIDI service module elevation of privileges7.0CNA v3.10.3%2026-07-14Fix
CVE-2026-56182Microsoft Windows NTFS elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-56181Microsoft Windows Network Address Translation (NAT) spoofing8.3CNA v3.10.3%2026-07-14Fix
CVE-2026-56178Microsoft Defender For Endpoint for Mac elevation of privilege5.5CNA v3.10.2%2026-07-14Fix
CVE-2026-56176Windows Win32k elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-56175Microsoft Windows NTFS elevation of privilege7.8CNA v3.10.3%2026-07-14Fix
CVE-2026-56173Microsoft Windows WebView elevation of privilege7.0CNA v3.10.3%2026-07-14Fix
CVE-2026-56170Microsoft NET ASP.NET Core denial of service7.5CNA v3.11.2%2026-07-14Fix
CVE-2026-56169Microsoft Windows Admin Center elevation of privilege8.1CNA v3.10.7%2026-07-14Fix
CVE-2026-56168Microsoft Windows SMB server denial of service6.5CNA v3.11.1%2026-07-14Fix
CVE-2026-56164Microsoft SharePoint Server missing authentication for critical function5.3CNA v3.11.0%2026-07-14KEVExploit codeFix
CVE-2026-56159Microsoft Windows DHCP server service remote code execution9.8CNA v3.11.0%2026-07-14Fix
CVE-2026-56157Microsoft SharePoint server spoofing5.4CNA v3.10.5%2026-07-14Fix
CVE-2026-56156Microsoft Excel remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-56155Microsoft Active Directory Federation Services insufficient granularity of access control7.8CNA v3.10.3%2026-07-14KEVFix
CVE-2026-55954Missing ID token claim validation in ueberauth_apple allows account takeover9.1CNA v4.00.7%2026-07-14Fix
CVE-2026-55949Microsoft Excel remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-55948Microsoft Excel remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-55947Microsoft Excel remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-55944Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central remote code execution9.8CNA v3.11.5%2026-07-14Fix
CVE-2026-55899Microsoft Excel remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-55898Microsoft Excel information disclosure6.1CNA v3.10.5%2026-07-14Fix
CVE-2026-55651alextselegidis easyappointments Easy!Appointments vulnerable to Appointments takeover7.1CNA v3.10.3%2026-07-14
CVE-2026-55145Outlook CoPilot tampering6.3CNA v3.10.5%2026-07-14Fix
CVE-2026-55144Microsoft Windows Cryptography API: Next Generation (CNG) tampering7.1CNA v3.10.2%2026-07-14Fix
CVE-2026-55142Microsoft Word information disclosure5.5CNA v3.10.6%2026-07-14Fix
CVE-2026-55141Microsoft Excel remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-55140Microsoft Office remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-55139Microsoft Office information disclosure5.5CNA v3.10.5%2026-07-14Fix
CVE-2026-55138Microsoft Excel information disclosure5.5CNA v3.10.5%2026-07-14Fix
CVE-2026-55137Microsoft Excel remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-55136Microsoft Excel remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-55135Microsoft SharePoint server spoofing4.6CNA v3.10.6%2026-07-14Fix
CVE-2026-55134Microsoft Word remote code execution7.8CNA v3.10.6%2026-07-14Fix
CVE-2026-55133Microsoft OneNote remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-55132Microsoft Word remote code execution7.8CNA v3.10.6%2026-07-14Fix
CVE-2026-55131Microsoft Excel remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-55130Microsoft Word remote code execution7.8CNA v3.10.6%2026-07-14Fix
CVE-2026-55129Microsoft Office remote code execution7.8CNA v3.10.5%2026-07-14Fix
CVE-2026-55128Microsoft Word remote code execution7.8CNA v3.10.6%2026-07-14Fix
CVE-2026-55127Microsoft Word remote code execution7.8CNA v3.10.6%2026-07-14Fix