CVE-2026 list

CVE-2026 records published in July 2026

Page eight of 10: records 7,001 to 8,000 of the 9,534 published in July 2026, newest first. The first page carries the figures for July 2026.

CVE-2026 records published in July 2026, newest first: records 7,001 to 8,000 of 9,534
CVE Summary CVSS EPSS Published Signals
CVE-2026-57372WPJAM Basic WordPress plugin server side request forgery (SSRF)7.2CNA v3.10.3%2026-07-13Fix
CVE-2026-57371WPJAM Basic WordPress plugin PHP object injection8.8CNA v3.10.5%2026-07-13Fix
CVE-2026-57369Themify Builder WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-13Fix
CVE-2026-57368Jobmonster WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-13Fix
CVE-2026-57365reCAPTCHA (v2 and v3) for Asgaros Forum WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-07-13Fix
CVE-2026-57364Better Payment WordPress plugin Input vulnerability improper input validation6.5CNA v3.10.4%2026-07-13Fix
CVE-2026-57363ChatBot WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-13Fix
CVE-2026-56877Skillable SCORM Lab Launch Integration web parameter tampering6.3CNA v3.10.4%2026-07-13
CVE-2026-55773cedar-policy cedar-java CedarJava has a policy injection8.8CNA v3.10.5%2026-07-13Fix
CVE-2026-55772cedar-policy cedar-java CedarJava has a type confusion8.8CNA v3.10.5%2026-07-13Fix
CVE-2026-55771Cedar-Java has policy injection, type confusion, and incorrect equality comparison8.8CNA v3.10.6%2026-07-13Fix
CVE-2026-53365Linux kernel virtio vsock zerocopy send path memory leak5.5NVD v3.10.2%2026-07-13Exploit codeFix
CVE-2026-53364Linux kernel Bluetooth BIG sync termination handler memory leak5.5v3.10.1%2026-07-13Fix
CVE-2026-52533D-Link DIR-1253 shadow file privilege escalation9.8CISA ADP v3.10.6%2026-07-13
CVE-2026-51821Shenzhou Shihan Video Conference System getUserLogin endpoint SQL injection9.8CISA ADP v3.10.8%2026-07-13
CVE-2026-51541OpENer out-of-bounds read9.1CISA ADP v3.10.6%2026-07-13
CVE-2026-51540OpENer integer underflow9.8CISA ADP v3.10.6%2026-07-13
CVE-2026-51539receive loop of libmodbus A denial of service7.5CISA ADP v3.10.5%2026-07-13
CVE-2026-51538OpENer improper access control9.1CISA ADP v3.10.5%2026-07-13
CVE-2026-51537OpENer out-of-bounds read9.1CISA ADP v3.10.6%2026-07-13
CVE-2026-51536OpENer integer overflow9.1CISA ADP v3.10.6%2026-07-13
CVE-2026-49972Laravel-Mediable file upload RCE via Extension Bypass7.7CNA v4.01.1%2026-07-13Fix
CVE-2026-49971Laravel-Mediable stored XSS via SVG file upload5.3CNA v4.00.4%2026-07-13Fix
CVE-2026-49970Laravel-Mediable path traversal via File::sanitizePath8.7CNA v4.01.0%2026-07-13Fix
CVE-2026-49969Laravel-Mediable SSRF via RemoteUrlAdapter URL Handling5.3CNA v4.00.4%2026-07-13Fix
CVE-2026-49876Apache Gravitino Authenticated server-side request forgery6.5CISA ADP v3.10.5%2026-07-13Fix
CVE-2026-48364Adobe ColdFusion uncontrolled search path element8.2CNA v3.10.3%2026-07-13Fix
CVE-2026-48363Adobe ColdFusion uncontrolled search path element8.2CNA v3.10.3%2026-07-13Fix
CVE-2026-41041Apache Gravitino: URL path injection9.1CISA ADP v3.10.6%2026-07-13Fix
CVE-2026-40553Stack-based buffer overflow in gawk7.5v3.10.3%2026-07-13Fix
CVE-2026-40469Heap buffer overflow in gawk9.1v3.10.4%2026-07-13Fix
CVE-2026-40468Heap buffer overflow in gawk9.1v3.10.2%2026-07-13Fix
CVE-2026-40467GNU gawk getline redirection handling use-after-free7.5v3.10.2%2026-07-13Fix
CVE-2026-39042MikroTik RouterOS libumsg unflatten function integer overflow7.5CISA ADP v3.10.6%2026-07-13
CVE-2026-26396OpenBMB XAgent workspace file handler path traversal7.5CISA ADP v3.11.1%2026-07-13
CVE-2026-22103EVbee DC-80 command injection in NPC start web endpoint9.3CNA v4.01.4%2026-07-13Fix
CVE-2026-22102EVbee DC-80 arbitrary file overwrite through certificate update functionality9.3CNA v4.00.5%2026-07-13Fix
CVE-2026-22100EVbee DC-80 comnand injection in OCPP ReserveLogin message8.6CNA v4.01.1%2026-07-13Fix
CVE-2026-22099EVbee DC-80 missing authentication for Bluetooth communication8.7CNA v4.00.3%2026-07-13Fix
CVE-2026-22098EVbee DC-80 sensitive information is written to logs9.2CNA v4.00.4%2026-07-13Fix
CVE-2026-22097EVbee DC-80 missing firmware validation allows remote code execution9.3CNA v4.00.3%2026-07-13Fix
CVE-2026-22096EVbee DC-80 missing authentication for webserver endpoints9.3CNA v4.00.5%2026-07-13Fix
CVE-2026-22095EVbee DC-80 command injection in diagnosis web endpoint9.3CNA v4.01.4%2026-07-13Fix
CVE-2026-22093Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app9.5CNA v4.00.3%2026-07-13Fix
CVE-2026-15685Ollama downloadBlob improper validation of array index denial of service7.5CNA v3.00.7%2026-07-13
CVE-2026-15684Glarysoft Glary Utilities link following local privilege escalation7.3CNA v3.00.2%2026-07-13
CVE-2026-15683Lorex 2K Indoor Wi-Fi Security Camera Device Management Server improper certificate validation7.5CNA v3.00.1%2026-07-13
CVE-2026-15682AnyDesk Support Information link following denial of service5.5v3.10.1%2026-07-13
CVE-2026-15681AnyDesk Screen Recording link following denial of service5.5v3.10.1%2026-07-13
CVE-2026-15680Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator format string remote code execution7.5CNA v3.00.4%2026-07-13
CVE-2026-15618mosaxiv clawlet exec Safety Guard tool_exec.go guardExecCommand protection mechanism5.3CNA v4.00.4%2026-07-13
CVE-2026-15607Tanstack db Alias Path select.ts select prototype pollution5.3CNA v4.00.4%2026-07-13
CVE-2026-15605wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash2.3CNA v4.00.2%2026-07-13
CVE-2026-15598antv layout object.js setNestedValue prototype pollution5.3CNA v4.00.4%2026-07-13Exploit code
CVE-2026-15597SourceCodester Class and Exam Timetabling System edit_exam2.php SQL injection6.9CNA v4.00.4%2026-07-13
CVE-2026-15596SourceCodester Class and Exam Timetabling System subject.php cross-site scripting5.3CNA v4.00.5%2026-07-13
CVE-2026-15595SourceCodester Class and Exam Timetabling System forsubject.php cross-site scripting5.3CNA v4.00.5%2026-07-13
CVE-2026-15594waooAI waoowaoo Media hash.ts stablePublicIdFromStorageKey improper authorization6.3CNA v4.00.5%2026-07-13
CVE-2026-15584Red Hat incluster-checks debug pods privilege escalation7.5CNA v3.10.4%2026-07-13
CVE-2026-15574Red Hat OpenShift AI sensitive information in an accessible file7.5CNA v3.10.5%2026-07-13Fix
CVE-2026-15559CodeAstro Simple Online Leave Management System POST accept.php SQL injection5.3CNA v4.00.3%2026-07-13
CVE-2026-15558CodeAstro Simple Online Leave Management System deletemp.php SQL injection5.3CNA v4.00.3%2026-07-13
CVE-2026-15557waooAI waoowaoo Internal Task header api-auth.ts requireProjectAuthLight improper authentication6.9CNA v4.00.7%2026-07-13
CVE-2026-15553Ragic｜Enterprise Cloud Database arbitrary file upload6.9CNA v4.00.4%2026-07-13Fix
CVE-2026-15552Ragic｜Enterprise Cloud Database stored cross-site scripting5.3CNA v4.00.3%2026-07-13Fix
CVE-2026-15551Samsung Open Source rlottie integer overflow5.5CNA v3.10.1%2026-07-13
CVE-2026-15548Shibby Tomato DNS List Rendering httpd sub_407220 stack-based overflow8.7CNA v4.00.8%2026-07-13
CVE-2026-15547Shibby Tomato CIFS Mount sub_2D048 os command injection5.3CNA v4.01.8%2026-07-13
CVE-2026-15546Shibby Tomato start_jffs2 sub_2D568 os command injection5.3CNA v4.01.8%2026-07-13
CVE-2026-15545Shibby Tomato apcupsd tomatodata.cgi main out-of-bounds write8.7CNA v4.00.7%2026-07-13
CVE-2026-15544Shibby Tomato apcupsd tomatodata.cgi getupsvar stack-based overflow8.7CNA v4.00.8%2026-07-13
CVE-2026-15543Tenda CH22 CertListInfo formCertListInfo buffer overflow8.7CNA v4.00.9%2026-07-13
CVE-2026-15542will-moss Isaiah Websocket Connection Authentication main.go improper authentication6.9CNA v4.00.7%2026-07-13
CVE-2026-15541will-moss Isaiah Master Websocket server.go Server.Handle authorization6.9CNA v4.00.5%2026-07-13
CVE-2026-15540SourceCodester Online Book Store System Administrative index.php PHP file inclusion5.3CNA v4.00.4%2026-07-13
CVE-2026-15539SourceCodester Online Book Store System book image unrestricted file upload5.1CNA v4.00.4%2026-07-13
CVE-2026-15538primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution5.3CNA v4.00.5%2026-07-13Fix
CVE-2026-15537SourceCodester Online Book Store System login.php SQL injection6.9CNA v4.00.4%2026-07-13
CVE-2026-15536itsourcecode Hospital Management System patviewprescription.php SQL injection5.3CNA v4.00.3%2026-07-13
CVE-2026-15535AkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserialization5.3CNA v4.00.4%2026-07-13
CVE-2026-15533DedeCMS Column Management search.php code injection5.1CNA v4.00.4%2026-07-13
CVE-2026-15532SourceCodester Online Book Store System User Management cross-site scripting4.8CNA v4.00.4%2026-07-13
CVE-2026-15531yashbhalgat HashNeRF-pytorch Checkpoint file run_nerf.py torch.load deserialization4.8CNA v4.00.3%2026-07-13
CVE-2026-15530WuzhiCMS Attachment API index.php listimage information disclosure6.9CNA v4.00.5%2026-07-13
CVE-2026-15529yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization5.3CNA v4.00.4%2026-07-13Fix
CVE-2026-15528lamaalrajih kicad-mcp path_validator.py protection mechanism4.8CNA v4.00.2%2026-07-13
CVE-2026-15527better-auth better-icons scan_project_icons/sync_icon path traversal4.8CNA v4.00.2%2026-07-13
CVE-2026-15526augmnt augments-mcp-server scan_project_deps scan-project-deps.ts scanProjectDeps path traversal4.8CNA v4.00.2%2026-07-13
CVE-2026-15525kLOsk adloop write.py _validate_urls server-side request forgery5.3CNA v4.00.4%2026-07-13Fix
CVE-2026-15524alioshr memory-bank-mcp list-project-files-validation-factory.ts path traversal4.8CNA v4.00.2%2026-07-13
CVE-2026-15523CodeAstro Simple Online Leave Management System dashboard.php SQL injection5.3CNA v4.00.3%2026-07-13
CVE-2026-15522tugcantopaloglu godot-mcp run_project index.js validatePath path traversal4.8CNA v4.00.2%2026-07-13Fix
CVE-2026-15521makafeli n8n-workflow-builder update_node_from_file server.cjs path traversal4.8CNA v4.00.2%2026-07-13
CVE-2026-15520GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow4.8CNA v4.00.2%2026-07-13Fix
CVE-2026-15519usestrix PyPI system_prompt.jinja inclusion of functionality from untrusted control sphere2.3CNA v4.00.3%2026-07-13
CVE-2026-15518AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload5.1CNA v4.00.4%2026-07-13
CVE-2026-15517Jinher OA PlanGiveOut.aspx SQL injection6.9CNA v4.00.4%2026-07-13
CVE-2026-15516MacCMS Pro Installation Index.php step5 authorization6.3CNA v4.00.4%2026-07-13Fix
CVE-2026-15515Tencent PC Manager QMUDisk driver qmudisk64.sys uncontrolled search path7.3CNA v4.00.2%2026-07-13
CVE-2026-14934Google Cloud BigQuery repository creation functionality missing authorization9.4CNA v4.00.4%2026-07-13Fix
CVE-2026-14906Mozilla Firefox unrestricted file upload5.3CISA ADP v3.10.3%2026-07-13Fix
CVE-2026-14846PrestaShop CSV data export CSV injection4.5CNA v4.00.4%2026-07-13
CVE-2026-14453Centreon Infra Monitoring open tickets module code injection9.6CNA v3.10.8%2026-07-13Fix
CVE-2026-14165Dassault Systèmes Tuleap Enterprise Edition insecure direct object reference7.5CNA v3.10.4%2026-07-13
CVE-2026-13221Perl regular expression trie compiler integer overflow9.1NVD v3.10.4%2026-07-13Fix
CVE-2026-13014Remote code execution vulnerability in Suspicious application9.2CNA v4.00.7%2026-07-13
CVE-2026-12582Library Management System WordPress plugin unauthenticated SQL injection via book_id8.6CISA ADP v3.10.4%2026-07-13Fix
CVE-2026-12536Avada Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-13Fix
CVE-2026-12397WP Job Portal WordPress plugin Subscriber+ Employer email disclosure via IDOR4.3CISA ADP v3.10.3%2026-07-13Fix
CVE-2026-12396WP Job Portal WordPress plugin Subscriber+ arbitrary Job Approval, Featuring and Rejection5.4CISA ADP v3.10.3%2026-07-13Fix
CVE-2026-12385Smart Slider 3 WordPress plugin missing authorization authenticated sensitive information exposure4.3CNA v3.10.4%2026-07-13Fix
CVE-2026-12275Tutor LMS Droip and Kirki page builder integration improper authorization7.1CISA ADP v3.10.3%2026-07-13Fix
CVE-2026-12274Tutor LMS WordPress plugin Instructor+ arbitrary post Overwrite via IDOR6.5CISA ADP v3.10.3%2026-07-13Fix
CVE-2026-12273Tutor LMS WordPress plugin Subscriber+ arbitrary Auto-Approved comment creation4.3CISA ADP v3.10.3%2026-07-13Fix
CVE-2026-12271Tutor LMS WordPress plugin Subscriber+ arbitrary Quiz Attempt modification via IDOR5.4CISA ADP v3.10.3%2026-07-13Fix
CVE-2026-12257Remote code execution in Mura Software’s CMS9.3CNA v4.00.7%2026-07-13
CVE-2026-12081Database for Contact Form 7 entry file field PHP object injection5.0CISA ADP v3.10.2%2026-07-13Fix
CVE-2026-11964User Registration and Membership PayPal webhook handler vulnerability9.1CISA ADP v3.10.5%2026-07-13Fix
CVE-2026-11963User Registration and Membership membership upgrade handler insecure direct object reference8.1CISA ADP v3.10.4%2026-07-13Fix
CVE-2026-10551Breeze Cache WordPress plugin unauthenticated stored XSS via Minify Library6.1CISA ADP v3.10.3%2026-07-13Fix
CVE-2026-10106Mattermost Server interactive post action cookie validation incorrect authorization6.5CNA v3.10.3%2026-07-13Fix
CVE-2026-10103Mattermost Server shared channel inbound sync handler insecure direct object reference4.3CNA v3.10.2%2026-07-13Fix
CVE-2026-10085Mattermost Server channel patch API missing authorization5.4CNA v3.10.3%2026-07-13Fix
CVE-2026-9824Mattermost remote cluster metadata enumeration via /share-channel autocomplete4.3CNA v3.10.3%2026-07-13Fix
CVE-2026-9820Mattermost schemes teams endpoint exposes private team invite IDs3.8CNA v3.10.3%2026-07-13Fix
CVE-2026-9708Mattermost incoming webhook user attribution via unvalidated webhook owner4.9CNA v3.10.4%2026-07-13Fix
CVE-2026-9597Mattermost Server magic-link token login authentication bypass5.4CNA v3.10.2%2026-07-13Fix
CVE-2026-9571Mattermost Server OAuth refresh token grant authentication bypass5.9CNA v3.10.3%2026-07-13Fix
CVE-2026-9492GIGABYTE｜Gigabyte Control Center improper access control8.5CNA v4.00.2%2026-07-13Fix
CVE-2026-7162WinFSP integer overflow7.8CNA v3.10.1%2026-07-13
CVE-2026-6875Sandbox escape in ServiceNow AI Platform9.5CNA v4.01.4%2026-07-13Reported exploitedNucleiEmerging ThreatsExploit codeFix
CVE-2026-6850Mattermost Server message attachment markdown parser denial of service6.5CNA v3.10.4%2026-07-13Fix
CVE-2026-6847Unauthenticated remote code execution in ThemisNETPanel9.3CNA v4.00.9%2026-07-13Fix
CVE-2026-6541Mattermost unscoped updates to other playbooks' metric configuration4.3CNA v3.10.3%2026-07-13Fix
CVE-2026-4769WAGO 0765-110x/0100-0000 unauthenticated access to Internal Diagnostic interface9.3CNA v4.00.8%2026-07-13Fix
CVE-2026-4765Self cross-site scripting (Self-XSS) in Tallos Chat by RD Station Conversas0.0CNA v4.00.4%2026-07-13
CVE-2026-61876LuCI DHCPv6 Lease Hostname stored cross-site scripting9.4CNA v4.01.3%2026-07-12Exploit code
CVE-2026-61875openwrt luci luci-app-upnp stored XSS via UPnP Port Mapping Description8.7CNA v4.00.4%2026-07-12Fix
CVE-2026-61874filebrowser Stale Public Share via Trailing-Slash Delete2.3CNA v4.00.3%2026-07-12Fix
CVE-2026-59260OpenWrt luci-app-samba4 read ACL remote code execution via smbd8.7CNA v4.00.9%2026-07-12Fix
CVE-2026-58596Microsoft Edge (Chromium-based) elevation of privilege8.3CNA v3.10.6%2026-07-12Fix
CVE-2026-56336Capgo information disclosure via Unauthenticated SSO check-domain endpoint6.9CNA v4.00.3%2026-07-12Fix
CVE-2026-56313Capgo Cross-Organization Account Disruption via SSO Prelink endpoint7.2CNA v4.00.5%2026-07-12Fix
CVE-2026-56308Capgo Insufficient Authentication in Email Change endpoint8.4CNA v4.00.4%2026-07-12Fix
CVE-2026-56281Capgo SQL injection via Unvalidated limit parameter in Admin Stats endpoint5.1CNA v4.00.3%2026-07-12Fix
CVE-2026-56271Flowise Weak Default JWT Secrets in Authentication Middleware9.3CNA v4.00.7%2026-07-12Reported exploitedFix
CVE-2026-56260Crawl4AI arbitrary file write via output_path parameter8.8CNA v4.00.6%2026-07-12Fix
CVE-2026-56259Crawl4AI LLM Credential Exfiltration via base_url and Environment Variable Resolution8.8CNA v4.00.4%2026-07-12Fix
CVE-2026-56252Capgo Scope Isolation failure in Webhook Test endpoint5.3CNA v4.00.3%2026-07-12Fix
CVE-2026-56241Capgo RBAC Demotion Privilege Retention via Stale org_users.user_right7.2CNA v4.00.4%2026-07-12Fix
CVE-2026-56238Capgo unauthenticated information disclosure via PostgREST global_stats endpoint8.7CNA v4.00.6%2026-07-12Fix
CVE-2026-15514Metasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query SQL injection6.9CNA v4.00.4%2026-07-12
CVE-2026-15513Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection5.3CNA v4.01.8%2026-07-12Fix
CVE-2026-15512pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection5.3CNA v4.00.4%2026-07-12
CVE-2026-15511Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection9.3CNA v4.04.7%2026-07-12
CVE-2026-15510Leantime API saveSetting improper authorization5.3CNA v4.00.3%2026-07-12
CVE-2026-15509Leantime JSON-RPC endpoint addUser improper authorization5.3CNA v4.00.3%2026-07-12
CVE-2026-15508Helicone ai-gateway AWS Metadata service service.rs build_target_url server-side request forgery5.3CNA v4.00.3%2026-07-12
CVE-2026-15507coollabsio Coolify Policy Policies authorization5.3CNA v4.00.3%2026-07-12
CVE-2026-15506SecureAge CatchPulse driver saappctl.sys heap-based overflow8.5CNA v4.00.2%2026-07-12
CVE-2026-15505vnotex vnote YAML Frontmatter markdownit.js cross-site scripting5.1CNA v4.00.3%2026-07-12
CVE-2026-15502AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase SQL injection5.3CNA v4.00.3%2026-07-12
CVE-2026-15501AstrBotDevs AstrBot MCP test endpoint server-side request forgery5.3CNA v4.00.3%2026-07-12
CVE-2026-15500AstrBotDevs AstrBot market_list endpoint plugin.py get_online_plugins server-side request forgery5.3CNA v4.00.4%2026-07-12
CVE-2026-15499AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization5.3CNA v4.00.3%2026-07-12
CVE-2026-15498sergomanov SmartHomeAdatum Login users.php SQL injection6.9CNA v4.00.4%2026-07-12
CVE-2026-15497SonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injection6.9CNA v4.00.7%2026-07-12
CVE-2026-15496SonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injection5.3CNA v4.02.0%2026-07-12
CVE-2026-15495SonicCloudOrg sonic-agent Android WebSocket Server AndroidWSServer.java os command injection5.3CNA v4.02.7%2026-07-12
CVE-2026-15494AMTT Hotel Broadband Operation System switch_status.php SQL injection5.1CNA v4.00.3%2026-07-12
CVE-2026-15493Akpali9 Attendance-Management-System absent.php cross-site scripting5.1CNA v4.00.3%2026-07-12
CVE-2026-15492igweze wizgrade studentConductManager.php cross-site scripting5.3CNA v4.00.4%2026-07-12
CVE-2026-15491RafyMrX TOKO-ONLINE-ROTI missing authentication6.9CNA v4.00.7%2026-07-12
CVE-2026-15490RafyMrX TOKO-ONLINE-ROTI add.php SQL injection6.9CNA v4.00.4%2026-07-12
CVE-2026-15489RafyMrX TOKO-ONLINE-ROTI login.php SQL injection6.9CNA v4.00.4%2026-07-12
CVE-2026-15488hcr707305003 shiroiAdmin FileController.php upload unrestricted upload6.9CNA v4.00.5%2026-07-12Fix
CVE-2026-15487TRENDnet TEW-821DAP Firmware Update system_ntp sub_41FBD0 os command injection5.3CNA v4.01.8%2026-07-12
CVE-2026-15486TRENDnet TEW-821DAP Firmware Update tools_ddns sub_42026C os command injection5.3CNA v4.01.8%2026-07-12
CVE-2026-15485TRENDnet TEW-821DAP DNS Lookup tools_nslookup sub_43F2C4 os command injection5.3CNA v4.01.8%2026-07-12
CVE-2026-15484TRENDnet TEW-821DAP ssi tools_nslookup sub_41EC14 buffer overflow8.7CNA v4.00.8%2026-07-12
CVE-2026-15483TRENDnet TEW-821DAP ssi tools_nslookup sub_41EC14 buffer overflow8.7CNA v4.00.8%2026-07-12
CVE-2026-15482Aster Telecom Azcall HTTP sis.php SQL injection6.9CNA v4.00.4%2026-07-12
CVE-2026-15481TRENDnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injection8.7CNA v4.02.9%2026-07-12
CVE-2026-15480TRENDnet TEW-635BRM Web service rc start_httpd stack-based overflow8.7CNA v4.00.8%2026-07-12
CVE-2026-15479H3C NX15 Administrator Password Modification endpoint modify change_passwd password recovery6.9CNA v4.00.5%2026-07-12
CVE-2026-15478IceHRM UserReport Endpoint EmployeeAttendanceReport.php SQL injection5.3CNA v4.00.3%2026-07-12
CVE-2026-15477Bahmni bahmnicore Search endpoint SQL additionalParams SQL injection5.3CNA v4.00.3%2026-07-12Fix
CVE-2026-15476QILING Disk Master Kernel driver diskbckp.sys access control4.8CNA v4.00.1%2026-07-12Fix
CVE-2026-15475MiniTool Partition Wizard Signed Kernel driver pwdrvio.sys access control4.8CNA v4.00.1%2026-07-12Fix
CVE-2026-15474Eleveo Call Recording Software audio.jsp improper authorization5.3CNA v4.00.3%2026-07-12
CVE-2026-15473Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization5.3CNA v4.00.3%2026-07-12
CVE-2026-15472Eleveo Call Recording Software composeEmailAction.do improper authorization5.3CNA v4.00.3%2026-07-12
CVE-2026-15471Eleveo Call Recording Software pci_dss_status.jsp improper authorization5.3CNA v4.00.3%2026-07-12
CVE-2026-10668Zephyr NuMaker HSUSBD USB driver denial of service2.4CNA v3.10.2%2026-07-12Fix
CVE-2026-10667Zephyr kernel object tracking use-after-free7.8CNA v3.10.1%2026-07-12Fix
CVE-2026-10666Zephyr IP address parser buffer overflow8.1CNA v3.10.7%2026-07-12Fix
CVE-2026-10665zephyrproject zephyr heap buffer overflow on WireGuard receive path7.4CNA v3.10.6%2026-07-12Fix
CVE-2026-10664zephyrproject zephyr out-of-bounds write in nRF70 Wi-Fi driver power-save event handler5.0CNA v3.10.2%2026-07-12Fix
CVE-2026-10663Zephyr USB host stack use-after-free6.1CNA v3.10.2%2026-07-12Fix
CVE-2026-61870ImageMagick memory leak via VIFF Encoder7.5v3.10.2%2026-07-11Fix
CVE-2026-61861ImageMagick use-after-free in FormatMagickCaption7.5v3.10.6%2026-07-11Fix
CVE-2026-61858ImageMagick Policy Bypass via APNG encoder5.3v3.10.2%2026-07-11Fix
CVE-2026-61857ImageMagick heap use-after-free via XMP7.5v3.10.3%2026-07-11Fix
CVE-2026-61465ImageMagick Memory Allocation Policy Bypass6.5v3.10.2%2026-07-11Fix
CVE-2026-61454Grav information disclosure via __GRAV_CONFIG__8.7CNA v4.00.4%2026-07-11Fix
CVE-2026-61448parse-community parse-server parse Server stored XSS via malformed Content-Type2.1CNA v4.00.4%2026-07-11Fix
CVE-2026-61447PraisonAI remote code execution via CodeAgent10.0CNA v4.02.5%2026-07-11Exploit codeFix
CVE-2026-61445PraisonAI arbitrary file write and command execution9.4CNA v4.00.9%2026-07-11Fix
CVE-2026-61442PraisonAI Platform authorization bypass via PATCH7.1CNA v4.00.5%2026-07-11Fix
CVE-2026-61439PraisonAI prompt injection Defense Bypass8.7CNA v4.00.4%2026-07-11Fix
CVE-2026-61429PraisonAI SSRF via Crawl4AI Chromium backend8.4CNA v4.00.3%2026-07-11Fix
CVE-2026-61428PraisonAI AgentMail message injection via Webhook6.9CNA v4.00.4%2026-07-11Fix
CVE-2026-61426PraisonAI Unauthenticated Agent Access via Insecure Defaults8.8CNA v4.00.5%2026-07-11Fix
CVE-2026-60090PraisonAI SQL/CQL injection via vector dimension9.3CNA v4.00.7%2026-07-11Fix
CVE-2026-60088PraisonAI path traversal via Custom commands6.8CNA v4.00.2%2026-07-11Fix
CVE-2026-58281Microsoft Edge (Chromium-based) remote code execution8.3CNA v3.11.0%2026-07-11Fix
CVE-2026-57828Joomla Extension Phoca.cz authenticated file upload in Phoca Downloads component8.8NVD v3.10.5%2026-07-11
CVE-2026-57827Joomla extension rsjoomla.com unauthenticated file upload in RSFiles component9.8NVD v3.12.3%2026-07-11NucleiExploit code
CVE-2026-56763Hono prototype pollution via __proto__ Key in parseBody with dot option6.3CNA v4.00.3%2026-07-11Fix
CVE-2026-56372ImageMagick heap buffer overflow Read via Unrecognized Magnify method9.1v3.10.3%2026-07-11Fix
CVE-2026-56303Capgo Unauthenticated API Key Metadata Disclosure via security DEFINER RPC function8.7CNA v4.00.5%2026-07-11Fix
CVE-2026-56296Capgo Cap-go App Existence Oracle via Unauthenticated transfer_app RPC6.9CNA v4.00.4%2026-07-11Fix
CVE-2026-56240Capgo Billing authorization bypass via Exhausted Usage Credits5.3CNA v4.00.3%2026-07-11Fix
CVE-2026-15470Eleveo Call Recording Software group.jsp improper authorization5.3CNA v4.00.3%2026-07-11
CVE-2026-15338LA-Studio Element Kit for Elementor WordPress plugin local file inclusion7.5CNA v3.11.0%2026-07-11Fix
CVE-2026-15335Booking Package WordPress plugin unauthenticated SQL injection via email form parameter7.5CNA v3.10.8%2026-07-11Fix
CVE-2026-15155Essential Addons for Elementor WordPress plugin account takeover8.8CNA v3.10.7%2026-07-11Fix
CVE-2026-15097Themify Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-11Fix
CVE-2026-15096Themify Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-11Fix
CVE-2026-15073KiviCare WordPress plugin SQL injection6.5CNA v3.10.4%2026-07-11Fix
CVE-2026-15072KiviCare WordPress plugin SQL injection6.5CNA v3.10.5%2026-07-11Fix
CVE-2026-15010bbp style pack WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-11Fix
CVE-2026-14262Simple JWT Login WordPress plugin authentication bypass to privilege escalation8.8CNA v3.10.7%2026-07-11Fix
CVE-2026-13756WP Grid Builder WordPress plugin authenticated (Subscriber+) privilege escalation via key parameter8.8CNA v3.10.4%2026-07-11Fix
CVE-2026-13378Form Vibes WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-07-11Fix
CVE-2026-13353WP Ultimate CSV Importer WordPress plugin missing authorization authenticated remote code execution8.8CNA v3.11.1%2026-07-11Fix
CVE-2026-13262Majestic Support WordPress plugin authenticated (Subscriber+) SQL injection via val parameter6.5CNA v3.10.6%2026-07-11Fix
CVE-2026-13250Solace Extra WordPress plugin missing authorization unauthenticated arbitrary content deletion5.3CNA v3.10.5%2026-07-11Fix
CVE-2026-13116PDF Invoices and Packing Slips for WooCommerce WordPress plugin insecure direct object reference4.3CNA v3.10.4%2026-07-11Fix
CVE-2026-13114Motors WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-07-11Fix
CVE-2026-12994WCFM WordPress plugin authorization bypass5.3CNA v3.10.6%2026-07-11Fix
CVE-2026-12738WP Easy Pay WordPress plugin missing authorization authenticated arbitrary post Status modification4.3CNA v3.10.4%2026-07-11Fix
CVE-2026-12426Members WordPress plugin unauthenticated sensitive information disclosure5.3CNA v3.10.5%2026-07-11Fix
CVE-2026-12141Premium Addons for Elementor WordPress plugin stored cross-site scripting4.9CNA v3.10.3%2026-07-11Fix
CVE-2026-12126WCFM Marketplace WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-11Fix
CVE-2026-12103Wallet for WooCommerce WordPress plugin missing authorization authenticated User/Email enumeration4.3CNA v3.10.5%2026-07-11Fix
CVE-2026-11901WP Hotel Booking WordPress plugin insufficient verification of data authenticity5.3CNA v3.10.3%2026-07-11Fix
CVE-2026-11898White Label CMS WordPress plugin stored cross-site scripting4.4CNA v3.10.4%2026-07-11Fix
CVE-2026-11591Widgets for Google Reviews WordPress plugin stored cross-site scripting4.4CNA v3.10.4%2026-07-11Fix
CVE-2026-11426UnderConstructionPage PRO WordPress plugin arbitrary file read6.5CNA v3.10.5%2026-07-11Fix
CVE-2026-10865Cost Calculator Builder WordPress plugin information disclosure5.3CNA v3.10.6%2026-07-11Fix
CVE-2026-10660Zephyr Bluetooth BAP Broadcast Assistant out-of-bounds write6.4CNA v3.10.2%2026-07-11Fix
CVE-2026-10628Points and Rewards for WooCommerce WordPress plugin authorization bypass4.3CNA v3.10.6%2026-07-11Fix
CVE-2026-10041WCFM WordPress plugin insecure direct object reference4.3CNA v3.10.4%2026-07-11Fix
CVE-2026-9738Print, PDF, Email by PrintFriendly WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-07-11Fix
CVE-2026-9282W3 Total Cache WordPress plugin unauthenticated arbitrary file read via f_array[] parameter7.5CNA v3.12.9%2026-07-11NucleiFix
CVE-2026-9017NEX-Forms WordPress plugin missing authorization unauthenticated arbitrary form Entry modification5.3CNA v3.10.5%2026-07-11Fix
CVE-2026-8678MyParcel WordPress plugin authorization bypass4.3CNA v3.10.4%2026-07-11Fix
CVE-2026-7655SureCart WordPress plugin unauthenticated Linked WordPress account takeover8.1CNA v3.10.5%2026-07-11Fix
CVE-2026-7620Notification for Telegram WordPress plugin missing authorization authenticated Cron modification4.3CNA v3.10.5%2026-07-11Fix
CVE-2026-7559Affilia WordPress plugin unauthorized access4.3CNA v3.10.5%2026-07-11Fix
CVE-2026-7544Mux Video Uploader WordPress plugin authenticated (Subscriber+) information exposure4.3CNA v3.10.4%2026-07-11Fix
CVE-2026-6939CorvusPay WooCommerce Payment Gateway WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.6%2026-07-11Fix
CVE-2026-6804AI Chatbot and Workflow Automation by AIWU WordPress plugin authorization bypass5.3CNA v3.10.6%2026-07-11Fix
CVE-2026-6803AI Chatbot and Workflow Automation by AIWU WordPress plugin missing authorization5.3CNA v3.10.5%2026-07-11Fix
CVE-2026-6801Context Blog WordPress theme unauthenticated sensitive information exposure via postID parameter5.3CNA v3.10.4%2026-07-11Fix
CVE-2026-5743Mixed Media Gallery Blocks WordPress plugin stored cross-site scripting6.4CNA v3.10.5%2026-07-11Fix
CVE-2026-4661WP CTA WordPress plugin unauthenticated time-based blind SQL injection via fildname parameter7.5CNA v3.10.5%2026-07-11Fix
CVE-2026-3576Planyo online reservation system WordPress plugin unauthenticated server-side request forgery7.2CNA v3.18.8%2026-07-11NucleiExploit codeFix
CVE-2026-3552SurfLink WordPress plugin missing authorization authenticated 410 Gone URL import4.3CNA v3.10.4%2026-07-11Fix
CVE-2026-3367Lockme OAuth2 calendars integration WordPress plugin stored cross-site scripting4.4CNA v3.10.4%2026-07-11Fix
CVE-2026-2354Swiss Toolkit For WP WordPress plugin arbitrary file upload8.8CNA v3.11.0%2026-07-11
CVE-2026-1832ThriveDesk WordPress plugin missing authorization to authenticated (Subscriber+) Cache deletion4.3CNA v3.10.4%2026-07-11Fix
CVE-2026-1382fresh Podcaster WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-11
CVE-2026-1359Genolve WordPress plugin unauthorized access8.8CNA v3.10.4%2026-07-11Fix
CVE-2026-61492JetBrains YouTrack cross-site scripting3.5CNA v3.10.7%2026-07-10Fix
CVE-2026-61461Dify SQL injection via MyScale Vector Store search_by_full_text8.7CNA v4.00.5%2026-07-10Fix
CVE-2026-61460Krayin CRM insecure direct object reference via Controllers8.7CNA v4.00.5%2026-07-10
CVE-2026-61459Flux159 mcp-server-kubernetes MCP Server Kubernetes argument injection via kubectl Structured tools9.3CNA v4.02.4%2026-07-10Exploit codeFix
CVE-2026-61456Grav stored XSS via SVG Upload API5.1CNA v4.00.2%2026-07-10Fix
CVE-2026-61455Grav decompression bomb via ZipArchiver7.1CNA v4.00.3%2026-07-10Fix
CVE-2026-61450Grav Config Exfiltration via offsetGet Filter7.1CNA v4.05.4%2026-07-10Fix
CVE-2026-61444PraisonAI code injection via f-string9.4CNA v4.00.6%2026-07-10Fix
CVE-2026-61441PraisonAI Platform authorization bypass via Dependencies7.1CNA v4.00.4%2026-07-10Fix
CVE-2026-61437PraisonAI remote code execution via tools.py8.5CNA v4.00.2%2026-07-10Fix
CVE-2026-61434PraisonAI Allowlist Bypass via find -exec8.7CNA v4.00.9%2026-07-10Fix
CVE-2026-61432PraisonAI FastContext path traversal6.9CNA v4.00.4%2026-07-10Fix
CVE-2026-61431PraisonAI path traversal via ContextGatherer6.8CNA v4.00.4%2026-07-10Fix
CVE-2026-60091PraisonAI unauthenticated SSRF via webhook_url6.9CNA v4.00.3%2026-07-10Fix
CVE-2026-60089PraisonAI path traversal via config.toml6.9CNA v4.00.2%2026-07-10Fix
CVE-2026-60086PraisonAI prompt injection Defense Bypass6.9CNA v4.00.4%2026-07-10Fix
CVE-2026-59796JetBrains TeamCity missing authorization8.1CNA v3.10.4%2026-07-10Fix
CVE-2026-59795JetBrains TeamCity cross-site scripting8.1CNA v3.10.3%2026-07-10Fix
CVE-2026-59794JetBrains TeamCity cross-site scripting7.3CNA v3.10.3%2026-07-10Fix
CVE-2026-59793JetBrains TeamCity external control of a file path8.8CNA v3.10.5%2026-07-10Fix
CVE-2026-59792JetBrains IntelliJ IDEA relative path traversal9.6CNA v3.10.6%2026-07-10Fix
CVE-2026-59791JetBrains YouTrack clickjacking3.5CNA v3.10.2%2026-07-10Fix
CVE-2026-59193Grav CMS Improper Handling of Highly Compressed Data in Installer::unZip6.9CNA v4.00.6%2026-07-10Fix
CVE-2026-59190Grav Admin Plugin IDOR privilege escalation via saveUser8.7CNA v4.00.4%2026-07-10
CVE-2026-59180Apprise forwards configured auth headers across cross-origin HTTP redirects3.1CNA v3.10.3%2026-07-10Fix
CVE-2026-59162Excelize: Negative shared-string index causes panic in GetCellValue and GetRows6.9CNA v4.00.7%2026-07-10Fix
CVE-2026-59161Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation8.7CNA v4.00.7%2026-07-10Fix
CVE-2026-59155Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API6.9CNA v4.00.5%2026-07-10Fix
CVE-2026-59154Wekan: Checklist direct DDP updates can write checklist data into private boards4.3CNA v3.10.4%2026-07-10Fix
CVE-2026-59151Prowler: SAML Domain Claiming enables Cross-Tenant account takeover9.6CNA v3.10.5%2026-07-10Fix
CVE-2026-58661n8n Disk Space Exhaustion via Data-Table file upload endpoint4.3v3.10.4%2026-07-10Fix
CVE-2026-58591Colorbox Moderately critical cross-site scripting SA-CONTRIB-2026-0695.4CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-58590FlowDrop Moderately critical Access bypass SA-CONTRIB-2026-0685.4CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-58589FlowDrop Moderately critical Access bypass SA-CONTRIB-2026-0675.4CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-58588Drupal Canvas Moderately critical improper validation SA-CONTRIB-2026-0666.1CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-58587Drupal Canvas Moderately critical improper validation SA-CONTRIB-2026-0656.1CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-58503Frappe: Unauthenticated User Enumeration via reset_password6.9CNA v4.00.6%2026-07-10Fix
CVE-2026-58499Path traversal in EverOS /API/v1/memory/add via unvalidated sender_id8.2CNA v3.10.5%2026-07-10Fix
CVE-2026-58493getgrav grav grav-plugin-database: DSN parameter injection5.1CNA v4.00.5%2026-07-10Fix
CVE-2026-58492getgrav grav SQL injection9.2CNA v4.00.5%2026-07-10Fix
CVE-2026-58225elixir-ecto postgrex SQL injection2.1CNA v4.00.2%2026-07-10Exploit codeFix
CVE-2026-57994phpMyFAQ information disclosure of Inactive FAQ Content via Public API endpoints6.9CNA v4.00.4%2026-07-10Fix
CVE-2026-57961phpMyFAQ authenticated path traversal in PDF Export via concatenatePaths function5.1CNA v4.00.4%2026-07-10Fix
CVE-2026-57850RustDesk Missing Session Scope Enforcement allows Out-of-Scope Control message injection8.7CNA v4.00.5%2026-07-10Exploit codeFix
CVE-2026-57807OAuth Single Sign On - SSO (OAuth Client) WordPress plugin broken authentication9.8CNA v3.10.7%2026-07-10Fix
CVE-2026-57584Phalcon default router regular expression denial of service8.7CNA v4.00.5%2026-07-10Fix
CVE-2026-57575Misskey: SSRF bypass in URL Preview6.9CNA v4.00.6%2026-07-10Fix
CVE-2026-57574Misskey: TOTP tokens can be reused7.4CNA v4.00.6%2026-07-10Fix
CVE-2026-57476Deloitte AI Assist for Customer unauthenticated RAG corpus read and write6.3CNA v4.00.4%2026-07-10Fix
CVE-2026-57475Deloitte AI Assist for Customer unauthenticated configuration write6.9CNA v4.00.6%2026-07-10Fix
CVE-2026-57474Deloitte AI Assist for Customer information disclosure6.9CNA v4.00.5%2026-07-10Fix
CVE-2026-57230OpenReplay: Authenticated ClickHouse SQL injection via session search5.4CNA v3.10.3%2026-07-10Fix
CVE-2026-57221Broadcom RabbitMQ queue and exchange declaration missing authorization5.3CNA v4.00.4%2026-07-10Fix
CVE-2026-57220Broadcom RabbitMQ stream listener resource exhaustion7.5CNA v3.10.5%2026-07-10Fix
CVE-2026-57219Broadcom RabbitMQ HTTP API OAuth configuration information disclosure8.7CNA v4.02.8%2026-07-10NucleiFix
CVE-2026-57218Broadcom RabbitMQ OAuth 2 consumer incorrect authorization4.9CNA v4.00.4%2026-07-10Fix
CVE-2026-57217RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass7.0CNA v4.00.4%2026-07-10Fix
CVE-2026-57216Broadcom RabbitMQ loopback authentication check improper authentication6.8CNA v3.10.5%2026-07-10Fix
CVE-2026-57215Broadcom RabbitMQ direct-reply-to binding incorrect authorization7.0CNA v4.00.4%2026-07-10Fix
CVE-2026-57214RabbitMQ: Stored XSS in RabbitMQ management UI7.1CNA v4.00.2%2026-07-10Fix
CVE-2026-57213RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering5.7CNA v4.00.3%2026-07-10Fix
CVE-2026-57212RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size7.1CNA v4.00.4%2026-07-10Fix
CVE-2026-57211RabbitMQ: UNC SSRF affecting the management UI on Windows6.5CNA v3.10.6%2026-07-10Fix
CVE-2026-57167PeerTube: Improper neutralization of script-related HTML tags in a web page (basic XSS)5.1CNA v4.00.5%2026-07-10Fix
CVE-2026-57158FreeRDP planar_decompress_plane_rle_only: Heap OOB read incomplete fix for5.1CNA v4.00.7%2026-07-10Fix
CVE-2026-57157FreeRDP out-of-bounds read in the camera device enumerator server6.5CNA v3.10.5%2026-07-10Fix
CVE-2026-57156FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing8.6CNA v4.00.7%2026-07-10Fix
CVE-2026-56814Elixir Plug multipart parser denial of service6.9CNA v4.01.1%2026-07-10Fix
CVE-2026-56813elixir-plug plug cookie attribute injection in Plug.Conn.Cookies.encode/22.1CNA v4.00.2%2026-07-10Fix
CVE-2026-56765Vikunja task attachment endpoint insecure direct object reference9.3CNA v4.00.5%2026-07-10Fix
CVE-2026-56690Dell PowerFlex Manager SQL injection8.5CNA v3.10.3%2026-07-10Fix
CVE-2026-56689Dell PowerFlex Manager SQL injection7.7CNA v3.10.4%2026-07-10Fix
CVE-2026-56688Dell PowerFlex Manager OS command injection9.1CNA v3.12.0%2026-07-10Fix
CVE-2026-56676decolua 9router image fetch handler server-side request forgery7.4CNA v3.10.3%2026-07-10Fix
CVE-2026-566759router /v1 APIs has unauthenticated access via reverse proxy locality collapse8.3CNA v3.10.5%2026-07-10Fix
CVE-2026-56668ZITADEL: Unauthorized Token privilege escalation in OAuth2 Token Exchange8.1CNA v3.10.4%2026-07-10Fix
CVE-2026-56667ZITADEL: Stored XSS via Default URI Redirect in Login V27.3CNA v3.10.4%2026-07-10Fix
CVE-2026-56666ZITADEL: Auto-linking by email: IdP-side email verification is not checked4.8CNA v3.10.3%2026-07-10Fix
CVE-2026-56665ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider4.2CNA v3.10.3%2026-07-10Fix
CVE-2026-56664ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider4.2CNA v3.10.3%2026-07-10Fix
CVE-2026-56373ImageMagick use-after-free Write in PDB Decoder5.3v3.10.2%2026-07-10Fix
CVE-2026-56366ImageMagick memory leak in META Reader APP1JPEG Error Path6.5v3.10.2%2026-07-10Fix
CVE-2026-56354n8n cross-site scripting and open redirect in Form Node5.4v3.10.2%2026-07-10Fix
CVE-2026-56335Capgo Channel Configuration Mutation via Write-Scoped API Keys7.1CNA v4.00.4%2026-07-10Fix
CVE-2026-56329Capgo Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding5.3CNA v4.00.3%2026-07-10Fix
CVE-2026-56312Capgo Account Creation before CAPTCHA Validation in accept_invitation endpoint6.9CNA v4.00.4%2026-07-10Fix
CVE-2026-56309Capgo Plan Bypass via Unrestricted Attachment upload endpoint5.3CNA v4.00.4%2026-07-10Fix
CVE-2026-56305Capgo authentication bypass in Password Change via Missing Current Password Validation8.7CNA v4.00.5%2026-07-10Fix
CVE-2026-56279Capgo information disclosure via get_orgs_v7 RPC endpoint8.7CNA v4.00.4%2026-07-10Fix
CVE-2026-56261Crawl4AI server-side request forgery via Webhook URLs7.5NVD v3.10.5%2026-07-10Fix
CVE-2026-56254capacitor-updater End-to-End Encryption Bypass via Private Key Distribution8.3CNA v4.00.2%2026-07-10Fix
CVE-2026-55890Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style4.8CNA v3.10.3%2026-07-10Fix
CVE-2026-55885Grav: Admin Backup Zip file exposes Account Credentials and Configuration Secrets6.8CNA v3.10.3%2026-07-10Fix
CVE-2026-55884Tilt: Missing authentication on the network-exposed Tilt HUD server9.2CNA v4.00.5%2026-07-10Fix
CVE-2026-55883Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream8.3CNA v4.00.3%2026-07-10Fix
CVE-2026-55882Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server8.3CNA v4.00.5%2026-07-10Fix
CVE-2026-55881OpenReplay session replay download endpoint insecure direct object reference7.1CNA v4.00.4%2026-07-10Fix
CVE-2026-55880OpenReplay: Cross-user IDOR in notes and dashboard widgets7.1CNA v3.10.3%2026-07-10
CVE-2026-55879OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover9.3CNA v3.10.5%2026-07-10Fix
CVE-2026-55852Frappe: TarSlip RCE in Package Import8.6CNA v4.00.7%2026-07-10Fix
CVE-2026-55843Snipe-IT: Improper privilege management7.0CNA v4.00.5%2026-07-10Fix
CVE-2026-55827FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode7.5CNA v3.10.5%2026-07-10Fix
CVE-2026-55810Plotly.js Graphing Critical PHP object injection SA-CONTRIB-2026-0508.1CISA ADP v3.10.4%2026-07-10Fix
CVE-2026-55809Flag attendance field Critical PHP object injection SA-CONTRIB-2026-0498.1CISA ADP v3.10.4%2026-07-10Fix
CVE-2026-55808Drupal core Moderately critical improper validation SA-CORE-2026-0095.4CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-55807Drupal core Moderately critical server-side request forgery SA-CORE-2026-0083.1CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-55806Drupal core Less critical cache poisoning and open redirect SA-CORE-2026-0075.9CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-55804Drupal core Moderately critical Gadget chain SA-CORE-2026-0065.9CISA ADP v3.10.4%2026-07-10Fix
CVE-2026-55803Drupal core Critical PHP object injection SA-CORE-2026-0055.9CISA ADP v3.10.4%2026-07-10Fix
CVE-2026-55789Logto SAML identity provider XML injection8.5CNA v3.10.4%2026-07-10Fix
CVE-2026-55783M2Team NanaZip archive extraction handlers null pointer dereference2.4CNA v4.00.2%2026-07-10Fix
CVE-2026-55782M2Team NanaZip WebAssembly archive parser denial of service2.4CNA v4.00.2%2026-07-10Fix
CVE-2026-55781M2Team NanaZip UFS and FFS parser denial of service2.4CNA v4.00.2%2026-07-10Exploit codeFix
CVE-2026-55780NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract2.4CNA v4.00.4%2026-07-10Exploit codeFix
CVE-2026-55687espressif esp-idf ESF-IDF: Stack-based out-of-bounds write in JPEG Decoder DQT Marker Parsing7.5CNA v3.10.7%2026-07-10Fix
CVE-2026-55672ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows7.4CNA v3.10.4%2026-07-10Fix
CVE-2026-55671ZITADEL: Server-side request forgery (SSRF) and Denylist Bypass in Outgoing HTTP components2.3CNA v4.00.4%2026-07-10Fix
CVE-2026-55670ZITADEL: Cross-Tenant user leakage via Recycled Identifiers2.3CNA v4.00.4%2026-07-10Fix
CVE-2026-55669ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider4.2CNA v3.10.2%2026-07-10Fix
CVE-2026-55665gristlabs grist-core DOM-based XSS in Grist via unsanitized links, enabling privilege escalation8.5CNA v4.00.5%2026-07-10Fix
CVE-2026-55664Grist forms endpoint information disclosure4.3CNA v3.10.3%2026-07-10Fix
CVE-2026-55659gristlabs grist-core grist: XSS through unsafe value interpolation in server-rendered pages7.7CNA v3.10.4%2026-07-10Fix
CVE-2026-556419router proxy Host header validation authentication bypass8.2CNA v3.10.3%2026-07-10Fix
CVE-2026-556389router codex proxy route missing authorization8.6CNA v3.10.6%2026-07-10Fix
CVE-2026-55615Langroid Neo4jChatAgent Cypher execution injection9.2CNA v4.00.5%2026-07-10Fix
CVE-2026-55516Snipe-IT: Cross-company asset maintenance re-parenting via API update7.7CNA v3.10.4%2026-07-10Fix
CVE-2026-55515Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint5.0CNA v3.10.3%2026-07-10Fix
CVE-2026-555019Router login rate limiter vulnerability7.3CNA v3.10.5%2026-07-10Fix
CVE-2026-555009Router database import and export endpoint missing authentication9.9CNA v3.10.7%2026-07-10Fix
CVE-2026-55481Snipe-IT: CSS injection via `header_color` setting6.2CNA v4.00.3%2026-07-10Fix
CVE-2026-55479Snipe-IT: Incorrect permission for legacy license checkin API5.3CNA v4.00.3%2026-07-10Fix
CVE-2026-55478Snipe-IT: Missing object-level authorization in Kits API5.3CNA v4.00.3%2026-07-10Fix
CVE-2026-55476Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin parameter5.3CNA v4.00.3%2026-07-10Fix
CVE-2026-55475Snipe-IT: Import created_by can be overwritten5.7CNA v3.10.3%2026-07-10Fix
CVE-2026-55474Snipe-IT: Directory traversal in displaySig7.1CNA v4.00.5%2026-07-10Fix
CVE-2026-55472Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation4.3CNA v3.10.3%2026-07-10Fix
CVE-2026-55469Snipe-IT: Path traversal vulnerability via CSV import `image` field6.5CNA v3.10.6%2026-07-10Fix
CVE-2026-55466Snipe-IT: Stored XSS via inline-served attachment6.2CNA v4.00.4%2026-07-10Fix
CVE-2026-55464Snipe-IT: Stored XSS via Markdown custom field4.8CNA v4.00.3%2026-07-10Fix
CVE-2026-55462Snipe-IT: Authorization bypass on print inventory page4.3CNA v3.10.3%2026-07-10Fix
CVE-2026-55461Snipe-IT: Open redirect after User Edit6.1CNA v3.10.3%2026-07-10Fix
CVE-2026-55460Snipe-IT: Authorization bypass on bulk editing users7.1CNA v3.10.4%2026-07-10Fix
CVE-2026-55452Snipe-IT: CSV formula injection in Activity Report export4.8CNA v4.00.4%2026-07-10Fix
CVE-2026-55405LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector7.6CNA v3.10.5%2026-07-10Fix
CVE-2026-55377Logto: Account Center MFA management step-up bypass via WebAuthn registration verification8.1CNA v3.10.5%2026-07-10Fix
CVE-2026-55370Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)6.4CNA v3.10.3%2026-07-10Fix
CVE-2026-55233OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream7.5CNA v3.10.5%2026-07-10Fix
CVE-2026-55229Gotenberg: SSRF via LibreOffice document processing7.5CNA v3.11.5%2026-07-10NucleiFix
CVE-2026-55213h2o QPACK decoder denial of service7.5CNA v3.10.5%2026-07-10
CVE-2026-55187Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to)5.8CNA v3.10.4%2026-07-10Fix
CVE-2026-55175Spinnaker: Improper yaml processing on kustomize bake operations7.5CNA v3.11.1%2026-07-10Fix
CVE-2026-54919cpp-httplib certificate verification for IP-literal hosts improper certificate validation7.4CNA v3.10.3%2026-07-10Fix
CVE-2026-54771Langroid: Handle_message executes user-supplied tool JSON without sender verification8.1CNA v3.10.4%2026-07-10Fix
CVE-2026-54769Langroid: Sandbox escape to remote code execution via Incomplete `eval` Mitigation in TableChatAgent10.0CNA v3.10.9%2026-07-10Fix
CVE-2026-54760langroid path traversal9.3CNA v4.00.6%2026-07-10Fix
CVE-2026-54736Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)8.2CNA v4.00.2%2026-07-10Fix
CVE-2026-54714Logto: XSS via unescaped RelayState in SAML auto-submit form6.1CNA v3.10.3%2026-07-10Fix
CVE-2026-54470Dell Unisphere for PowerMax XML external entity injection5.3CNA v3.10.3%2026-07-10Fix
CVE-2026-54469Dell Unisphere for PowerMax deserialization of untrusted data8.8CNA v3.10.9%2026-07-10Fix
CVE-2026-54468Dell Unisphere for PowerMax path traversal6.5CNA v3.10.5%2026-07-10Fix
CVE-2026-54423OpenStack Ironic unprotected alternate path8.2CNA v3.10.5%2026-07-10Fix
CVE-2026-54329Snipe-IT: Cross-Tenant Accessory injection in Snipe-IT API8.5CNA v3.10.4%2026-07-10Fix
CVE-2026-54149MaxKB MCP tool import validation bypass allows post-authentication remote code execution8.8CNA v3.10.5%2026-07-10Fix
CVE-2026-54063Excelize: Unbounded Row Index Allocation in Worksheet parser (checkSheet OOM/panic DoS)7.5CNA v3.10.6%2026-07-10Fix
CVE-2026-54001osquery authenticode table heap-based buffer overflow7.0CNA v4.00.2%2026-07-10Fix
CVE-2026-54000osquery processes table heap-based buffer overflow7.0CNA v4.00.2%2026-07-10Fix
CVE-2026-53657Lima guest agent socket privilege escalation8.2CNA v3.10.2%2026-07-10Fix
CVE-2026-53653Grav: Unauthenticated denial of service via unbounded image derivative dimensions8.7CNA v4.00.5%2026-07-10Fix
CVE-2026-53450Coturn: IPv4-mapped bypasses default loopback peer protection7.4CNA v3.10.3%2026-07-10Fix
CVE-2026-53449Coturn: Arbitrary file write via CLI psd command6.0CNA v3.10.2%2026-07-10Fix
CVE-2026-53448Coturn: SQL injection in HTTPS Admin Panel Delete Operations7.2CNA v3.10.7%2026-07-10Fix
CVE-2026-53363Linux kernel xfrm IP-TFS fragment merging vulnerability9.8CNA v3.10.3%2026-07-10Fix
CVE-2026-52761ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture5.8CNA v3.10.4%2026-07-10Fix
CVE-2026-52747OWASP ModSecurity multipart form-data parser vulnerability8.6CNA v3.10.5%2026-07-10Fix
CVE-2026-51119Invixium IXM WEB CreateAppUser endpoint privilege escalation9.1CISA ADP v3.10.5%2026-07-10Exploit code
CVE-2026-50180Langroid SQLChatAgent query validator SQL injection8.7CNA v4.00.7%2026-07-10Fix
CVE-2026-49844Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson6.3CNA v4.00.6%2026-07-10Fix
CVE-2026-49394Frappe: Auth. bypass via update_page7.1CNA v4.00.5%2026-07-10Fix
CVE-2026-49213baptisteArno typebot.io TypeBot: SSRF protection bypass8.1CNA v3.10.4%2026-07-10Fix
CVE-2026-48127Frappe: Arbitrary Attachment injection via add_attachments and upload_file5.3CNA v4.00.6%2026-07-10Fix
CVE-2026-47422Frappe: Unrestricted API access to save_report5.3CNA v4.00.4%2026-07-10Fix
CVE-2026-47199Frappe: Check_safe_sql_query Permits SELECT INTO OUTFILE2.3CNA v4.00.5%2026-07-10Fix
CVE-2026-46388osquery file carve insecure temporary file4.4CNA v3.10.1%2026-07-10Fix
CVE-2026-45203Imagination Technologies Graphics DDK HWPerf command size check race condition7.8CISA ADP v3.10.1%2026-07-10Fix
CVE-2026-45196GPU Ddk Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel7.8CISA ADP v3.10.1%2026-07-10Fix
CVE-2026-44918OpenStack Ironic missing authorization5.5CNA v3.10.4%2026-07-10Fix
CVE-2026-44795Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types8.8CNA v3.11.0%2026-07-10Fix
CVE-2026-44383Hydro-Québec Le Circuit Electrique charging station backend insufficient session expiration8.7CNA v4.00.6%2026-07-10
CVE-2026-42952Hydro-Québec Le Circuit Electrique charging station backend denial of service8.7CNA v4.00.5%2026-07-10
CVE-2026-42219Frappe: Path traversal via /backups route6.9CNA v4.00.7%2026-07-10Fix
CVE-2026-41880OS command injection in R-SOFT DMS9.0CNA v4.01.3%2026-07-10Fix
CVE-2026-41879Weak password hashing in R-SOFT DMS8.2CNA v4.00.3%2026-07-10Fix
CVE-2026-41878Insecure direct object reference in R-SOFT DMS7.1CNA v4.00.5%2026-07-10Fix
CVE-2026-41877Stored XSS in R-SOFT DMS5.1CNA v4.00.4%2026-07-10Fix
CVE-2026-41876OS command injection in R-SOFT DMS8.7CNA v4.01.2%2026-07-10Fix
CVE-2026-41482Frappe: Possible path traversal and local file inclusion via Chrome PDF Generator7.1CNA v4.00.5%2026-07-10Fix
CVE-2026-41154GPU Ddk Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse7.8CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-40454Apache IoTDB C++ client TsBlock deserializer out-of-bounds read7.5CISA ADP v3.10.5%2026-07-10Fix
CVE-2026-40452Apache IoTDB fastLastQuery REST endpoint authorization bypass7.5CISA ADP v3.10.4%2026-07-10Fix
CVE-2026-40009Apache IoTDB improper privilege management6.5CISA ADP v3.10.4%2026-07-10Fix
CVE-2026-40008Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC9.8CISA ADP v3.10.6%2026-07-10Fix
CVE-2026-40007Apache IoTDB AirGap receiver uncontrolled recursion7.5CISA ADP v3.10.5%2026-07-10Fix
CVE-2026-40006Apache IoTDB: Unauthenticated heap-exhaustion DoS7.5CISA ADP v3.10.6%2026-07-10Fix
CVE-2026-40005Apache IoTDB: Path traversal in Pipe File Transfer Receiver9.1CISA ADP v3.10.5%2026-07-10Fix
CVE-2026-39903SimpleMachines SMF Simple Machines Forum authorization bypass via AttachmentApprove.php7.1CNA v4.00.5%2026-07-10
CVE-2026-39244Adm-zip: Crafted ZIP file triggers 4GB memory allocation7.5CISA ADP v3.10.8%2026-07-10Fix
CVE-2026-38059ST Engineering iDirect iQ-Series Terminals missing authentication for critical function8.7CNA v4.00.6%2026-07-10Fix
CVE-2026-38057ST Engineering iDirect iQ-Series Terminals cross-site request forgery7.0CNA v4.00.3%2026-07-10Fix
CVE-2026-34196Imagination Technologies Graphics DDK PMRDevPhysAddrOSMem function use-after-free7.8CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-33382Grafana OSS denial of service via unbounded request body size7.5CNA v3.10.4%2026-07-10Fix
CVE-2026-29519Lucee CFML server reflected XSS via URL Path Parsing6.2CNA v4.00.5%2026-07-10Exploit code
CVE-2026-28564Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials9.8CISA ADP v3.10.7%2026-07-10Fix
CVE-2026-22660FlaskBB logic flaw Authorization Group Deletion via Bulk AJAX endpoint8.6CNA v4.00.6%2026-07-10
CVE-2026-22659FlaskBB authorization bypass via Topic ID Manipulation7.2CNA v4.00.5%2026-07-10
CVE-2026-21057Samsung Mobile Samsung Pass improper input validation6.8CNA v4.00.2%2026-07-10
CVE-2026-21056Samsung Mobile Samsung Health improper authorization4.8CNA v4.00.1%2026-07-10
CVE-2026-21055Samsung Mobile Bixby improper export of Android application components8.5CNA v4.00.2%2026-07-10Exploit code
CVE-2026-21054Samsung Mobile InputSharing improper export of Android application components6.9CNA v4.00.2%2026-07-10
CVE-2026-21053Samsung Mobile Samsung Email improper input validation5.1CNA v4.00.2%2026-07-10
CVE-2026-21052Samsung Mobile Devices SemClipboardService path traversal6.8CNA v4.00.2%2026-07-10
CVE-2026-21051Samsung Mobile Devices WLAN security incorrect default permissions5.1CNA v4.00.2%2026-07-10
CVE-2026-21050Samsung Mobile Devices SmartThingsKit improper access control5.1CNA v4.00.2%2026-07-10
CVE-2026-21049Samsung Mobile Devices libpadm.so library out-of-bounds write8.4CNA v4.00.2%2026-07-10
CVE-2026-21048Samsung Mobile Devices out-of-bounds write8.4CNA v4.00.5%2026-07-10
CVE-2026-21046Samsung Mobile Devices fabricKeymaster trustlet time-of-check time-of-use race condition8.4CNA v4.00.1%2026-07-10
CVE-2026-21045Samsung Mobile Devices out-of-bounds write8.4CNA v4.00.5%2026-07-10Exploit code
CVE-2026-21044Samsung Mobile Devices KnoxGuardManager improper authorization5.8CNA v4.00.1%2026-07-10
CVE-2026-21043Samsung Mobile Devices Wallpaper service path traversal6.7CNA v4.00.2%2026-07-10
CVE-2026-21042Samsung Mobile Devices libsavsac.so out-of-bounds write8.7CNA v4.00.4%2026-07-10
CVE-2026-21041Samsung Mobile Devices SamsungSEAgentService improper access control6.9CNA v4.00.2%2026-07-10
CVE-2026-21040Samsung Mobile Devices IAFDService improper access control6.9CNA v4.00.1%2026-07-10
CVE-2026-21039Samsung Mobile Devices settings improper access control6.9CNA v4.00.2%2026-07-10
CVE-2026-20744Hydro-Québec Le Circuit Electrique charging station backend improper access control9.3CNA v4.00.8%2026-07-10
CVE-2026-15378Red Hat OpenShift AI guardrails-detectors: Guardrails-detectors: Ssrf and local file read9.3CNA v3.10.5%2026-07-10Fix
CVE-2026-15377Eleveo Call Recording Software sendlogfile improper authorization5.3CNA v4.00.3%2026-07-10
CVE-2026-15376Eleveo Call Recording Software statisticReportAction.do improper authorization5.3CNA v4.00.3%2026-07-10
CVE-2026-15375Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization5.3CNA v4.00.4%2026-07-10
CVE-2026-15374Eleveo Call Recording Software Group roleAddAction.do improper authorization5.3CNA v4.00.3%2026-07-10
CVE-2026-15373Eleveo Call Recording Software userAddAction.do improper authorization5.3CNA v4.00.3%2026-07-10
CVE-2026-15332zhayujie CowAgent message endpoint channel.py authorization5.3CNA v4.00.4%2026-07-10
CVE-2026-15331zhayujie CowAgent Skill Installation service.py _add_package path traversal5.3CNA v4.00.6%2026-07-10Fix
CVE-2026-15330zhayujie CowAgent Vision tool vision.py _download_to_data_url server-side request forgery6.9CNA v4.00.6%2026-07-10Fix
CVE-2026-15329zhayujie CowAgent Browser tool browser_tool.py BrowserTool._do_navigate information disclosure5.3CNA v4.00.4%2026-07-10
CVE-2026-15326halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal5.1CNA v4.00.5%2026-07-10
CVE-2026-15321MyEMS Admin Backend svg.py on_post cross-site scripting4.8CNA v4.00.4%2026-07-10Fix
CVE-2026-15320Sipeed PicoClaw pico.go rt.ReloadConfig authorization5.3CNA v4.00.4%2026-07-10
CVE-2026-15319Sipeed PicoClaw Launcher access_control.go IPAllowlist access control6.9CNA v4.00.5%2026-07-10
CVE-2026-15318Sipeed PicoClaw MQTT Channel mqtt.go authorization5.3CNA v4.00.4%2026-07-10
CVE-2026-15317Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery5.3CNA v4.00.4%2026-07-10
CVE-2026-15311NousResearch hermes-agent Matrix adapter markdown renderer cross-site scripting5.1CNA v4.00.4%2026-07-10
CVE-2026-15302ARMember WordPress plugin directory traversal via X-FILENAME5.3CNA v3.10.7%2026-07-10Fix
CVE-2026-15301BuddyHolis TableSearch WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.3%2026-07-10
CVE-2026-15300GEO my WP WordPress plugin unauthenticated SQL injection via distance / lat / lng parameters9.1CNA v3.10.6%2026-07-10Fix
CVE-2026-15299Animation Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-10Fix
CVE-2026-15298TelSender WordPress plugin unauthenticated stored cross-site scripting via Telegram Chat Title7.2CNA v3.10.4%2026-07-10Fix
CVE-2026-15297Newsletter WordPress plugin reflected cross-site scripting6.1CNA v3.10.4%2026-07-10Fix
CVE-2026-15296affiliate-toolkit WP Affiliate Plugin with Amazon WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-10Fix
CVE-2026-15295Ajax Load More WordPress plugin authenticated (Administrator+) stored cross-site scripting4.4CNA v3.10.2%2026-07-10Fix
CVE-2026-15293WP Business Intelligence Lite WordPress plugin missing authorization privilege escalation8.0CNA v3.10.5%2026-07-10
CVE-2026-15292Sudoku Shortcode WordPress plugin cross-site scripting6.4CNA v3.10.3%2026-07-10
CVE-2026-15291Chat Help WordPress plugin information disclosure7.5CNA v3.10.7%2026-07-10Fix
CVE-2026-15290Ultimate Member WordPress plugin blind SQL injection7.5CNA v3.10.5%2026-07-10Fix
CVE-2026-15289Booking calendar, Appointment Booking System WordPress plugin SQL injection5.9CNA v3.10.4%2026-07-10Fix
CVE-2026-15288SureForms WordPress plugin improper input validation7.5CNA v3.10.5%2026-07-10Fix
CVE-2026-15287rtMedia for WordPress, BuddyPress and bbPress plugin authenticated (Subscriber+) SQL injection6.5CNA v3.10.4%2026-07-10Fix
CVE-2026-15286StellarWP Kadence Blocks process_pattern REST endpoint incorrect authorization4.3CNA v3.10.4%2026-07-10Fix
CVE-2026-15285The Plus Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-10Fix
CVE-2026-15284King Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-10Fix
CVE-2026-15283WPvivid Backup for MainWP WordPress plugin authenticated (Admin+) stored cross-site scripting4.4CNA v3.10.2%2026-07-10Fix
CVE-2026-15282Instant Appointment WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.11.1%2026-07-10Exploit code
CVE-2026-15146Wget FTP passive mode connection handling server-side request forgery5.9CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-15143Red Hat OpenShift AI guardrails-detectors: Guardrails-detectors: Ssrf and local file read9.3CNA v3.10.5%2026-07-10Fix
CVE-2026-15104BetterDocs WordPress plugin authenticated (Custom+) SQL injection via lang parameter6.5CNA v3.10.4%2026-07-10Fix
CVE-2026-15089Commerce guest registration Critical Unsupported SA-CONTRIB-2026-0799.1CISA ADP v3.10.4%2026-07-10
CVE-2026-15087Clean RESTful Critical Unsupported SA-CONTRIB-2026-0785.9CISA ADP v3.10.3%2026-07-10
CVE-2026-15086Raw Formatter [Meta Tag Formatter] Critical Unsupported SA-CONTRIB-2026-0775.9CISA ADP v3.10.3%2026-07-10
CVE-2026-15085AI SEO/GEO Analyzer Moderately critical cross-site scripting SA-CONTRIB-2026-0765.4CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-15084UI Patterns (SDC in Drupal UI) Moderately critical cross-site scripting SA-CONTRIB-2026-0755.4CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-15083Eca: Event Condition Action Less critical information disclosure SA-CONTRIB-2026-0744.2CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-15082Siteimprove Analytics Moderately critical cross-site scripting SA-CONTRIB-2026-0735.4CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-15081Location Selector Critical SQL injection SA-CONTRIB-2026-0727.4CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-15080Ray Enterprise Translation Moderately critical cross-site request forgery SA-CONTRIB-2026-0714.3CISA ADP v3.10.1%2026-07-10Fix
CVE-2026-15079Login Disable Moderately critical Access bypass SA-CONTRIB-2026-0705.4CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-15070Salon Booking System WordPress plugin cross-site request forgery to remote code execution8.8CNA v3.10.4%2026-07-10Fix
CVE-2026-15028Red Hat Enterprise Linux 10 buffer access with incorrect length3.9CNA v3.10.2%2026-07-10Fix
CVE-2026-15026Import and export users and customers WordPress plugin information disclosure4.3CNA v3.10.4%2026-07-10Fix
CVE-2026-14894Super Forms WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.15.1%2026-07-10NucleiExploit codeFix
CVE-2026-14480OpenPLC v3 external control of file name or path8.7CNA v4.00.6%2026-07-10Fix
CVE-2026-14475Cookie Banner for GDPR / CCPA WordPress plugin SQL injection4.9CNA v3.10.5%2026-07-10Fix
CVE-2026-14461Out-of-bound read in mtr5.1CNA v4.00.3%2026-07-10Fix
CVE-2026-13710Jeg Kit for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-10Fix
CVE-2026-13430Post Export Import with Media WordPress plugin arbitrary file upload7.2CNA v3.11.1%2026-07-10Fix
CVE-2026-13347Hide My WP Lite WordPress plugin unauthenticated path traversal to arbitrary file read7.5CNA v3.10.7%2026-07-10
CVE-2026-13247Logo Slider WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-10Fix
CVE-2026-13244Tealium iQ Tag Management Critical PHP object injection SA-CONTRIB-2026-0648.1CISA ADP v3.10.4%2026-07-10Fix
CVE-2026-13243Salesforce Suite Moderately critical cross-site request forgery SA-CONTRIB-2026-0634.8CISA ADP v3.10.1%2026-07-10Fix
CVE-2026-13242Geolocation Field Critical SQL injection SA-CONTRIB-2026-0626.5CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-13241Paragraphs Moderately critical Access bypass SA-CONTRIB-2026-0616.5CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-13240Paragraphs Less critical Access bypass SA-CONTRIB-2026-0606.5CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-13239WissKI Critical Access bypass SA-CONTRIB-2026-0596.5CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-13238Commerce Realex / Global Payments Moderately critical Access Bypass SA-CONTRIB-2026-0584.8CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-13237AI Agents Moderately critical information disclosure, Access bypass SA-CONTRIB-2026-0574.8CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-13236AI Agents Less critical Access bypass SA-CONTRIB-2026-0564.2CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-13235AI (Artificial Intelligence) Moderately critical Access bypass SA-CONTRIB-2026-0553.3CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-13234AI Moderately critical information disclosure / cross-site scripting SA-CONTRIB-2026-0546.1CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-13233OpenAI Provider Moderately critical server-side request forgery SA-CONTRIB-2026-0533.3CISA ADP v3.10.2%2026-07-10Exploit codeFix
CVE-2026-13232Drupal Advanced Content Feedback (aka admin_feedback) incorrect authorization3.1CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-13231Advanced Content Feedback Moderately critical cross-site scripting SA-CONTRIB-2026-0516.1CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-13039Eventin - missing authorization to Unauthenticated Payment Bypass via REST API5.3CNA v3.10.4%2026-07-10Fix
CVE-2026-13010JoomSport WordPress plugin authenticated (Contributor+) SQL injection via event shortcode attribute6.5CNA v3.10.4%2026-07-10Fix
CVE-2026-12955GDPR Cookie Consent WordPress plugin unauthorized access4.3CNA v3.10.3%2026-07-10Fix
CVE-2026-12924Eventin WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-10Fix
CVE-2026-12918Mail Mint WordPress plugin authenticated (Administrator+) SQL injection via recipients parameter4.9CNA v3.10.5%2026-07-10Fix
CVE-2026-12761miniOrange Social Login and Register WordPress plugin authentication bypass9.8CNA v3.10.9%2026-07-10Fix
CVE-2026-12685EscortWP WordPress theme content deletion via Vendor-Authored backdoor7.5CISA ADP v3.10.4%2026-07-10
CVE-2026-12598LoginPress Pro WordPress plugin unauthenticated authentication bypass8.1CNA v3.10.6%2026-07-10Fix
CVE-2026-12597LoginPress Pro WordPress plugin unauthenticated authentication bypass8.1CNA v3.10.6%2026-07-10Fix
CVE-2026-12595LoginPress Pro WordPress plugin unauthenticated authentication bypass8.1CNA v3.10.6%2026-07-10Fix
CVE-2026-12535Formatter Field Critical PHP object injection SA-CONTRIB-2026-0489.8CISA ADP v3.10.6%2026-07-10Fix
CVE-2026-12400FlowForms WordPress plugin insecure direct object reference to arbitrary form modification4.3CNA v3.10.4%2026-07-10Exploit codeFix
CVE-2026-12276LA-Studio Element Kit for Elementor WordPress plugin unauthenticated open Registration5.3CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-12123All-in-One Video Gallery WordPress plugin server-side request forgery6.4CNA v3.10.4%2026-07-10Fix
CVE-2026-12108Highlighting Code Block WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-07-10Fix
CVE-2026-11992Easy Appointments WordPress plugin missing authorization authenticated Bulk Appointment manipulation4.3CNA v3.10.5%2026-07-10Fix
CVE-2026-11990KiviCare WordPress plugin authorization bypass5.3CNA v3.10.6%2026-07-10Fix
CVE-2026-11915Brute force attack protection Critical Unsupported SA-CONTRIB-2026-0475.9CISA ADP v3.10.3%2026-07-10
CVE-2026-11914Composer Critical Unsupported SA-CONTRIB-2026-0465.9CISA ADP v3.10.3%2026-07-10
CVE-2026-11913Mother May I Critical Unsupported SA-CONTRIB-2026-0459.8CISA ADP v3.10.6%2026-07-10
CVE-2026-11909Examples for Developers Moderately critical Access bypass SA-CONTRIB-2026-0443.3CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-11908Tagify Moderately critical cross-site scripting (XSS) SA-CONTRIB-2026-0435.4CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-11818WPCafe WordPress plugin missing authorization authenticated arbitrary modification5.4CNA v3.10.4%2026-07-10Fix
CVE-2026-11392WP Hotel Booking WordPress plugin reflected cross-site scripting6.1CNA v3.10.4%2026-07-10Fix
CVE-2026-11321GLPI DataInjection plugin authenticated SQL injection via CSV Import7.1CNA v4.00.4%2026-07-10Fix
CVE-2026-10770Anti-spam by CleanTalk Moderately critical cross-site scripting SA-CONTRIB-2026-0426.1CISA ADP v3.10.3%2026-07-10Fix
CVE-2026-10769Commerce Core Moderately critical cross-site scripting SA-CONTRIB-2026-0415.4CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-10768LocalGov Workflows Moderately critical information disclosure SA-CONTRIB-2026-0399.8CISA ADP v3.12.1%2026-07-10NucleiFix
CVE-2026-9857Invoice123 WordPress plugin missing authorization authenticated setting modification4.3CNA v3.10.5%2026-07-10Fix
CVE-2026-9838ICS Calendar WordPress plugin reflected cross-site scripting via htmltagtitle parameter6.1CNA v3.10.5%2026-07-10Fix
CVE-2026-9726Drupal AlternativeCommerce (Basket) Highly critical Arbitrary PHP code execution SA-CONTRIB-2026-0389.8CISA ADP v3.10.6%2026-07-10Fix
CVE-2026-8609Grafana OSS pre-authentication denial of service via the OAuth login route5.3CNA v3.10.5%2026-07-10Fix
CVE-2026-8595Grafana OSS stored XSS in the table panel (TableNG)6.8CNA v3.10.3%2026-07-10Fix
CVE-2026-7639GPU Ddk page UAF read in PMMETA_PROTECT heap memory7.8CISA ADP v3.10.2%2026-07-10Fix
CVE-2026-6802Easy Upload Files During Checkout WordPress plugin unauthorized access5.3CNA v3.10.4%2026-07-10Fix
CVE-2026-6440GoodMeet WordPress plugin cross-site request forgery to Google Meet Credential reset4.3CNA v3.10.2%2026-07-10Exploit codeFix
CVE-2026-6212IDOR in Teracity's TeraMIS8.8CNA v3.10.4%2026-07-10
CVE-2026-5801SQLi in Semtek Informatics' SEM-PMP9.8CNA v3.10.6%2026-07-10
CVE-2026-5069Fluent Forms WordPress plugin incorrect authorization5.4CNA v3.10.3%2026-07-10Fix
CVE-2026-3907Hostel WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-10Fix
CVE-2026-3251XSS in Webremium's Mezunum Satiyorum6.4CNA v3.10.2%2026-07-10
CVE-2026-2398IDOR in AdamPOS' MobilMen 20T8.8CNA v3.10.5%2026-07-10
CVE-2026-2397SQLi in AdamPOS' MobilMen 20T9.8CNA v3.10.5%2026-07-10
CVE-2026-1946GW AI Website Builder WordPress plugin unauthorized access4.3CNA v3.10.4%2026-07-10Fix
CVE-2026-1667SEO Plugin by Squirrly SEO WordPress plugin stored cross-site scripting7.2CNA v3.10.3%2026-07-10Fix
CVE-2026-61474MISP: Improper sharing group authorization check when adding attributes5.3CNA v4.00.4%2026-07-09
CVE-2026-61344Superior Court of California Hearing Reminder Service unauthenticated information disclosure6.9CNA v4.00.5%2026-07-09Fix
CVE-2026-61343LibreBooking path traversal8.6CNA v4.01.0%2026-07-09Exploit codeFix
CVE-2026-60120Bagisto stored XSS via CSTI in create.blade.php5.1CNA v4.00.4%2026-07-09Fix
CVE-2026-60109Zeek null pointer dereference DoS via Kerberos KRB_ERROR Parsing8.7CNA v4.00.9%2026-07-09Fix
CVE-2026-60108Zeek Uncontrolled Memory Consumption DoS via FTP Analyzer8.7CNA v4.00.8%2026-07-09Fix
CVE-2026-60095Vinchin Backup and Recovery stack buffer overflow via ModuleHandShake6.9CNA v4.00.7%2026-07-09
CVE-2026-60094Vinchin Backup and Recovery heap buffer overflow via agentlink_server6.9CNA v4.00.6%2026-07-09
CVE-2026-59858Vim: Arbitrary code execution via C Omni-Completion8.4CNA v4.00.1%2026-07-09Fix
CVE-2026-59857Vim: Out-of-bounds write in SAL Soundfolding5.6CNA v4.00.2%2026-07-09Fix
CVE-2026-59856Vim: Arbitrary code execution via PHP Omni-Completion8.4CNA v4.00.2%2026-07-09Fix
CVE-2026-59855SiYuan: Store XSS to RCE via Asset.render8.6CNA v4.00.5%2026-07-09Fix
CVE-2026-59854SiYuan file copy API information disclosure4.9CNA v3.10.5%2026-07-09Fix
CVE-2026-59853SiYuan saved-search criteria API missing authorization6.5CNA v3.10.4%2026-07-09Fix
CVE-2026-59834SiYuan: SQL Query in Block Search exposes Hidden Published Document Content7.5CNA v3.10.5%2026-07-09Fix
CVE-2026-59833SiYuan: Stored XSS to RCE in SiYuan8.6CNA v4.00.5%2026-07-09Fix
CVE-2026-59832SiYuan snippets static file handler path traversal7.7CNA v3.10.5%2026-07-09Fix
CVE-2026-59831cli inclusion of untrusted functionality4.4CNA v3.10.3%2026-07-09Fix
CVE-2026-59828Discourse: Hidden post revisions leak through adjacent visible diffs5.3CNA v3.10.5%2026-07-09Fix
CVE-2026-59827Metabase: Unsafe deserialization of H2 Query results9.9CNA v3.13.8%2026-07-09Exploit codeFix
CVE-2026-59826Metabase: Arbitrary code execution via Database Connection Detail Bypass9.1CNA v3.11.0%2026-07-09Fix
CVE-2026-59817Ghost: Paid gift memberships obtainable at minimal cost via the donations feature5.3CNA v3.10.4%2026-07-09Fix
CVE-2026-59734Coolify: OS command injection in Health Check Configuration allows remote code execution8.8CNA v3.10.8%2026-07-09Exploit codeFix
CVE-2026-59726Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment10.0CNA v3.13.0%2026-07-09NucleiFix
CVE-2026-59721Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection7.2CNA v3.11.0%2026-07-09Fix
CVE-2026-59720Hoppscotch: Insecure default Configuration allows Public Exposure of Private Collection Data7.5CNA v3.10.6%2026-07-09Fix
CVE-2026-59715open-webui Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers3.1CNA v3.10.4%2026-07-09Fix
CVE-2026-59692GStreamer DTLS certificate verification callback stack-based buffer overflow7.5CNA v3.11.0%2026-07-09Fix
CVE-2026-59691GStreamer rfbsrc Hextile decoder out-of-bounds write7.1CNA v3.10.6%2026-07-09Fix
CVE-2026-59269A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirec3.8CNA v3.10.3%2026-07-09
CVE-2026-59227Open WebUI image edit API missing authorization4.3CNA v3.10.4%2026-07-09Fix
CVE-2026-59226Open WebUI scheduled automations improper authorization3.1CNA v3.10.5%2026-07-09Fix
CVE-2026-59225open-webui open WebUI: Arena task endpoints can bypass underlying model access controls5.4CNA v3.10.4%2026-07-09Fix
CVE-2026-59224Open WebUI terminal proxy authentication bypass by spoofing8.0CNA v3.10.4%2026-07-09Fix
CVE-2026-59223Open WebUI web fetch host filter vulnerability4.3CNA v3.10.4%2026-07-09Fix
CVE-2026-59222Open WebUI channel members endpoint information disclosure6.0CNA v4.00.5%2026-07-09Fix
CVE-2026-59221open-webui terminal proxy path traversal guard bypass via 9x encoded traversal7.7CNA v3.10.5%2026-07-09Fix
CVE-2026-59220open-webui open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config6.5CNA v3.10.6%2026-07-09Fix
CVE-2026-59219open-webui open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout7.1CNA v3.10.5%2026-07-09Fix
CVE-2026-59218open-webui open WebUI: Account enumeration via observable login timing discrepancy5.3CNA v3.10.4%2026-07-09Fix
CVE-2026-59217open-webui open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check4.3CNA v3.10.4%2026-07-09Fix
CVE-2026-59216Open WebUI Socket.IO event-caller session handling improper access control7.7CNA v3.10.5%2026-07-09Fix
CVE-2026-59215Open WebUI channel thread parent binding insecure direct object reference3.1CNA v3.10.3%2026-07-09Fix
CVE-2026-59214open-webui Open WebUI: Stored web worker XSS via Pyodide7.3CNA v3.10.4%2026-07-09Fix
CVE-2026-59213open-webui open WebUI: Cross-user model-list exposure via static cache key in get_all_models3.5CNA v3.10.4%2026-07-09Fix
CVE-2026-59212Open WebUI knowledge file access control incorrect authorization5.4CNA v3.10.4%2026-07-09Fix
CVE-2026-59209n8n HTTP Request node pagination expression information disclosure7.1CNA v4.00.4%2026-07-09Fix
CVE-2026-59208n8n token exchange identity resolution improper authentication7.6CNA v4.00.3%2026-07-09Fix
CVE-2026-59207n8n AI Agents MCP connector vulnerability7.1CNA v4.00.4%2026-07-09Fix
CVE-2026-59206n8n workflow credentials handling prototype pollution7.1CNA v4.00.7%2026-07-09Fix
CVE-2026-59149Mockoon: Path traversal in templated `filePath` lets a request escape the served directory6.5CNA v3.10.5%2026-07-09Fix
CVE-2026-59148Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft8.8CNA v3.10.3%2026-07-09Fix
CVE-2026-58459gpsd gpsprof command injection via gnuplot plot title subtype field9.6v3.12.9%2026-07-09Fix
CVE-2026-58378Allwinner TV Box TV98 ADB exposed on network8.6CNA v4.00.4%2026-07-09
CVE-2026-58307Samsung Open Source Escargot out-of-bounds read6.1CNA v3.10.2%2026-07-09
CVE-2026-58306Samsung Open Source Escargot heap-based buffer overflow6.1CNA v3.10.2%2026-07-09
CVE-2026-58305Samsung Open Source Escargot type confusion6.1CNA v3.10.2%2026-07-09
CVE-2026-58304Samsung Open Source Escargot out-of-bounds read6.1CNA v3.10.2%2026-07-09
CVE-2026-58303Samsung Open Source Escargot stack-based buffer overflow6.1CNA v3.10.2%2026-07-09
CVE-2026-58198ChatterBot: Symlink-Following arbitrary Write via UbuntuCorpusTrainer5.5CNA v3.10.1%2026-07-09Fix
CVE-2026-58144Cotonti Siena stored XSS via PFS module ntitle parameter5.1CNA v4.00.2%2026-07-09
CVE-2026-58143Cotonti Siena CSRF via admin.php Config Update endpoint8.7CNA v4.00.2%2026-07-09
CVE-2026-58123nesquena hermes-webui Hermes WebUI unauthenticated RCE via Terminal API9.3CNA v4.04.6%2026-07-09NucleiFix
CVE-2026-58122nesquena hermes-webui hermes WebUI authentication bypass via X-Forwarded-For header spoofing9.3CNA v4.00.4%2026-07-09Fix
CVE-2026-57501Zen Browser context-menu link handling vulnerability0.0CNA v3.10.5%2026-07-09Fix
CVE-2026-57111Apache Helix REST: Permissive CORS Configuration in REST API allows Unrestricted Cross-Origin7.5CISA ADP v3.10.3%2026-07-09Fix
CVE-2026-57054Junos OS: MX Series: Web filtering doesn't block specifically formatted URLs6.9CNA v4.00.4%2026-07-09Fix
CVE-2026-57032Junos OS: EX Series: Subscribing to an unsupported telemetry sensor path causes fxpc process crash7.1CNA v4.00.4%2026-07-09Fix
CVE-2026-57031Juniper Networks Junos OS packet forwarding engine improper check for exceptional conditions5.3CNA v4.00.2%2026-07-09Fix
CVE-2026-57030Junos OS: SRX Series: Flow sessions are not getting cleared leading to a DoS8.2CNA v4.00.4%2026-07-09Fix
CVE-2026-57029Juniper Networks Junos OS Evolved flow collector handler vulnerability6.0CNA v4.00.2%2026-07-09Fix
CVE-2026-57028Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker6.9CNA v4.00.3%2026-07-09Fix
CVE-2026-57027Juniper Networks Junos OS packet forwarding engine memory leak7.1CNA v4.00.3%2026-07-09Fix
CVE-2026-57026Juniper Networks Junos OS SIP plugin improper syntax validation8.7CNA v4.00.5%2026-07-09Fix
CVE-2026-57025Juniper Networks Junos OS fileio library denial of service6.8CNA v4.00.1%2026-07-09Fix
CVE-2026-57024Juniper Networks Junos OS IKE daemon denial of service6.9CNA v4.00.4%2026-07-09Fix
CVE-2026-57023Junos OS: MX with SPC3, SRX Series: A specifically malformed TCP packet causes a flowd crash8.7CNA v4.00.5%2026-07-09Fix
CVE-2026-57022Juniper Networks Junos OS Packet Forwarding Engine improper check for exceptional conditions8.2CNA v4.00.4%2026-07-09Fix
CVE-2026-57021Juniper Networks Junos OS http-gatekeeper out-of-bounds write6.9CNA v4.00.5%2026-07-09Fix
CVE-2026-57020Juniper Networks Junos OS packet forwarding engine improper check for exceptional conditions7.1CNA v4.00.3%2026-07-09Fix
CVE-2026-57019Junos OS: MX Series: Specific traffic causes an FPC to reset7.1CNA v4.00.3%2026-07-09Fix
CVE-2026-56460HCL DevOps Deploy and Launch API information disclosure6.5CNA v3.10.4%2026-07-09Fix
CVE-2026-56459HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure6.2CNA v3.10.1%2026-07-09Fix
CVE-2026-56458HCL DevOps Deploy is susceptible to a permissive cross-domain security policy with untrusted domains5.4CNA v3.10.3%2026-07-09Fix
CVE-2026-56292Joomla Extension AcyMailing.com SQL injection in AcyMailing extension7.5NVD v3.11.4%2026-07-09Nuclei
CVE-2026-56291Balbooa Forms unrestricted upload of file with dangerous type9.8NVD v3.114.9%2026-07-09KEVNucleiExploit code
CVE-2026-56289Loop with unreachable exit condition in GNU patch5.5v3.10.1%2026-07-09Fix
CVE-2026-56288Null pointer dereference in GNU patch5.5v3.10.1%2026-07-09Fix
CVE-2026-55865Python Liquid case tag parser infinite loop7.1CNA v4.00.5%2026-07-09Fix
CVE-2026-55689OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset6.8CNA v3.10.4%2026-07-09Fix
CVE-2026-55605@arikusi/deepseek-mcp-server missing authentication on Self-Hosted HTTP MCP endpoint5.3CNA v3.10.6%2026-07-09Fix
CVE-2026-55604@arikusi/deepseek-mcp-server has an authorization bypass through user-controlled key8.6CNA v3.10.4%2026-07-09Fix
CVE-2026-55590CakePHP: Open redirect weakness via backslash bypass5.1CNA v4.00.5%2026-07-09Fix
CVE-2026-55424Discourse: Topic featured link susceptible to stored XSS7.4CNA v4.00.4%2026-07-09Fix
CVE-2026-55420Discourse: Remote code execution via pdf uploads7.5CNA v3.10.6%2026-07-09Fix
CVE-2026-55212Pimcore class definition creation API privilege escalation7.1CNA v3.10.4%2026-07-09Fix
CVE-2026-55208Pimcore: SQL injection7.7CNA v3.10.4%2026-07-09Fix
CVE-2026-55207Pimcore: Account takeover8.8CNA v3.10.7%2026-07-09Fix
CVE-2026-55170OpenFGA Improper Policy Enforcement2.1CNA v4.00.3%2026-07-09Fix
CVE-2026-54801Siemens CPCI85 Central Processing/Communication unverified password change8.6CNA v4.00.6%2026-07-09Fix
CVE-2026-54800Siemens CPCI85 Central Processing/Communication insecure default initialization6.3CNA v4.00.2%2026-07-09Fix
CVE-2026-54799Siemens CPCI85 Central Processing/Communication active debug code8.4CNA v4.00.2%2026-07-09Fix
CVE-2026-54798Siemens CPCI85 Central Processing/Communication active debug code7.1CNA v4.00.4%2026-07-09Fix
CVE-2026-54695Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID7.5CNA v3.10.6%2026-07-09Fix
CVE-2026-54005Kirby: `pages.access` permission is not checked in the `site/find` REST API route7.1CNA v4.00.4%2026-07-09Fix
CVE-2026-54004Kirby: Access to files of top-level drafts is not protected by permissions6.3CNA v4.00.5%2026-07-09Fix
CVE-2026-54003Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header9.1CNA v4.00.7%2026-07-09Fix
CVE-2026-54002Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize`8.5CNA v4.00.5%2026-07-09Fix
CVE-2026-53987GLPI 11 Tag plugin stored cross-site scripting in Kanban Badge Rendering7.3CNA v4.00.5%2026-07-09Fix
CVE-2026-53963Discourse: Stored-XSS in 2FA delete confirmation modal7.3CNA v3.10.7%2026-07-09Fix
CVE-2026-53962Discourse: Insufficient SVG sanitization logic5.4CNA v3.10.4%2026-07-09Fix
CVE-2026-53961Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email6.5CNA v3.10.3%2026-07-09Fix
CVE-2026-51926docuForm FSM Client login.php vulnerability7.5CISA ADP v3.10.6%2026-07-09
CVE-2026-51925docuForm GmbH Client v.11.11c A local file inclusion8.1CISA ADP v3.10.5%2026-07-09
CVE-2026-51924docuForm Client report.php file upload insecure direct object reference8.1CISA ADP v3.10.6%2026-07-09
CVE-2026-51923docuForm Client user settings insecure direct object reference8.1CISA ADP v3.10.7%2026-07-09
CVE-2026-51606Tenda CP3 RTSP service improper input validation7.5CISA ADP v3.10.5%2026-07-09
CVE-2026-51605Tenda CP3 RTSP service stack-based buffer overflow7.5CISA ADP v3.10.6%2026-07-09
CVE-2026-51604Tenda CP3 RTSP service stack-based buffer overflow7.5CISA ADP v3.10.6%2026-07-09
CVE-2026-51603Tenda CP3 RTSP service stack-based buffer overflow7.5CISA ADP v3.10.6%2026-07-09
CVE-2026-51602Tenda CP3 RTSP service stack-based buffer overflow7.5CISA ADP v3.10.6%2026-07-09
CVE-2026-51601Tenda CP3 RTSP service stack-based buffer overflow7.5CISA ADP v3.10.6%2026-07-09
CVE-2026-51600Tenda CP3 RTSP service resource exhaustion7.5CISA ADP v3.10.6%2026-07-09
CVE-2026-51599An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding me9.8CISA ADP v3.10.6%2026-07-09
CVE-2026-51598Mercury MIPC252W IP camera RTSP service denial of service6.5CISA ADP v3.10.3%2026-07-09
CVE-2026-51597Mercury MIPC252W IP camera RTSP Digest authentication vulnerability9.1CISA ADP v3.10.5%2026-07-09
CVE-2026-50644SQL injection in SOPlanning Audit Retention Configuration8.6CNA v4.00.5%2026-07-09Fix
CVE-2026-50188Kirby: Request header injection in `Http\Remote`6.9CNA v4.00.4%2026-07-09Fix
CVE-2026-50181Langroid: Path traversal in the file tools allows read/write outside configured current directory7.1CNA v3.10.2%2026-07-09Fix
CVE-2026-49276Kirby: Self cross-site scripting (self-XSS) in the writer field7.4CNA v4.00.4%2026-07-09Fix
CVE-2026-49274Kirby: `pages.access` permission is not checked in the pages picker for parent pages5.3CNA v4.00.5%2026-07-09Fix
CVE-2026-49256Discourse: Hidden tag names leaked via category serializers6.3CNA v4.00.5%2026-07-09Fix
CVE-2026-47840Cloud Foundry Foundation UAA LDAP StartTLS unconditionally disables hostname verification8.3CNA v4.00.2%2026-07-09
CVE-2026-47831Cloud Foundry Foundation bosh-windows-stemcell-builder GenerateRandomPassword function vulnerability7.7CNA v4.00.3%2026-07-09
CVE-2026-47830Cloud Foundry Foundation bosh-windows-stemcell-builder incorrect permission assignment8.5CNA v4.00.1%2026-07-09
CVE-2026-47829Argument injection in BOSH CLI allows Local command execution on Operator Workstations7.7CNA v4.00.4%2026-07-09Fix
CVE-2026-47828Missing TLS Certificate Verification in BOSH CLI allows Root code execution8.9CNA v4.00.3%2026-07-09Fix
CVE-2026-47826Cloud Foundry Foundation BOSH CLI tool blobs.yaml path traversal allows File Writes8.5CNA v4.00.5%2026-07-09Fix
CVE-2026-46413Discourse: Regular users can route multipart uploads into the admin backup store6.5CNA v3.10.5%2026-07-09Fix
CVE-2026-45788Discourse: Secure uploads exposed by hotlinked image copying6.3CNA v4.00.6%2026-07-09Fix
CVE-2026-45780Discourse: Private event sample invitees are serialized to non-invited event viewers5.3CNA v3.10.5%2026-07-09Fix
CVE-2026-44787Discourse: Signup-time primary_group_id assignment grants whisperer access8.2CNA v3.10.5%2026-07-09Fix
CVE-2026-44342QuantumNous new-api new API CSRF in email and WeChat account binding endpoints5.3CNA v3.10.2%2026-07-09Fix
CVE-2026-43752Claris FileMaker Server unrestricted file upload4.9CISA ADP v3.10.5%2026-07-09Fix
CVE-2026-42486Xen XAPI role-based access control vulnerability9.4CNA v4.00.2%2026-07-09Fix
CVE-2026-41857BOSH CLI Shell injection7.1CNA v4.00.2%2026-07-09Fix
CVE-2026-39246decompress link following7.5CISA ADP v3.10.7%2026-07-09
CVE-2026-39245decompress path traversal6.2CISA ADP v3.10.4%2026-07-09Fix
CVE-2026-39243decompress allows arbitrary hardlink creation during archive extraction5.5CISA ADP v3.10.3%2026-07-09Fix
CVE-2026-38076An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS) via a crafted input.7.5CISA ADP v3.10.6%2026-07-09Fix
CVE-2026-33803Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker6.9CNA v4.00.4%2026-07-09Fix
CVE-2026-33802Junos OS: EX Series: Unauthorized users can execute service-impacting CLI command6.8CNA v4.00.1%2026-07-09Fix
CVE-2026-33801Juniper Networks Junos OS routing protocol daemon improper check for exceptional conditions7.1CNA v4.00.3%2026-07-09Fix
CVE-2026-33800Junos OS: MX Series: In a VC scenario a high rate of micro-BFD session flaps will cause an FPC crash7.1CNA v4.00.3%2026-07-09Fix
CVE-2026-33799Juniper Networks Junos OS SNMP daemon out-of-bounds write5.3CNA v4.00.4%2026-07-09Fix
CVE-2026-33794Junos OS Evolved: PTX Series: Receipt of repeated ECMP routing updates results in PFE crash8.2CNA v4.00.4%2026-07-09Fix
CVE-2026-33655QuantumNous new-api New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs7.7CNA v3.10.4%2026-07-09Fix
CVE-2026-33390Incorrect privilege assignment for Arc sensors in Guardian/CMC7.2CNA v4.00.4%2026-07-09Fix
CVE-2026-31985Nozomi Networks Remote Collector n2os-tui TLS configuration improper certificate validation8.3CNA v4.00.2%2026-07-09Fix
CVE-2026-31984DoS through oversized audit log entries in Guardian/CMC8.7CNA v4.00.5%2026-07-09Fix
CVE-2026-31983Missing authentication in SSH keys synchronization endpoint in Guardian/CMC6.9CNA v4.00.4%2026-07-09Fix
CVE-2026-31982Open redirect in SAML Single Sign-On in Guardian/CMC5.3CNA v4.00.3%2026-07-09Fix
CVE-2026-31981HTML injection in Diagram tab and Graph view in Guardian/CMC4.8CNA v4.00.3%2026-07-09Fix
CVE-2026-31267Mercusys MW302R administrative web interface stack-based buffer overflow5.7CISA ADP v3.10.3%2026-07-09
CVE-2026-23562Xen Project XAPI role-based access control vulnerability9.4CNA v4.00.2%2026-07-09Fix
CVE-2026-23561Xen Project XAPI role-based access control vulnerability9.4CNA v4.00.2%2026-07-09Fix
CVE-2026-23560Xen Project XAPI role-based access control vulnerability9.4CNA v4.00.2%2026-07-09Fix
CVE-2026-23559Xen Project XAPI role-based access control vulnerability9.4CNA v4.00.2%2026-07-09Fix
CVE-2026-23556oxenstored keeps quota related use counts across domain destruction9.4CNA v4.00.2%2026-07-09Fix
CVE-2026-21901Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash6.7CNA v4.00.2%2026-07-09Fix
CVE-2026-15308Python CPython incremental HTMLParser feed allows CPU-exhaustion DoS8.7CNA v4.00.6%2026-07-09Fix
CVE-2026-15276pdeljanov Symphonia Metadata denial of service4.8CNA v4.00.2%2026-07-09
CVE-2026-15274lo48576 fbxcel Node header parser.rs denial of service4.8CNA v4.00.2%2026-07-09
CVE-2026-15271TOTOLINK EX200 Web boa.conf least privilege violation7.7CNA v4.00.7%2026-07-09
CVE-2026-15270D-Link DIR-823G Web boa.conf least privilege violation7.7CNA v4.00.9%2026-07-09
CVE-2026-15204TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal6.9CNA v4.00.7%2026-07-09
CVE-2026-15202YzmCMS header yzmphp.php get_url cross-site scripting5.3CNA v4.00.4%2026-07-09
CVE-2026-15195apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution5.3CNA v4.00.5%2026-07-09Fix
CVE-2026-15194Open5GS AMF context.c amf_context_final use-after-free4.8CNA v4.00.2%2026-07-09
CVE-2026-15193AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injection4.8CNA v4.01.1%2026-07-09
CVE-2026-15192mettle sendportal APIv1 Webhooks mailjet missing authentication6.9CNA v4.00.8%2026-07-09
CVE-2026-15191mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization5.3CNA v4.00.4%2026-07-09
CVE-2026-15190SourceCodester Simple and Nice Shopping Cart Script login.php SQL injection6.9CNA v4.00.4%2026-07-09
CVE-2026-15189aerostackdev aerostack-mcp mcp-whatsapp upload_media server-side request forgery5.3CNA v4.00.4%2026-07-09
CVE-2026-15188django-job-portal employee profile API vulnerability5.3CNA v4.00.4%2026-07-09
CVE-2026-15187enquirer Public Package API Enquirer.set prototype pollution5.3CNA v4.00.4%2026-07-09Fix
CVE-2026-15186macrozheng mall portal endpoint create resource injection5.3CNA v4.00.4%2026-07-09
CVE-2026-15185GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds4.8CNA v4.00.2%2026-07-09
CVE-2026-15184GNU LibreDWG DWG file dwg.c dwg_next_entity null pointer dereference4.8CNA v4.00.2%2026-07-09Fix
CVE-2026-15182GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow4.8CNA v4.00.2%2026-07-09Fix
CVE-2026-15158Blocksy Companion WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.11.1%2026-07-09Fix
CVE-2026-15138tumf mcp-text-editor text_editor.py _validate_file_path path traversal5.3CNA v4.00.5%2026-07-09
CVE-2026-15137code-projects Interview Management System View.php SQL injection6.9CNA v4.00.4%2026-07-09
CVE-2026-15135code-projects Online Food Order System edit_food_items.php SQL injection6.9CNA v4.00.4%2026-07-09
CVE-2026-15134CodeAstro Simple Online Leave Management System index.php SQL injection6.9CNA v4.00.4%2026-07-09
CVE-2026-15000Connect Contact Form 7 and Mailchimp WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.6%2026-07-09Fix
CVE-2026-14372Bit Form WordPress plugin authenticated (Subscriber+) arbitrary file deletion via _old parameter7.1CNA v3.11.1%2026-07-09Fix
CVE-2026-14343Download Manager WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-09Fix
CVE-2026-14342Mail Mint WordPress plugin authenticated (Administrator+) SQL injection via contact_ids parameter4.9CNA v3.10.4%2026-07-09Fix
CVE-2026-14261Xerte Online Tools setup reinstallation endpoint authentication bypass9.1CISA ADP v3.11.0%2026-07-09Fix
CVE-2026-14245miniOrange OTP Login, Verification and SMS Notifications WordPress plugin authentication bypass9.8CNA v3.11.1%2026-07-09Fix
CVE-2026-13771Customer Reviews for WooCommerce WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-09Fix
CVE-2026-13492UsersWP WordPress plugin authenticated (Subscriber+) arbitrary file deletion via file upload field8.8CNA v3.10.7%2026-07-09Fix
CVE-2026-13462PayRange for Android,, contains an SSL bypass vulnerability7.5CISA ADP v3.10.3%2026-07-09
CVE-2026-13461PayRange contains a JavaScript injection9.6CISA ADP v3.10.5%2026-07-09
CVE-2026-13450GamiPress WordPress plugin insecure direct object reference5.3CNA v3.10.7%2026-07-09Fix
CVE-2026-13441EventPrime WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-07-09Fix
CVE-2026-13334Mang Board WP WordPress plugin reflected cross-site scripting via stag parameter6.1CNA v3.10.4%2026-07-09Fix
CVE-2026-13253Ultimate Post WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-09Fix
CVE-2026-13080WPFunnels WordPress plugin authenticated (Administrator+) local file inclusion via logKey parameter6.6CNA v3.11.2%2026-07-09Fix
CVE-2026-13011ERP: Complete HR, Accounting and CRM Suite Built for WooCommerce WordPress plugin SQL injection6.5CNA v3.10.5%2026-07-09Fix
CVE-2026-12879Cross-Tenant Data Exfiltration in Apigee via BigQuery confused deputy5.9CNA v4.00.3%2026-07-09Fix
CVE-2026-12593Privilege escalation via forged API token creation in Axivion Dashboard OIDC/OAuth2/SSO subsystem8.7CNA v4.00.4%2026-07-09Fix
CVE-2026-12590body-parser limit option validation resource exhaustion3.7CNA v3.10.4%2026-07-09Fix
CVE-2026-12517Fediverse Embeds WordPress plugin unauthenticated SSRF via site Info endpoint5.3CISA ADP v3.10.3%2026-07-09Fix
CVE-2026-12516Fediverse Embeds WordPress plugin unauthenticated SSRF via Media Proxy5.3CISA ADP v3.10.3%2026-07-09Fix
CVE-2026-12433Hydra Booking WordPress plugin insecure direct object reference to sensitive information exposure4.3CNA v3.10.5%2026-07-09Fix
CVE-2026-12428Blocks for ACF Fields WordPress plugin unauthorized access6.5CNA v3.10.5%2026-07-09Fix
CVE-2026-12418User Frontend: AI Powered Frontend Posting WordPress plugin insecure direct object reference5.3CNA v3.10.4%2026-07-09Fix
CVE-2026-12406User Frontend WordPress plugin missing authorization unauthenticated arbitrary Attachment deletion5.3CNA v3.10.6%2026-07-09Fix
CVE-2026-12270Everest Forms WordPress plugin unauthenticated missing authorization6.5CISA ADP v3.10.3%2026-07-09Fix
CVE-2026-12170AcyMailing WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-09Fix
CVE-2026-12116Xerte Online Tools antivirus binary path setting vulnerability9.8CISA ADP v3.10.7%2026-07-09Fix
CVE-2026-11875WP Support Plus Responsive Ticket System guest session cookie vulnerability5.3CISA ADP v3.10.3%2026-07-09
CVE-2026-11869WP DSGVO Tools (GDPR) WordPress plugin unauthenticated sensitive information disclosure5.3CISA ADP v3.10.3%2026-07-09Fix
CVE-2026-11571Everest Forms WordPress plugin unauthenticated sensitive information exposure7.5CISA ADP v3.10.4%2026-07-09Fix
CVE-2026-11404Cesanta Mongoose out-of-bounds read in MG_TLS_BUILTIN ClientHello Session ID Parsing8.7CNA v4.00.6%2026-07-09Fix
CVE-2026-11359Metagauss Memberships and User Profiles for WooCommerce missing authorization4.3CNA v3.10.3%2026-07-09Fix
CVE-2026-9253WP Cost Estimation and Payment Forms Builder customerInfos parameter stored cross-site scripting7.2CNA v3.10.3%2026-07-09Fix
CVE-2026-9240Colissimo Officiel: Méthodes de livraison pour WooCommerce WordPress plugin unauthorized access4.3CNA v3.10.3%2026-07-09Fix
CVE-2026-9237Employee, Leave and Recruitment Management System WordPress plugin authorization bypass4.3CNA v3.10.4%2026-07-09Fix
CVE-2026-9235DHL eCommerce (Benelux) for WooCommerce WordPress plugin unauthorized access4.3CNA v3.10.3%2026-07-09Fix
CVE-2026-9028CorvusPay WooCommerce Payment Gateway WordPress plugin authorization bypass5.3CNA v3.10.5%2026-07-09Fix
CVE-2026-9027CorvusPay WooCommerce Payment Gateway payment success REST endpoint improper signature verification5.3CNA v3.10.4%2026-07-09Fix
CVE-2026-9021Easy Invoice WordPress plugin missing authorization5.3CNA v3.10.5%2026-07-09Fix
CVE-2026-8996Backup and Staging by WP Time Capsule WordPress plugin information disclosure6.5CNA v3.10.5%2026-07-09Fix
CVE-2026-8848Popup Maker WordPress plugin authorization bypass7.2CNA v3.11.2%2026-07-09Fix
CVE-2026-7558Age Verification and Identity Verification by Token of Trust WordPress plugin unauthorized access5.3CNA v3.10.5%2026-07-09Fix
CVE-2026-6910Bookero.pl WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-09Fix
CVE-2026-5955SQLi in Inrove Software's BiEticaret9.8CNA v3.10.5%2026-07-09Fix
CVE-2026-5793XSS in Inrove Software's BiEticaret6.1CNA v3.10.3%2026-07-09Fix
CVE-2026-5523Divi Form Builder WordPress plugin missing authorization privilege escalation8.8CNA v3.10.4%2026-07-09Fix
CVE-2026-5005Stored XSS in Twiser's OKRs and Goals5.4CNA v3.10.2%2026-07-09Fix
CVE-2026-4653Block, Suspend, Report for BuddyPress WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-09Fix
CVE-2026-4298DSGVO All in one for WP WordPress plugin missing authorization authenticated settings reset4.3CNA v3.10.4%2026-07-09Fix
CVE-2026-4275Divi Torque Lite WordPress plugin cross-site request forgery to arbitrary plugin installation8.8CNA v3.10.3%2026-07-09Fix
CVE-2026-4256LDAP injection in PEAKUP's PassGate8.2CNA v3.10.4%2026-07-09
CVE-2026-2342XSS in Oceanicsoft's ValeApp9.3CNA v3.10.4%2026-07-09
CVE-2026-1989IDOR in PAVO Inc.'s PAVO Pay7.5CNA v3.10.4%2026-07-09
CVE-2026-1365Information disclosure in Sayax's OSOS6.5CNA v3.10.5%2026-07-09
CVE-2026-0287PAN-OS: Denial of service vulnerabilities in Network Traffic Processing6.6CNA v4.00.6%2026-07-09Fix
CVE-2026-0286PAN-OS: Authenticated command injection in CLI6.0CNA v4.01.7%2026-07-09Fix
CVE-2026-0285PAN-OS: Server-side request forgery vulnerability in Management Web interface4.7CNA v4.00.4%2026-07-09Fix
CVE-2026-0284PAN-OS: XML injection vulnerability in Large Scale VPN (LSVPN)4.7CNA v4.00.5%2026-07-09Fix
CVE-2026-0283PAN-OS: Authentication bypass vulnerability in Large Scale VPN (LSVPN)4.5CNA v4.00.4%2026-07-09Fix
CVE-2026-0282PAN-OS: File deletion vulnerability in Management Web interface2.7CNA v4.00.3%2026-07-09Fix
CVE-2026-0281PAN-OS: Information disclosure vulnerability in Management Web interface2.1CNA v4.00.3%2026-07-09Fix
CVE-2026-0280PAN-OS: IPv6 Firewall Policy Bypass1.7CNA v4.00.3%2026-07-09Fix
CVE-2026-0279PAN-OS: Multiple cross-site scripting (XSS)1.3CNA v4.00.8%2026-07-09Fix
CVE-2026-0278Prisma Access Agent: Multiple DLP Policy Bypass vulnerabilities on Windows5.8CNA v4.00.2%2026-07-09Fix
CVE-2026-0277Prisma Access Agent: Improper certificate validation on iOS5.7CNA v4.00.2%2026-07-09Fix
CVE-2026-0276Cortex XDR Broker VM: Privilege escalation (PE)1.1CNA v4.00.1%2026-07-09Fix
CVE-2026-0275Prisma Browser: Local privilege escalation on macOS2.0CNA v4.00.2%2026-07-09Fix
CVE-2026-60125ImportModule function in MISP ignores per-organisation import module restrictions5.3CNA v4.00.4%2026-07-08
CVE-2026-60124MISP importModule missing authorization allows read-only users to modify events5.3CNA v4.00.4%2026-07-08
CVE-2026-60105Monsta FTP SSRF via IPv4-Mapped IPv6 Address Bypass7.7CNA v4.01.5%2026-07-08NucleiFix
CVE-2026-60104Bitwarden Server authorization bypass via Admin Auth request8.0NVD v3.10.4%2026-07-08Fix
CVE-2026-60102Horde Vfs OS command injection via Horde_Vfs_Smb driver7.7CNA v4.03.3%2026-07-08Fix
CVE-2026-60092AVideo stored cross-site scripting via Unescaped User-Agent in Participants Panel5.1CNA v4.00.3%2026-07-08
CVE-2026-60002OpenBSD OpenSSH use-after-free9.4v3.10.3%2026-07-08Fix
CVE-2026-60001OpenBSD OpenSSH resource exhaustion6.5CNA v3.10.3%2026-07-08Fix
CVE-2026-60000OpenBSD OpenSSH resource exhaustion7.5v3.10.4%2026-07-08Fix
CVE-2026-59999OpenBSD OpenSSH use of a less trusted source7.5v3.10.2%2026-07-08Fix
CVE-2026-59998OpenBSD OpenSSH GSSAPIStrictAcceptorCheck option vulnerability6.5v3.10.2%2026-07-08Fix
CVE-2026-59997OpenBSD OpenSSH improper quantity validation5.4v3.10.2%2026-07-08Fix
CVE-2026-59996OpenBSD OpenSSH relative path traversal5.4v3.10.3%2026-07-08Fix
CVE-2026-59995OpenBSD OpenSSH relative path traversal5.4v3.10.3%2026-07-08Fix
CVE-2026-59948Composer: Arbitrary file write outside vendor via malicious transitive package name7.0CNA v3.10.2%2026-07-08Fix
CVE-2026-59947Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)4.7CNA v3.10.1%2026-07-08Fix
CVE-2026-59946Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files6.1CNA v3.10.2%2026-07-08Fix
CVE-2026-59939httplib2 gzip and deflate decompression decompression bomb7.5CNA v3.10.7%2026-07-08Fix
CVE-2026-59938pypdf image dimension parsing excessive memory allocation6.9CNA v4.00.5%2026-07-08Fix
CVE-2026-59937pypdf cross-reference table parser resource exhaustion6.9CNA v4.00.6%2026-07-08Fix
CVE-2026-59936pypdf inline image end marker detection infinite loop8.7CNA v4.00.6%2026-07-08Fix
CVE-2026-59935pypdf inline image parser infinite loop8.7CNA v4.00.6%2026-07-08Fix
CVE-2026-59930Mistune table of contents heading IDs insufficient verification of data authenticity4.3CNA v3.10.2%2026-07-08Fix
CVE-2026-59929Mistune safe URL filter cross-site scripting6.1CNA v3.10.3%2026-07-08Fix
CVE-2026-59928Mistune block_parser: Quadratic-time parsing on long lists of repeated reference-link definitions7.5CNA v3.10.7%2026-07-08Fix
CVE-2026-59927Mistune include directive uncontrolled recursion5.3CNA v3.10.5%2026-07-08Fix
CVE-2026-59926Mistune: XSS via unescaped class option in Admonition directive5.3CNA v4.00.3%2026-07-08Fix
CVE-2026-59925Mistune inline_parser: Quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs7.5CNA v3.10.6%2026-07-08Fix
CVE-2026-59924Mistune: Arbitrary file read via Include directive path traversal5.9CNA v3.10.5%2026-07-08Fix
CVE-2026-59923Mistune: XSS via percent-encoded javascript URI bypass in safe_url6.1CNA v3.10.3%2026-07-08Fix
CVE-2026-59922Mistune strikethrough, mark and insert plugins algorithmic complexity7.5CNA v3.10.6%2026-07-08Fix
CVE-2026-59897Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication4.8CNA v3.10.2%2026-07-08Fix
CVE-2026-59896Hono/jsx does not isolate context per request, leading to cross-request data disclosure6.5CNA v3.10.3%2026-07-08Fix
CVE-2026-59895Hono: Server-Side XSS via JSX Escaping Bypass in cx utility6.1CNA v3.10.3%2026-07-08Fix
CVE-2026-59892opentelemetry-js OpenTelemetry JavaScript: Denial of service in `JaegerPropagator`7.5CNA v3.10.8%2026-07-08Fix
CVE-2026-59890setuptools MANIFEST.in file matching incorrect comparison6.1CNA v3.10.4%2026-07-08Fix
CVE-2026-59887markdown-it linkify-it mailto validator algorithmic complexity7.5CNA v3.10.6%2026-07-08Fix
CVE-2026-59883Guzzle: Cookie Disclosure and injection via IP-Address Domains4.7CNA v3.10.2%2026-07-08Fix
CVE-2026-59882Guzzlehttp/psr7: Host Confusion via Weak URI Host Validation4.2CNA v3.10.3%2026-07-08Fix
CVE-2026-59880Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set8.7CNA v4.00.7%2026-07-08Fix
CVE-2026-59879immutable-js Immutable.js `List` 32-bit trie overflow → unrecoverable DoS8.7CNA v4.00.7%2026-07-08Fix
CVE-2026-59877protobuf.js proto option parser infinite loop5.3CNA v3.10.7%2026-07-08Fix
CVE-2026-59876protobuf.js Text Format map parsing prototype pollution4.8CNA v3.10.3%2026-07-08Fix
CVE-2026-59875node-tar PAX path and linkpath parsing uncaught exception5.3CNA v3.10.5%2026-07-08Fix
CVE-2026-59874node-tar tar.replace infinite loop8.7CNA v4.00.6%2026-07-08Fix
CVE-2026-59873node-tar archive decompression denial of service9.2CNA v4.00.6%2026-07-08Fix
CVE-2026-59871node-tar PAX path parsing type confusion5.3CNA v3.10.6%2026-07-08Fix
CVE-2026-59870js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing7.5CNA v3.10.7%2026-07-08Fix
CVE-2026-59869js-yaml YAML merge-key parsing denial of service7.5CNA v3.10.6%2026-07-08Fix
CVE-2026-59868js-yaml YAML merge-key parsing denial of service5.3CNA v3.10.6%2026-07-08Fix
CVE-2026-59822BerriAI LiteLLM improper authentication8.8CNA v4.00.8%2026-07-08KEVFix
CVE-2026-59821LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks2.1CNA v4.00.9%2026-07-08Fix
CVE-2026-59820LiteLLM: Improper limitation of a pathname to a restricted directory (path traversal)6.1CNA v4.00.6%2026-07-08Fix
CVE-2026-59819LiteLLM: Local file read via request-supplied OIDC file references2.1CNA v4.00.6%2026-07-08Fix
CVE-2026-59818Etcd: GRPC client listener does not enforce `--client-crl-file` certificate revocation6.5CNA v3.10.4%2026-07-08Fix
CVE-2026-59807Composio SDK sensitive file upload via tool-file-uploads.ts8.9CNA v4.00.4%2026-07-08Fix
CVE-2026-59806Gradio open redirect and SSRF via /gradio_api/file= endpoint4.9CNA v4.00.4%2026-07-08Fix
CVE-2026-59805Gumroad insecure direct object reference in PurchasesController7.1CNA v4.00.4%2026-07-08Fix
CVE-2026-59804Midscene Bridge Server Session Hijack via Unauthenticated WebSocket7.6CNA v4.00.3%2026-07-08
CVE-2026-59803rpcx denial of service via Gzip decompression bomb in Wire protocol8.7CNA v4.00.7%2026-07-08
CVE-2026-59802PasswordPusher Redirect-based XSS via data URI in URL Push Payload6.3CNA v4.00.3%2026-07-08Fix
CVE-2026-59731Astro authorization bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch8.2CNA v3.10.5%2026-07-08Fix
CVE-2026-59725Socket.IO: Engine.IO Polling Transport Connection Exhaustion7.5CNA v3.10.6%2026-07-08Fix
CVE-2026-59724Socket.IO: Engine.IO WebTransport SID DoS7.5CNA v3.10.6%2026-07-08Fix
CVE-2026-59723Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)8.8CNA v3.10.2%2026-07-08Fix
CVE-2026-59703repomix local file inclusion via file:// URL Scheme in Git Clone endpoint8.7CNA v4.00.5%2026-07-08Fix
CVE-2026-59702repomix server-side request forgery via Unvalidated Repository URLs in POST /API/pack9.2CNA v4.00.4%2026-07-08Fix
CVE-2026-59262AFFiNE Unauthorized Document Edit History Access via GraphQL histories field7.1CNA v4.00.4%2026-07-08Fix
CVE-2026-59261OpenClaw Credential Override via Workspace Dotenv files6.5NVD v3.10.3%2026-07-08Fix
CVE-2026-59257n8n SQL injection in MySQL v1 executeQuery Operation via Expression Interpolation8.8v3.10.6%2026-07-08Fix
CVE-2026-59253n8n improper authorization in Workflow Assignment to Folders5.0v3.10.3%2026-07-08Fix
CVE-2026-58657Grav Stored CSS injection via Markdown Image resize action4.8CNA v4.00.3%2026-07-08Fix
CVE-2026-58656Grav API Plugin Cross-Origin Admin account takeover via CORS Wildcard and JWT Query parameter8.7CNA v4.00.5%2026-07-08
CVE-2026-58654Grav arbitrary file upload via Avatar endpoint5.3CNA v4.00.4%2026-07-08Fix
CVE-2026-58525Microsoft Edge (Chromium-based) security feature bypass8.2CNA v3.10.5%2026-07-08Fix
CVE-2026-58501Zeep SSRF because Settings.forbid_external is not enforced5.9CNA v3.10.4%2026-07-08Fix
CVE-2026-58494Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination6.5CNA v3.10.2%2026-07-08Fix
CVE-2026-58480Blocksy Companion Pro Unauthenticated file upload via save_attachments9.2CNA v4.03.6%2026-07-08Exploit codeFix
CVE-2026-58254NATS.io NATS Server leafnode trace destination permission check vulnerability5.3CNA v4.00.3%2026-07-08Fix
CVE-2026-58253nats-io nats-server NATS Server: Route API Auth Bypass8.8CNA v3.10.4%2026-07-08Fix
CVE-2026-58252nats-io nats-server NATS Server: Subscribe Authz Bypass via Wildcard-Overlap6.5CNA v3.10.5%2026-07-08Fix
CVE-2026-58251nats-io nats-server NATS Server: Queue Subscribe Authz Bypass6.5CNA v3.10.5%2026-07-08Fix
CVE-2026-58250nats-io nats-server NATS Server: Pre-auth server crash via double INFO in leafnode handshake7.5CNA v3.10.7%2026-07-08Fix
CVE-2026-58214nats-io nats-server NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix4.3CNA v3.10.3%2026-07-08Fix
CVE-2026-58213nats-io nats-server NATS Server: MQTT SUBSCRIBE protocol injection7.1CNA v3.10.4%2026-07-08Fix
CVE-2026-58211NATS.io NATS Server no_auth_user connection handling vulnerability5.4CNA v3.10.3%2026-07-08Fix
CVE-2026-58210nats-io nats-server NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory7.5CNA v3.10.7%2026-07-08Fix
CVE-2026-58209nats-io nats-server NATS Server: MQTT retained and QoS replay bypass subscribe deny filters4.3CNA v3.10.3%2026-07-08Fix
CVE-2026-58208NATS.io NATS Server MQTT-over-WebSocket handling denial of service6.8CNA v3.10.6%2026-07-08Fix
CVE-2026-58207nats-io nats-server NATS Server: Remote crash via integer overflow in Connz pagination7.7CNA v3.10.6%2026-07-08Fix
CVE-2026-58192Appium: Unauthenticated arbitrary file/directory deletion in @Appium/storage-plugin8.6CNA v3.10.6%2026-07-08Fix
CVE-2026-58191Appium: Reflected XSS / arbitrary JS in @Appium/base-driver /test/guinea-pig* routes6.5CNA v3.10.6%2026-07-08NucleiFix
CVE-2026-57895Fuji Electric Pupsman incorrect default permissions8.5CNA v4.00.2%2026-07-08
CVE-2026-57481Parse Server LiveQuery information disclosure2.3CNA v4.00.5%2026-07-08Fix
CVE-2026-57480parse-community parse-server parse Server: Denial of service8.7CNA v4.00.6%2026-07-08Fix
CVE-2026-57439CyberChef: Prototype pollution in Series Chart operation5.0CNA v3.10.2%2026-07-08Fix
CVE-2026-57260Foxit PDF Editor and Reader U3D mesh decompression out-of-bounds write7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57259Foxit PDF Editor/Reader XDP XFA XXE arbitrary local file read6.5CNA v3.10.4%2026-07-08Fix
CVE-2026-57258Foxit PDF Editor/Reader crash via Malformed PRC 3D Stream6.1CNA v3.10.2%2026-07-08Fix
CVE-2026-57257Security vulnerability in Foxit PDF Editor/Reader PRC 3D BRep Renderer Heap OOB read6.1CNA v3.10.2%2026-07-08Fix
CVE-2026-57256Foxit Editor/Reader List Box Format use-after-free7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57255Security vulnerability in Foxit PDF Editor/Reader OOB read via NaN-Bypass Clamp6.1CNA v3.10.2%2026-07-08Fix
CVE-2026-57254Foxit PDF Editor/Reader Annotation type confusion7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57253Foxit PDF Editor/Reader PDF File Parsing out-of-bounds read information disclosure6.1CNA v3.10.2%2026-07-08Fix
CVE-2026-57252Foxit PDF Editor/Reader AcroForm use-after-free remote code execution7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57251Foxit PDF Editor/Reader Cloud Appearance buffer overflow7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57250Foxit PDF Editor/Reader form field use-after-free7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57249Foxit PDF Editor/Reader Annotation use-after-free7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57248Foxit PDF Editor/Reader Annotation Improper Release vulnerability7.8CNA v3.10.2%2026-07-08Fix