CVE-2026 list

CVE-2026 records published in July 2026

Page nine of 10: records 8,001 to 9,000 of the 9,534 published in July 2026, newest first. The first page carries the figures for July 2026.

CVE-2026 records published in July 2026, newest first: records 8,001 to 9,000 of 9,534
CVE Summary CVSS EPSS Published Signals
CVE-2026-57247Foxit PDF Editor/Reader field use-after-free7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57246Foxit PDF Editor/Reader Signature buffer overflow7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57245Foxit PDF Editor/Reader Signature Hyperlink use-after-free7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57244Foxit PDF Editor/Reader Form Control use-after-free7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57243Foxit PDF Editor/Reader page out-of-bounds read6.1CNA v3.10.2%2026-07-08Fix
CVE-2026-57242Foxit PDF Editor/Reader page use-after-free7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57241Foxit PDF Editor/Reader page out-of-bounds read6.1CNA v3.10.2%2026-07-08Fix
CVE-2026-57240Foxit PDF Editor/Reader form field use-after-free remote code execution7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57239Foxit PDF Editor/Reader local privilege escalation8.2CNA v3.10.2%2026-07-08Exploit codeFix
CVE-2026-57238Foxit PDF Editor/Reader Annotation use-after-free remote code execution7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-57237Foxit PDF Editor/Reader Annotation use-after-free remote code execution7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-56843WebPros Plesk XML-RPC API incorrect authorization9.9CNA v3.10.7%2026-07-08Fix
CVE-2026-56778n8n authorization bypass in Public API Execution Retry endpoint5.3CNA v4.00.3%2026-07-08Fix
CVE-2026-56776n8n Incorrect OAuth Scope Validation in Workflow Test Run endpoint5.3CNA v4.00.3%2026-07-08Fix
CVE-2026-56775n8n Incorrect OAuth Scope Validation in Evaluation Test Runs endpoints5.3CNA v4.00.3%2026-07-08Fix
CVE-2026-56669Elysia: Inefficient algorithmic complexity and interpretation conflict7.5CNA v3.10.6%2026-07-08Fix
CVE-2026-56437Fuji Electric Pupsman uncontrolled search path8.4CNA v4.00.2%2026-07-08
CVE-2026-56374ImageMagick heap buffer overflow in FTXT Encoder via format parameter7.1v3.10.2%2026-07-08Fix
CVE-2026-56362ImageMagick Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization4.2v3.10.2%2026-07-08Fix
CVE-2026-56360n8n Webhook Forgery via Unsigned POST requests in ZendeskTrigger6.3CNA v4.00.3%2026-07-08Fix
CVE-2026-56359n8n cross-site scripting in Credential Management OAuth2 Authorization URL4.8CNA v4.00.2%2026-07-08Fix
CVE-2026-56298Capgo EXIF Metadata Exposure in App Information Image upload5.3CNA v4.00.3%2026-07-08Fix
CVE-2026-56297FreeRDP use-after-free via race condition in DRDYNVC Channel Callback8.1v3.10.5%2026-07-08Fix
CVE-2026-56293Capgo Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app5.3CNA v4.00.2%2026-07-08Fix
CVE-2026-56284Capgo Unauthenticated Metrics Disclosure via get_total_metrics RPC6.9CNA v4.00.4%2026-07-08Fix
CVE-2026-56283Capgo HTML injection leading to open redirection in Organization settings4.8CNA v4.00.2%2026-07-08Fix
CVE-2026-56273Flowise path traversal in Vector Store basePath parameter4.9CNA v4.00.5%2026-07-08Fix
CVE-2026-56250Capgo arbitrary R2 Object Deletion via Mutable r2_path in app_versions8.7CNA v4.00.5%2026-07-08Fix
CVE-2026-56246Capgo Cross-Organization authorization bypass via Scoped API Key Privilege Inheritance7.2CNA v4.00.4%2026-07-08Fix
CVE-2026-56226Capgo Unauthenticated Organization data disclosure via get_orgs_v6 RPC8.7CNA v4.00.4%2026-07-08Fix
CVE-2026-56220Capgo Unauthorized Manifest Insertion via Read-Only Org Member7.1CNA v4.00.3%2026-07-08Fix
CVE-2026-56217Capgo Encrypted Bundle Policy Bypass via Direct PostgREST Update5.3CNA v4.00.3%2026-07-08Fix
CVE-2026-56086Dell PowerProtect Data Domain incorrect authorization8.8CNA v3.10.4%2026-07-08Fix
CVE-2026-56003libXfont2 computeProps Property Buffer heap buffer overflow8.8NVD v3.10.6%2026-07-08Fix
CVE-2026-56002libXfont2 PCF Font Parsing heap buffer overflow8.8NVD v3.10.6%2026-07-08Fix
CVE-2026-56001libXfont2 BitmapScaleBitmaps integer overflow heap buffer overflow8.8NVD v3.10.6%2026-07-08Fix
CVE-2026-56000xorg-x11-server / xwayland GLX contextTags use-after-free in CommonMakeCurrent7.8NVD v3.10.3%2026-07-08Fix
CVE-2026-55999xorg-server / xwayland glamor font atlas heap buffer overflow7.8NVD v3.10.3%2026-07-08Fix
CVE-2026-55878Symfony: Path traversal in symfony/ux-toolkit allows arbitrary file write and Read7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-55877Symfony UX: XSS in symfony/ux-icons6.1CNA v3.10.3%2026-07-08Fix
CVE-2026-55874SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read7.7CNA v3.10.6%2026-07-08Fix
CVE-2026-55873seaweedfs incorrect authorization4.3CNA v3.10.3%2026-07-08Fix
CVE-2026-55849@CycloneDX/cyclonedx-npm: Shell injection via Unsanitized `--workspace` argument8.5CNA v4.00.2%2026-07-08Fix
CVE-2026-55830RestrictedPython guard hooks can be shadowed via positional-only arguments8.3CNA v3.10.4%2026-07-08Fix
CVE-2026-55778parse-community parse-server parse Server: Stored XSS2.1CNA v4.00.6%2026-07-08Fix
CVE-2026-55761Portainer has Unauthenticated Restore endpoint that allows Admin takeover on Uninitialized Instances7.1CNA v4.00.5%2026-07-08Fix
CVE-2026-55760handlebars.java FileTemplateLoader path traversal7.5CNA v3.10.5%2026-07-08Fix
CVE-2026-55668File Browser ScopedFs symlink handling link following6.3CNA v3.10.4%2026-07-08Fix
CVE-2026-55596Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript8.7CNA v3.10.4%2026-07-08Fix
CVE-2026-55575LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce8.2CNA v4.00.5%2026-07-08Fix
CVE-2026-55542Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL1.3CNA v4.00.3%2026-07-08Fix
CVE-2026-55471HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory8.7CNA v4.00.6%2026-07-08Fix
CVE-2026-55470HAPI FHIR: DSTU2 FHIRPathEngine.matches missing RegexTimeout protection allows ReDoS7.5CNA v3.10.7%2026-07-08Fix
CVE-2026-55438Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing5.8CNA v3.10.2%2026-07-08Fix
CVE-2026-55437Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component5.4CNA v3.10.3%2026-07-08Fix
CVE-2026-55436Coder's AI Bridge Proxy skips TLS certificate verification in default configuration7.4CNA v3.10.3%2026-07-08Fix
CVE-2026-55433Coder devcontainer recreate endpoint missing authorization5.4CNA v3.10.4%2026-07-08Fix
CVE-2026-55432Coder's sub-agent app registration bypasses template port-sharing policy enforcement5.4CNA v3.10.3%2026-07-08Fix
CVE-2026-55431Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps7.7CNA v3.10.3%2026-07-08Fix
CVE-2026-55430Coder workspace app routing vulnerability5.8CNA v3.10.2%2026-07-08Fix
CVE-2026-55429Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID8.7CNA v3.10.5%2026-07-08Fix
CVE-2026-55428Coder tailnet coordinator improper authorization8.2CNA v3.10.4%2026-07-08Fix
CVE-2026-55427Coder vulnerable to SSH config injection8.3CNA v3.10.5%2026-07-08Fix
CVE-2026-55404yt-dlp shortcut file writer command injection7.5CNA v3.10.6%2026-07-08Fix
CVE-2026-55206py7zr archive header parser denial of service8.7CNA v4.00.3%2026-07-08Fix
CVE-2026-55195py7zr archive extraction denial of service8.7CNA v4.00.3%2026-07-08Fix
CVE-2026-55079Coder provisioner file upload denial of service4.9CNA v3.10.6%2026-07-08Fix
CVE-2026-54784CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality7.4CNA v3.10.3%2026-07-08Fix
CVE-2026-54783CoreWCF WS-Security signature verification vulnerability7.4CNA v3.10.2%2026-07-08Fix
CVE-2026-54782CoreWCF: Authentication bypass in CoreWCF SAML / token signature validation10.0CNA v3.10.4%2026-07-08Fix
CVE-2026-54781CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced7.4CNA v3.10.2%2026-07-08Fix
CVE-2026-54780CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass3.7CNA v3.10.2%2026-07-08Fix
CVE-2026-54779CoreWCF: SAML token replay protection is inoperative5.9CNA v3.10.4%2026-07-08Fix
CVE-2026-54778CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution6.2CNA v3.10.1%2026-07-08Fix
CVE-2026-54777CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance6.5CNA v3.10.1%2026-07-08Fix
CVE-2026-54776CoreWCF Unix domain socket PosixIdentity transport missing authentication4.4CNA v3.10.2%2026-07-08Fix
CVE-2026-54775CoreWCF Kafka consume pump denial of service6.5CNA v3.10.6%2026-07-08Fix
CVE-2026-54774CoreWCF SAML token signature verification vulnerability7.4CNA v3.10.2%2026-07-08Fix
CVE-2026-54773CoreWCF: WS-Security signature substitution via document-wide Signature lookup5.9CNA v3.10.4%2026-07-08Fix
CVE-2026-54772CoreWCF net.tcp, net.pipe and net.uds framing handshake denial of service7.5CNA v3.10.8%2026-07-08Fix
CVE-2026-54652Frigate viewer can read logs exposing admin and camera credentials8.1CNA v3.10.4%2026-07-08
CVE-2026-54591AsyncSSH: SCP path traversal to arbitrary file write8.1CNA v3.10.5%2026-07-08Fix
CVE-2026-54590AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion5.9CNA v3.10.4%2026-07-08Fix
CVE-2026-54528jupyterlab-git excluded_paths case-sensitivity bypass allows Reading Excluded Directories7.1CNA v3.10.4%2026-07-08Fix
CVE-2026-54527JupyterLab Git: Stored XSS leading to RCE9.3CNA v4.00.5%2026-07-08Fix
CVE-2026-54499Stanza: Remote code execution via Unsafe Pickle deserialization in Model Loaders7.5CNA v3.10.5%2026-07-08Fix
CVE-2026-54344ToolJet GitHub Actions comment body shell injection exposes deployment secrets4.7CNA v3.10.4%2026-07-08Fix
CVE-2026-54061Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import9.1CNA v3.10.6%2026-07-08Fix
CVE-2026-53951Copier: Trust-prefix bypass via path traversal runs tasks unprompted8.8CNA v4.00.3%2026-07-08Fix
CVE-2026-53624Fiber: HSTS header never set in helmet middleware due to incorrect protocol check4.8CNA v3.10.2%2026-07-08Fix
CVE-2026-53482Dell PowerProtect Data Domain integer overflow7.5CNA v3.10.5%2026-07-08Fix
CVE-2026-53480Dell PowerProtect Data Domain path traversal2.7CNA v3.10.4%2026-07-08Fix
CVE-2026-52200UZ801_v2.1 4G LTE Router MifiService web management API code injection9.8CISA ADP v3.10.9%2026-07-08
CVE-2026-51535OpENer network processing loop resource exhaustion7.5CISA ADP v3.10.5%2026-07-08
CVE-2026-50813SQLite Session Extension out-of-bounds read5.5CISA ADP v3.10.2%2026-07-08Fix
CVE-2026-50812SQLite Session Extension in SQLite A null pointer dereference5.5CISA ADP v3.10.2%2026-07-08Fix
CVE-2026-49866js-libp2p gossipsub control messages denial of service7.5CNA v3.10.6%2026-07-08Fix
CVE-2026-49147App::Ack filename output escape sequence injection7.5CISA ADP v3.10.5%2026-07-08Fix
CVE-2026-49146App::Ack versions for Perl allow memory exhaustion7.5CISA ADP v3.10.6%2026-07-08Fix
CVE-2026-49145App::Ack versions for Perl read arbitrary files via --files-from in a project .ackrc7.5CISA ADP v3.10.5%2026-07-08Fix
CVE-2026-48492Snipe-IT's selectlist visibility is too permissive4.9CNA v4.00.4%2026-07-08Fix
CVE-2026-47646Microsoft Dynamics 365 Customer Voice cross-site scripting9.3CNA v3.10.5%2026-07-08Fix
CVE-2026-45045Fiber: X-Real-IP spoofing via Header.Add in BalancerForward5.3CNA v3.10.5%2026-07-08Fix
CVE-2026-44840Dgraph vulnerable to DQL injection via checkUserPassword GraphQL Query7.5CNA v3.10.5%2026-07-08Fix
CVE-2026-44512ONNX: Null pointer dereference in Upsample Version Converter Adapter (Zero Inputs)5.5CNA v3.10.2%2026-07-08Fix
CVE-2026-44332Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer5.3CNA v3.10.5%2026-07-08Fix
CVE-2026-44161Fluentd out_http output plugin server-side request forgery7.2CNA v3.10.4%2026-07-08Fix
CVE-2026-44160Fluentd: Denial of service (DoS) via Gzip decompression bomb in `in_http` and `in_forward`7.5CNA v3.10.6%2026-07-08Fix
CVE-2026-44025Fluentd: Exposure of sensitive information via Monitor Agent API7.5CNA v3.10.5%2026-07-08Fix
CVE-2026-44024Fluentd is vulnerable to remote code execution9.8CNA v3.11.1%2026-07-08Fix
CVE-2026-42505Invoking Encrypted Client Hello privacy leak in crypto/tls5.3CISA ADP v3.10.4%2026-07-08Fix
CVE-2026-41122Dell PowerProtect Data Domain cross-site scripting7.1CNA v3.10.3%2026-07-08Fix
CVE-2026-41042Apache Gravitino testConnection API vulnerability9.1CISA ADP v3.11.5%2026-07-08NucleiExploit codeFix
CVE-2026-39822Root escape via symlink plus trailing slash in os7.8CISA ADP v3.10.2%2026-07-08Fix
CVE-2026-39179SOGo A SQL injection6.3CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-39178SOGo A SQL injection6.3CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-36028Code A protection mechanism failure6.8CISA ADP v3.10.3%2026-07-08
CVE-2026-36027Code27 Companion Hub USB debugging (ADB) interface arbitrary code execution6.8CISA ADP v3.10.3%2026-07-08Exploit code
CVE-2026-35552CAXperts UPVWebServices license deactivation endpoint missing authorization8.1CISA ADP v3.10.5%2026-07-08
CVE-2026-35211OpenCTI: Elasticsearch Painless script injection6.5CNA v3.10.5%2026-07-08Fix
CVE-2026-35210OpenCTI: Authorization bypass via `synchronized-upsert` HTTP header injection7.1CNA v3.10.4%2026-07-08Fix
CVE-2026-31309Mysterium Node configuration API endpoint missing authorization9.8CISA ADP v3.10.6%2026-07-08Exploit code
CVE-2026-29009U-Boot buffer overflow in nfs_readlink_reply via NFS READLINK9.8v3.10.7%2026-07-08Fix
CVE-2026-29008U-Boot integer underflow DoS via tcp_rx_state_machine8.7CNA v4.00.7%2026-07-08
CVE-2026-29007U-Boot out-of-bounds read in tcp_rx_state_machine via tcp.c6.9CNA v4.00.7%2026-07-08
CVE-2026-24700Cisco RV130W OS command injection7.2CISA ADP v3.11.9%2026-07-08
CVE-2026-24699Cisco RV130W OS command injection7.2CISA ADP v3.11.5%2026-07-08
CVE-2026-24698Cisco RV130W OS command injection7.2CISA ADP v3.11.5%2026-07-08
CVE-2026-24697Cisco RV130W OS command injection7.2CISA ADP v3.11.5%2026-07-08
CVE-2026-22927Omnissa Workspace ONE® Tunnel path traversal7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-15174Heap-based buffer overflow in Wireshark5.5CNA v3.10.1%2026-07-08Fix
CVE-2026-15173Heap-based buffer overflow in Wireshark4.7CNA v3.10.1%2026-07-08Fix
CVE-2026-15172Unchecked input for loop condition in Wireshark5.5CNA v3.10.1%2026-07-08Fix
CVE-2026-15171Null pointer dereference in Wireshark5.5CNA v3.10.1%2026-07-08Fix
CVE-2026-15170Heap-based buffer overflow in Wireshark5.5CNA v3.10.2%2026-07-08Fix
CVE-2026-15169Heap-based buffer overflow in Wireshark5.5CNA v3.10.3%2026-07-08Fix
CVE-2026-15168Wireshark BLF file parser uninitialized variable use2.5CNA v3.10.1%2026-07-08Fix
CVE-2026-15167Stack-based buffer overflow in Wireshark7.5CNA v3.10.2%2026-07-08Fix
CVE-2026-15166Stack-based buffer overflow in Wireshark5.5CNA v3.10.2%2026-07-08Fix
CVE-2026-15165Heap-based buffer overflow in Wireshark5.5CNA v3.10.1%2026-07-08Fix
CVE-2026-15164Heap-based buffer overflow in ciscodump5.5CNA v3.10.1%2026-07-08Fix
CVE-2026-15163Loop with unreachable exit condition (infinite loop) in Wireshark5.5CNA v3.10.2%2026-07-08Fix
CVE-2026-15154Red Hat OpenShift AI guardrails-detectors detection API regular expression denial of service6.5CNA v3.10.5%2026-07-08Fix
CVE-2026-15133Google Chrome InterestGroups use-after-free8.8CISA ADP v3.10.4%2026-07-08Fix
CVE-2026-15132Google Chrome uninitialized variable use8.8CISA ADP v3.10.5%2026-07-08Fix
CVE-2026-15131Google Chrome Navigation inappropriate implementation4.3CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15130Google Chrome Navigation insufficient policy enforcement4.3CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15129Google Chrome Views use-after-free8.8CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15128Google Chrome forms inappropriate implementation6.1CISA ADP v3.10.2%2026-07-08Fix
CVE-2026-15127Google Chrome WebGL inappropriate implementation6.1CISA ADP v3.10.2%2026-07-08Fix
CVE-2026-15126Google Chrome forms use-after-free8.8CISA ADP v3.10.4%2026-07-08Fix
CVE-2026-15125Google Chrome forms inappropriate implementation8.8CISA ADP v3.10.4%2026-07-08Fix
CVE-2026-15124Google Chrome Passwords insufficient policy enforcement4.3CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15123Google Chrome DOM inappropriate implementation8.8CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15122Google Chrome sandbox escape8.3CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15121Google Chrome WebRTC use-after-free8.8CISA ADP v3.10.5%2026-07-08Fix
CVE-2026-15120Google Chrome Core use-after-free8.3CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15119Google Chrome race condition8.3CISA ADP v3.10.2%2026-07-08Fix
CVE-2026-15118Google Chrome Input use-after-free8.8CISA ADP v3.10.4%2026-07-08Fix
CVE-2026-15117Google Chrome Payments use-after-free7.5CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15116Google Chrome Actor use-after-free8.8CISA ADP v3.10.4%2026-07-08Fix
CVE-2026-15115Google Chrome improper input validation3.3CISA ADP v3.10.1%2026-07-08Fix
CVE-2026-15114Google Chrome Codecs out-of-bounds read8.8CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15113Google Chrome Autofill use-after-free9.6CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15112Google Chrome Ozone use-after-free8.8CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15111Google Chrome Views use-after-free7.5CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15110Google Chrome extensions use-after-free8.8CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15109Google Chrome uninitialized variable use6.5CISA ADP v3.10.3%2026-07-08Fix
CVE-2026-15108Google Chrome Extensions API integer overflow4.3CISA ADP v3.10.2%2026-07-08Fix
CVE-2026-15107Google Chrome IndexedDB use-after-free8.8CISA ADP v3.10.4%2026-07-08Fix
CVE-2026-15105davenardella snap7 ReadVar request s7_server.cpp PerformFunctionRead out-of-bounds write5.3CNA v4.00.4%2026-07-08
CVE-2026-15067Snowflake Terraform Provider for Snowflake data source input SQL injection8.8CNA v3.10.5%2026-07-08Fix
CVE-2026-15063Trustyai-service-operator: Trustyai service operator: Gorch port bypass when auth is enabled6.3CNA v3.10.3%2026-07-08
CVE-2026-15062SQL injection in Snowflake Snowpark Python SDK9.6CNA v3.10.4%2026-07-08Fix
CVE-2026-15053Tanium addressed a denial of service vulnerability in Tanium Server7.5CNA v3.10.5%2026-07-08Fix
CVE-2026-15044Red Hat TrustyAI Service Operator AI guardrails and orchestrator API missing authentication6.3CNA v3.10.3%2026-07-08
CVE-2026-15041Red Hat 389 Directory Server password verification timing side channel3.7CNA v3.10.4%2026-07-08Fix
CVE-2026-15036Harness gitspaces endpoint list_all.go getAuthorizedSpaces authorization5.3CNA v4.00.4%2026-07-08
CVE-2026-15035bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection7.8v3.12.2%2026-07-08
CVE-2026-15034flask-dashboard Flask-MonitoringDashboard cross-site request forgery5.3CNA v4.00.3%2026-07-08
CVE-2026-15033christopherthielen check-peer-dependencies peerDependencies module OS command injection5.3CNA v4.01.8%2026-07-08
CVE-2026-14967Black Lantern Security BBOT github_workflows module path traversal3.1CNA v3.10.3%2026-07-08Fix
CVE-2026-14966Black Lantern Security BBOT unarchive module symlink guard link following3.1CNA v3.10.4%2026-07-08Fix
CVE-2026-14896Nomad vulnerable to cross-namespace host volume claim deletion4.2CNA v3.10.3%2026-07-08Fix
CVE-2026-14891Nomad vulnerable to sandbox escape in Docker task driver8.7CNA v3.10.5%2026-07-08Fix
CVE-2026-14500Bulk Order Update for WooCommerce WordPress plugin unauthenticated arbitrary file read5.3CNA v3.10.5%2026-07-08
CVE-2026-14495DoLogin Security WordPress plugin unauthenticated authentication bypass8.8CNA v3.10.8%2026-07-08Fix
CVE-2026-14489WHMCS Bridge WordPress plugin unauthenticated arbitrary file upload via ccce parameter8.8CNA v3.11.0%2026-07-08
CVE-2026-14487Simple Coherent Form WordPress plugin unauthenticated arbitrary file deletion via id parameter9.1CNA v3.11.2%2026-07-08
CVE-2026-14482多说社会化评论框 WordPress plugin unauthenticated privilege escalation8.8CNA v3.10.6%2026-07-08
CVE-2026-14454Imager versions for Perl treat unsigned EXIF IFD entry counts as signed9.8CISA ADP v3.10.7%2026-07-08Fix
CVE-2026-14373Nomad Docker driver Linux host namespace bypass7.7CNA v3.10.3%2026-07-08Fix
CVE-2026-14362HashiCorp Shared library denial of service via crafted push/pull gossip message in memberlist4.9CNA v3.10.4%2026-07-08Fix
CVE-2026-14361HashiCorp consul-template writeToFile template helper link following4.7CNA v3.10.1%2026-07-08Exploit codeFix
CVE-2026-14250Themehunk Login Registration WordPress plugin unauthenticated privilege escalation6.3CNA v3.10.4%2026-07-08Fix
CVE-2026-14244Jssor Slider by jssor.com WordPress plugin unauthenticated arbitrary file read via URL parameter7.5CNA v3.11.0%2026-07-08
CVE-2026-14158Widget Logic Visual WordPress plugin remote code execution8.8CNA v3.11.0%2026-07-08
CVE-2026-13320Improper neutralization of input during web page generation (cross-site scripting) in GitLab7.3CNA v3.10.4%2026-07-08Fix
CVE-2026-13129Foxit PDF Editor/Reader Annotation use-after-free remote code execution7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-13128Foxit PDF Editor/Reader Doc object use-after-free remote code execution7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-13127Foxit PDF Editor/Reader Annotation use-after-free remote code execution7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-13126Foxit PDF Editor/Reader Annotation use-after-free remote code execution7.8CNA v3.10.2%2026-07-08Fix
CVE-2026-12936Recurio WordPress plugin authenticated (Shop Manager+) SQL injection via data parameter4.9CNA v3.10.4%2026-07-08Fix
CVE-2026-12378Appointment Booking Calendar Plugin and Scheduling Plugin PHP object injection8.1CISA ADP v3.10.6%2026-07-08Fix
CVE-2026-12153WP Learn Manager WordPress plugin authorization bypass9.8CNA v3.10.7%2026-07-08
CVE-2026-12097User Management WordPress plugin missing authorization unauthenticated plugin settings modification5.3CNA v3.10.4%2026-07-08Fix
CVE-2026-12041Chatra Live Chat + ChatBot + Cart Saver WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-07-08Fix
CVE-2026-12002Smash Balloon Social Photo Feed WordPress plugin cross-site request forgery4.7CNA v3.10.1%2026-07-08Fix
CVE-2026-11903Stored XSS in MOVEit Transfer Ad Hoc module8.0CNA v3.10.4%2026-07-08Fix
CVE-2026-11827Insufficiently protected credentials in GitLab4.9CNA v3.10.4%2026-07-08Fix
CVE-2026-11798Social Share, Social Login and Social Comments WordPress plugin reflected cross-site scripting6.1CNA v3.10.4%2026-07-08
CVE-2026-10708Adalo No-Code App Builder App Builder insufficiently protected credentials7.5CISA ADP v3.10.2%2026-07-08
CVE-2026-10706Adalo No-Code App Builder App Builder exposure of sensitive information to an Unauthorized attacker7.5CISA ADP v3.10.4%2026-07-08
CVE-2026-10699Memory leak in SFTP service can result in a denial of service in MOVEit Transfer7.5CNA v3.10.5%2026-07-08Fix
CVE-2026-10698Progress MOVEit Transfer table scope bypass vulnerability in custom reports7.2CNA v3.10.6%2026-07-08Fix
CVE-2026-10570Sympl Repeater for ACF and Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-08
CVE-2026-10037Sandbox escape in Ubuntu OpenJDK Packages via xdg-desktop-portal8.8CNA v3.10.2%2026-07-08Fix
CVE-2026-9842Backstage WordPress plugin unauthenticated privilege escalation7.5CNA v3.10.5%2026-07-08
CVE-2026-9731Wp Js Detect WordPress plugin cross-site request forgery to plugin settings update4.3CNA v3.10.2%2026-07-08
CVE-2026-9701Eventer WordPress plugin insecure password reset Mechanism to unauthenticated privilege escalation9.8CNA v3.10.5%2026-07-08Fix
CVE-2026-9700Eventer WordPress plugin unauthenticated SQL injection via code parameter7.5CNA v3.10.5%2026-07-08Fix
CVE-2026-9695Improper authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 20269.8CNA v3.10.6%2026-07-08
CVE-2026-9074IBM API Connect SQL injection9.1CNA v3.10.5%2026-07-08Fix
CVE-2026-8801File Extension Restriction Bypass in MOVEit Transfer3.5CNA v3.10.5%2026-07-08Fix
CVE-2026-8800Progress MOVEit Transfer Cross-Org External Token Metadata accessible to AuditUser role2.7CNA v3.10.4%2026-07-08Fix
CVE-2026-8651IPv6 Loopback Spoof via Trusted host Header Bypasses Origin Check in MOVEit Transfer3.7CNA v3.10.4%2026-07-08Fix
CVE-2026-8650Authenticated path traversal allows MOVEit admins to view arbitrary system files4.5CNA v3.10.6%2026-07-08Fix
CVE-2026-8649Progress MOVEit Transfer institution scope bypass vulnerability in custom reports6.4CNA v3.10.5%2026-07-08Fix
CVE-2026-8472Missing authorization in GitLab4.3CNA v3.10.4%2026-07-08Fix
CVE-2026-8315Stored XSS in Webbeyaz's Mediküm Web5.4CNA v3.10.2%2026-07-08
CVE-2026-8310Reflected XSS in Webbeyaz's Mediküm Web6.1CNA v3.10.3%2026-07-08
CVE-2026-8307SQLi in Webbeyaz's Mediküm Web9.8CNA v3.10.5%2026-07-08
CVE-2026-7492Missing authorization in GitLab4.3CNA v3.10.3%2026-07-08Fix
CVE-2026-6896Improper neutralization of input during web page generation (cross-site scripting) in GitLab8.7CNA v3.10.4%2026-07-08Fix
CVE-2026-6854My Calendar WordPress plugin unauthenticated SQL injection via mc_auth and mc_host parameters7.5CNA v3.11.6%2026-07-08NucleiFix
CVE-2026-6820VikBooking Hotel Booking Engine and PMS WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-07-08Fix
CVE-2026-6818VikBooking Hotel Booking Engine and PMS WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-07-08Fix
CVE-2026-6742Advanced iFrame WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-08Fix
CVE-2026-6740Nexter Blocks WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-08Fix
CVE-2026-6459Essential Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-08Fix
CVE-2026-6371Stored XSS in Limatek's LimRAD NAC4.8CNA v3.10.2%2026-07-08Fix
CVE-2026-6352Incorrect authorization in GitLab2.7CNA v3.10.4%2026-07-08Fix
CVE-2026-6280Improper access control in Nomysoft Informatics' Nomysem6.5CNA v3.10.4%2026-07-08
CVE-2026-6230Tainacan WordPress plugin unauthenticated SQL injection via geoquery REST API parameter7.5CNA v3.10.5%2026-07-08Fix
CVE-2026-5923Poly Voice potential unauthorized modification of WebUI using CSRF Attack6.0CNA v4.00.2%2026-07-08Fix
CVE-2026-5922Poly Voice potential unauthorized modification of WebUI using XSS Attack5.9CNA v4.00.4%2026-07-08Fix
CVE-2026-5459User Frontend: AI Powered Frontend Posting WordPress plugin insecure direct object reference5.3CNA v3.10.3%2026-07-08Fix
CVE-2026-5356LatePoint WordPress plugin improper input validation7.5CNA v3.10.4%2026-07-08Fix
CVE-2026-3688WCFM Membership WordPress plugin insecure direct object reference8.1CNA v3.10.4%2026-07-08Fix
CVE-2026-3144IBM API Connect default credentials8.1CNA v3.10.4%2026-07-08Fix
CVE-2026-0288PAN-OS: Buffer overflow vulnerabilities in User-ID Terminal Server agent7.2CNA v4.00.8%2026-07-08Fix
CVE-2026-598009Router OS command injection via sudoPassword parameter in Tailscale Install endpoint9.2CNA v4.02.0%2026-07-07Fix
CVE-2026-59709Ghostfolio Unauthorized Portfolio Holding Tag Modification via missing permission check5.3CNA v4.00.3%2026-07-07
CVE-2026-59708Ghostfolio Unauthorized Portfolio data exposure via Public endpoint8.7CNA v4.00.6%2026-07-07
CVE-2026-59707LocalAI server-side request forgery via POST /models/apply9.2CNA v4.00.5%2026-07-07Fix
CVE-2026-59706mem0 Unauthenticated Config API Exposure and SSRF via ollama_base_url9.2CNA v4.00.4%2026-07-07
CVE-2026-59705mem0 OpenMemory API unauthenticated access via Memory endpoints9.3CNA v4.00.8%2026-07-07Fix
CVE-2026-59704Cap missing access control in Video AI Metadata endpoint7.1CNA v4.00.3%2026-07-07
CVE-2026-59153Anki's local HTTP server does not sufficiently validate requests2.1CNA v4.00.3%2026-07-07Fix
CVE-2026-58583FluxInk Color Management Driver local privilege escalation8.4CNA v4.00.1%2026-07-07Fix
CVE-2026-58473Cognee Unauthorized LLM Configuration Overwrite via /API/v1/settings9.3CNA v4.00.5%2026-07-07Fix
CVE-2026-58472GNU Wget heap buffer overflow via HTML Attribute Encoding7.1v3.10.4%2026-07-07Fix
CVE-2026-58471GNU Wget heap buffer overflow via convert_fname in url.c7.1v3.10.4%2026-07-07Fix
CVE-2026-58470GNU Wget integer overflow via Content-Range Header Parsing6.9CNA v4.00.2%2026-07-07Fix
CVE-2026-58469GNU Wget Heap Buffer Underread via Metalink URL Parsing8.7CNA v4.00.5%2026-07-07Fix
CVE-2026-58468NocoBase server-side request forgery via serverRequest wrapper5.1CNA v4.00.3%2026-07-07
CVE-2026-58384Gimp: Gimp: Integer overflow in read_rle_channel7.8NVD v3.10.3%2026-07-07Fix
CVE-2026-58315SEIKO EPSON Web Config cross-site request forgery5.1CNA v4.00.1%2026-07-07
CVE-2026-58266Anki: User scripts in iframes have access to the internal Anki API6.5CNA v3.10.2%2026-07-07Fix
CVE-2026-57871MicroRealEstate relative path traversal7.1CNA v4.00.5%2026-07-07
CVE-2026-57870MicroRealEstate insecure direct object reference5.3CNA v4.00.4%2026-07-07
CVE-2026-57869MicroRealEstate insecure direct object reference7.1CNA v4.00.4%2026-07-07
CVE-2026-57868MicroRealEstate insecure direct object reference7.1CNA v4.00.4%2026-07-07
CVE-2026-57867MicroRealEstate authentication bypass8.8CNA v4.00.6%2026-07-07
CVE-2026-57851MSI KernCoreLib64.sys privilege escalation via IOCTL Handlers8.5CNA v4.00.2%2026-07-07Exploit code
CVE-2026-57172DataEase: Hard-coded JWT Signing Secret in ShareLink8.3CNA v4.00.4%2026-07-07Fix
CVE-2026-56812Phoenix: Presence keys colliding with `Object.prototype` members break existence checks6.3CNA v4.00.8%2026-07-07Fix
CVE-2026-56811Phoenix: Unbounded channel joins per transport enables DoS over few connections8.7CNA v4.00.8%2026-07-07Fix
CVE-2026-55647DataEase: Authenticated stored XSS in the dashboard text components5.1CNA v4.00.5%2026-07-07Fix
CVE-2026-55635DataEase: Authenticated SQL injection in Chart Quota Filters8.7CNA v4.00.4%2026-07-07Fix
CVE-2026-55633DataEase H2 RCE via Zip protocol and File Dropper Fix bypass8.7CNA v4.00.8%2026-07-07Fix
CVE-2026-55631DataEase: Path traversal leading to arbitrary file deletion via Font Management7.2CNA v4.00.5%2026-07-07Fix
CVE-2026-55592Dashy: XSS in workspace URL parameter3.9CNA v3.10.3%2026-07-07NucleiFix
CVE-2026-55490OpenWrt: EAD integer underflow → Pre-Auth denial of service6.5CNA v3.10.7%2026-07-07Fix
CVE-2026-55435Suspended Coder users retain access to AI Bridge LLM proxy endpoints5.4CNA v3.10.3%2026-07-07Fix
CVE-2026-55434Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints6.5CNA v3.10.6%2026-07-07Fix
CVE-2026-55418FastGPT: S3 presign/read handlers do not bind the object key to the caller's team8.6CNA v3.10.5%2026-07-07Fix
CVE-2026-55417Chevereto private profile setting leaks username on /json endpoint6.9CNA v4.00.4%2026-07-07Fix
CVE-2026-55408koodo-reader koodo Reader: Remote code execution via malicious epub file8.4CNA v4.00.2%2026-07-07Fix
CVE-2026-55078Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service6.5CNA v3.10.6%2026-07-07Fix
CVE-2026-55077Coder: User-admin role can reset owner account password7.2CNA v3.10.6%2026-07-07Fix
CVE-2026-55076Coder's OIDC email_verified type coercion bypass enables account takeover7.4CNA v3.10.6%2026-07-07Fix
CVE-2026-55075Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass7.4CNA v3.10.5%2026-07-07Fix
CVE-2026-54698Hasura: Row-level authorization bypass on table computed fields6.0CNA v4.00.3%2026-07-07Fix
CVE-2026-54607FastGPT: SSRF in HTTP-tool OpenAPI schema importer7.7CNA v3.10.5%2026-07-07Fix
CVE-2026-54602FastGPT: Cross-team LLM request/response disclosure (IDOR) via /API/core/ai/record/getRecord7.1CNA v4.00.4%2026-07-07Fix
CVE-2026-54601Labring FastGPT dataset collection retraining endpoint mass assignment6.3CNA v3.10.4%2026-07-07Fix
CVE-2026-53935cilium incorrect authorization6.9CNA v3.10.3%2026-07-07Fix
CVE-2026-53878Django header injection possibility since DomainNameValidator accepted newlines in input5.3CNA v4.00.3%2026-07-07Fix
CVE-2026-53877Django heap buffer over-read in GDALRaster6.3CNA v4.00.4%2026-07-07Fix
CVE-2026-53751DataEase: H2 JDBC URL Filter Bypass leads to remote code execution (RCE)8.7CNA v4.00.6%2026-07-07Fix
CVE-2026-53730DataEase: Unauthorized access to Engine Database via previewSql endpoint8.7CNA v4.00.4%2026-07-07Fix
CVE-2026-53729DataEase ExportCenter IDOR allows cross-user export task access8.7CNA v4.00.6%2026-07-07Fix
CVE-2026-53648FOSSBilling: Downloadable product files can be overwritten through filename collisions5.1CNA v4.00.4%2026-07-07Fix
CVE-2026-53647FOSSBilling guest API key info endpoint information disclosure6.9CNA v4.00.5%2026-07-07Exploit codeFix
CVE-2026-53511Kovid Goyal calibre template formatter code injection8.5CNA v4.00.2%2026-07-07Fix
CVE-2026-53483Dell PowerProtect Data Domain improper authentication9.8CNA v3.10.6%2026-07-07Fix
CVE-2026-53481Dell PowerProtect Data Domain path traversal9.8CNA v3.10.6%2026-07-07Fix
CVE-2026-53479Dell PowerProtect Data Domain OS command injection7.2CNA v3.12.0%2026-07-07Fix
CVE-2026-51937An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and the GetAccessTokenComponent.java component7.5CISA ADP v3.10.6%2026-07-07
CVE-2026-50811FreeType An out-of-bounds read6.5CISA ADP v3.10.5%2026-07-07Fix
CVE-2026-50810GPAC MPD smooth streaming index parser null pointer dereference5.5CISA ADP v3.10.2%2026-07-07
CVE-2026-50530DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets7.1CNA v4.00.4%2026-07-07Fix
CVE-2026-50529DataEase share proxy endpoint incorrect authorization8.7CNA v4.00.5%2026-07-07Fix
CVE-2026-50179Actual: CSV formula injection in Transaction Export via Imported Payee/Notes fields4.2CNA v3.10.3%2026-07-07Fix
CVE-2026-50007Actual: Shared users can perform owner-only file management actions7.2CNA v4.00.4%2026-07-07Fix
CVE-2026-49487Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs6.5CISA ADP v3.10.7%2026-07-07Fix
CVE-2026-49471Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE8.3CNA v3.10.4%2026-07-07Fix
CVE-2026-49296Apache Airflow apache-airflow DAG source authorization bypass exposes co-located DAG source6.5CISA ADP v3.10.6%2026-07-07Fix
CVE-2026-49229Actual: Disabled OpenID users keep access through existing session tokens8.3CNA v3.10.4%2026-07-07Fix
CVE-2026-49033Stack-based buffer overflow in Labcenter Proteus8.4CNA v4.00.2%2026-07-07Fix
CVE-2026-48958Joomla! Core [20260712] Incorrect Access Control in com_fields webservice endpoints6.4CNA v4.00.5%2026-07-07Fix
CVE-2026-48957Joomla! Core [20260711] Incorrect Access Control in com_privacy webservice endpoints6.4CNA v4.00.4%2026-07-07Fix
CVE-2026-48956Joomla! Core [20260710] Incorrect Access Control in com_modules6.4CNA v4.00.3%2026-07-07Fix
CVE-2026-48955Joomla! Core [20260709] Incorrect Access Control in com_workflow6.4CNA v4.00.3%2026-07-07Fix
CVE-2026-48954Joomla! Core [20260708] XSS through language overrides5.9CNA v4.00.2%2026-07-07Fix
CVE-2026-48953Joomla! Core [20260707] XSS in the generic image output layout5.9CNA v4.00.2%2026-07-07Fix
CVE-2026-48952Joomla! Core [20260706] XSS in com_installer5.9CNA v4.00.2%2026-07-07Fix
CVE-2026-48951Joomla! Core [20260705] XSS in various modalreturn layouts5.9CNA v4.00.2%2026-07-07Fix
CVE-2026-48950Joomla! Core [20260704] XSS in com_templates5.9CNA v4.00.2%2026-07-07Fix
CVE-2026-48949Joomla! Core [20260703] XSS in MFA method management5.9CNA v4.00.2%2026-07-07Fix
CVE-2026-48948Joomla! Core [20260702] Incorrect Access Control in com_contact vcf download6.4CNA v4.00.4%2026-07-07Fix
CVE-2026-48947Joomla! Core [20260701] Incorrect Access Control in com_media webservice endpoints6.4CNA v4.00.3%2026-07-07Fix
CVE-2026-48892Apache Airflow: Config API leaks per-key secrets backend kwargs masker bypass on synthetic options6.5CISA ADP v3.10.7%2026-07-07Fix
CVE-2026-48891Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph4.3CISA ADP v3.10.6%2026-07-07Fix
CVE-2026-48828Apache Airflow: Bulk JSON variables bypass should_hide_value_for_key redact called without the key6.5CISA ADP v3.10.7%2026-07-07Fix
CVE-2026-48588Django potential exposure of private data via cached Set-Cookie response2.3CNA v4.00.4%2026-07-07Fix
CVE-2026-46700Actual sync-server secrets endpoint missing authorization4.3CNA v3.10.3%2026-07-07Fix
CVE-2026-46672Actual: CSV formula injection in `@actual-app/cli` `--format CSV` Output4.6CNA v3.10.2%2026-07-07Fix
CVE-2026-46354Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft9.1CNA v3.10.3%2026-07-07Fix
CVE-2026-45796Coder vulnerable to unauthenticated SSRF via Azure Instance Identity endpoint6.5CNA v3.10.4%2026-07-07Fix
CVE-2026-44938SUSE Rancher Fleet has PSS Bypass through addLabelsFromOptions in Fleet agent8.8CNA v3.10.4%2026-07-07Fix
CVE-2026-44877HPE Networking Instant On Unauthenticated Remote Disclosure of Cryptographic Secrets6.5CNA v3.10.5%2026-07-07
CVE-2026-44454Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent8.1CNA v3.12.6%2026-07-07Fix
CVE-2026-42958Labcenter Proteus file parser use-after-free8.4CNA v4.00.2%2026-07-07Fix
CVE-2026-42953Out-of-bounds write in Labcenter Proteus8.4CNA v4.00.2%2026-07-07Fix
CVE-2026-42201Coolify: OS command injection via Database Credential fields in Docker Compose service commands3.3CNA v3.10.3%2026-07-07Fix
CVE-2026-42200Coolify: PostgreSQL Init script path traversal leads to arbitrary file write and Root RCE8.8CNA v3.10.9%2026-07-07Fix
CVE-2026-42172Coolify: Sanctum API Tokens have no Expiration Leaked Tokens Grant Permanent Access3.1CNA v3.10.3%2026-07-07Fix
CVE-2026-42147Coolify: SSRF via S3 Storage endpoint in testConnection4.9CNA v3.10.4%2026-07-07Fix
CVE-2026-42145Coolify: File upload without Type or Size Validation in Database Backup Restore3.1CNA v3.10.4%2026-07-07Fix
CVE-2026-42143Coolify: OS command injection via Persistent Volume Names Root RCE on Managed Servers8.8CNA v3.10.8%2026-07-07Fix
CVE-2026-37271Fire-Boltt Smartwatch FB BGS001 GATT write handler improper authentication9.8CISA ADP v3.10.6%2026-07-07
CVE-2026-37270Trueview Security camera T18161-AF authentication bypass9.8CISA ADP v3.10.7%2026-07-07
CVE-2026-36163LiquidFiles file view endpoint cross-site scripting5.4CISA ADP v3.10.2%2026-07-07
CVE-2026-36162LiquidFiles Upload File Shares API stored cross-site scripting5.4CISA ADP v3.10.2%2026-07-07
CVE-2026-34198Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing5.3CNA v3.10.2%2026-07-07Fix
CVE-2026-34171Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value8.0CNA v3.10.2%2026-07-07Fix
CVE-2026-34170Coolify: Server-side request forgery via attacker-controlled GitHub App API URL4.3CNA v3.10.3%2026-07-07Fix
CVE-2026-34168Coolify: Command injection via unsanitized persistent storage name in docker volume commands8.8CNA v3.10.8%2026-07-07Fix
CVE-2026-34158Coolify: Command injection via single-quote breakout in Docker Compose custom commands8.8CNA v3.10.7%2026-07-07Fix
CVE-2026-34152Coolify: Command injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)8.8CNA v3.10.7%2026-07-07Fix
CVE-2026-34149Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs3.3CNA v3.10.4%2026-07-07Fix
CVE-2026-34058Coolify: OS command injection via Unmanaged Container Operations remote code execution8.8CNA v3.10.7%2026-07-07Fix
CVE-2026-34057Coolify: Authenticated remote code execution via command injection in Database Import Container Name8.8CNA v3.10.6%2026-07-07Fix
CVE-2026-34048Coolify terminal websocket bootstrap routes missing authorization9.9CNA v3.10.8%2026-07-07Exploit codeFix
CVE-2026-34047Coolify: WebSocket endpoint access control flaw leading to remote code execution9.9CNA v3.10.7%2026-07-07Fix
CVE-2026-34044Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped)7.7CNA v3.10.4%2026-07-07Fix
CVE-2026-34037coollabsio coolify Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo9.9CNA v3.10.4%2026-07-07Fix
CVE-2026-34035Coolify: Host RCE via Log Drain secret/env command injection8.8CNA v3.10.6%2026-07-07Fix
CVE-2026-34034Coolify: Host RCE via Sentinel token injection8.8CNA v3.10.8%2026-07-07Fix
CVE-2026-33264Apache Airflow: DAG author RCE on webserver9.8CISA ADP v3.11.6%2026-07-07Fix
CVE-2026-28378Grafana Enterprise Cross-Organization Public Dashboard Deletion via Missing Org Isolation3.1CNA v3.10.2%2026-07-07Fix
CVE-2026-27844Gallagher Controller 7000 and 6000 improper error handling2.7CNA v3.10.4%2026-07-07Fix
CVE-2026-27790Gallagher T-20 Readers improper error handling2.7CNA v3.10.4%2026-07-07Fix
CVE-2026-26053Gallagher Command Centre Server incorrect privilege assignment5.3CNA v3.10.2%2026-07-07Fix
CVE-2026-23698Vtiger CRM authenticated RCE via Module Import file upload8.6CNA v4.01.2%2026-07-07Exploit code
CVE-2026-23697Vtiger CRM authenticated file upload RCE via Documents module8.7CNA v4.01.0%2026-07-07Exploit code
CVE-2026-14969Red Hat Directory Server LDBM attribute encryption predictable initialization vector4.4CNA v3.10.1%2026-07-07Fix
CVE-2026-14940Red Hat Directory Server DN normalization heap-based buffer overflow5.3CNA v3.10.5%2026-07-07Fix
CVE-2026-14935GStreamer webrtcbin SDP fingerprint check incorrect control flow3.7CNA v3.10.2%2026-07-07Fix
CVE-2026-14904RES Auth.GetUserPrivateKey arbitrary file read7.1CNA v4.00.6%2026-07-07Fix
CVE-2026-14895String::Util versions for Perl are susceptible to a regular expression denial of service7.5CISA ADP v3.10.6%2026-07-07Fix
CVE-2026-14868arcinfo PcVue weak encryption mechanism for User directory8.4CNA v4.00.1%2026-07-07Fix
CVE-2026-14867arcinfo PcVue insecure password storage in User directory6.8CNA v4.00.1%2026-07-07Fix
CVE-2026-14740DBI versions for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment9.1CISA ADP v3.10.4%2026-07-07Fix
CVE-2026-14739Perl DBI SQL statement preparsing out-of-bounds write9.8CISA ADP v3.10.4%2026-07-07Fix
CVE-2026-14476Red Hat Enterprise Linux 10 sssd: Sssd: Gpo cache path traversal8.0CNA v3.10.7%2026-07-07Fix
CVE-2026-14474Red Hat Enterprise Linux SSSD LDAP sudo provider privilege escalation8.8CNA v3.10.6%2026-07-07Fix
CVE-2026-14380DBI versions for Perl are vulnerable to code injection via caller-influenced Profile8.8CISA ADP v3.10.5%2026-07-07Fix
CVE-2026-14345WPFunnels WordPress plugin unauthenticated remote code execution via postData parameter9.8CNA v3.11.4%2026-07-07Fix
CVE-2026-13696LDAP injection in HAVELSAN's Liman MYS8.8CNA v3.10.5%2026-07-07Fix
CVE-2026-13356Mozilla Interrupted navigation could allow address bar origin spoofing in Firefox for iOS6.3CISA ADP v3.10.2%2026-07-07Fix
CVE-2026-13199Insufficient entropy in Raspberry Pi 5 and Compute Module 54.0CISA ADP v3.10.2%2026-07-07
CVE-2026-13020Weak password recovery Mechanism in Portal for ArcGIS8.1CNA v3.10.5%2026-07-07Fix
CVE-2026-13019Esri Portal for ArcGIS missing authentication9.8CNA v3.10.8%2026-07-07Fix
CVE-2026-12948Digi International Digi PortServer TS stored cross-site scripting (XSS)4.8CNA v4.00.4%2026-07-07Fix
CVE-2026-12375uncanny-automator-pro WordPress plugin Uncanny Automator Pro backdoor9.8CISA ADP v3.10.5%2026-07-07Fix
CVE-2026-12352Digi International PortServer TS 1/2/4 incorrect authorization5.9CNA v3.10.4%2026-07-07Exploit codeFix
CVE-2026-12277Frontend File Manager WordPress plugin unauthenticated arbitrary file deletion8.7CISA ADP v3.10.4%2026-07-07Exploit code
CVE-2026-11610389-ds-base SASL I/O layer of heap-based buffer overflow8.8CNA v3.10.5%2026-07-07Fix
CVE-2026-11348Authentication bypass in HAVELSAN's Open Source Project Liman MYS8.1CNA v3.10.3%2026-07-07Fix
CVE-2026-11340Authorization bypass in HAVELSAN's Open Source Project Liman MYS8.3CNA v3.10.4%2026-07-07Fix
CVE-2026-11328Exclusive Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-07Fix
CVE-2026-10834WP Travel Engine WordPress plugin Subscriber+ arbitrary Media file Move via user_profile_image4.6CISA ADP v3.10.2%2026-07-07Fix
CVE-2026-10659Null pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume4.7CNA v3.10.1%2026-07-07Fix
CVE-2026-8377Improper authorization in Armiya Technologies' Access Control System8.2CNA v3.10.3%2026-07-07Fix
CVE-2026-8309Reflected XSS in Armiya Technologies' Access Control System5.4CNA v3.10.2%2026-07-07Fix
CVE-2026-8306Stored XSS in Armiya Technologies' Access Control System6.1CNA v3.10.3%2026-07-07Fix
CVE-2026-7380HTML injection in Armiya Technologies' Access Control System6.1CNA v3.10.3%2026-07-07Fix
CVE-2026-7017HTTP::Tiny versions for Perl forward credential headers to cross-origin redirect targets7.1CISA ADP v3.10.2%2026-07-07Fix
CVE-2026-6101AMP for WP WordPress plugin arbitrary file write7.5CNA v3.11.0%2026-07-07Fix
CVE-2026-5799IDOR in Idvlabs' Ontime7.5CNA v3.10.4%2026-07-07
CVE-2026-5730IDOR in Idvlabs' Ontime7.5CNA v3.10.4%2026-07-07
CVE-2026-4375DoLeads Integrator WordPress plugin remote code execution9.0CISA ADP v3.10.4%2026-07-07
CVE-2026-59713Leantime OIDC login CSRF via Unconditional State Verification Stub8.6CNA v4.00.2%2026-07-06
CVE-2026-59712Leantime JSON-RPC API broken access control via users.getUser8.6CNA v4.00.4%2026-07-06
CVE-2026-59711showdown cross-site scripting via Unescaped Metadata Title in completeHTMLDocument5.3CNA v4.00.3%2026-07-06
CVE-2026-59710showdown stored XSS via Unescaped Table Header ID attribute injection5.3CNA v4.00.3%2026-07-06
CVE-2026-59196pnpm hoisted install lockfile alias handling path traversal7.1CNA v3.10.4%2026-07-06Fix
CVE-2026-59195pnpm config dependency symlink creation path traversal8.2CNA v3.10.4%2026-07-06Fix
CVE-2026-59194pnpm patch-remove command path traversal7.1CNA v3.10.4%2026-07-06Fix
CVE-2026-59152langchain-ai langsmith-sdk arbitrary server-side file read in LangSmith SDK TracingMiddleware5.0CNA v3.10.2%2026-07-06Fix
CVE-2026-59089Gimp: Gimp: Denial of service via integer overflow in playstation tim loader5.5CNA v3.10.3%2026-07-06Fix
CVE-2026-58404Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings4.6CNA v4.00.4%2026-07-06Fix
CVE-2026-58403Hugo symlink confinement bypass in os.ReadFile5.9CNA v4.00.5%2026-07-06Fix
CVE-2026-58402Hugo default code block renderer XSS via unescaped code-fence language5.1CNA v4.00.3%2026-07-06Fix
CVE-2026-58380Gimp: Gimp: Stack buffer overflow in pnmscanner_gettoken7.8NVD v3.10.3%2026-07-06Fix
CVE-2026-58226Unauthenticated denial of service via unbounded HPACK integer decoding in hpax8.7CNA v4.00.5%2026-07-06Fix
CVE-2026-58203pydantic-settings NestedSecretsSettingsSource path traversal5.3CNA v3.10.2%2026-07-06Fix
CVE-2026-57573Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint8.6CNA v3.10.4%2026-07-06Fix
CVE-2026-57572Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args10.0CNA v3.10.9%2026-07-06Fix
CVE-2026-57571Crawl4AI arbitrary file write via download filename path traversal9.6CNA v3.10.8%2026-07-06Fix
CVE-2026-56810mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/58.7CNA v4.00.5%2026-07-06Fix
CVE-2026-56140Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy9.8CISA ADP v3.10.7%2026-07-06Fix
CVE-2026-56139Apache Camel Undertow information disclosure through error messages5.3CISA ADP v3.10.6%2026-07-06Exploit codeFix
CVE-2026-55994Apache Camel Iggy component vulnerability7.5CISA ADP v3.10.6%2026-07-06Exploit codeFix
CVE-2026-55993Apache Camel Atmosphere WebSocket component vulnerability7.5CISA ADP v3.10.9%2026-07-06Exploit codeFix
CVE-2026-55798Pillow: WindowsViewer.get_command OS command injection via unescaped shell path4.5CNA v3.10.2%2026-07-06Fix
CVE-2026-55727Genetec Security Center improper authentication7.5CNA v3.10.5%2026-07-06Fix
CVE-2026-55646vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit6.5CNA v3.10.5%2026-07-06Fix
CVE-2026-55574vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends8.7CNA v4.00.6%2026-07-06Fix
CVE-2026-55514vLLM denial of service via prompt embeds on M-RoPE models7.1CNA v4.00.7%2026-07-06Fix
CVE-2026-55380Pillow GdImageFile decompression bomb protection bypass7.5CNA v3.10.4%2026-07-06Fix
CVE-2026-55379Pillow BDF font loader denial of service7.5CNA v3.10.4%2026-07-06Fix
CVE-2026-54893Email-derived URL path injection in the Swoosh Microsoft Graph adapter2.1CNA v4.00.2%2026-07-06Fix
CVE-2026-54765Traefik Kubernetes Gateway API provider incorrect authorization6.3CNA v4.00.3%2026-07-06Fix
CVE-2026-54764traefik ForwardAuth middleware leaks X-Forwarded-Port spoofing6.9CNA v4.00.3%2026-07-06Fix
CVE-2026-54763Traefik: HeaderField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth7.8CNA v4.00.2%2026-07-06Fix
CVE-2026-54291pgjdbc silent channel-binding authentication downgrade via unsupported certificate algorithms8.2CNA v4.00.2%2026-07-06Fix
CVE-2026-54234vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection7.5CNA v3.10.6%2026-07-06Fix
CVE-2026-54060Pillow: `FontFile.compile`: `Image.new` called without `_decompression_bomb_check`7.5CNA v3.10.4%2026-07-06Fix
CVE-2026-54059Python Pillow PCF font loader vulnerability7.5CNA v3.10.4%2026-07-06Fix
CVE-2026-53913Apache Camel Keycloak KeycloakSecurityPolicy missing authentication9.8CISA ADP v3.11.1%2026-07-06Exploit codeFix
CVE-2026-53763OP-TEE has AES-GCM 32-bit integer overflow in length counters that breaks authentication guarantee3.8CNA v3.00.2%2026-07-06Fix
CVE-2026-53646FOSSBilling: Client password reset token reuse allows persistent account takeover7.7CNA v4.00.3%2026-07-06Fix
CVE-2026-53645FOSSBilling staff permission management privilege escalation8.5CNA v4.00.4%2026-07-06Fix
CVE-2026-53644FOSSBilling API key secret endpoints insecure direct object reference8.6CNA v4.00.4%2026-07-06Fix
CVE-2026-53643FOSSBilling allows low-privileged staff accounts to perform unauthorized actions8.7CNA v4.00.4%2026-07-06Fix
CVE-2026-53642FOSSBilling: Unverified clients can access client-area pages when email confirmation is required5.3CNA v4.00.4%2026-07-06Fix
CVE-2026-53641FOSSBilling has stored XSS in client email views4.8CNA v4.00.4%2026-07-06Fix
CVE-2026-53640FOSSBilling admin API read endpoints missing authorization2.3CNA v4.00.4%2026-07-06Fix
CVE-2026-50135Hugo: Symlink confinement bypass in resources.Get6.9CNA v4.00.4%2026-07-06Fix
CVE-2026-50134Hugo: Security.http.urls allow-list bypass via HTTP redirects6.3CNA v4.00.4%2026-07-06Fix
CVE-2026-50133Hugo: XSS via text/html content files5.1CNA v4.00.3%2026-07-06Fix
CVE-2026-49365Apache Camel information disclosure through error messages5.3CISA ADP v3.10.6%2026-07-06Exploit codeFix
CVE-2026-49297Apache Airflow Google provider: Path traversal8.1CISA ADP v3.11.0%2026-07-06Fix
CVE-2026-49099Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter5.3CISA ADP v3.10.5%2026-07-06Exploit codeFix
CVE-2026-49098Apache Camel Kafka component header filter vulnerability5.3CISA ADP v3.10.6%2026-07-06Exploit codeFix
CVE-2026-49097Apache Camel IRC component header filter vulnerability6.5CISA ADP v3.10.7%2026-07-06Exploit codeFix
CVE-2026-49086Apache Camel Dapr Pub/Sub component confused deputy6.5CISA ADP v3.10.7%2026-07-06Exploit codeFix
CVE-2026-49042Apache Camel: Langchain4j-tools: Filter tool argument headers against declared parameters7.3CISA ADP v3.10.7%2026-07-06Exploit codeFix
CVE-2026-48614WebPros Plesk An improper authorization9.9CNA v3.10.6%2026-07-06Fix
CVE-2026-48316Adobe ColdFusion improper input validation10.0CNA v3.11.1%2026-07-06Fix
CVE-2026-48267DNG SDK null pointer dereference5.5CNA v3.10.2%2026-07-06Fix
CVE-2026-48206Apache Camel JIRA component insecure direct object reference5.3CISA ADP v3.10.6%2026-07-06Exploit codeFix
CVE-2026-48205Apache Camel DNS has improper input validation, leading to server-side request forgery (SSRF)9.1CISA ADP v3.10.6%2026-07-06Exploit codeFix
CVE-2026-48204Apache Camel MongoDB GridFS component improper access control9.8CISA ADP v3.10.7%2026-07-06Exploit codeFix
CVE-2026-48203Apache Camel improper neutralization9.1CISA ADP v3.10.6%2026-07-06Exploit codeFix
CVE-2026-46726Apache Camel Vertx WebSocket consumer server-side request forgery7.5CISA ADP v3.10.9%2026-07-06Exploit codeFix
CVE-2026-46592Apache Camel CXF SOAP component confused deputy7.5CISA ADP v3.10.6%2026-07-06Exploit codeFix
CVE-2026-46591Apache Camel Data Query Logic vulnerability improper neutralization8.2CISA ADP v3.10.6%2026-07-06Exploit codeFix
CVE-2026-46590Apache Camel deserialization of untrusted data8.8CISA ADP v3.10.8%2026-07-06Fix
CVE-2026-46588Apache Camel improper input validation7.3CISA ADP v3.10.7%2026-07-06Exploit codeFix
CVE-2026-46587Apache Camel improper input validation7.3CISA ADP v3.10.7%2026-07-06Exploit codeFix
CVE-2026-46585Apache Camel Lucene component insecure direct object reference7.5CISA ADP v3.10.6%2026-07-06Exploit codeFix
CVE-2026-46584Apache Camel Mail component SMTP producer information disclosure3.7CISA ADP v3.10.6%2026-07-06Exploit codeFix
CVE-2026-46457Apache Camel improper input validation7.5CISA ADP v3.10.7%2026-07-06Exploit codeFix
CVE-2026-46456Apache Camel improper input validation9.8CISA ADP v3.10.8%2026-07-06Exploit codeFix
CVE-2026-46455Apache Camel insufficient session expiration9.8CISA ADP v3.10.7%2026-07-06Exploit codeFix
CVE-2026-46454Apache Camel improper input validation9.8CISA ADP v3.10.8%2026-07-06Exploit codeFix
CVE-2026-46453Apache Camel Elasticsearch REST client component insecure direct object reference5.3CISA ADP v3.10.6%2026-07-06Exploit codeFix
CVE-2026-44937SUSE Rancher Fleet had an Unauthenticated Webhook: Regex injection8.3CNA v4.00.4%2026-07-06Fix
CVE-2026-44936Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml5.0CNA v3.10.3%2026-07-06Fix
CVE-2026-44934Exposed tokens in SUSE Rancher AI agent logs7.0CNA v4.00.2%2026-07-06Fix
CVE-2026-44362OP-TEE's subkey rollback protection can be bypassed with older subkey versions5.5CNA v3.10.2%2026-07-06Fix
CVE-2026-43928FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment2.3CNA v4.00.4%2026-07-06Fix
CVE-2026-43927FOSSBilling has race condition in cart checkout that bypasses promo code usage limits6.9CNA v4.00.3%2026-07-06Fix
CVE-2026-43925FOSSBilling client registration endpoint mass assignment6.9CNA v4.00.5%2026-07-06Fix
CVE-2026-43921FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization8.9CNA v4.00.4%2026-07-06Fix
CVE-2026-43918FOSSBilling session identity loaders insufficient session expiration8.7CNA v4.00.4%2026-07-06Fix
CVE-2026-43867Apache Camel deserialization of untrusted data9.8CISA ADP v3.10.9%2026-07-06Exploit codeFix
CVE-2026-43866Apache Camel, Apache Camel: Camel JMS fix bypass via DefaultExchangeHolder7.3CISA ADP v3.10.7%2026-07-06Exploit codeFix
CVE-2026-43865Apache Camel deserialization of untrusted data8.1CISA ADP v3.11.0%2026-07-06Exploit codeFix
CVE-2026-43825Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java deserialization in SvmDoccatModel7.3CISA ADP v3.113.9%2026-07-06Fix
CVE-2026-42546OP-TEE has missing OPTEE_MSG_ATTR_TYPE_MASK in cleanup_shm_refs leaks mobj references3.8CNA v3.10.2%2026-07-06Fix
CVE-2026-42527Apache Camel deserialization of untrusted data8.1CISA ADP v3.10.7%2026-07-06Exploit codeFix
CVE-2026-42341FOSSBilling has an unauthenticated payment bypass via IPN callback forgery9.2CNA v4.00.3%2026-07-06Fix
CVE-2026-42331FOSSBilling missing authorization in guest Invoice API endpoints7.7CNA v4.00.4%2026-07-06Fix
CVE-2026-42204Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root8.8CNA v3.10.7%2026-07-06Fix
CVE-2026-42153Coolify: PostgreSQL Healthcheck command injection allows Root code execution in Container8.8CNA v3.10.7%2026-07-06Fix
CVE-2026-42148Coolify: Command injection via Unescaped Version String in Docker Build3.8CNA v3.10.2%2026-07-06Fix
CVE-2026-41899Coolify unauthenticated feedback endpoint allows Discord webhook abuse6.5CNA v3.10.5%2026-07-06Fix
CVE-2026-41516OP-TEE: Hisilicon HPRE PKCS#1 Decryption Padding Oracle2.5CNA v3.10.1%2026-07-06Fix
CVE-2026-41515OP-TEE: RSA-OAEP padding oracle in NXP CAAM driver enables plaintext recovery2.5CNA v3.10.1%2026-07-06Fix
CVE-2026-41514OP-TEE: RSA-OAEP padding oracle in Hisilicon HPRE driver enables plaintext recovery2.5CNA v3.10.1%2026-07-06Fix
CVE-2026-41434OP-TEE has unbounded recursion in sanitize_client_object3.3CNA v3.10.2%2026-07-06Fix
CVE-2026-40859Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies8.1CISA ADP v3.10.9%2026-07-06Exploit codeFix
CVE-2026-40257OP-TEE has SHA-3 accelerated finalize heap overflow5.5CNA v3.10.2%2026-07-06Fix
CVE-2026-40141BeyondTrust Remote Support and Privileged Remote Access web application component NoSQL injection8.5CNA v4.00.5%2026-07-06Fix
CVE-2026-40140BeyondTrust Remote Support and Privileged Remote Access denial of service8.7CNA v4.00.6%2026-07-06Fix
CVE-2026-40139BeyondTrust Remote Support and Privileged Remote Access authentication bypass9.2CNA v4.00.8%2026-07-06Fix
CVE-2026-40138BeyondTrust Remote Support and Privileged Remote Access authentication bypass9.2CNA v4.00.5%2026-07-06Fix
CVE-2026-40047Apache Camel command improper neutralization9.1CISA ADP v3.12.4%2026-07-06Exploit codeFix
CVE-2026-38979Ajenti HTTP response headers clickjacking5.4CISA ADP v3.10.3%2026-07-06
CVE-2026-38976mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard for top-level super.7.5CISA ADP v3.10.6%2026-07-06
CVE-2026-38973mrubyc missing-method lookup out-of-bounds read4.4CISA ADP v3.10.2%2026-07-06
CVE-2026-34599Coolify: Authenticated remote code execution in GetLogs Livewire component8.8CNA v3.12.8%2026-07-06Fix
CVE-2026-34167Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor5.0CNA v3.10.3%2026-07-06Fix
CVE-2026-34153Coolify LocalFileVolume fs_path command injection enables RCE8.8CNA v3.10.8%2026-07-06Fix
CVE-2026-34050Coolify Settings/Updates Livewire component missing instance administrator authorization6.5CNA v3.10.4%2026-07-06Fix
CVE-2026-34049Coolify: Command injection via unsanitized MongoDB collection names in database backup3.3CNA v3.10.3%2026-07-06Fix
CVE-2026-34038Coolify authenticated remote command injection leading to RCE and secret exfiltration9.9CNA v3.12.5%2026-07-06Exploit codeFix
CVE-2026-33734FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters6.9CNA v4.00.4%2026-07-06Fix
CVE-2026-32718Coolify read-scoped API tokens can perform state-changing validation operations6.5CNA v3.10.4%2026-07-06Fix
CVE-2026-25271Qualcomm Snapdragon time-of-check time-of-use (TOCTOU) race condition in DSP service7.8CNA v3.10.1%2026-07-06Fix
CVE-2026-25268Qualcomm Snapdragon stack-based buffer overflow in WLAN host8.8CNA v3.10.1%2026-07-06Fix
CVE-2026-24014Apache IoTDB: Path traversal in DataNode Internal RPC Trigger JAR upload allows arbitrary file write9.8CISA ADP v3.10.7%2026-07-06Fix
CVE-2026-24013Apache IoTDB: Authentication bypass via Forged SessionID in Thrift RPC9.1CISA ADP v3.10.6%2026-07-06Fix
CVE-2026-24012Apache IoTDB: Denial of service via resource exhaustion in Aggregation Query7.5CISA ADP v3.10.7%2026-07-06Fix
CVE-2026-21384Qualcomm Snapdragon out-of-bounds write in Camera driver5.3CNA v3.10.1%2026-07-06Fix
CVE-2026-21383Qualcomm Snapdragon reusing a nonce, key pair in encryption in HLOS7.1CNA v3.10.1%2026-07-06Fix
CVE-2026-21379Qualcomm Snapdragon buffer over-read in Windows Compute7.8CNA v3.10.1%2026-07-06Fix
CVE-2026-21370Qualcomm Snapdragon out-of-bounds write in Camera driver5.3CNA v3.10.1%2026-07-06Fix
CVE-2026-21369Qualcomm Snapdragon out-of-bounds write in Camera driver5.3CNA v3.10.1%2026-07-06Fix
CVE-2026-21368Qualcomm Snapdragon out-of-bounds write in Camera driver5.3CNA v3.10.1%2026-07-06Fix
CVE-2026-14898OpenAI Codex desktop app for macOS prompt injection6.5CISA ADP v3.10.4%2026-07-06Fix
CVE-2026-14809PROG MIS｜Prog Management System SQL injection8.7CNA v4.00.6%2026-07-06Fix
CVE-2026-14808PROG MIS｜Prog Management System exposure of sensitive information9.3CNA v4.00.7%2026-07-06Fix
CVE-2026-14807PROG MIS｜ERP App use of hard-coded credentials9.3CNA v4.00.6%2026-07-06Fix
CVE-2026-14803Mojo::JSON versions for Perl allow memory exhaustion6.5CISA ADP v3.10.5%2026-07-06Fix
CVE-2026-14802react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection6.9CNA v4.02.1%2026-07-06Exploit code
CVE-2026-14801GPAC TeXML file load_text.c txtin_probe_duration divide by zero4.8CNA v4.00.2%2026-07-06
CVE-2026-14800imhamzaazam ecommerceFlask cross-site request forgery5.3CNA v4.00.2%2026-07-06
CVE-2026-14799CodeAstro Ecommerce Website my_account.php SQL injection5.3CNA v4.00.3%2026-07-06
CVE-2026-14798CodeAstro Apartment Visitor Management System visitor-entry.php SQL injection5.3CNA v4.00.3%2026-07-06
CVE-2026-14797CodeAstro Apartment Visitor Management System edit-apartment.php SQL injection5.3CNA v4.00.3%2026-07-06
CVE-2026-14796CodeAstro Apartment Visitor Management System report.php SQL injection5.3CNA v4.00.3%2026-07-06
CVE-2026-14795CodeAstro Apartment Visitor Management System action-visitor.php SQL injection5.3CNA v4.00.3%2026-07-06
CVE-2026-14794Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization5.3CNA v4.00.4%2026-07-06Fix
CVE-2026-14793Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization5.3CNA v4.00.4%2026-07-06Fix
CVE-2026-14792Formbricks Survey actions.ts access control6.9CNA v4.00.6%2026-07-06Fix
CVE-2026-14791crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross-site scripting5.1CNA v4.00.3%2026-07-06
CVE-2026-14790GPAC Media file write_nhml.c nhmldump_send_frame null pointer dereference4.8CNA v4.00.2%2026-07-06
CVE-2026-14789radareorg radare2 Memory64ListStream mdmp.c stack-based overflow7.8v3.10.2%2026-07-06Fix
CVE-2026-14788radareorg radare2 cfile.c r_core_bin_load use-after-free7.8v3.10.2%2026-07-06Fix
CVE-2026-14787radareorg radare2 pb Print cmd_print.inc cmd_print integer overflow7.8v3.10.2%2026-07-06Fix
CVE-2026-14786radareorg radare2 str.c r_str_word_get0set integer overflow5.5v3.10.2%2026-07-06Fix
CVE-2026-14784vxcontrol PentAGI Docker API client.go sandbox5.3CNA v4.00.4%2026-07-06
CVE-2026-14783NousResearch hermes-agent skills_tool.py skill_view path traversal5.3CNA v4.00.5%2026-07-06
CVE-2026-14778SourceCodester Onlne Examination and Learning Management System improper authorization6.9CNA v4.00.5%2026-07-06
CVE-2026-14777SourceCodester Onlne Examination and Learning Management System unrestricted upload5.3CNA v4.00.4%2026-07-06
CVE-2026-14536Devolutions Server incorrect authorization8.8v3.10.4%2026-07-06Fix
CVE-2026-14471AWS MCP Gateway and Registry improper neutralization8.6CNA v4.00.6%2026-07-06Fix
CVE-2026-14468Path traversal allows arbitrary file read in Terraform Enterprise container7.7CNA v3.10.4%2026-07-06Fix
CVE-2026-13753Certain HP DeskJet All in One potential information disclosure7.5CISA ADP v3.10.5%2026-07-06Exploit codeFix
CVE-2026-13708TONYC Imager::File::JPEG APP13 marker parsing memory leak7.5CISA ADP v3.10.6%2026-07-06Fix
CVE-2026-13705Imager versions for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader7.1CISA ADP v3.10.2%2026-07-06Fix
CVE-2026-13698OpenVPN A memory leak6.0CNA v4.00.5%2026-07-06Fix
CVE-2026-13122OpenVPN reachable assertion5.9CNA v4.00.5%2026-07-06Fix
CVE-2026-12686Incorrect authorisation in Adiss’s Biloop9.3CNA v4.00.4%2026-07-06Fix
CVE-2026-12154Reviews Widgets for Google, Yelp and TripAdvisor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-06Fix
CVE-2026-12083Admin and Site Enhancements role-restoration handler missing authorization8.1CISA ADP v3.10.5%2026-07-06Fix
CVE-2026-11962FileOrganizer WordPress plugin authenticated arbitrary file upload via elFinder file Operations8.8CISA ADP v3.10.7%2026-07-06Fix
CVE-2026-11855Simple Membership WordPress plugin unauthenticated stored XSS via Stripe Webhook API Version8.8CISA ADP v3.10.5%2026-07-06Fix
CVE-2026-11766Ultimate Member WordPress plugin Subscriber+ stored XSS via Custom Textarea Profile fields8.0CISA ADP v3.10.4%2026-07-06Fix
CVE-2026-11405Tenda firmware httpd login handler vulnerability9.8CISA ADP v3.10.8%2026-07-06Exploit code
CVE-2026-10830AllCoach WordPress plugin unauthenticated account takeover8.8CISA ADP v3.10.4%2026-07-06Fix
CVE-2026-9182Unvalidated file upload vulnerability in ArcGIS Server9.8CNA v3.10.6%2026-07-06Fix
CVE-2026-9181Directory traversal in ArcGIS Server9.8CNA v3.11.2%2026-07-06Emerging ThreatsFix
CVE-2026-9165Red Hat Advanced Cluster Security for Kubernetes GraphQL API resource exhaustion7.7CNA v3.10.5%2026-07-06Fix
CVE-2026-7185Unauthorized access to files in T-Systems products6.0CNA v4.00.4%2026-07-06Fix
CVE-2026-6901B&R Industrial Automation APROL untrusted search path8.4CNA v4.00.2%2026-07-06Fix
CVE-2026-6900B&R Industrial Automation APROL improper certificate validation9.1CNA v4.00.2%2026-07-06Fix
CVE-2026-6382FileOrganizer WordPress plugin multiple elFinder plugins authenticated OS command injection9.1CISA ADP v3.11.4%2026-07-06Fix
CVE-2026-5268CIENA 6500 S-Series SFTP Server Authentication Weakness9.1CISA ADP v3.10.7%2026-07-06Fix
CVE-2026-4249WSO2 API Manager throttling event handling denial of service8.6CNA v3.10.6%2026-07-06Fix
CVE-2026-1433NT-ware uniFLOW ULM Remote User Interface information disclosure4.8CNA v4.00.3%2026-07-06Fix
CVE-2026-59520CrawlWP SEO WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2026-07-05Fix
CVE-2026-59519FormLayer WordPress plugin sensitive data exposure5.3CNA v3.10.3%2026-07-05Fix
CVE-2026-59511Exclusive Addons Elementor WordPress plugin sensitive data exposure5.3CNA v3.10.3%2026-07-05Fix
CVE-2026-59510ail framework its PDF object handling path traversal7.1CNA v4.00.5%2026-07-05
CVE-2026-59509Unauthenticated arbitrary MongoDB collection read in cve-search9.2CNA v4.01.4%2026-07-05Nuclei
CVE-2026-14781Red Hat Keycloak OIDC identity broker vulnerability4.8CNA v3.10.3%2026-07-05
CVE-2026-14776SourceCodester Onlne Examination and Learning Management System unrestricted upload5.3CNA v4.00.4%2026-07-05
CVE-2026-14775SourceCodester Onlne Examination and Learning Management System unrestricted upload5.3CNA v4.00.4%2026-07-05
CVE-2026-14774itsourcecode Hospital Management System paymentdischarge.php SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14773itsourcecode Hospital Management System payment.php SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14772SourceCodester Class and Exam Timetabling System edit_course1.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14771SourceCodester Class and Exam Timetabling System edit_exam1.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14770SourceCodester Class and Exam Timetabling System edit_room.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14769code-projects Real State Services pay.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14768code-projects Real State Services builderHome.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14767CodeAstro Ecommerce Website POST parameter confirm.php SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14766CodeAstro Apartment Visitor Management System POST parameter search-result.php SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14764code-projects Hotel and Tourism Reservation Event Management add_event.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14763code-projects Hotel and Tourism Reservation Tour Reservations tour_reserves.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14762code-projects Hotel and Tourism Reservation Room Management rooms.php SQL injection6.9CNA v4.00.4%2026-07-05Exploit code
CVE-2026-14761radareorg radare2 str.c r_str_append integer overflow5.5v3.10.2%2026-07-05Fix
CVE-2026-14760radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use-after-free7.8v3.10.2%2026-07-05Fix
CVE-2026-14759radareorg radare2 RBinJava line number table parser heap-based buffer overflow7.8v3.10.2%2026-07-05Fix
CVE-2026-14758radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow5.5v3.10.2%2026-07-05Fix
CVE-2026-14757radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow7.8v3.10.2%2026-07-05Fix
CVE-2026-14756code-projects Hotel and Tourism Reservation Tour Management add_tour.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14755code-projects Hotel and Tourism Reservation Reservations Management reservations.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14754code-projects Hotel and Tourism Reservation add_room.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14753mjperpinosa stumasy Note Handler/Assignment notes authorization6.9CNA v4.00.5%2026-07-05
CVE-2026-14752mjperpinosa stumasy add_into_dictionary.php add_definition cross-site scripting5.1CNA v4.00.3%2026-07-05
CVE-2026-14751mjperpinosa stumasy search_scratch_data.php search_scratch_data SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14750mjperpinosa stumasy SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14749mjperpinosa stumasy calculate.php eval code injection6.9CNA v4.00.5%2026-07-05
CVE-2026-14748AIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgery5.3CNA v4.00.4%2026-07-05
CVE-2026-14747code-projects Real State Services addprojectsale.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14746code-projects Real State Services addprojectrent.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14745code-projects Real State Services single-list_rent.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14744code-projects Real State Services normalHomeRent.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14743code-projects Real State Services normalHomeSale.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14742langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash2.3CNA v4.00.2%2026-07-05Fix
CVE-2026-14738exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hash6.3CNA v4.00.3%2026-07-05
CVE-2026-14737Hanwang e-Face General Management Platform querySysAuthStr.do SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14736Ruijie RG-UAC user_auth_commit.php unrestricted upload6.9CNA v4.00.5%2026-07-05
CVE-2026-14735code-projects Smart Parking System parkings.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14734SourceCodester Class and Exam Timetabling System edit_product.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14733SourceCodester Class and Exam Timetabling System edit_coursea.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14732SourceCodester Class and Exam Timetabling System edit_exam.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14731itsourcecode Hospital Management System patientreport.php SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14730itsourcecode Hospital Management System patientprofile.php SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14725SourceCodester Online Boat Reservation System session expiration5.3CNA v4.00.4%2026-07-05
CVE-2026-14723AD-Security AD_Miner Cache analyse_cache.py request_a deserialization4.8CNA v4.00.3%2026-07-05
CVE-2026-14722tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injection6.9CNA v4.00.5%2026-07-05
CVE-2026-14721UTT HiPER 1250GW Web Endpoint ConfigWirelessBase_5g stack-based overflow8.7CNA v4.00.8%2026-07-05
CVE-2026-14719SourceCodester Onlne Examination and Learning Management System improper privilege management6.9CNA v4.00.5%2026-07-05
CVE-2026-14717itsourcecode Hospital Management System patientlogin.php SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14716nextlevelbuilder GoClaw WebSocket RPC router.go MethodRouter.Handle authorization5.3CNA v4.00.4%2026-07-05
CVE-2026-14714zhayujie chatgpt-on-wechat CowAgent wx endpoint common.py verify_server missing authentication6.9CNA v4.00.8%2026-07-05Fix
CVE-2026-14713SourceCodester Pizzafy E-Commerce System ajax.php confirm_order SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14706code-projects Online Examination Quiz Creation feature update.php SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14705code-projects Online Examination head.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14704stephen-kruger bluebox cross-site scripting5.3CNA v4.00.5%2026-07-05
CVE-2026-14703itsourcecode Hospital Management System patientorder.php SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14702zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values2.0CNA v4.00.1%2026-07-05
CVE-2026-14701code-projects Internship Management System password change endpoint SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14700code-projects Internship Management System Employer Login endpoint login.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14699zcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlink4.8CNA v4.00.2%2026-07-05
CVE-2026-14698SourceCodester Syllabus-Aligned Learning Management and Examination System unrestricted upload5.3CNA v4.00.4%2026-07-05
CVE-2026-14695SourceCodester Multi-Vendor Online Grocery Management System registration handler SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14694SourceCodester Multi-Vendor Online Grocery Management System POST parameter handler SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14693SourceCodester Multi-Vendor Online Grocery Management System improper authorization5.3CNA v4.00.4%2026-07-05
CVE-2026-14692SourceCodester Multi-Vendor Online Grocery Management System POST parameter handler SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14691SourceCodester Multi-Vendor Online Grocery Management System settings handler code injection5.3CNA v4.00.4%2026-07-05
CVE-2026-14690SourceCodester Multi-Vendor Online Grocery Management System improper authorization6.9CNA v4.00.5%2026-07-05
CVE-2026-14689CodeAstro Apartment Visitor Management System add-apartment.php SQL injection5.3CNA v4.00.3%2026-07-05
CVE-2026-14688itsourcecode Online Hotel Management System login.php SQL injection6.9CNA v4.00.4%2026-07-05
CVE-2026-14687666ghj BettaFish InsightEngine search-result deduplication incorrect comparison6.9CNA v4.00.5%2026-07-05
CVE-2026-14686HdrHistogram DoubleHistogram range check incorrect comparison4.8CNA v4.00.3%2026-07-05Fix
CVE-2026-14570Crypt::DSA DSA nonce generation insufficient randomness7.5CISA ADP v3.10.5%2026-07-05Fix
CVE-2026-12386Buffer overflow in TUBITAK BILGEM's Pardus Pen3.9CNA v3.10.1%2026-07-05Fix
CVE-2026-12250Sensitive data exposure in TUBITAK BILGEM's Pardus Domain Joiner7.9CNA v3.10.2%2026-07-05Fix
CVE-2026-10657Out-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL)3.7CNA v3.10.4%2026-07-05Fix
CVE-2026-10656Zephyr MAX32 USB device controller driver null pointer dereference4.6CNA v3.10.3%2026-07-05Fix
CVE-2026-9085TUBITAK BILGEM Pardus-Parental-Control DNS spoofing8.8CNA v3.10.1%2026-07-05Fix
CVE-2026-6509Privilege escalation in TUBITAK BILGEM's Pardus Update7.8CNA v3.10.1%2026-07-05Fix
CVE-2026-54424Unity Parsec incorrect use of privileged APIs8.4CNA v3.10.2%2026-07-04Exploit code
CVE-2026-53362Linux kernel IPv6 fragmented packet output out-of-bounds write7.8CNA v3.10.7%2026-07-04KEVExploit codeFix
CVE-2026-53361In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- uni7.1CNA v3.10.2%2026-07-04Exploit codeFix
CVE-2026-53360Linux kernel SEV out-of-bounds read8.8CNA v3.10.2%2026-07-04Exploit codeFix
CVE-2026-53359Linux kernel KVM shadow paging use-after-free8.8CNA v3.11.0%2026-07-04Exploit codeFix
CVE-2026-14685HdrHistogram AbstractHistogram AbstractHistogram.java recordValueWithCount state issue4.8CNA v4.00.2%2026-07-04Fix
CVE-2026-14684HdrHistogram AbstractHistogram.java memory allocation4.8CNA v4.00.2%2026-07-04Fix
CVE-2026-14683HdrHistogram AbstractHistogram.java memory allocation4.8CNA v4.00.2%2026-07-04Fix
CVE-2026-14660code-projects Online Job Portal login.php SQL injection6.9CNA v4.00.4%2026-07-04
CVE-2026-14659itsourcecode Hospital Management System patientappointment.php SQL injection5.3CNA v4.00.3%2026-07-04
CVE-2026-14658code-projects Assessment Management marking-scheme.php SQL injection5.3CNA v4.00.3%2026-07-04
CVE-2026-14657code-projects Assessment Management Database Query marking-scheme.php SQL injection5.3CNA v4.00.3%2026-07-04
CVE-2026-14656code-projects Assessment Management remove-user.php cross-site scripting5.3CNA v4.00.5%2026-07-04
CVE-2026-14655code-projects Assessment Management view-users.php cross-site scripting4.8CNA v4.00.4%2026-07-04
CVE-2026-14654SourceCodester Simple and Nice Shopping Cart Script girlsproductdeletequery.php SQL injection6.9CNA v4.00.4%2026-07-04
CVE-2026-14653SourceCodester Simple and Nice Shopping Cart Script mensproductdeletequery.php SQL injection6.9CNA v4.00.4%2026-07-04
CVE-2026-14652SourceCodester Simple and Nice Shopping Cart Script Admin Login login.php SQL injection6.9CNA v4.00.4%2026-07-04
CVE-2026-14651connorskees grass visitor denial of service4.8CNA v4.00.2%2026-07-04
CVE-2026-14650connorskees grass UTF-8 Character raw_to_parse_error denial of service4.8CNA v4.00.2%2026-07-04
CVE-2026-14649code-projects Online Voting System saveVote.php test_input SQL injection6.9CNA v4.00.4%2026-07-04
CVE-2026-14648code-projects Online Voting System Login authentication.php test_input SQL injection6.9CNA v4.00.6%2026-07-04
CVE-2026-14647onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds5.3CNA v4.00.4%2026-07-04Fix
CVE-2026-14642SourceCodester Class and Exam Timetabling System edit_class2.php SQL injection6.9CNA v4.00.4%2026-07-04
CVE-2026-14641SourceCodester Class and Exam Timetabling System edit_course.php SQL injection6.9CNA v4.00.4%2026-07-04
CVE-2026-14640CodeAstro Apartment Visitor Management System Login index.php SQL injection6.9CNA v4.00.4%2026-07-04
CVE-2026-14639CodeAstro Ecommerce Website my_account.php SQL injection5.3CNA v4.00.3%2026-07-04
CVE-2026-14638itsourcecode Hospital Management System patient.php SQL injection5.3CNA v4.00.3%2026-07-04
CVE-2026-14637kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization8.8CNA v4.00.8%2026-07-04
CVE-2026-14636kirilkirkov Ecommerce-CodeIgniter-Bootstrap vendor image manager path traversal5.3CNA v4.00.5%2026-07-04
CVE-2026-14635kirilkirkov Ecommerce-CodeIgniter-Bootstrap vendor multi-image upload path traversal6.9CNA v4.00.6%2026-07-04
CVE-2026-14634kirilkirkov Ecommerce-CodeIgniter-Bootstrap subscribed emails admin cross-site scripting5.3CNA v4.00.5%2026-07-04
CVE-2026-14633kirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API endpoint set cross-site scripting5.3CNA v4.00.5%2026-07-04
CVE-2026-14632kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php setReferrer redirect5.3CNA v4.00.5%2026-07-04
CVE-2026-14630ForceInjection AI-fundermentals memory recall handler weak hash2.3CNA v4.00.2%2026-07-04
CVE-2026-14629RT-Thread parameter lwp_syscall.c sys_ioctl divide by zero5.3CNA v4.00.5%2026-07-04
CVE-2026-14628NousResearch hermes-agent Live Webhook endpoint base.py extract_media path traversal6.9CNA v4.00.8%2026-07-04
CVE-2026-14627NousResearch hermes-agent Discord platform integration improper authentication6.3CNA v4.00.6%2026-07-04
CVE-2026-14626NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service5.3CNA v4.00.5%2026-07-04
CVE-2026-14625NousResearch hermes-agent server.py shell.exec protection mechanism5.3CNA v4.00.4%2026-07-04
CVE-2026-14624omec-project amf NGSetupRequest handler.go denial of service5.3CNA v4.00.5%2026-07-04
CVE-2026-14623omec-project amf NGAP Message RRCInactiveTransitionReport denial of service5.3CNA v4.00.5%2026-07-04
CVE-2026-14622jairiidriss restaurant-website-php-mysql AJAX endpoint ajax_files missing authentication6.9CNA v4.00.7%2026-07-04
CVE-2026-14621FederatedAI FATE OSX Broker session data exposure2.3CNA v4.00.4%2026-07-04
CVE-2026-14619itsourcecode Hospital Management System medicine.php SQL injection5.3CNA v4.00.3%2026-07-04
CVE-2026-14618Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service5.3CNA v4.00.5%2026-07-04
CVE-2026-14535Trail of Bits fickling MLAllowlist analysis pass protection mechanism failure9.8v3.10.6%2026-07-04Fix
CVE-2026-14534Fickling check_safety bypass via unlisted standard library modules (_posixsubprocess, site, atexit)8.8CNA v3.10.6%2026-07-04Fix
CVE-2026-12746BIAFRA Dancer2::Plugin::Auth::OAuth::Provider OAuth callback handling cross-site request forgery8.1CISA ADP v3.10.3%2026-07-04Fix
CVE-2026-12740Plack::Middleware::OAuth versions for Perl do not support the OAuth 2.0 state parameter8.1CISA ADP v3.10.2%2026-07-04
CVE-2026-12252Untrusted JAR code execution in multiple Stanford Interface Classes in nltk/nltk7.8CNA v3.00.2%2026-07-04Fix
CVE-2026-12196HestiaCP admin takeover8.3CNA v4.00.4%2026-07-04
CVE-2026-12195myvesta vesta OS command injection8.5CNA v4.00.7%2026-07-04
CVE-2026-12194PHPIPAM authenticated LFI2.3CNA v4.00.4%2026-07-04
CVE-2026-59234Authorization bypass through user-controlled key in Prospero Flow CRM calendar event deletion6.9CNA v4.00.6%2026-07-03Fix
CVE-2026-58597Microsoft Edge (Chromium-based) spoofing4.3CNA v3.10.7%2026-07-03Fix
CVE-2026-58524Microsoft Edge (Chromium-based) spoofing5.4CNA v3.10.4%2026-07-03Fix
CVE-2026-58523Microsoft Edge for Android security feature bypass6.5CNA v3.10.9%2026-07-03Fix
CVE-2026-58522Microsoft Edge for Android information disclosure6.8CNA v3.10.4%2026-07-03Fix
CVE-2026-58426Gitea Actions artifacts signed URL improper signature verification9.6CNA v3.10.3%2026-07-03Fix
CVE-2026-58424Gitea Open Source Git Server Permanent Fork PR Workflow Approval Gate Bypass8.9CNA v3.10.4%2026-07-03Exploit codeFix
CVE-2026-58423Gitea Open Source Git Server LFS authentication bypass7.7CNA v3.10.5%2026-07-03Fix
CVE-2026-58422Gitea OAuth sign-in callback improper authorization9.8CISA ADP v3.10.6%2026-07-03Fix
CVE-2026-58421Gitea Open Source Git Server unauthenticated ReDoS7.5CISA ADP v3.10.6%2026-07-03Fix
CVE-2026-58419Gitea Open Source Git Server notification API leaks private issue metadata after access revocation7.5CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-58418Gitea Open Source Git Server SSRF via HTTP Redirect in Repository Migration6.5CNA v3.10.4%2026-07-03Fix
CVE-2026-58379Red Hat Enterprise Linux 9 Gimp: Gimp: Heap buffer overflow in read_channel_data7.3CNA v3.10.2%2026-07-03Fix
CVE-2026-58300Microsoft Edge for Android information disclosure6.2CNA v3.10.4%2026-07-03Fix
CVE-2026-58299Microsoft Edge for Android remote code execution7.5CNA v3.10.5%2026-07-03Fix
CVE-2026-58298Microsoft Edge (Chromium-based) spoofing7.2CNA v3.10.4%2026-07-03Fix
CVE-2026-58297Microsoft Edge for Android information disclosure7.1CNA v3.10.5%2026-07-03Fix
CVE-2026-58296Microsoft Edge for Android information disclosure7.1CNA v3.10.5%2026-07-03Fix
CVE-2026-58295Microsoft Edge (Chromium-based) security feature bypass8.3CNA v3.10.5%2026-07-03Fix
CVE-2026-58294Microsoft Edge (Chromium-based) remote code execution7.5CNA v3.10.6%2026-07-03Fix
CVE-2026-58293Microsoft Edge (Chromium-based) remote code execution8.1CNA v3.10.6%2026-07-03Fix
CVE-2026-58292Microsoft Edge (Chromium-based) remote code execution7.5CNA v3.10.5%2026-07-03Fix
CVE-2026-58291Microsoft Edge (Chromium-based) information disclosure6.1CNA v3.11.0%2026-07-03Fix
CVE-2026-58290Microsoft Edge (Chromium-based) remote code execution7.5CNA v3.10.4%2026-07-03Fix
CVE-2026-58289Microsoft Edge (Chromium-based) remote code execution9.0CNA v3.12.0%2026-07-03Exploit codeFix
CVE-2026-58288Microsoft Edge (Chromium-based) remote code execution8.3CNA v3.10.6%2026-07-03Fix
CVE-2026-58287Microsoft Edge (Chromium-based) remote code execution8.3CNA v3.10.6%2026-07-03Fix
CVE-2026-58286Microsoft Edge (Chromium-based) spoofing8.1CNA v3.10.4%2026-07-03Fix
CVE-2026-58285Microsoft Edge (Chromium-based) remote code execution8.3CNA v3.10.6%2026-07-03Fix
CVE-2026-58284Microsoft Edge (Chromium-based) remote code execution8.3CNA v3.10.6%2026-07-03Fix
CVE-2026-58283Microsoft Edge (Chromium-based) spoofing8.1CNA v3.10.4%2026-07-03Fix
CVE-2026-58282Microsoft Edge (Chromium-based) spoofing8.1CNA v3.10.4%2026-07-03Fix
CVE-2026-58278Microsoft Edge (Chromium-based) spoofing5.4CNA v3.10.4%2026-07-03Fix
CVE-2026-58276Microsoft Edge (Chromium-based) remote code execution7.5CNA v3.10.6%2026-07-03Fix
CVE-2026-57993Microsoft Edge (Chromium-based) spoofing7.4CNA v3.10.9%2026-07-03Fix
CVE-2026-57992Microsoft Edge (Chromium-based) remote code execution7.5CNA v3.10.6%2026-07-03Fix
CVE-2026-57991Microsoft Edge (Chromium-based) information disclosure7.4CNA v3.11.0%2026-07-03Fix
CVE-2026-57988Microsoft Edge (Chromium-based) remote code execution7.1CNA v3.10.8%2026-07-03Fix
CVE-2026-57987Microsoft Edge (Chromium-based) spoofing6.5CNA v3.10.9%2026-07-03Fix
CVE-2026-57986Microsoft Edge (Chromium-based) remote code execution7.5CNA v3.10.6%2026-07-03Fix
CVE-2026-57985Microsoft Edge (Chromium-based) remote code execution7.6CNA v3.10.7%2026-07-03Fix
CVE-2026-57984Microsoft Edge (Chromium-based) remote code execution7.5CNA v3.10.6%2026-07-03Fix
CVE-2026-57983Microsoft Edge (Chromium-based) security feature bypass8.7CNA v3.10.6%2026-07-03Fix
CVE-2026-57981Microsoft Edge (Chromium-based) remote code execution8.8CNA v3.10.8%2026-07-03Fix
CVE-2026-57977Microsoft Edge (Chromium-based) spoofing7.1CNA v3.10.6%2026-07-03Fix
CVE-2026-57975Microsoft Edge (Chromium-based) remote code execution7.5CNA v3.10.6%2026-07-03Fix
CVE-2026-57974Microsoft Edge (Chromium-based) remote code execution8.8CNA v3.10.8%2026-07-03Fix
CVE-2026-56646Microsoft Edge (Chromium-based) spoofing6.5CNA v3.10.9%2026-07-03Fix
CVE-2026-56645Microsoft Edge (Chromium-based) remote code execution8.8CNA v3.10.8%2026-07-03Fix
CVE-2026-56085Dell PowerProtect Data Domain uninitialized resource use3.3CNA v3.10.1%2026-07-03Fix
CVE-2026-56015Net::IP::LPM versions for Perl allow a heap out-of-bounds read via an unbounded prefix length9.1CISA ADP v3.10.7%2026-07-03Fix
CVE-2026-55945Microsoft Edge (Chromium-based) information disclosure4.2CNA v3.10.2%2026-07-03Fix
CVE-2026-55726Gardyn IoT Hub exposure of sensitive system information to an unauthorized control sphere6.9CNA v4.00.5%2026-07-03Fix
CVE-2026-54483Dell PowerProtect Data Domain OS command injection6.7CNA v3.10.6%2026-07-03Fix
CVE-2026-54477Gardyn IoT Hub improper neutralization of HTTP headers for scripting syntax5.1CNA v4.00.3%2026-07-03Fix
CVE-2026-53478Dell PowerProtect Data Domain OS command injection7.2CNA v3.12.0%2026-07-03Fix
CVE-2026-49815Dell PowerProtect Data Domain OS command injection7.2CNA v3.11.7%2026-07-03Fix
CVE-2026-49814Dell PowerProtect Data Domain OS command injection7.2CNA v3.12.0%2026-07-03Fix
CVE-2026-49813Dell PowerProtect Data Domain OS command injection6.7CNA v3.10.6%2026-07-03Fix
CVE-2026-47898Apache Lucene.net: XXE vulnerability in Lucene.net.Analysis.Common PatternParser4.0CNA v4.00.5%2026-07-03Fix
CVE-2026-47897Apache Lucene.net: Arbitrary file write from malicious server to Lucene.net.Replicator client8.9CNA v4.00.7%2026-07-03Fix
CVE-2026-47896Apache Lucene.Net Lucene.Net.Replicator path traversal8.9CNA v4.00.8%2026-07-03Fix
CVE-2026-46730Dell PowerProtect Data Domain incorrect authorization4.2CNA v3.10.2%2026-07-03Fix
CVE-2026-46468Dell PowerProtect Data Domain link following4.4CNA v3.10.2%2026-07-03Fix
CVE-2026-46467Dell PowerProtect Data Domain sensitive information in log files5.8CNA v3.10.1%2026-07-03Fix
CVE-2026-46466Dell PowerProtect Data Domain use of a less trusted source2.7CNA v3.10.2%2026-07-03Fix
CVE-2026-46465Dell PowerProtect Data Domain format string5.5CNA v3.10.4%2026-07-03Fix
CVE-2026-46464Dell PowerProtect Data Domain link following4.9CNA v3.10.6%2026-07-03Fix
CVE-2026-46463Dell PowerProtect Data Domain integer overflow6.5CNA v3.10.3%2026-07-03Fix
CVE-2026-45489Microsoft Edge (Chromium-based) spoofing6.5CNA v3.10.9%2026-07-03Fix
CVE-2026-45488Microsoft Edge (Chromium-based) spoofing5.4CNA v3.10.4%2026-07-03Fix
CVE-2026-44269Dell PowerProtect Data Domain link following4.4CNA v3.10.2%2026-07-03Fix
CVE-2026-44268Dell PowerProtect Data Domain incorrect permission assignment4.4CNA v3.10.1%2026-07-03Fix
CVE-2026-41124Dell PowerProtect Data Domain path traversal2.3CNA v3.10.2%2026-07-03Fix
CVE-2026-41123Dell PowerProtect Data Domain improper access control4.3CNA v3.10.3%2026-07-03Fix
CVE-2026-35159Dell Inspiron 15 3520 authentication bypass5.3CNA v3.10.2%2026-07-03Fix
CVE-2026-28744Gitea Git smart HTTP bypasses repository token scopes for bearer tokens8.1CNA v3.10.4%2026-07-03Fix
CVE-2026-28740Gitea LFS object reuse bypasses Code-unit authorization7.1CNA v3.10.3%2026-07-03Fix
CVE-2026-28737Gitea 3D file viewer allows stored XSS through glTF extensionsRequired8.7CNA v3.10.4%2026-07-03Fix
CVE-2026-28705Gitea repository dumps write release assets using unsafe path names5.3CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-28699Gitea Basic Auth bypasses OAuth2 access token scopes8.1CNA v3.10.6%2026-07-03Exploit codeFix
CVE-2026-27783Gitea issue-template APIs bypass repository unit authorization4.3CNA v3.10.3%2026-07-03Fix
CVE-2026-27780Gitea pre-receive hook can miss branch-protection checks after scanner errors9.8CISA ADP v3.10.6%2026-07-03Fix
CVE-2026-27779Gitea forwarded-proto handling allows public URL spoofing7.5CISA ADP v3.10.6%2026-07-03Fix
CVE-2026-27775Gitea pre-receive hook permission cache allows full repository write access8.8CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-27771Gitea Composer package source links use insufficient permission checks8.2CNA v3.01.4%2026-07-03NucleiEmerging ThreatsExploit codeFix
CVE-2026-27761Gitea repository feeds bypass API token scope enforcement4.3CNA v3.10.4%2026-07-03Fix
CVE-2026-27660Gitea draft releases use insufficient permission checks7.5CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-27657Gitea email settings allow changing another user's primary email address7.5CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-26355Dell PowerProtect Data Domain OS command injection6.5CNA v3.11.8%2026-07-03Fix
CVE-2026-26307Gitea git grep search lacks a timeout7.5CISA ADP v3.10.6%2026-07-03Fix
CVE-2026-26292Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions9.8CISA ADP v3.10.7%2026-07-03Fix
CVE-2026-26247Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange9.1CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-26232Gitea OAuth2 authorization codes lack expiry and reuse enforcement9.1CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-26231Gitea maintainer-edit permissions allow unauthorized commits to readable repositories8.5CNA v3.10.4%2026-07-03Fix
CVE-2026-25782Gitea tracked-time deletion can target entries from another issue5.3CISA ADP v3.10.4%2026-07-03Fix
CVE-2026-25779Gitea redirect handling permits open redirects through backslash paths6.1CISA ADP v3.10.3%2026-07-03Fix
CVE-2026-25718Gitea template repository generation mishandles symlinked paths9.1CISA ADP v3.10.6%2026-07-03Fix
CVE-2026-25714Gitea user organization API bypasses public-only token filtering4.3CNA v3.10.3%2026-07-03Fix
CVE-2026-25712Gitea organization permission APIs expose private visibility information7.5CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-25038Gitea private organization labels are visible to unauthorized users7.5CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-24690Gitea pull-request branch updates use insufficient permission checks7.5CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-24451Gitea fork synchronization can expose private parent repository data7.5CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-22874Gitea webhook and migration allow-list filtering permits SSRF9.6CNA v3.10.5%2026-07-03Fix
CVE-2026-22555Gitea organization forks can expose organization secrets without create permission8.1CNA v3.10.4%2026-07-03Fix
CVE-2026-22547Gitea repository creation accepts invalid field values9.1CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-20909Gitea tracked-time list endpoint has insufficient permission checks5.3CISA ADP v3.10.3%2026-07-03Fix
CVE-2026-20896Gitea Docker image trusts spoofable reverse-proxy headers by default9.8CNA v3.12.8%2026-07-03NucleiEmerging ThreatsExploit codeFix
CVE-2026-20779Gitea TOTP single-use enforcement defect allows OTP replay7.1CNA v3.10.5%2026-07-03Fix
CVE-2026-20706Gitea repository archive downloads bypass token scope checks9.1CISA ADP v3.10.6%2026-07-03Fix
CVE-2026-14631webpack-dev-server vulnerable to denial of service via a malformed host or Origin header5.3CNA v3.10.5%2026-07-03Fix
CVE-2026-14620webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints4.7CNA v3.10.5%2026-07-03Exploit codeFix
CVE-2026-14617NousResearch hermes-agent streaming reasoning tag filter case sensitivity bypass2.3CNA v4.00.4%2026-07-03
CVE-2026-14615Red Hat Keycloak child group listing information disclosure4.3CNA v3.10.4%2026-07-03Fix
CVE-2026-14614Red Hat Keycloak client scope assignment insecure direct object reference5.4CNA v3.10.3%2026-07-03Fix
CVE-2026-14613Red Hat Keycloak role group listing vulnerability4.3CNA v3.10.4%2026-07-03Fix
CVE-2026-14612Red Hat Enterprise Linux 10 Two off-by-one error4.2CNA v3.10.2%2026-07-03
CVE-2026-14611DeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resource5.3CNA v4.00.4%2026-07-03
CVE-2026-14610Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow4.8CNA v4.00.1%2026-07-03Fix
CVE-2026-14609SourceCodester CET Automated Grading System with AI Predictive Analytics session fixiation6.3CNA v4.00.4%2026-07-03
CVE-2026-14608SourceCodester CET Automated Grading System student records improper authorization5.3CNA v4.00.4%2026-07-03
CVE-2026-14607RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption6.8CNA v4.00.2%2026-07-03
CVE-2026-14606RT-Thread SWM341 CAN SWM341.h CAN_Receive stack-based overflow8.5CNA v4.00.2%2026-07-03
CVE-2026-14605RT-Thread ls1c CAN ls1c_can.h recvmsg stack-based overflow8.5CNA v4.00.2%2026-07-03
CVE-2026-14604Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free5.3CNA v4.00.2%2026-07-03
CVE-2026-14544HPLIP hpcups processing path integer overflow9.8CNA v3.11.2%2026-07-03Fix
CVE-2026-14460Missing authorization in TUBITAK BILGEM's pardus-software8.8CNA v3.10.2%2026-07-03Fix
CVE-2026-14459Argument injection in TUBITAK BILGEM's pardus-software8.8CNA v3.10.2%2026-07-03Exploit codeFix
CVE-2026-14355PHP ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD5.6CNA v3.10.3%2026-07-03Fix
CVE-2026-14352AR for WooCommerce WordPress plugin unauthenticated path traversal to arbitrary file read7.5CNA v3.10.7%2026-07-03Fix
CVE-2026-14327AR for WordPress plugin unauthenticated arbitrary file read via file parameter7.5CNA v3.10.6%2026-07-03Fix
CVE-2026-13768Gardyn IoT Hub use of hard-coded credentials9.5CNA v4.00.7%2026-07-03Exploit codeFix
CVE-2026-13341KongHQ mcp-konnect prompt injection and credential exposure7.4CNA v3.10.4%2026-07-03Fix
CVE-2026-13040NEX-Forms WordPress plugin unauthenticated stored cross-site scripting via real_val__ parameter7.2CNA v3.10.5%2026-07-03Fix
CVE-2026-12960ASUS Router app improper export of Android application components6.0CNA v4.00.2%2026-07-03Exploit code
CVE-2026-12920Cookie Banner for GDPR / CCPA WordPress plugin SQL injection4.9CNA v3.10.5%2026-07-03Fix
CVE-2026-12734weDocs: AI Powered Knowledge Base WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-03Fix
CVE-2026-12731weDocs: AI Powered Knowledge Base WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-03Fix
CVE-2026-12729weDocs: AI Powered Knowledge Base WordPress plugin missing authorization4.3CNA v3.10.4%2026-07-03Fix
CVE-2026-12557Ninja Forms WordPress plugin authorization bypass5.3CNA v3.10.4%2026-07-03Fix
CVE-2026-12481Deserialization of untrusted data in keras-team/Keras9.8v3.10.7%2026-07-03Fix
CVE-2026-12064curl proto-default skips SSH verification7.5CISA ADP v3.10.4%2026-07-03Fix
CVE-2026-11900Ad Inserter WordPress plugin insecure direct object reference4.3CNA v3.10.5%2026-07-03Fix
CVE-2026-11856curl cross-origin Digest auth state leak9.8CISA ADP v3.10.7%2026-07-03Fix
CVE-2026-11778CURCY WordPress plugin unauthenticated arbitrary shortcode execution via exchange parameter5.4CNA v3.10.4%2026-07-03Fix
CVE-2026-11586curl WS Auto-PONG memory exhaustion7.5CISA ADP v3.10.6%2026-07-03Fix
CVE-2026-11564curl native CA trust persist9.1CISA ADP v3.10.4%2026-07-03Fix
CVE-2026-11398LatePoint WordPress plugin authorization bypass5.3CNA v3.10.6%2026-07-03Fix
CVE-2026-11397WP Import Export Lite WordPress plugin server-side request forgery5.5CNA v3.10.4%2026-07-03Fix
CVE-2026-11352curl QUIC zero-length UDP datagrams busy-loop7.5CISA ADP v3.10.7%2026-07-03Fix
CVE-2026-10536curl HTTP/2 stream-dependency tree UAF9.8CISA ADP v3.10.6%2026-07-03Fix
CVE-2026-10055Eclipse Theia server-side request forgery8.5CNA v3.10.4%2026-07-03Fix
CVE-2026-10054Eclipse Theia missing authentication8.8CNA v3.10.2%2026-07-03Fix
CVE-2026-9756GenerateBlocks WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-03Fix
CVE-2026-9725Printcart Web to Print Product Designer for WooCommerce WordPress plugin arbitrary file deletion9.1CNA v3.11.2%2026-07-03Fix
CVE-2026-9626JSON API User WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-03Fix
CVE-2026-9547curl SSH improper host validation7.4CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-9546curl sending old referer7.5CISA ADP v3.10.7%2026-07-03Fix
CVE-2026-9545curl exposing HTTP/3 early data7.5CISA ADP v3.10.4%2026-07-03Fix
CVE-2026-9230Quiz and Survey Master (QSM) WordPress plugin authorization bypass4.3CNA v3.10.5%2026-07-03Fix
CVE-2026-9180MotoPress Appointment Booking WordPress plugin insecure direct object reference5.3CNA v3.10.6%2026-07-03Fix
CVE-2026-9148Comments WordPress plugin unauthenticated stored cross-site scripting via Website field7.2CNA v3.10.5%2026-07-03Fix
CVE-2026-9080curl UAF after pause in socket callback7.3CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-9079curl stale proxy password leak9.8CISA ADP v3.10.6%2026-07-03Fix
CVE-2026-8932curl incomplete mTLS config matching in conn reuse7.5CISA ADP v3.10.4%2026-07-03Exploit codeFix
CVE-2026-8927curl env-set cross-proxy Digest auth state leak9.1CISA ADP v3.10.5%2026-07-03Fix
CVE-2026-8926curl password leak with netrc and user in URL9.1CISA ADP v3.10.4%2026-07-03Fix
CVE-2026-8925curl SASL double free9.8CISA ADP v3.11.1%2026-07-03Fix
CVE-2026-8924curl trailing dot domain super cookie9.1CISA ADP v3.10.7%2026-07-03Fix
CVE-2026-8921ASUS Business Manager external control of a file path8.5CNA v4.00.2%2026-07-03
CVE-2026-8892CM Business Directory WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-07-03Fix
CVE-2026-8804Cleartext storage of sensitive information for Puppet Resource API6.7CNA v4.00.1%2026-07-03Fix
CVE-2026-8489Ultimate Member WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-03Fix
CVE-2026-8458curl wrong reuse for different services6.5CISA ADP v3.10.4%2026-07-03Fix
CVE-2026-8351RTMKit WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-07-03Fix
CVE-2026-8286curl wrong STARTTLS connection reuse8.1CISA ADP v3.10.3%2026-07-03Fix
CVE-2026-5137RTMKit WordPress plugin limited local file inclusion4.3CNA v3.10.4%2026-07-03Fix
CVE-2026-4967UNISOC chipsets IMS out-of-bounds read7.5CNA v3.10.7%2026-07-03Fix
CVE-2026-4804Zakra WordPress theme stored cross-site scripting6.4CNA v3.10.3%2026-07-03Fix
CVE-2026-4322XSS in Raera's Destekz6.1CNA v3.10.3%2026-07-03
CVE-2026-4321SQLi in Raera's Destekz9.8CNA v3.10.5%2026-07-03
CVE-2026-59102Forgejo stored XSS via Actions Run Full Name Rendering2.1CNA v4.00.3%2026-07-02Fix
CVE-2026-59101EstrellaXD Auto_Bangumi AutoBangumi SSRF via /API/v1/setup/test-downloader6.9CNA v4.00.5%2026-07-02Fix
CVE-2026-59100lobehub LobeChat Broken Object Level Authorization via Chat-Group Agent Operations2.3CNA v4.00.3%2026-07-02
CVE-2026-59099Apereo CAS AES-GCM nonce reuse information disclosure9.3CNA v4.00.5%2026-07-02Fix
CVE-2026-59098lobehub LobeChat Cross-User Document Disclosure via Unscoped RAG Semantic Search7.1CNA v4.00.4%2026-07-02
CVE-2026-59097Taiga Unauthorized Due-Date Creation via API Viewsets6.9CNA v4.00.5%2026-07-02Fix
CVE-2026-59096Dapr OIDC Discovery Issuer and JWKS URI injection via Unvalidated X-Forwarded-Host8.2CNA v4.00.3%2026-07-02
CVE-2026-59095lobehub LobeChat SSRF via importFromUrl and fetchImageFromUrl8.3CNA v4.00.4%2026-07-02Fix
CVE-2026-59094Pathway unauthenticated denial of service via Exponential Glob Pattern Matching in Document Store8.7CNA v4.00.8%2026-07-02
CVE-2026-59093Weaviate privilege escalation via Unchecked Permissions in RBAC Role Assignment8.7CNA v4.00.7%2026-07-02Fix
CVE-2026-59092JuiceFS authentication bypass via pprof and metrics endpoints9.8v3.10.7%2026-07-02
CVE-2026-58653PraisonAI authorization bypass via Unvalidated project_id in issue Create/Update5.3CNA v4.00.3%2026-07-02Fix
CVE-2026-58652luci-app-travelmate arbitrary command execution via UCI script parameter7.7CNA v4.00.8%2026-07-02
CVE-2026-58580lobehub LobeChat Broken Object-Level Authorization in Message Sub-Resource Writes6.0CNA v4.00.3%2026-07-02
CVE-2026-58579RAGFlow stored cross-site scripting via Agent Pipeline Node Name5.1CNA v4.00.3%2026-07-02Fix
CVE-2026-58578lobehub LobeChat regular expression denial of service in GitHub Skill Import7.1CNA v4.00.5%2026-07-02Fix
CVE-2026-58467Cockpit CMS path traversal local file inclusion via index.php8.2CNA v4.01.7%2026-07-02Nuclei
CVE-2026-58466EstrellaXD Auto_Bangumi AutoBangumi Hard-coded default credentials via add_default_user9.3CNA v4.00.8%2026-07-02Fix
CVE-2026-58465Eclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocation DoS8.7CNA v4.00.9%2026-07-02Fix
CVE-2026-58460react-native-receive-sharing-intent path traversal via _display_name7.0CNA v4.00.2%2026-07-02
CVE-2026-58455Dockwatch Unauthenticated OS command injection via ajax/compose.php9.2CNA v4.08.0%2026-07-02NucleiEmerging ThreatsExploit code
CVE-2026-58381Gimp: Gimp: Double free in read_layer_block7.3NVD v3.10.3%2026-07-02Fix
CVE-2026-57766WPIDE File Manager and Code Editor WordPress plugin cross-site request forgery (CSRF)8.8CNA v3.10.2%2026-07-02Fix
CVE-2026-57765WP EasyCart WordPress plugin SQL injection8.5CNA v3.10.4%2026-07-02Fix
CVE-2026-57764Surbma Yoast SEO Breadcrumb Shortcode WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-07-02
CVE-2026-57763Structured Content WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-07-02
CVE-2026-57762Simple URLs WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2026-07-02Fix
CVE-2026-57761SEOWP WordPress theme CSRF to stored XSS7.1CNA v3.10.1%2026-07-02
CVE-2026-57760Sendcloud Shipping WordPress plugin broken access control5.3CNA v3.10.3%2026-07-02Fix
CVE-2026-57759ProfileGrid WordPress plugin cross-site request forgery (CSRF)8.8CNA v3.10.2%2026-07-02Fix
CVE-2026-57758Permalink Manager for WooCommerce WordPress plugin CSRF to stored XSS7.1CNA v3.10.1%2026-07-02Fix
CVE-2026-57757pCloud WP Backup WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.2%2026-07-02Fix
CVE-2026-57756nicen-localize-image WordPress plugin SQL injection8.5CNA v3.10.4%2026-07-02
CVE-2026-57755Mosaic Gallery Advanced Gallery WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-07-02
CVE-2026-57754Livemesh Addons for WPBakery Page Builder WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-07-02
CVE-2026-57753Kit (formerly ConvertKit) for WooCommerce WordPress plugin sensitive data exposure5.3CNA v3.10.3%2026-07-02Fix
CVE-2026-57752iNET Webkit WordPress plugin SQL injection8.5CNA v3.10.4%2026-07-02
CVE-2026-57751Heateor Social Login WordPress plugin cross-site request forgery (CSRF)8.1CNA v3.10.2%2026-07-02
CVE-2026-57750ez Form Calculator Premium WordPress plugin broken access control5.3CNA v3.10.3%2026-07-02
CVE-2026-57749SportsPress Pro WordPress plugin local file inclusion7.5CNA v3.10.4%2026-07-02
CVE-2026-57748Shopify WordPress plugin local file inclusion7.5CNA v3.10.4%2026-07-02
CVE-2026-57747Booked WordPress plugin cross-site request forgery (CSRF)6.5CNA v3.10.2%2026-07-02
CVE-2026-57746Booked WordPress plugin broken access control7.1CNA v3.10.3%2026-07-02
CVE-2026-57731Flatsome WordPress theme broken access control6.5CNA v3.10.3%2026-07-02
CVE-2026-57730Flatsome WordPress theme broken access control4.3CNA v3.10.3%2026-07-02
CVE-2026-57690Werkstatt WordPress theme cross-site request forgery (CSRF)4.3CNA v3.10.1%2026-07-02
CVE-2026-57689Werkstatt WordPress theme broken access control4.3CNA v3.10.3%2026-07-02
CVE-2026-57688POS Entegratör WordPress plugin broken access control8.2CNA v3.10.4%2026-07-02Fix
CVE-2026-57687Custom Field Template WordPress plugin SQL injection8.5CNA v3.10.4%2026-07-02Fix
CVE-2026-57686WowAddons WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57685Martfury - WooCommerce Marketplace WordPress theme broken access control4.3CNA v3.10.3%2026-07-02
CVE-2026-57684TheFox WordPress theme cross-site scripting (XSS)6.5CNA v3.10.2%2026-07-02
CVE-2026-57683WP Fast Total Search WordPress plugin SQL injection9.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57682Simple Link Directory WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57681GeoDirectory WordPress plugin server side request forgery (SSRF)6.4CNA v3.10.2%2026-07-02Fix
CVE-2026-57680Kirki WordPress plugin insecure direct object references (IDOR)6.5CNA v3.10.3%2026-07-02Fix
CVE-2026-57679GeekyBot WordPress plugin SQL injection9.3CNA v3.10.4%2026-07-02Fix
CVE-2026-57678ThemePunch Slider Revolution reflected cross-site scripting7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57677Novalnet Payment Gateway for WooCommerce WordPress plugin PHP object injection9.8CNA v3.10.6%2026-07-02Fix
CVE-2026-57675WP Photo Album Plus WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57674Timetics WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57673Optimole WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57672wpDataTables WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57671perfmatters WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57670Google Maps CP WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57669Advanced Contact form 7 DB WordPress plugin broken access control6.5CNA v3.10.3%2026-07-02Fix
CVE-2026-57625Admin and Site Enhancements (ASE) Pro WordPress plugin cross-site scripting (XSS)9.6CNA v3.10.5%2026-07-02Fix
CVE-2026-57624Blocksy Companion Pro WordPress plugin remote code execution (RCE)10.0CNA v3.10.9%2026-07-02Fix
CVE-2026-57623W3 Total Cache WordPress plugin arbitrary code execution9.0CNA v3.10.5%2026-07-02Emerging ThreatsFix
CVE-2026-57621Booktics WordPress plugin PHP object injection9.8CNA v3.10.6%2026-07-02Fix
CVE-2026-57426Modula - PRO WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57366WPAdverts WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57362ChatBot WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57361Survey Maker WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57360eCommerce Product Catalog WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57359ReviewX WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57358Customize My Account for WooCommerce WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57357Search Atlas SEO WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57356MC Woocommerce Wishlist WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix
CVE-2026-57355Classified Listing WordPress plugin broken access control6.5CNA v3.10.3%2026-07-02Fix
CVE-2026-57354JetReviews WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-07-02Fix
CVE-2026-57353Link Whisper Premium WordPress plugin broken access control6.5CNA v3.10.3%2026-07-02Fix
CVE-2026-57352ALD WordPress plugin Unauthenticated improper authentication4.8CNA v3.10.3%2026-07-02Fix
CVE-2026-57351HandL UTM Grabber WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-07-02Fix