--===============1635925356315796311==
Content-Type: multipart/alternative; boundary="===============7983194463610718321=="
MIME-Version: 1.0

--===============7983194463610718321==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

Cybersecurity and Infrastructure Security Agency (CISA)

You are subscribed to Vulnerability Bulletins for Cybersecurity and Infrast= ructure Security Agency. This information has recently been updated and is = now available.

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities t= hat have been recorded in the past week. In some cases, the vulnerabilities=
in the bulletin may not yet have assigned CVSS scores.

Vulnerabilities are based on the=C2=A0Common Vulnerabilities and Exposures =
[ https://www.cve.org/ ]=C2=A0(CVE) vulnerability naming standard and are o= rganized according to severity, determined by the=C2=A0Common Vulnerability=
Scoring System [ https://www.cve.org/about/relatedefforts ]=C2=A0(CVSS) st= andard. The division of high, medium, and low severities correspond to the = following scores:


* *High*: vulnerabilities with a CVSS base score of 7.0=E2=80=9310.0=20
* *Medium*: vulnerabilities with a CVSS base score of 4.0=E2=80=936.9=20
* *Low*: vulnerabilities with a CVSS base score of 0.0=E2=80=933.9=20

Entries may include additional information provided by organizations and ef= forts sponsored by CISA. This information may include identifying informati= on, values, definitions, and related links. Patch information is provided w= hen available. Please note that some of the information in the bulletin is = compiled from external, open-source reports and is not a direct result of C= ISA analysis.

=C2=A0

Vulnerability Summary for the Week of June 29, 2026 [ https://www.cisa.gov/= news-events/bulletins/sb26-187 ] 07/06/2026 11:00 AM EDT=20

High Vulnerabilities

Primary
Vendor -- Product Description Published CVSS Score Source Info @fastify/exp= ress--@fastify/express @fastify/express versions 4.0.6 and earlier only rew= rite the plugin prefix for middleware mount paths when the path argument is=
a string. Non-string mount paths (arrays of paths and regular expressions)=
are left unprefixed inside prefixed plugin scopes, so middleware registere=
d with those forms does not match the actual prefixed request path. Applica= tions that use path-scoped middleware for authentication, authorization, ra=
te limiting, or auditing on routes inside a prefixed scope can be bypassed =
by sending a request to the prefixed route, because Fastify still matches t=
he route but the middleware is skipped. Patches: upgrade to @fastify/expres=
s 4.0.7. Workarounds: use string mount paths instead of arrays or regular e= xpressions in prefixed plugins, or register one use call per path. 2026-06-=
30 9.1 CVE-2026-6556 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6556 ] @= fastify/middie--@fastify/middie @fastify/middie versions 9.1.0 through 9.3.=
2 decode the encoded slash %2F inside path parameter values before matching=
middleware paths, while Fastify's underlying router preserves the encoding=
during route lookup. The two layers disagree on the canonical request path=
, so the middleware fails to match a URL that the route handler does match.=
When middleware is used for authentication, authorization, rate limiting, =
or auditing on parameterized paths, an attacker can reach the protected han= dler by sending a single crafted URL with an encoded slash in the parameter=
position. The bypass is HTTP method agnostic and requires no authenticatio=
n or special preconditions. Patches: upgrade to @fastify/middie 9.3.3. Work= arounds: avoid parameterized middleware paths for security decisions, or en= force authentication at the route handler or via a Fastify hook that runs a= fter the router has resolved the request. 2026-07-01 9.1 CVE-2026-14198 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-14198 ] @fastify/middie--@fastif= y/middie @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL=
normalization step used by the standalone engine when incoming request pat=
hs contain malformed percent-encoded sequences. Inputs such as an incomplet=
e percent escape or a truncated multibyte sequence cause the underlying dec= oder to throw synchronously, and the exception escapes the middie normalize=
step and terminates the Node.js process. The bypass affects applications t= hat call middie.run directly on the standalone engine API, causing an immed= iate denial of service for all connected clients until restart. Application=
s using the Fastify plugin path are not affected because Fastifys error han= dler catches the exception. Patches: upgrade to @fastify/middie 9.3.3. Work= arounds: migrate from the standalone engine API to the Fastify plugin path,=
where the framework error handler catches the exception. 2026-07-01 7.5 CV= E-2026-14181 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14181 ] a--nicen= -localize-image Contributor SQL Injection in nicen-localize-image <=3D 1.4.=
9 versions. 2026-07-02 8.5 CVE-2026-57756 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-57756 ] acl project--acl acl before version 2.4.0 contains a s= ymlink traversal vulnerability in the libacl pathname-based functions acl_g= et_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() t= hat allows local attackers to escalate privileges by replacing any pathname=
component with a symbolic link. Attackers who control any component of a p= athname processed by a privileged caller can redirect ACL read or write ope= rations to arbitrary files or directories, enabling unauthorized manipulati=
on of access control lists and local privilege escalation. 2026-06-29 7.1 C= VE-2026-54369 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54369 ] Adobe--= Adobe Campaign Classic (ACC) Adobe Campaign Classic (ACC) versions 7.4.3 bu= ild 9396 and earlier are affected by an Incorrect Authorization vulnerabili=
ty that could result in arbitrary code execution in the context of the curr= ent user. Exploitation of this issue does not require user interaction. Sco=
pe is changed. 2026-06-30 10 CVE-2026-48286 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-48286 ] Adobe--ColdFusion ColdFusion versions 2025.9, 2023.2=
0 and earlier are affected by an Unrestricted Upload of File with Dangerous=
Type vulnerability that could result in arbitrary code execution in the co= ntext of the current user. Exploitation of this issue does not require user=
interaction. Scope is changed. 2026-06-30 10 CVE-2026-48276 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-48276 ] Adobe--ColdFusion ColdFusion versio=
ns 2025.9, 2023.20 and earlier are affected by an Improper Input Validation=
vulnerability that could result in arbitrary code execution in the context=
of the current user. Exploitation of this issue does not require user inte= raction. Scope is changed. 2026-06-30 10 CVE-2026-48277 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-48277 ] Adobe--ColdFusion ColdFusion versions 20= 25.9, 2023.20 and earlier are affected by an Improper Input Validation vuln= erability that could result in arbitrary code execution in the context of t=
he current user. Exploitation of this issue does not require user interacti= on. Scope is changed. 2026-06-30 10 CVE-2026-48281 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-48281 ] Adobe--ColdFusion ColdFusion versions 2025.9,=
2023.20 and earlier are affected by an Improper Limitation of a Pathname t=
o a Restricted Directory ('Path Traversal') vulnerability that could lead t=
o arbitrary code execution in the context of the current user. Exploitation=
of this issue does not require user interaction. Scope is changed. 2026-06= -30 10 CVE-2026-48282 [ https://www.cve.org/CVERecord?id=3DCVE-2026-48282 ]=
Adobe--ColdFusion ColdFusion versions 2025.9, 2023.20 and earlier are affe= cted by an Unrestricted Upload of File with Dangerous Type vulnerability th=
at could result in arbitrary code execution in the context of the current u= ser. Exploitation of this issue does not require user interaction. Scope is=
changed. 2026-06-30 10 CVE-2026-48283 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-48283 ] Adobe--ColdFusion ColdFusion versions 2025.9, 2023.20 a=
nd earlier are affected by an Improper Limitation of a Pathname to a Restri= cted Directory ('Path Traversal') vulnerability that could lead to arbitrar=
y file system read and limited write access. An attacker could exploit this=
vulnerability to access sensitive files and directories outside the intend=
ed access scope. Exploitation of this issue does not require user interacti= on. Scope is changed. 2026-06-30 9.3 CVE-2026-48313 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-48313 ] Adobe--ColdFusion ColdFusion versions 2025.9=
, 2023.20 and earlier are affected by an Improper Input Validation vulnerab= ility that could result in arbitrary code execution in the context of the c= urrent user. An attacker could exploit this vulnerability to inject malicio=
us scripts into a web page, potentially gaining elevated access or control = over the victim's account or session. Exploitation of this issue requires u= ser interaction in that a victim must open a malicious file. Scope is chang= ed. 2026-06-30 9.3 CVE-2026-48315 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-48315 ] Adobe--ColdFusion ColdFusion versions 2025.9, 2023.20 and earl= ier are affected by a Server-Side Request Forgery (SSRF) vulnerability that=
could result in a Security feature bypass. An attacker could leverage this=
vulnerability to bypass security measures and gain unauthorized read acces=
s. Exploitation of this issue does not require user interaction. Scope is c= hanged. 2026-06-30 8.6 CVE-2026-48285 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-48285 ] Adobe--ColdFusion ColdFusion versions 2025.9, 2023.20 and = earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerabilit=
y. An attacker could exploit this vulnerability to inject malicious scripts=
into a web page, potentially resulting in arbitrary code execution in the = context of the current user. Exploitation of this issue requires user inter= action in that a victim must open a malicious link. Scope is changed. 2026-= 06-30 8.8 CVE-2026-48307 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4830=
7 ] advancedcoding--Comments wpDiscuz The Comments - wpDiscuz plugin for Wo= rdPress is vulnerable to Stored Cross-Site Scripting via the guest commente=
r 'Website' field in versions up to, and including, 7.6.56 This is due to i= nsufficient output escaping in the getCommentAuthor() function, which inter= polates the stored comment_author_url value directly into single-quoted HTM=
L attributes without applying esc_url() or esc_attr(). This makes it possib=
le for unauthenticated attackers to inject arbitrary web scripts in pages t= hat will execute whenever a user accesses an injected page. 2026-07-03 7.2 = CVE-2026-9148 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9148 ] Advantec= h--Hospital Quering Management Hospital Queuing Management developed by Adv= antech has a Sensitive Data Exposure vulnerability, allowing unauthenticate=
d remote attackers to access a specific URL to obtain API documentation. 20= 26-06-30 9.8 CVE-2026-14162 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 4162 ] Advantech--Hospital Queuing Management Hospital Quening Management d= eveloped by Advantech has a Sensitive Data Exposure vulnerability, allowing=
unauthenticated remote attackers to access a specific URL to obtain API do= cumentation. 2026-06-30 7.5 CVE-2026-14161 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-14161 ] Ahmadgb--GeekyBot Unauthenticated SQL Injection in Ge= ekyBot <=3D 1.2.5 versions. 2026-07-02 9.3 CVE-2026-57679 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-57679 ] ajith-ab--react-native-receive-sharing= -intent react-native-receive-sharing-intent contains a path traversal vulne= rability that allows a co-resident malicious application to write files out= side the intended cache directory by supplying a crafted _display_name valu=
e containing dot-dot path components through a malicious ContentProvider. A= ttackers can fire an explicit ACTION_SEND intent at the consuming app's exp= orted share-receiver activity to overwrite arbitrary files in the consuming=
app's private data directory, including databases, shared preferences, and=
cached configuration, with attacker-controlled content. 2026-07-02 7.7 CVE= -2026-58460 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58460 ] AncoraThe= mes--Lighthouse Unauthenticated Local File Inclusion in Lighthouse <=3D 1.2= .12 versions. 2026-07-02 8.1 CVE-2025-58902 [ https://www.cve.org/CVERecord= ?id=3DCVE-2025-58902 ] Andy Fragen--WP Debugging Unauthenticated Cross Site=
Scripting (XSS) in WP Debugging <=3D 2.12.2 versions. 2026-07-02 7.1 CVE-2= 026-57350 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57350 ] Anyscale, I= nc--Ray Ray prior to 2.56.0 contains an unsafe deserialization vulnerabilit=
y in the WebDataset reader that allows attackers to achieve remote code exe= cution by supplying a malicious tar archive to the read_webdataset() functi= on. The _default_decoder() function in webdataset_datasource.py uncondition= ally calls pickle.loads() on tar entries with .pkl/.pickle extensions and t= orch.load() with weights_only=3DFalse on .pt/.pth entries, executing arbitr= ary code inside Ray remote workers on every worker that processes the malic= ious archive. 2026-07-01 8.8 CVE-2026-57516 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-57516 ] apereo--cas Apereo CAS 7.3.0 before 8.0.0-RC6 contai=
ns a cryptographic vulnerability that allows remote unauthenticated attacke=
rs to recover plaintext conversation state by exploiting AES-GCM initializa= tion vector reuse across the server lifetime. Attackers can collect multipl=
e client-side webflow execution tokens from the unauthenticated login page = and perform known-plaintext analysis to decrypt the webflow conversation st= ate due to keystream reuse caused by a fixed all-zero IV paired with the sa=
me encryption key. 2026-07-02 9.1 CVE-2026-59099 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-59099 ] Arraytics--Booktics Unauthenticated PHP Object = Injection in Booktics <=3D 1.0.21 versions. 2026-07-02 9.8 CVE-2026-57621 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-57621 ] Arraytics--Timetics Un= authenticated Cross Site Scripting (XSS) in Timetics <=3D 1.0.58 versions. = 2026-07-02 7.1 CVE-2026-57674 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -57674 ] ASE--Admin and Site Enhancements (ASE) Pro Unauthenticated Cross S= ite Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <=3D 8.8.5 ver= sions. 2026-07-02 9.6 CVE-2026-57625 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-57625 ] Astoundify--Jobify Unauthenticated Cross Site Scripting (XS=
S) in Jobify <=3D 4.3.2 versions. 2026-06-29 7.1 CVE-2026-57336 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-57336 ] attr project--attr attr before v= ersion 2.6.0 contains a symlink traversal vulnerability in the getfattr and=
setfattr utilities that allows local attackers to escalate privileges by r= eplacing a pathname component with a symbolic link during directory hierarc=
hy traversal. Attackers who control a pathname component can redirect getfa= ttr and setfattr operations to arbitrary files by substituting a symlink, l= eading to local privilege escalation when getfattr or setfattr is invoked b=
y a privileged process over an attacker-controlled path. 2026-06-29 7.1 CVE= -2026-54371 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54371 ] AWS--Amaz=
on CloudFront Inconsistent interpretation of HTTP/2 requests in Amazon Clou= dFront with AWS WAF enabled might allow remote actors to bypass AWS WAF man= aged rule body inspection via crafted HTTP/2 requests that fragment the req= uest body across frames so that only a partial body is inspected. This issu=
e was remediated server-side. No customer action is required. 2026-06-29 9.=
8 CVE-2026-13762 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13762 ] AWS-= -AWS Advanced JDBC Wrapper Deserialization of untrusted data in the RemoteQ= ueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 thro= ugh 4.0.0 might allow an actor with write access to the shared cache infras= tructure to execute arbitrary code on application servers that read cached = query results via a crafted serialized Java object. The RemoteQueryCachePlu= gin uses ObjectInputStream without class filtering when deserializing cache=
d query results from Redis or Valkey, enabling gadget chain execution when = cache entries are poisoned. We recommend upgrading to AWS Advanced JDBC Wra= pper version 4.0.1 or later. 2026-07-01 7.5 CVE-2026-14265 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-14265 ] AWS--AWS Application Load Balancer In= consistent interpretation of HTTP/2 requests in AWS Application Load Balanc=
er with AWS WAF enabled might allow remote actors to bypass AWS WAF managed=
rule body inspection via crafted HTTP/2 requests that fragment the request=
body across frames so that only a partial body is inspected. This issue on=
ly impacts HTTP/2 ALB target groups. To remediate this issue, customers sho= uld enable the "Inspect after sufficient data" target group configuration a= ssociated to an ALB load balancer. Refer to: ( https://docs.aws.amazon.com/= elasticloadbalancing/latest/application/edit-target-group-attributes.html#w= af-http2-inspection ) 2026-06-29 9.8 CVE-2026-13763 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-13763 ] AWS--AWS CDK OS command injection in the Nod= ejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib =
on all platforms might allow a actor who controls dependency version string=
s in a project's package.json file to execute arbitrary commands on the hos=
t running the CDK toolchain via injected shell metacharacters in the OsComm= and helper. This issue requires the actor to control the content of a packa= ge.json dependency version string that is processed during Docker-based bun= dling with nodeModules specified. To remediate this issue, users should upg= rade to=C2=A0v2.260.0. 2026-07-01 7.3 CVE-2026-13760 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-13760 ] Ays Pro--Survey Maker Unauthenticated Cross=
Site Scripting (XSS) in Survey Maker <=3D 5.2.2.5 versions. 2026-07-02 7.1=
CVE-2026-57361 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57361 ] BeRoc= ket--Permalink Manager for WooCommerce Unauthenticated Cross Site Request F= orgery (CSRF) in Permalink Manager for WooCommerce <=3D 1.0.8.2 versions. 2= 026-07-02 7.1 CVE-2026-57758 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 57758 ] BlueAstralThemes--SEOWP Unauthenticated Cross Site Request Forgery = (CSRF) in SEOWP <=3D 3.12.2 versions. 2026-07-02 7.1 CVE-2026-57761 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-57761 ] BMC--Control-M/Enterprise Ma= nager Messaging consumer functionality allows deserialization of user-contr= olled data without sufficient restriction of allowed object types in the ou=
t of support Control-M/Server and Control-M/Enterprise Manager versions 9.0= .20.x and potentially earlier. This issue may allow an authenticated attack=
er to trigger unintended server-side behavior through crafted serialized co= ntent. 2026-07-01 8 CVE-2026-10538 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-10538 ] BMC--Control-M/Server A Control-M/Server communication comman=
d does not sufficiently filter or sanitize user-supplied input. Under certa=
in conditions, this issue may allow an unauthenticated attacker to execute = unauthorized commands on the affected server, potentially leading to compro= mise of the server.=C2=A0 This vulnerability affects Control-M/Server versi= ons 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported v= ersions. 2026-07-01 9 CVE-2026-10539 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-10539 ] BoldGrid--W3 Total Cache Unauthenticated Arbitrary Code Exe= cution in W3 Total Cache <=3D 2.9.4 versions. 2026-07-02 9 CVE-2026-57623 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-57623 ] Capgo--Capgo Capgo bef= ore 12.128.2 contains a broken object level authorization vulnerability in = middlewareKey() that accepts the client-controlled x-limited-key-id header = without validating ownership, allowing authenticated users to adopt cross-t= enant limited keys. Attackers can supply another tenant's limited key ID to=
bypass authorization checks and access unauthorized cross-tenant resources=
across multiple API endpoints. 2026-06-30 8.8 CVE-2026-56230 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-56230 ] Capgo--Capgo Capgo before 12.128.2=
contains a path traversal vulnerability in the builder upload proxy that a= llows authenticated users with build permissions to bypass upload restricti= ons. Attackers can append traversal sequences to the upload path, which are=
normalized by the WHATWG URL parser, enabling access to internal administr= ative endpoints with the privileged BUILDER_API_KEY header and resulting in=
server-side privilege escalation. 2026-06-30 8.3 CVE-2026-56233 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-56233 ] Capgo--Capgo Capgo before 12.12= 8.2 allows org admins to assign org-scoped RBAC roles at app scope without = validating role scope compatibility, including to pending invitees. Attacke=
rs can pre-seed malformed high-privilege bindings that survive invite accep= tance, enabling accepted low-privilege users to perform unauthorized privil= eged app actions. 2026-06-30 8.8 CVE-2026-56247 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-56247 ] Capgo--Capgo Capgo before 12.128.2 contains an a= uthentication bypass vulnerability in the account deletion endpoint that al= lows deletion without password re-authentication or secondary verification.=
Attackers can delete user accounts via session hijacking, CSRF attacks, or=
parameter tampering, resulting in unauthorized account deletion, data loss=
, and denial-of-service. 2026-06-30 8.1 CVE-2026-56286 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-56286 ] Capgo--Capgo Capgo before 12.128.2 contai=
ns a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac = function that allows unauthenticated attackers to retrieve RBAC role bindin=
gs and member email addresses. Attackers can exploit improper NULL comparis=
on in the authorization gate to disclose organization membership, roles, an=
d email addresses via the PostgREST RPC endpoint using only a public API ke=
y. 2026-06-30 7.5 CVE-2026-56219 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-56219 ] Capgo--Capgo Capgo before 12.128.2 contains an authorization by= pass vulnerability in the channel creation endpoint that allows authenticat=
ed users to overwrite existing channels by reusing their names. Attackers w= ith app.create_channel permission can exploit a logic mismatch between exis= tence validation and upsert operations to reassign channel ownership and mo= dify critical production channel configurations. 2026-06-30 7.6 CVE-2026-56= 249 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56249 ] Capgo--Capgo Capg=
o before 12.128.2 contains unauthenticated security definer RPC functions g= et_user_id and get_org_perm_for_apikey that expose API key validity oracles=
and user UUID disclosure. Unauthenticated attackers using the public API k=
ey can validate leaked keys, enumerate users and apps, and determine permis= sion levels, significantly increasing the actionability of compromised cred= entials. 2026-06-30 7.5 CVE-2026-56300 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-56300 ] Capgo--Capgo Capgo before 12.128.2 contains an authoriz= ation flaw in POST /private/create_device that accepts a caller-supplied or= g_id parameter without validating it matches the target app's owner organiz= ation. Authenticated attackers can create device records for an application=
using a foreign organization identifier, bypassing the intended org/app au= thorization boundary. 2026-06-30 7.1 CVE-2026-56320 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-56320 ] ChaN--FatFs In FatFS R0.16 and earlier conta= ins a FAT32 integer overflow bug in mount_volume() where fasize *=3D fs->n_= fats can wrap, leading to attacker-controlled file-size metadata and unsafe=
read lengths in downstream callers. This maps to CWE-190 (Integer Overflow=
or Wraparound). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S= :C/C:H/I:H/A:H (7.6, High). Remote delivery is also possible in OTA/update = pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical=
Impact: Total. 2026-07-01 7.6 CVE-2026-6682 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-6682 ] ChaN--FatFs FatFs R0.16 and earlier contains a stack=
overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is=
trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based=
Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N= /S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitat= ion: PoC, Technical Impact: Total. 2026-07-01 7.6 CVE-2026-6687 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-6687 ] ChaN--FatFs FatFs R0.16 and earli=
er contains a downstream-caller vulnerability pattern associated with FatFs=
long filename handling. With LFN enabled, fno.fname can be up to 255 chara= cters; many callers copy it into short fixed buffers without bounds checks,=
causing overflow. This maps to CWE-120 (Buffer Copy without Checking Size =
of Input). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H= /I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC=
, Technical Impact: Total. 2026-07-01 7.6 CVE-2026-6688 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-6688 ] Chill Media Labs S.R.L.--Modula - PRO Una= uthenticated Cross Site Scripting (XSS) in Modula - PRO <=3D 2.10.8 version=
s. 2026-07-02 7.1 CVE-2026-57426 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-57426 ] Cisco--Cisco Catalyst Center A vulnerability in Cisco Catalyst = Center could allow an unauthenticated, remote attacker to read arbitrary fi= les from a restricted container.&nbsp; This vulnerability is due to insuffi= cient validation of user-supplied input. An attacker could exploit this vul= nerability by sending a crafted HTTP request to an affected device. A succe= ssful exploit could allow the attacker to read arbitrary files from a restr= icted container of the affected device. 2026-07-01 7.5 CVE-2026-20191 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-20191 ] Cisco--Cisco Secure Endpoi=
nt A vulnerability in the PE file format parser of ClamAV could allow an un= authenticated, remote attacker to cause a DoS condition, or possibly other = expanded impacts, resulting from memory corruption on an affected device. T= his vulnerability is due to improper boundary checks for content in PE file=
s during scanning, which may result in an out-of-bounds buffer write. An at= tacker could exploit this vulnerability by submitting a crafted file that c= ontains PE content to be scanned by ClamAV on an affected device. A success= ful exploit could allow the attacker to cause the ClamAV scanning process t=
o terminate, resulting in a DoS condition on the affected software. 2026-07= -01 7.5 CVE-2026-20213 [ https://www.cve.org/CVERecord?id=3DCVE-2026-20213 =
] Cisco--Cisco Secure Endpoint A vulnerability in the FSG file format parse=
r of ClamAV could allow an unauthenticated, remote attacker to cause a DoS = condition, or possibly other expanded impacts, resulting from memory corrup= tion on an affected device. This vulnerability is due to improper boundary = checks for content in FSG files during scanning, which may result in an out= -of-bounds buffer write. An attacker could exploit this vulnerability by su= bmitting a crafted file that contains portable executable content compresse=
d with FSG to be scanned by ClamAV on an affected device. A successful expl= oit could allow the attacker to cause the ClamAV scanning process to termin= ate, resulting in a DoS condition on the affected software. 2026-07-01 7.5 = CVE-2026-20214 [ https://www.cve.org/CVERecord?id=3DCVE-2026-20214 ] Cisco-= -Cisco Secure Endpoint A vulnerability in the 7z file format parser of Clam=
AV could allow an unauthenticated, remote attacker to cause a DoS condition=
, or possibly other expanded impacts, resulting from memory corruption on a=
n affected device. This vulnerability is due to improper boundary checks fo=
r content in 7z files during scanning, which may result in an out-of-bounds=
buffer write. An attacker could exploit this vulnerability by submitting a=
crafted file that contains 7z&nbsp;content to be scanned by ClamAV on an a= ffected device. A successful exploit could allow the attacker to cause the = ClamAV scanning process to terminate, resulting in a DoS condition on the a= ffected software. 2026-07-01 7.5 CVE-2026-20215 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-20215 ] Cisco--Cisco Secure Endpoint A vulnerability in = the InstallShield file format parser of ClamAV could allow an unauthenticat= ed, remote attacker to cause a DoS condition on an affected device. This vu= lnerability is due to improper handling of temporary resources during file = scanning. An attacker could exploit this vulnerability by submitting a craf= ted InstallShield file to be scanned by ClamAV on an affected device. A suc= cessful exploit could allow the attacker to terminate the ClamAV scanning p= rocess and temporarily consume available system resources, resulting in a D=
oS condition on the affected software. 2026-07-01 7.5 CVE-2026-20216 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-20216 ] Cisco--Cisco Secure Endpoin=
t A vulnerability in the PESpin file format parser of ClamAV could allow an=
unauthenticated, remote attacker to cause a DoS condition, or possibly oth=
er expanded impacts, resulting from memory corruption on an affected device=
. This vulnerability is due to improper boundary checks for content in PESp=
in files during scanning, which may result in an out-of-bounds buffer write=
. An attacker could exploit this vulnerability by submitting a crafted file=
that contains PESpin content to be scanned by ClamAV on an affected device=
. A successful exploit could allow the attacker to cause the ClamAV scannin=
g process to terminate, resulting in a DoS condition on the affected softwa= re. 2026-07-01 7.5 CVE-2026-20217 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-20217 ] Cisco--Cisco Secure Endpoint A vulnerability in the ALZ file f= ormat parser of ClamAV could allow an unauthenticated, remote attacker to c= ause a DoS condition, or possibly other expanded impacts, resulting from me= mory corruption on an affected device. This vulnerability is due to imprope=
r boundary checks for content in ALZ files during scanning, which may resul=
t in an out-of-bounds buffer write. An attacker could exploit this vulnerab= ility by submitting a crafted file that contains ALZ content to be scanned =
by ClamAV on an affected device. A successful exploit could allow the attac= ker to cause the ClamAV scanning process to terminate, resulting in a DoS c= ondition on the affected software. 2026-07-01 7.5 CVE-2026-20243 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-20243 ] Cisco--Cisco Secure Endpoint A = vulnerability in the DMG file format parser of ClamAV could allow an unauth= enticated, remote attacker to cause a DoS condition, or possibly other expa= nded impacts, resulting from memory corruption on an affected device. This = vulnerability is due to improper boundary checks for content in DMG files d= uring scanning, which may result in an integer overflow on 32-bit platforms=
only. An attacker could exploit this vulnerability by submitting a crafted=
file that contains DMG content to be scanned by ClamAV on an affected devi= ce. A successful exploit could allow the attacker to cause the ClamAV scann= ing process to terminate, resulting in a DoS condition on the affected soft= ware. 2026-07-01 7.5 CVE-2026-20244 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-20244 ] cmsjunkie--WP-BusinessDirectory Business directory plugin fo=
r WordPress The WP-BusinessDirectory plugin for WordPress is vulnerable to = Unauthenticated Arbitrary File Deletion in versions up to and including 4.0= .1. This is due to insufficient path validation in the remove() method of t=
he JBusinessDirectoryControllerUpload class. The task=3Dupload.remove endpo= int is accessible without authentication via the plugin's frontend routing = system. The _filename parameter is accepted with RAW filter (no sanitizatio= n), and the helper function makePathFile() only normalizes directory separa= tor characters without stripping path traversal sequences (../). When combi= ned with the _path_type=3D2 parameter, which sets the base directory to the=
plugin's site folder, an attacker can supply a _filename value containing = ../ sequences to traverse outside the plugin directory and call PHP's unlin= k() on arbitrary files - including wp-config.php, wp-config-backup.php, or = other critical server files accessible to the web server process. This make=
s it possible for unauthenticated attackers to delete arbitrary files on th=
e server. 2026-07-01 9.1 CVE-2026-6070 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-6070 ] cockpit-project--cockpit Cockpit CMS before release 364 = contains a path traversal and local file inclusion vulnerability that allow=
s unauthenticated attackers to read arbitrary files or execute PHP files by=
including unvalidated PATH_INFO derived from REQUEST_URI in filesystem pat=
h construction without containment checks. Attackers can inject dot-dot seq= uences into the URL to traverse outside the designated spaces directory, an=
d when the resolved path ends with a .php extension, the application passes=
it to include(), enabling local file inclusion on deployments using the PH=
P built-in server or certain non-default Nginx configurations. 2026-07-02 7=
.5 CVE-2026-58467 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58467 ] cod= e-projects--Hotel and Tourism Reservation A flaw has been found in code-pro= jects Hotel and Tourism Reservation 1.0. Affected is an unknown function of=
the file /admin/add_room.php. Executing a manipulation of the argument del= ete_image/edit/description/number/price/rooms/type can lead to sql injectio=
n. The attack can be launched remotely. The exploit has been published and = may be used. 2026-07-05 7.3 CVE-2026-14754 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-14754 ] code-projects--Hotel and Tourism Reservation A vulner= ability has been found in code-projects Hotel and Tourism Reservation 1.0. = Affected by this vulnerability is an unknown functionality of the file /adm= in/reservations.php of the component Reservations Management Page. The mani= pulation of the argument delete leads to sql injection. The attack may be i= nitiated remotely. The exploit has been disclosed to the public and may be = used. 2026-07-05 7.3 CVE-2026-14755 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-14755 ] code-projects--Hotel and Tourism Reservation A vulnerability=
was found in code-projects Hotel and Tourism Reservation 1.0. Affected by = this issue is some unknown functionality of the file /admin/add_tour.php of=
the component Tour Management Page. The manipulation of the argument delet= e_image results in sql injection. The attack may be launched remotely. The = exploit has been made public and could be used. 2026-07-05 7.3 CVE-2026-147=
56 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14756 ] code-projects--Hot=
el and Tourism Reservation A vulnerability was detected in code-projects Ho= tel and Tourism Reservation 1.0. The impacted element is an unknown functio=
n of the file /admin/rooms.php of the component Room Management Page. The m= anipulation of the argument delete results in sql injection. It is possible=
to launch the attack remotely. The exploit is now public and may be used. = 2026-07-05 7.3 CVE-2026-14762 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -14762 ] code-projects--Hotel and Tourism Reservation A flaw has been found=
in code-projects Hotel and Tourism Reservation 1.0. This affects an unknow=
n function of the file /admin/tour_reserves.php of the component Tour Reser= vations Page. This manipulation of the argument tour causes sql injection. = The attack can be initiated remotely. The exploit has been published and ma=
y be used. 2026-07-05 7.3 CVE-2026-14763 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14763 ] code-projects--Hotel and Tourism Reservation A vulnerab= ility has been found in code-projects Hotel and Tourism Reservation 1.0. Th=
is impacts an unknown function of the file /admin/add_event.php of the comp= onent Event Management Page. Such manipulation of the argument fdetails lea=
ds to sql injection. The attack can be launched remotely. The exploit has b= een disclosed to the public and may be used. 2026-07-05 7.3 CVE-2026-14764 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14764 ] code-projects--Intern= ship Management System A security vulnerability has been detected in code-p= rojects Internship Management System 1.0. The impacted element is an unknow=
n function of the file employer/login.php of the component Employer Login E= ndpoint. The manipulation of the argument email/password leads to sql injec= tion. Remote exploitation of the attack is possible. The exploit has been d= isclosed publicly and may be used. 2026-07-05 7.3 CVE-2026-14700 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-14700 ] code-projects--Online Examinati=
on A vulnerability was determined in code-projects Online Examination 1.0. = Affected by this issue is some unknown functionality of the file head.php. = Executing a manipulation of the argument uname/password can lead to sql inj= ection. It is possible to launch the attack remotely. The exploit has been = publicly disclosed and may be utilized. 2026-07-05 7.3 CVE-2026-14705 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-14705 ] code-projects--Online Job = Portal A vulnerability was found in code-projects Online Job Portal 1.0. Th=
e affected element is an unknown function of the file login.php. Performing=
a manipulation of the argument txtUser/txtPass results in sql injection. T=
he attack may be initiated remotely. The exploit has been made public and c= ould be used. 2026-07-04 7.3 CVE-2026-14660 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-14660 ] code-projects--Online Voting System A security vulne= rability has been detected in code-projects Online Voting System up to 0.x/= 1.0. This issue affects the function test_input of the file /authentication= .php of the component Login. Such manipulation of the argument adminUserNam= e/adminPassword leads to sql injection. It is possible to launch the attack=
remotely. The exploit has been disclosed publicly and may be used. 2026-07= -04 7.3 CVE-2026-14648 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14648 =
] code-projects--Online Voting System A vulnerability was detected in code-= projects Online Voting System 1.0. Impacted is the function test_input of t=
he file /saveVote.php. Performing a manipulation of the argument voterName/= voterEmail/voterID/selectedCandidate results in sql injection. The attack c=
an be initiated remotely. 2026-07-04 7.3 CVE-2026-14649 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-14649 ] code-projects--Real State Services A wea= kness has been identified in code-projects Real State Services 1.0. Impacte=
d is an unknown function of the file /single-list_sale.php?action=3Dadd. Ex= ecuting a manipulation of the argument ID can lead to sql injection. The at= tack can be executed remotely. The exploit has been made available to the p= ublic and could be used for attacks. 2026-06-29 7.3 CVE-2026-13559 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-13559 ] code-projects--Real State Ser= vices A vulnerability was identified in code-projects Real State Services 1= .0. The impacted element is an unknown function of the file /normalHomeSale= .php. Such manipulation of the argument loc leads to sql injection. The att= ack may be performed from remote. The exploit is publicly available and mig=
ht be used. 2026-07-05 7.3 CVE-2026-14743 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-14743 ] code-projects--Real State Services A security flaw has=
been discovered in code-projects Real State Services 1.0. This affects an = unknown function of the file /normalHomeRent.php. Performing a manipulation=
of the argument loc results in sql injection. It is possible to initiate t=
he attack remotely. The exploit has been released to the public and may be = used for attacks. 2026-07-05 7.3 CVE-2026-14744 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-14744 ] code-projects--Real State Services A weakness ha=
s been identified in code-projects Real State Services 1.0. This impacts an=
unknown function of the file /single-list_rent.php. Executing a manipulati=
on of the argument ID can lead to sql injection. It is possible to launch t=
he attack remotely. The exploit has been made available to the public and c= ould be used for attacks. 2026-07-05 7.3 CVE-2026-14745 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-14745 ] code-projects--Real State Services A sec= urity vulnerability has been detected in code-projects Real State Services = 1.0. Affected is an unknown function of the file /addprojectrent.php. The m= anipulation of the argument amen leads to sql injection. The attack can be = initiated remotely. The exploit has been disclosed publicly and may be used=
. 2026-07-05 7.3 CVE-2026-14746 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-14746 ] code-projects--Real State Services A vulnerability was detected =
in code-projects Real State Services 1.0. Affected by this vulnerability is=
an unknown functionality of the file /addprojectsale.php. The manipulation=
of the argument amen results in sql injection. The attack can be launched = remotely. 2026-07-05 7.3 CVE-2026-14747 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14747 ] code-projects--Real State Services A weakness has been = identified in code-projects Real State Services 1.0. This vulnerability aff= ects unknown code of the file /builderHome.php. This manipulation of the ar= gument loc causes sql injection. The attack is possible to be carried out r= emotely. The exploit has been made available to the public and could be use=
d for attacks. 2026-07-05 7.3 CVE-2026-14768 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-14768 ] code-projects--Real State Services A security vulne= rability has been detected in code-projects Real State Services 1.0. This i= ssue affects some unknown processing of the file /pay.php. Such manipulatio=
n of the argument Bankname leads to sql injection. The attack may be perfor= med from remote. The exploit has been disclosed publicly and may be used. 2= 026-07-05 7.3 CVE-2026-14769 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 14769 ] code-projects--Smart Parking System A vulnerability has been found =
in code-projects Smart Parking System 1.0. The affected element is an unkno=
wn function of the file /parkings/parkings.php. Such manipulation of the ar= gument street/city/status leads to sql injection. The attack can be execute=
d remotely. The exploit has been disclosed to the public and may be used. 2= 026-07-05 7.3 CVE-2026-14735 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 14735 ] CodeAstro--Apartment Visitor Management System A vulnerability was = found in CodeAstro Apartment Visitor Management System 1.0. Affected is an = unknown function of the file /index.php of the component Login. Performing =
a manipulation of the argument Username results in sql injection. Remote ex= ploitation of the attack is possible. The exploit has been made public and = could be used. 2026-07-04 7.3 CVE-2026-14640 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-14640 ] Codepeople--Google Maps CP Unauthenticated Cross Si=
te Scripting (XSS) in Google Maps CP <=3D 1.2.5 versions. 2026-07-02 7.1 CV= E-2026-57670 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57670 ] CoderPre= ss--NOWPayments for WooCommerce Unauthenticated Broken Access Control in NO= WPayments for WooCommerce <=3D 1.4.0 versions. 2026-07-02 7.5 CVE-2026-3944=
8 [ https://www.cve.org/CVERecord?id=3DCVE-2026-39448 ] conductor-oss--cond= uctor Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated rem= ote code execution vulnerability that allows remote attackers to execute ar= bitrary OS commands by submitting inline workflow definitions containing ma= licious JavaScript or Python expressions to the workflow API endpoint prior=
to authentication. Attackers can exploit unsandboxed GraalVM evaluators co= nfigured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA=
, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via J= ava reflection or direct subprocess calls. 2026-06-30 9.8 CVE-2026-58138 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-58138 ] Connekt Media--Ajax Loa=
d More - Filters The Ajax Load More - Filters plugin for WordPress is vulne= rable to Stored Cross-Site Scripting via the 'taxonomy_include_children' pa= rameter in all versions up to, and including, 3.4.1 due to insufficient inp=
ut sanitization and output escaping. This makes it possible for unauthentic= ated attackers to inject arbitrary web scripts in pages that will execute w= henever a user accesses an injected page. 2026-06-30 7.2 CVE-2026-8141 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-8141 ] Contempoinc--Real Estate 7=
Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <=3D 3.5.9 ver= sions. 2026-07-02 7.1 CVE-2026-57343 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-57343 ] Control Web Panel--Control Web Panel Control Web Panel befo=
re 0.9.8.1225 contains a blind SQL injection vulnerability that allows unau= thenticated remote attackers to execute arbitrary SQL queries by submitting=
unsanitized input through the userRes POST parameter at the user endpoint.=
Attackers can exploit MySQL root privileges obtained via the injection to = write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP web= shell to the web-accessible roundcube logs directory and achieving remote c= ode execution as the cwpsvc account. 2026-07-01 9.8 CVE-2026-57517 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-57517 ] coollabsio--coolify Coolify i=
s an open-source and self-hostable tool for managing servers, applications,=
and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consiste= ntly validate server ownership with Server::whereTeamId($teamId) before any=
operation. However, multiple Livewire web UI components accept server_id a=
nd destination_uuid from URL query parameters without any team ownership va= lidation, allowing cross-team resource deployment. This vulnerability is fi= xed in 4.0.0-beta.474. 2026-06-29 9.6 CVE-2026-57498 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-57498 ] coollabsio--coolify Coolify is an open-sour=
ce and self-hostable tool for managing servers, applications, and databases=
. Prior to 4.0.0-beta.464, an authenticated command injection vulnerability=
in the CA Certificate management feature allows any authenticated user to = execute arbitrary commands as the configured SSH user on the managed server=
host. As the SSH user typically would have to either be root or part of th=
e docker group for Coolify to function as intended, this provides complete = compromise of the managed server and associated docker containers. This vul= nerability is fixed in 4.0.0-beta.464. 2026-06-30 8.8 CVE-2026-27957 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-27957 ] coollabsio--coolify Coolify=
is an open-source and self-hostable tool for managing servers, application=
s, and databases. Prior to 4.0.0-beta.471, an authenticated command injecti=
on vulnerability in the Destination Network Management functionality allows=
users with destination management permissions to execute arbitrary command=
s as root on managed servers. The "network" parameter is passed directly to=
shell commands without proper sanitization, enabling full remote code exec= ution on the host system. This vulnerability is fixed in 4.0.0-beta.471. 20= 26-06-29 8.8 CVE-2026-34594 [ https://www.cve.org/CVERecord?id=3DCVE-2026-3= 4594 ] coollabsio--coolify Coolify is an open-source and self-hostable tool=
for managing servers, applications, and databases. Prior to 4.0.0-beta.470=
, a critical Authenticated Host Remote Code Execution (RCE) vulnerability w=
as discovered in Coolify. The flaw resides in the handling of user-defined = build parameters for the Nixpacks build pack. Specifically, the install_com= mand provided by a user is directly concatenated into a shell command strin=
g that is executed on the deployment host during the building phase. An att= acker can leverage this to escape the intended build context and execute ar= bitrary commands with host-level privileges. This vulnerability is fixed in=
4.0.0-beta.470. 2026-06-29 8.8 CVE-2026-34597 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-34597 ] coollabsio--coolify Coolify is an open-source and=
self-hostable tool for managing servers, applications, and databases. Prio=
r to 4.0.0-beta.471, Coolify server and project lookups are not scoped to t=
he current team, allowing any authenticated user to access servers and proj= ects belonging to other teams by specifying their IDs directly. This vulner= ability is fixed in 4.0.0-beta.471. 2026-06-29 7.7 CVE-2026-34592 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-34592 ] coollabsio--coolify Coolify is=
an open-source and self-hostable tool for managing servers, applications, = and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's m= anual_webhook_secret_github field, which is used by Coolify's webhook endpo= ints to validate incoming requests, is nullable with no default - meaning n= ewly created applications have a null webhook secret. PHP's hash_hmac() fun= ction silently coerces a null key to an empty string ''. So when the secret=
is null, the server computes hash_hmac('sha256', $payload, '') - a determi= nistic value that any attacker can calculate independently. By sending X-Hu= b-Signature-256: sha256=3D<hash_hmac('sha256', payload, '')>, an unauthenti= cated attacker can forge a valid signature and trigger deployments. This vu= lnerability is fixed in 4.0.0-beta.474. 2026-06-29 7.5 CVE-2026-41896 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-41896 ] Cozmoslabs--Paid Member Su= bscriptions Unauthenticated Server Side Request Forgery (SSRF) in Paid Memb=
er Subscriptions <=3D 3.0.4 versions. 2026-07-02 7.2 CVE-2026-57348 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-57348 ] cozyvision1--SMS Alert SMS &=
OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery The SMS=
Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Re= covery plugin for WordPress is vulnerable to privilege escalation via accou=
nt takeover in all versions up to, and including, 3.9.5. This is due to the=
plugin not properly validating a user's identity prior to updating their d= etails like reset the password of any user account, including administrator=
s, and gain full access to those accounts. This makes it possible for unaut= henticated attackers to change arbitrary user's email addresses, including = administrators, and leverage that to reset the user's password and gain acc= ess to their account. This is only vulnerable on sites with OTP verificatio=
n for password resets enabled, and where the administrator (or other user) = has set a phone number for OTP verification. 2026-07-01 9.8 CVE-2026-11387 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-11387 ] Crawl4AI--Crawl4AI Cr= awl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerabilit=
y in the Docker API server's /execute_js endpoint, which accepts and execut=
es arbitrary user-supplied JavaScript in the server's browser context with = --disable-web-security enabled. An attacker can execute arbitrary JavaScrip=
t and, combined with the browser's relaxed security settings, perform serve= r-side request forgery against internal services. 2026-06-30 8.1 CVE-2026-5= 6264 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56264 ] Creative Themes-= -Blocksy Companion Pro Unauthenticated Remote Code Execution (RCE) in Block=
sy Companion Pro <=3D 2.1.46 versions. 2026-07-02 10 CVE-2026-57624 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-57624 ] D-Link--DCS-935L A vulnerabi= lity has been found in D-Link DCS-935L 1.10.01. This affects the function s= ub_400E40 of the file setconf.cgi of the component POST Parameter Handler. = Such manipulation of the argument UID leads to os command injection. The at= tack can be launched remotely. The exploit has been disclosed to the public=
and may be used. 2026-06-29 8.8 CVE-2026-13545 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-13545 ] dapr--dapr Dapr Sentry's OIDC discovery endpoint=
derives the issuer and jwks_uri of the /.well-known/openid-configuration d= ocument from the request Host, honoring an attacker-controlled X-Forwarded-= Host header without validation when no allowed-hosts list is configured (th=
e default), and serves the document with a one-hour public cache lifetime. =
A remote unauthenticated attacker can poison the discovery document so rely= ing parties performing dynamic (unpinned) discovery fetch the JWKS from an = attacker-controlled server, causing attacker-signed JWTs to be accepted. Ex= ploitation requires the OIDC server enabled without a configured jwt-issuer=
or oidc-allowed-hosts. 2026-07-02 7.5 CVE-2026-59096 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-59096 ] Dassault Systmes--BIOVIA Workbook A Race C= ondition vulnerability affecting BIOVIA Workbook from Release 2021 through = Release 2026 could allow a user to access unauthorized data from another us= er. 2026-07-01 8.1 CVE-2026-5120 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-5120 ] databasebackup--WP Database Backup Unlimited Database & Files Ba= ckup by Backup for WP The WP Database Backup - Unlimited Database & Files B= ackup by Backup for WP plugin for WordPress is vulnerable to OS Command Inj= ection in all versions up to and including 7.11 via the `wp_db_exclude_tabl=
e` parameter. This is due to the direct concatenation of user-supplied `$_P= OST['wp_db_exclude_table']` values into the `mysqldump` shell command strin=
g in the `mysqldump()` function of `includes/admin/class-wpdb-admin.php` wi= thout wrapping them in `escapeshellarg()`-every other argument in the same = command (DB_USER, DB_PASSWORD, host, filename, DB_NAME) is properly escaped=
, making the exclude-table values the sole exception-and because the only a= pplied filtering, `sanitize_text_field()` via `recursive_sanitize_text_fiel= d()`, strips HTML tags but leaves shell metacharacters such as `;`, `|`, ``=
` ``, and `$()` intact. This makes it possible for authenticated attackers=
, with administrator-level access and above, to execute arbitrary operating=
system commands on the server, potentially enabling full remote code execu= tion. The injection is stored: malicious values submitted through the plugi=
n settings form are persisted to the WordPress options table via `update_op= tion('wp_db_exclude_table')` and later retrieved with `get_option()` and pa= ssed unsanitized to `shell_exec()` whenever a backup operation runs. 2026-0= 7-02 7.2 CVE-2026-9834 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9834 ]=
Dell--Device Management Agent Dell Device Management Agent, versions prior=
to DDMA 26.05, contain an Improper Link Resolution Before File Access ('Li=
nk Following') vulnerability. A low privileged attacker with local access c= ould=C2=A0potentially exploit this vulnerability, leading to Elevation of P= rivileges. 2026-07-01 7.3 CVE-2026-41121 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-41121 ] Dell--PowerProtect Data Domain Dell PowerProtect Data D= omain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 throug=
h 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 relea=
se versions 7.13.1.0 through 7.13.1.70 contain an Improper Neutralization o=
f Special Elements used in an OS Command ('OS Command Injection') vulnerabi= lity. A high privileged attacker with remote access could potentially explo=
it this vulnerability, leading to arbitrary command execution. 2026-07-03 7=
.2 CVE-2026-49814 [ https://www.cve.org/CVERecord?id=3DCVE-2026-49814 ] Del= l--PowerProtect Data Domain Dell PowerProtect Data Domain, versions 7.7.1.0=
through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 rel= ease version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 th= rough 7.13.1.70 contain an improper neutralization of special Elements used=
in an OS command ('OS command Injection') vulnerability. A high privileged=
attacker with remote access could potentially exploit this vulnerability, = leading to execution of arbitrary OS commands. 2026-07-03 7.2 CVE-2026-4981=
5 [ https://www.cve.org/CVERecord?id=3DCVE-2026-49815 ] Dell--PowerProtect = Data Domain Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LT= S2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3= .1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 = contain an improper neutralization of special elements used in an OS comman=
d ('OS command Injection') vulnerability. A high privileged attacker with r= emote access could potentially exploit this vulnerability, leading to comma=
nd execution. 2026-07-03 7.2 CVE-2026-53478 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-53478 ] deltaww--AS228T AS228T with Authentication Bypass Vu= lnerability 2026-07-01 7.4 CVE-2026-12579 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-12579 ] deltaww--DVP80ES3 DVP80ES3 with=C2=A0 Improper Resourc=
e Shutdown or Release vulnerability. 2026-07-01 7.5 CVE-2026-12575 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-12575 ] deltaww--DVP80ES3 DVP80ES3 wi=
th Improper Enforcement of Message Integrity During Transmission in a Commu= nication Channel vulnerability. 2026-07-01 7.5 CVE-2026-12576 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-12576 ] deltaww--DVP80ES300T DVP80ES300T w= ith Improper Validation of Array Index Vulnerability 2026-07-01 7.5 CVE-202= 6-14193 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14193 ] Design themes= --Kids Zone - Children WordPress Theme Unauthenticated Cross Site Scripting=
(XSS) in Kids Zone - Children WordPress Theme <=3D 5.4 versions. 2026-07-0=
2 7.1 CVE-2025-69156 [ https://www.cve.org/CVERecord?id=3DCVE-2025-69156 ] = Designthemes--Fitness Zone WordPress Theme Unauthenticated Cross Site Scrip= ting (XSS) in Fitness Zone WordPress Theme <=3D 5.7 versions. 2026-07-02 7.=
1 CVE-2025-69155 [ https://www.cve.org/CVERecord?id=3DCVE-2025-69155 ] Desi= gnthemes--Kids Life | Children School WordPress Unauthenticated Cross Site = Scripting (XSS) in Kids Life | Children School WordPress <=3D 5.2 versions.=
2026-07-02 7.1 CVE-2026-27402 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-27402 ] Designthemes--LMS Unauthenticated Cross Site Scripting (XSS) in L=
MS <=3D 9.7 versions. 2026-07-02 7.1 CVE-2026-27404 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-27404 ] designthemes--SpaLab | Beauty Salon WordPres=
s Theme Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon=
WordPress Theme <=3D 6.7 versions. 2026-07-02 7.1 CVE-2025-69154 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2025-69154 ] designthemes--Trendy Travel Un= authenticated Cross Site Scripting (XSS) in Trendy Travel <=3D 6.7 versions=
. 2026-07-02 7.1 CVE-2025-69153 [ https://www.cve.org/CVERecord?id=3DCVE-20= 25-69153 ] dhruvin--Custom Payment Gateways for WooCommerce The Custom Paym= ent Gateways for WooCommerce plugin for WordPress is vulnerable to Stored C= ross-Site Scripting via the 'alg_wc_cpg_input_fields' parameter in all vers= ions up to, and including, 2.1.0 due to insufficient input sanitization and=
output escaping. This makes it possible for unauthenticated attackers to i= nject arbitrary web scripts in pages that will execute whenever a user acce= sses an injected page. This vulnerability is exploitable by unauthenticated=
guest users submitting a crafted checkout POST request, requiring no custo=
m input fields to be configured in the plugin. 2026-07-01 7.2 CVE-2026-7517=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-7517 ] Divi Engine--Divi For=
m Builder The Divi Form Builder plugin for WordPress is vulnerable to Arbit= rary File Upload leading to Remote Code Execution in all versions up to and=
including 5.1.8. This is due to insufficient file extension validation in = the do_image_upload() function where user-supplied input from the acceptFil= eTypes POST parameter is directly interpolated into a regular expression us=
ed to validate uploaded files. Attackers can specify PHP-executable extensi= ons such as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess=
protection which only blocks .php files specifically. Additionally, on Ngi= nx-based servers, the .htaccess protection is completely ineffective as Ngi=
nx does not process .htaccess files. This makes it possible for unauthentic= ated attackers (who can obtain a nonce from any public page containing a fo= rm) to upload executable PHP files to the publicly accessible /wp-content/u= ploads/de_fb_uploads/ directory and achieve Remote Code Execution by access= ing the uploaded file via HTTP. The vulnerability was partially patched in = version 5.1.3. 2026-07-02 9.8 CVE-2026-5524 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-5524 ] Dolibarr--dolibarr Dolibarr through 23.0.3, fixed in = commit 14db36e, contains a sql injection vulnerability that allows authenti= cated API users to exfiltrate arbitrary database contents by supplying mali= cious values to the sqlfilters query parameter in the setup dictionary and = multicurrencies REST API endpoints. The affected endpoints in api_setup.cla= ss.php and api_multicurrencies.class.php validate sqlfilters only for balan= ced parentheses and rewrite matched triplets, allowing text placed outside = the expected shape such as an appended UNION SELECT to be concatenated into=
the SQL WHERE clause unmodified, enabling retrieval of sensitive data incl= uding password hashes and API keys. 2026-06-30 7.6 CVE-2026-58376 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-58376 ] e4jvikwp--VikBooking Hotel Boo= king Engine & PMS Cross-Site Request Forgery (CSRF) vulnerability in e4jvik=
wp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue = affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12. 202= 6-07-01 7.4 CVE-2026-57723 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57= 723 ] Eclipse Foundation--Eclipse CSI - PIA PIA's OIDC issuer allowlist for=
Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https:= //ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of valid= ating the issuer as a properly host-bounded URL. An attacker can craft an i= ssuer such as https://ci.eclipse.org@evil.host (userinfo trick) or https://= ci.eclipse.org.evil.host (suffix trick) that satisfies the prefix check whi=
le pointing the OIDC discovery and JWKS fetches at a server the attacker co= ntrols. An unauthenticated caller of POST /v1/upload/sbom can use this to f= orce PIA to make outbound HTTP(S) requests to an arbitrary attacker-chosen = host, and to have oidc.verify_token accept a JWT signed with the attacker's=
own key. 2026-07-02 8.2 CVE-2026-14336 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14336 ] Eclipse Foundation--Eclipse Parsson In Eclipse Parsson = published Maven Central artifacts before version 1.1.8, the JSON parser did=
not enforce a default maximum on the number of characters consumed while p= arsing a single JSON document. Applications that parse attacker- controlled=
JSON can be forced to consume excessive CPU and memory by processing very = large documents, including large arrays, objects, strings, numbers, whitesp= ace, or nested structures, resulting in a denial of service. Eclipse Parsso=
n 1.1.8 introduces a configurable maximum parsing limit with a default limi=
t of 15 million parser-consumed characters. 2026-07-02 7.5 CVE-2026-9563 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-9563 ] Eclipse Foundation--Ecli= pse Theia In affected versions of Eclipse Theia (1.8.1 and later), the brow= ser backend exposes privileged terminal RPC over WebSocket (/services/shell= -terminal, /services/terminals/:id) without service-level authentication. W= ebSocket origin validation in @theia/core is fail-open: connections are acc= epted when the Origin header is missing or when no THEIA_HOSTS allowlist is=
configured (the default). The Socket.IO integration additionally replaces = the real Origin header with a client-supplied fix-origin header that an att= acker can control or omit. As a result, a foreign-origin web page visited b=
y a user with a running Theia instance can open the /services WebSocket nam= espace, invoke terminal creation, attach to the resulting terminal data cha= nnel, execute arbitrary OS commands, and read their output. This affects bo=
th local developer setups (drive-by attack) and hosted or tunneled deployme= nts without strong external authentication. A fix is in development that en= forces same-origin validation by default, removes trust in the fix-origin h= eader, gates HTTP and WebSocket access on a SameSite=3DStrict; HttpOnly con= nection-token cookie, and sanitizes shell terminal creation options. 2026-0= 7-03 8.8 CVE-2026-10054 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10054=
] Eclipse Foundation--Eclipse Theia In Eclipse Theia since version 1.26.0,=
the backend /services/request-service RPC accepts an attacker-controlled U=
RL from any client connected to the standard /services messaging endpoint, = performs the HTTP request server-side, and returns the full response body t=
o the caller. Because the destination URL is neither validated nor allowlis= ted, a remote attacker with access to the Theia service connection can issu=
e server-side HTTP requests to localhost or other backend-reachable hosts a=
nd read their responses, exposing internal administrative endpoints, cloud = instance metadata services, and other resources that are intentionally outs= ide the browser network boundary. The vulnerability affects deployments whe=
re the Theia service connection is reachable by untrusted users (for exampl=
e, multi-tenant or publicly-reachable Theia deployments). 2026-07-03 8.5 CV= E-2026-10055 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10055 ] eclipse-= wakaama--wakaama Eclipse Wakaama before snapshot/2026-05-26 contains an unb= ounded memory allocation vulnerability in the CoAP Block1 handler within co= ap/block.c that allows unauthenticated remote attackers to exhaust server m= emory by sending a sequence of Block1 PUT requests with incrementing block = numbers. Attackers can target the registration endpoint over UDP without au= thentication, causing the server to repeatedly reallocate a growing accumul= ation buffer by appending each block payload without enforcing any maximum = total size limit, resulting in denial of service through memory exhaustion.=
2026-07-02 7.5 CVE-2026-58465 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-58465 ] Edimax--EW-7478APC A flaw has been found in Edimax EW-7478APC 1.0=
4. This affects the function formiNICSiteSurvey of the file /goform/formiNI= CSiteSurvey of the component POST Request Handler. This manipulation of the=
argument selSSID causes buffer overflow. It is possible to initiate the at= tack remotely. The exploit has been published and may be used. The vendor w=
as contacted early about this disclosure but did not respond in any way. 20= 26-06-29 8.8 CVE-2026-13562 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 3562 ] Edimax--EW-7478APC A vulnerability has been found in Edimax EW-7478A=
PC 1.04. This impacts the function formL2TPSetup of the file /goform/formL2= TPSetup of the component POST Request Handler. Such manipulation of the arg= ument L2TPUserName leads to stack-based buffer overflow. It is possible to = launch the attack remotely. The exploit has been disclosed to the public an=
d may be used. The vendor was contacted early about this disclosure but did=
not respond in any way. 2026-06-29 8.8 CVE-2026-13563 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-13563 ] Edimax--EW-7478APC A vulnerability was fo= und in Edimax EW-7478APC 1.04. Affected is the function formPPPoESetup of t=
he file /goform/formPPPoESetup of the component POST Request Handler. Perfo= rming a manipulation of the argument pppUserName results in stack-based buf= fer overflow. The attack can be initiated remotely. The exploit has been ma=
de public and could be used. The vendor was contacted early about this disc= losure but did not respond in any way. 2026-06-29 8.8 CVE-2026-13564 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-13564 ] Edimax--EW-7478APC A securi=
ty vulnerability has been detected in Edimax EW-7478APC 1.04. This affects = the function formQoS of the file /goform/formQoS of the component POST Requ= est Handler. The manipulation of the argument selSSID leads to buffer overf= low. Remote exploitation of the attack is possible. The exploit has been di= sclosed publicly and may be used. The vendor was contacted early about this=
disclosure but did not respond in any way. 2026-06-29 8.8 CVE-2026-13580 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-13580 ] Edimax--EW-7478APC A f= law has been found in Edimax EW-7478APC 1.04. This issue affects the functi=
on formUSBAccount of the file /goform/formUSBAccount of the component POST = Request Handler. This manipulation of the argument UserName/Password causes=
buffer overflow. The attack is possible to be carried out remotely. The ex= ploit has been published and may be used. The vendor was contacted early ab= out this disclosure but did not respond in any way. 2026-06-29 8.8 CVE-2026= -13582 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13582 ] Edimax--EW-747= 8APC A vulnerability has been found in Edimax EW-7478APC 1.04. Impacted is = the function formUSBFolder of the file /goform/formUSBFolder of the compone=
nt POST Request Handler. Such manipulation of the argument ShareName/Select= Name leads to buffer overflow. The attack may be performed from remote. The=
exploit has been disclosed to the public and may be used. The vendor was c= ontacted early about this disclosure but did not respond in any way. 2026-0= 6-29 8.8 CVE-2026-13583 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13583=
] Eksagate Electronic Engineering and Computer Industry Trade Inc.--SYSGUA=
RD 6001 Improper neutralization of special elements used in an SQL command = ('SQL injection') vulnerability in Eksagate Electronic Engineering and Comp= uter Industry Trade Inc. SYSGUARD 6001 allows Blind SQL Injection. This iss=
ue affects SYSGUARD 6001: from 2.0.2 before 6.1.16.0.=C2=A0 NOTE: The vendo=
r was contacted and it was learned that the product is not supported. 2026-= 06-30 9.8 CVE-2026-8402 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8402 =
] Elastic--Kibana Improper Output Neutralization for Logs (CWE-117) in Kiba=
na can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93)=
. An attacker can supply specially crafted input that is written to log fil=
es without proper neutralization. When the log files are subsequently viewe=
d in a terminal that interprets control sequences, the injected content may=
alter the displayed log data. 2026-07-01 8 CVE-2026-49091 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-49091 ] Elated-Themes--Audrey Unauthenticated=
Local File Inclusion in Audrey <=3D 1.5 versions. 2026-07-02 8.1 CVE-2026-= 42382 [ https://www.cve.org/CVERecord?id=3DCVE-2026-42382 ] electron-userla= nd--electron-builder electron-updater allows for automatic updates for Elec= tron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib coul=
d use an empty path component when setting the LD_LIBRARY_PATH environment = variable at runtime. This causes the current working directory to be added =
to the dynamic linker search path, which may allow an attacker to execute a= rbitrary code by placing a malicious shared library in the directory from w= hich the AppImage is launched. This issue has been fixed in version 26.15.0=
. 2026-06-30 7.8 CVE-2026-54672 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-54672 ] elemntor--Image Optimizer Optimize Images and Convert to WebP or=
AVIF The Image Optimizer plugin for WordPress is vulnerable to arbitrary f= ile deletion in versions up to and including 1.7.4. This is due to insuffic= ient path validation in the Image_Backup::remove() function where backup fi=
le paths stored in post meta are used directly in file deletion operations = without verifying they are within the uploads directory. The plugin stores = backup file paths in the image_optimizer_metadata post meta field and trust=
s these paths completely when deleting backups on the delete_attachment hoo=
k. An authenticated attacker with Author-level access can edit the image_op= timizer_metadata post meta on their own attachments via WordPress's Custom = Fields interface, injecting arbitrary absolute file paths into the backups = array. When the attacker subsequently deletes the attachment, the plugin ca= lls File_System::delete() on each path without validation. This makes it po= ssible for authenticated attackers, with Author-level access and above, to = delete arbitrary files on the server within the web server's filesystem per= missions, potentially leading to denial of service, data loss, or security = degradation. 2026-07-02 8.1 CVE-2026-5821 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-5821 ] emarket-design--Request a Quote Quote Forms for Any Wor= dPress Site The Request a Quote plugin for WordPress is vulnerable to Code = Injection in versions up to, and including, 2.5.5 via the emd_delete_file A= JAX action. This is due to the emd_delete_file() handler deriving a PHP fun= ction name from the attacker-controlled $_POST['path'] parameter and invoki=
ng it dynamically via the variable-function call $sess_name(), and the hand= ler being registered for wp_ajax_nopriv with its only protection being a no= nce that the plugin prints into the public quote-form page via wp_localize_= script. This makes it possible for unauthenticated attackers to invoke arbi= trary zero-argument PHP functions on the server, such as phpinfo(), potenti= ally exposing sensitive server configuration and credentials, or executing = other destructive built-in PHP functions. 2026-07-02 7.5 CVE-2026-14249 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-14249 ] emarket-design--Video Ga= llery YouTube Gallery, Playlist & Video Grid The Youtube Showcase plugin fo=
r WordPress is vulnerable to Arbitrary Function Call in versions up to and = including 4.0.3. This is due to insufficient validation of the 'path' param= eter in the emd_delete_file() AJAX handler in includes/common-functions.php=
. The user-supplied value is passed through sanitize_text_field(), has its = trailing '_PLUGIN_DIR' substring stripped, and is then invoked as a PHP fun= ction name with no arguments via `$sess_name()`. The handler is gated only =
by a nonce - no current_user_can() check is present - and the nonce is emit= ted on any front-end page that renders a form shortcode containing file fie= lds. This makes it possible for authenticated attackers, with Subscriber-le= vel access and above, to invoke arbitrary zero-argument PHP functions (such=
as phpinfo, phpversion, get_defined_vars, error_get_last), resulting in se= nsitive information disclosure and potential further compromise depending o=
n the functions available in the environment. 2026-07-01 7.5 CVE-2026-12923=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-12923 ] Empirum--Matrix42 PB= ackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a=
named pipe (\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and G= ENERIC_WRITE permissions to all authenticated users. A low-privileged local=
attacker can connect to this pipe and send crafted IPC messages to trigger=
execution of arbitrary commands with SYSTEM privileges via an untrusted se= arch path. This allows privilege escalation by placing a malicious shadow.e=
xe in a controlled working directory. 2026-06-29 7.8 CVE-2026-57919 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-57919 ] Epiphyt--Embed Privacy Impro= per Limitation of a Pathname to a Restricted Directory ('Path Traversal') v= ulnerability in Epiphyt Embed Privacy allows Path Traversal. This issue aff= ects Embed Privacy: from n/a through 1.12.3. 2026-06-29 7.1 CVE-2026-57346 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-57346 ] Epsiloncool--WP Fast = Total Search Unauthenticated SQL Injection in WP Fast Total Search <=3D 1.8= 0.280 versions. 2026-07-02 9.3 CVE-2026-57683 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-57683 ] EstrellaXD--Auto_Bangumi AutoBangumi before 3.2.8 = contains a hard-coded default credentials vulnerability that allows unauthe= nticated attackers to authenticate as the administrator by using the public=
ly known default credentials seeded at startup via add_default_user() in th=
e database user module when the users table is empty. Attackers can submit = the default credentials to the authentication login endpoint to gain full c= ontrol of the application, including RSS feed configuration, downloader con= figuration, and all authenticated API endpoints. 2026-07-02 9.8 CVE-2026-58= 466 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58466 ] etruel--WPeMatico=
RSS Feed Fetcher Unauthenticated Cross Site Scripting (XSS) in WPeMatico R=
SS Feed Fetcher <=3D 2.8.17 versions. 2026-07-02 7.1 CVE-2026-57349 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-57349 ] EventON--EventON (Pro) - Wor= dPress Virtual Event Calendar Plugin The EventON - WordPress Virtual Event = Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection = via the WordPress 'search' parameter in versions up to, and including, 5.0.=
11 due to insufficient escaping on the user supplied parameter and lack of = preparation on the existing SQL query. This makes it possible for unauthent= icated attackers to append additional SQL queries into already existing que= ries that can be used to extract sensitive information from the database, g= ranted the "Enable additional search queries" setting is enabled and at lea=
st one published event exists. 2026-06-30 9.8 CVE-2026-9711 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-9711 ] fast-uri--fast-uri fast-uri versions = 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames = for HTTP-family URLs. The IDN conversion path calls a helper that does not = exist on the global URL constructor, silently leaving the host in its origi= nal Unicode form while normalize() and equal() still return values that dif= fer from a WHATWG-compatible URL parser. Applications that use fast-uri to = enforce host-based policy (denylists, loopback filtering, redirect validati= on, outbound proxy routing) before passing the same URL to Node's URL or fe= tch can be bypassed when the two implementations resolve the same input to = different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0=
.1 for the 4.x line. Workarounds: enforce host policy using the same URL pa= rser used for the actual request, or reject non-ASCII hosts before policy c= hecks. 2026-06-29 7.5 CVE-2026-13676 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-13676 ] Feast--Feast Feature Server A vulnerability has been identi= fied in the Feast Feature Server's `/save-document` endpoint that allows an=
unauthenticated remote attacker to write arbitrary JSON files to the serve= r's filesystem. Although the system attempts to restrict file locations, th= ese protections can be bypassed, enabling an attacker to overwrite vital ap= plication configurations or startup scripts. Because this flaw requires no = credentials or special privileges, any attacker with network access to the = server can potentially compromise the integrity of the system. This could l= ead to unauthorized system modifications, denial of service through disk ex= haustion, or potential remote code execution. 2026-07-01 9.1 CVE-2026-23537=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-23537 ] Feehi--CMS A vulnera= bility was found in Feehi CMS up to 2.1.1. This vulnerability affects unkno=
wn code of the file /api/articles of the component REST API Endpoint. Perfo= rming a manipulation results in missing authentication. The attack may be i= nitiated remotely. The exploit has been made public and could be used. The = project was informed of the problem early through an issue report but has n=
ot responded yet. 2026-06-29 7.3 CVE-2026-13546 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-13546 ] Flowise--Flowise Flowise before 3.1.0 (affected = versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise=
') for the express-session middleware when the EXPRESS_SESSION_SECRET envir= onment variable is not set (packages/server/src/enterprise/middleware/passp= ort/index.ts). Because this default secret is publicly visible in the sourc=
e code, an attacker can forge valid signed session cookies to impersonate a=
ny user and bypass authentication. 2026-06-30 9.1 CVE-2026-56278 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-56278 ] Frangoteam--FUXA SCADA/HMI FUXA=
versions 1.3.1 and prior contain an authentication bypass vulnerability vi=
a dot-segment path normalization in the REST API. The API router fails to n= ormalize dot-segment sequences before applying authentication middleware, a= llowing unauthenticated requests to access protected endpoints by prefixing=
paths with dot-segments such as /api/./users, /api/./roles, and /api/proje= ct/../users. These requests bypass authentication checks and return sensiti=
ve user and role data without credentials. 2026-06-30 7.5 CVE-2026-13207 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-13207 ] FrontAccounting--FrontA= ccounting FrontAccounting before 2.4.20 contains a path traversal vulnerabi= lity in the attachment upload handler that allows authenticated attackers t=
o execute arbitrary code by uploading files with traversal sequences in the=
unique_name parameter. Attackers can supply path traversal sequences ../..= /../shell.php to write files outside the intended attachments directory int=
o the web root, and by uploading PHP files without extension validation, ac= hieve remote code execution as the web server user. 2026-06-29 8.8 CVE-2026= -40521 [ https://www.cve.org/CVERecord?id=3DCVE-2026-40521 ] FrontAccountin= g--FrontAccounting FrontAccounting before 2.4.20 contains a SQL injection v= ulnerability in the Audit Trail report handler that allows authenticated at= tackers with SA_GLANALYTIC permission to execute arbitrary SQL queries by i= njecting malicious code into the PARAM_2 and PARAM_3 POST parameters. Attac= kers can exploit time-based blind SQL injection through SLEEP() functions t= hat are amplified across JOIN result sets to cause denial of service by exh= austing database connections, or extract arbitrary database content through=
UNION-based injection techniques. 2026-06-29 8.1 CVE-2026-40523 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-40523 ] FrontAccounting--FrontAccountin=
g FrontAccounting before 2.4.20 contains a SQL injection vulnerability in t=
he get_gl_transactions() function where the filter_type parameter is concat= enated directly into a SQL IN() clause without parameterization. Attackers = with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closi=
ng parenthesis followed by malicious conditions to extract sensitive journa=
l entry data through boolean-based blind SQL injection with reliable respon=
se size differentials. 2026-06-29 8.1 CVE-2026-40524 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-40524 ] FrontAccounting--FrontAccounting FrontAccou= nting before 2.4.20 contains a SQL injection vulnerability in the Bank Stat= ement report handler that allows authenticated attackers to extract arbitra=
ry database data by injecting UNION SELECT payloads into the PARAM_0 POST p= arameter. Attackers can supply malicious SQL syntax through the unparameter= ized WHERE clause to retrieve sensitive information including usernames, pa= ssword hashes, and email addresses from the users table, rendered into PDF = report output. 2026-06-29 7.1 CVE-2026-40522 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-40522 ] Fuelthemes--Werkstatt Contributor PHP Object Inject= ion in Werkstatt <=3D 4.8.3 versions. 2026-07-02 8.8 CVE-2026-27414 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-27414 ] Gardyn--Gardyn Home Firmware=
Gardyn devices expose a privileged iothubowner key. Access to this key wil=
l allow a malicious user to invoke an IoTHub Registry Manager function whic=
h returns connection information for all Gardyn Home Kit and Studio devices=
. Access to this key also allows a malicious user to execute arbitrary comm= ands on a specific connected device and may allow the malicious user to piv=
ot to other devices on the user's network. 2026-07-02 10 CVE-2026-13768 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-13768 ] GeoVision Inc.--GeoWebPl= ayer GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and=
"WS Player" for VMS-Cloud) is an addon that can be installed with various = GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server t= hat expands the capabilities of the various web-interfaces provided by the = GeoVision software and may be necessary for them to function properly. In o= rder to access the websocket server, no authentication is required. As such=
, any malicious website can attempt to open a connection to the server and = potentially access sensitive APIs. In particular, it's possible to call a c= ombination of the `create` method and `getScreenCapture` to retrieve the co= ntent of the user's screen. 2026-07-02 8.8 CVE-2026-13125 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-13125 ] GeoVision Inc.--GeoWebPlayer GeoWebPla= yer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" f=
or VMS-Cloud) is an addon that can be installed with various GeoVision soft= ware (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands th=
e capabilities of the various web-interfaces provided by the GeoVision soft= ware and may be necessary for them to function properly. The Websocket serv=
er can accept various commands coming from localhost. Many of the commands = will take an `index` value that is then used to access various arrays to en= ter critical sections, perform various actions via function calls, etc. How= ever the `index` value is usually not checked for valid range, and as such =
it can be used to access multiple arrays out-of-bound. #### connectInfo com= mand index-out-of-bound 2026-07-02 8.3 CVE-2026-13131 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-13131 ] GeoVision Inc.--GeoWebPlayer GeoWebPlayer = (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for V= MS-Cloud) is an addon that can be installed with various GeoVision software=
(GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the ca= pabilities of the various web-interfaces provided by the GeoVision software=
and may be necessary for them to function properly. The Websocket server c=
an accept various commands coming from localhost. Many of the commands will=
take an `index` value that is then used to access various arrays to enter = critical sections, perform various actions via function calls, etc. However=
the `index` value is usually not checked for valid range, and as such it c=
an be used to access multiple arrays out-of-bound. #### setStream command i= ndex-out-of-bound 2026-07-02 8.3 CVE-2026-13132 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-13132 ] GeoVision Inc.--GeoWebPlayer GeoWebPlayer (also = called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Clo= ud) is an addon that can be installed with various GeoVision software (GV-V= MS, GV-Cloud, ...). It creates a websocket server that expands the capabili= ties of the various web-interfaces provided by the GeoVision software and m=
ay be necessary for them to function properly. The Websocket server can acc= ept various commands coming from localhost. Many of the commands will take =
an `index` value that is then used to access various arrays to enter critic=
al sections, perform various actions via function calls, etc. However the `= index` value is usually not checked for valid range, and as such it can be = used to access multiple arrays out-of-bound. #### setPIP command index-out-= of-bound 2026-07-02 8.3 CVE-2026-57264 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-57264 ] GeoVision Inc.--GeoWebPlayer GeoWebPlayer (also called = "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is =
an addon that can be installed with various GeoVision software (GV-VMS, GV-= Cloud, ...). It creates a websocket server that expands the capabilities of=
the various web-interfaces provided by the GeoVision software and may be n= ecessary for them to function properly. The Websocket server can accept var= ious commands coming from localhost. Many of the commands will take an `ind= ex` value that is then used to access various arrays to enter critical sect= ions, perform various actions via function calls, etc. However the `index` = value is usually not checked for valid range, and as such it can be used to=
access multiple arrays out-of-bound. #### audio command index-out-of-bound=
2026-07-02 8.3 CVE-2026-57265 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-57265 ] GeoVision Inc.--GeoWebPlayer GeoWebPlayer (also called "Web Plugi=
n" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon t= hat can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...=
). It creates a websocket server that expands the capabilities of the vario=
us web-interfaces provided by the GeoVision software and may be necessary f=
or them to function properly. The Websocket server can accept various comma= nds coming from localhost. Many of the commands will take an `index` value = that is then used to access various arrays to enter critical sections, perf= orm various actions via function calls, etc. However the `index` value is u= sually not checked for valid range, and as such it can be used to access mu= ltiple arrays out-of-bound. #### 2wayAudio command index-out-of-bound 2026-= 07-02 8.3 CVE-2026-57266 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5726=
6 ] GeoVision Inc.--GeoWebPlayer GeoWebPlayer (also called "Web Plugin" in = the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that ca=
n be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It = creates a websocket server that expands the capabilities of the various web= -interfaces provided by the GeoVision software and may be necessary for the=
m to function properly. The Websocket server can accept various commands co= ming from localhost. Many of the commands will take an `index` value that i=
s then used to access various arrays to enter critical sections, perform va= rious actions via function calls, etc. However the `index` value is usually=
not checked for valid range, and as such it can be used to access multiple=
arrays out-of-bound. #### snapshot command index-out-of-bound 2026-07-02 8=
.3 CVE-2026-57267 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57267 ] Geo= Vision Inc.--GeoWebPlayer GeoWebPlayer (also called "Web Plugin" in the GV-= VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be in= stalled with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates=
a websocket server that expands the capabilities of the various web-interf= aces provided by the GeoVision software and may be necessary for them to fu= nction properly. The Websocket server can accept various commands coming fr=
om localhost. Many of the commands will take an `index` value that is then = used to access various arrays to enter critical sections, perform various a= ctions via function calls, etc. However the `index` value is usually not ch= ecked for valid range, and as such it can be used to access multiple arrays=
out-of-bound. ### saveVideo command index-out-of-bound When sending the `s= aveVideo` command, the `index` field is extracted from the websocket messag=
e [1]. Then without checking the range of the index, it is used to trigger =
a CriticalSection ([2]) and releases it [3]. The release function call ([3]=
) is executed using a function pointer which will be read out of bounds pot= entially leading to code execution: v6 =3D get_entry(a2, "index"); result =
=3D json_is_value_int(v6); if ( (_BYTE)result ) { v8 =3D get_entry(a2, "ind= ex"); index =3D json_value_to_int(&v8->value); // [1] result =3D CCriticalS= ection::EnterCritSection(&this->crit_sections[index]); //[2] if ( result ) =
{ if ( this->array_of_IPCams[index] ) { if ( this->array_of_IPCams[index]->= field_20 ) do_PostMessageA((CViewer *)this->array_of_IPCams[index], 0x111u,=
0x139Fu, v11); } return (*(int (__thiscall **)(CCriticalSection *))(this->= crit_sections[index].vtbl + 20))(&this->crit_sections[index]); //[3] } } 20= 26-07-02 8.3 CVE-2026-57268 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5= 7268 ] GeoVision Inc.--GeoWebPlayer GeoWebPlayer (also called "Web Plugin" =
in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that=
can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). =
It creates a websocket server that expands the capabilities of the various = web-interfaces provided by the GeoVision software and may be necessary for = them to function properly. The Websocket server can accept various commands=
coming from localhost. Many of the commands will take an `index` value tha=
t is then used to access various arrays to enter critical sections, perform=
various actions via function calls, etc. However the `index` value is usua= lly not checked for valid range, and as such it can be used to access multi= ple arrays out-of-bound. #### disconnect command index-out-of-bound 2026-07= -02 8.3 CVE-2026-57269 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57269 =
] GeoVision Inc.--GeoWebPlayer GeoWebPlayer (also called "Web Plugin" in th=
e GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can =
be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It cr= eates a websocket server that expands the capabilities of the various web-i= nterfaces provided by the GeoVision software and may be necessary for them =
to function properly. The Websocket server can accept various commands comi=
ng from localhost. Many of the commands will take an `index` value that is = then used to access various arrays to enter critical sections, perform vari= ous actions via function calls, etc. However the `index` value is usually n=
ot checked for valid range, and as such it can be used to access multiple a= rrays out-of-bound. #### play command index-out-of-bound 2026-07-02 8.3 CVE= -2026-57270 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57270 ] GeoVision=
Inc.--GeoWebPlayer GeoWebPlayer (also called "Web Plugin" in the GV-VMS do= cumentation and "WS Player" for VMS-Cloud) is an addon that can be installe=
d with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a web= socket server that expands the capabilities of the various web-interfaces p= rovided by the GeoVision software and may be necessary for them to function=
properly. #### pause command index-out-of-bound 2026-07-02 8.3 CVE-2026-57= 271 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57271 ] GeoVision Inc.--G= eoWebPlayer GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentat= ion and "WS Player" for VMS-Cloud) is an addon that can be installed with v= arious GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket s= erver that expands the capabilities of the various web-interfaces provided =
by the GeoVision software and may be necessary for them to function properl=
y. The Websocket server can accept various commands coming from localhost. = Many of the commands will take an `index` value that is then used to access=
various arrays to enter critical sections, perform various actions via fun= ction calls, etc. However the `index` value is usually not checked for vali=
d range, and as such it can be used to access multiple arrays out-of-bound.=
#### byPass command index-out-of-bound 2026-07-02 8.3 CVE-2026-57272 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-57272 ] GeoVision Inc.--GeoWebPlay=
er GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "=
WS Player" for VMS-Cloud) is an addon that can be installed with various Ge= oVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server tha=
t expands the capabilities of the various web-interfaces provided by the Ge= oVision software and may be necessary for them to function properly. The We= bsocket server can accept various commands coming from localhost. One of th= em, `connectionInfo` is meant to provide the necessary details to connect t=
o a camera. The handler associated with this command that we call`handle_co= nnection_info` contains multiple instances of string copy that can overflow=
. The function `handle_connect_info` copies attacker-controlled JSON string=
s into fixed-size buffers using manual byte-by-byte loops that do not enfor=
ce length limits. #### Buffer Overflow in username field (no key present) 2= 026-07-02 8.3 CVE-2026-57273 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 57273 ] GeoVision Inc.--GeoWebPlayer GeoWebPlayer (also called "Web Plugin"=
in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon tha=
t can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...).=
It creates a websocket server that expands the capabilities of the various=
web-interfaces provided by the GeoVision software and may be necessary for=
them to function properly. The Websocket server can accept various command=
s coming from localhost. One of them, `connectionInfo` is meant to provide = the necessary details to connect to a camera. The handler associated with t= his command that we call`handle_connection_info` contains multiple instance=
s of string copy that can overflow. The function `handle_connect_info` copi=
es attacker-controlled JSON strings into fixed-size buffers using manual by= te-by-byte loops that do not enforce length limits. #### Buffer Overflow in=
password field (no key present) 2026-07-02 8.3 CVE-2026-57274 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-57274 ] GeoVision Inc.--GeoWebPlayer GeoW= ebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Play= er" for VMS-Cloud) is an addon that can be installed with various GeoVision=
software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expan=
ds the capabilities of the various web-interfaces provided by the GeoVision=
software and may be necessary for them to function properly. The Websocket=
server can accept various commands coming from localhost. One of them, `co= nnectionInfo` is meant to provide the necessary details to connect to a cam= era. The handler associated with this command that we call`handle_connectio= n_info` contains multiple instances of string copy that can overflow. The f= unction `handle_connect_info` copies attacker-controlled JSON strings into = fixed-size buffers using manual byte-by-byte loops that do not enforce leng=
th limits. #### Buffer Overflow in username field (key present) 2026-07-02 = 8.3 CVE-2026-57275 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57275 ] Ge= oVision Inc.--GeoWebPlayer GeoWebPlayer (also called "Web Plugin" in the GV= -VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be i= nstalled with various GeoVision software (GV-VMS, GV-Cloud, ...). It create=
s a websocket server that expands the capabilities of the various web-inter= faces provided by the GeoVision software and may be necessary for them to f= unction properly. The Websocket server can accept various commands coming f= rom localhost. One of them, `connectionInfo` is meant to provide the necess= ary details to connect to a camera. The handler associated with this comman=
d that we call`handle_connection_info` contains multiple instances of strin=
g copy that can overflow. The function `handle_connect_info` copies attacke= r-controlled JSON strings into fixed-size buffers using manual byte-by-byte=
loops that do not enforce length limits. #### Buffer Overflow in password = field (key present) 2026-07-02 8.3 CVE-2026-57276 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-57276 ] GeoVision Inc.--GeoWebPlayer GeoWebPlayer (als=
o called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-C= loud) is an addon that can be installed with various GeoVision software (GV= -VMS, GV-Cloud, ...). It creates a websocket server that expands the capabi= lities of the various web-interfaces provided by the GeoVision software and=
may be necessary for them to function properly. The Websocket server can a= ccept various commands coming from localhost. One of them, `connectionInfo`=
is meant to provide the necessary details to connect to a camera. The hand= ler associated with this command that we call`handle_connection_info` conta= ins multiple instances of string copy that can overflow. The function `hand= le_connect_info` copies attacker-controlled JSON strings into fixed-size bu= ffers using manual byte-by-byte loops that do not enforce length limits. ##=
## Buffer Overflow in key field 2026-07-02 8.3 CVE-2026-57277 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-57277 ] GeoVision Inc.--GeoWebPlayer GeoWe= bPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe=
r" for VMS-Cloud) is an addon that can be installed with various GeoVision = software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expand=
s the capabilities of the various web-interfaces provided by the GeoVision = software and may be necessary for them to function properly. The Websocket = server can accept various commands coming from localhost. One of them, `con= nectionInfo` is meant to provide the necessary details to connect to a came= ra. The handler associated with this command that we call`handle_connection= _info` contains multiple instances of string copy that can overflow. The fu= nction `handle_connect_info` copies attacker-controlled JSON strings into f= ixed-size buffers using manual byte-by-byte loops that do not enforce lengt=
h limits. #### Buffer Overflow in ip field 2026-07-02 8.3 CVE-2026-57278 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-57278 ] Gitea--Gitea Open Sourc=
e Git Server Gitea Docker image versions up to and including 1.26.2 use REV= ERSE_PROXY_TRUSTED_PROXIES=3D* by default, allowing any source IP to impers= onate a user when reverse-proxy authentication headers such as X-WEBAUTH-US=
ER are enabled. 2026-07-03 9.8 CVE-2026-20896 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-20896 ] Gitea--Gitea Open Source Git Server Gitea versions=
up to and including 1.26.2 have incomplete SSRF protection in webhook and = migration allow-list filtering. 2026-07-03 9.6 CVE-2026-22874 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-22874 ] Gitea--Gitea Open Source Git Serve=
r Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-reposit= ory artifact read and cross-task upload-state write 2026-07-03 9.6 CVE-2026= -58426 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58426 ] Gitea--Gitea O= pen Source Git Server Gitea versions before 1.26.0 allow API users to fork =
a repository into an organization without first passing the CanCreateOrgRep=
o check, which can expose organization secrets. 2026-07-03 8.1 CVE-2026-225=
55 [ https://www.cve.org/CVERecord?id=3DCVE-2026-22555 ] Gitea--Gitea Open = Source Git Server Gitea versions up to and including 1.26.1 allow the Allow=
edits from maintainers permission path to authorize commits to repositorie=
s that the user can read but should not be able to write. 2026-07-03 8.5 CV= E-2026-26231 [ https://www.cve.org/CVERecord?id=3DCVE-2026-26231 ] Gitea--G= itea Open Source Git Server Gitea versions up to and including 1.26.1 allow=
OAuth2 access token scope enforcement to be bypassed through HTTP Basic au= thentication. 2026-07-03 8.1 CVE-2026-28699 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-28699 ] Gitea--Gitea Open Source Git Server Gitea versions f= rom 1.25.0 before 1.26.0 allow stored cross-site scripting through the exte= nsionsRequired field in glTF files rendered by the 3D file viewer. 2026-07-=
03 8.7 CVE-2026-28737 [ https://www.cve.org/CVERecord?id=3DCVE-2026-28737 ]=
Gitea--Gitea Open Source Git Server Gitea versions up to and including 1.2= 6.1 allow Git smart HTTP requests authenticated with bearer tokens to bypas=
s repository token scope checks. 2026-07-03 8.1 CVE-2026-28744 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-28744 ] Gitea--Gitea Open Source Git Serv=
er Permanent Fork PR Workflow Approval Gate Bypass 2026-07-03 8.9 CVE-2026-= 58424 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58424 ] Gitea--Gitea Op=
en Source Git Server Gitea versions from 1.5.0 before 1.26.3 have a TOTP si= ngle-use enforcement defect that allows a valid TOTP code to be accepted mo=
re than once across web two-factor authentication flows and the Basic Auth = X-Gitea-OTP path. 2026-07-03 7.1 CVE-2026-20779 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-20779 ] Gitea--Gitea Open Source Git Server Gitea versio=
ns up to and including 1.26.2 allow Git LFS object reuse to authorize priva=
te source objects for users who have repository access but lack Code-unit a= ccess. 2026-07-03 7.1 CVE-2026-28740 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-28740 ] Gitea--Gitea Open Source Git Server LFS authentication bypa=
ss via malformed SSH sub-verb allows unauthorized read access to private re= positories 2026-07-03 7.7 CVE-2026-58423 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-58423 ] GNOME--GLib A flaw was found in GLib. An off-by-one err=
or can occur in the g_key_file_get_locale_string_list function in the gkeyf= ile.c file when loading a key file with an empty value. This flaw can cause=
an out-of-bounds access of 1 byte or a denial of service when the out-of-b= ounds access crosses a page boundary. 2026-06-30 7.3 CVE-2026-58014 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-58014 ] GNOME--GLib A flaw was found=
in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() =
in the gio/gdbusintrospection.c file when processing malformed D-Bus intros= pection XML, specifically with a <node> element nested within other element=
s like <method>, <signal>, <property> or <arg>. This issue can cause an uns= igned integer overflow and lead to an out-of-bounds read, resulting in a de= nial of service. 2026-06-30 7.5 CVE-2026-58016 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-58016 ] GoodLayers--Tourmaster Subscriber Local File Incl= usion in Tourmaster <=3D 5.4.5 versions. 2026-07-02 7.5 CVE-2025-69133 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2025-69133 ] gorse-io--gorse Gorse bef= ore 0.5.10 contains an authentication bypass vulnerability in the /api/dump=
and /api/restore endpoints that allows unauthenticated attackers to access=
protected functionality when admin_api_key is empty, which is the default = configuration. Remote attackers can exfiltrate the entire database includin=
g user records, items, and feedback data containing personally identifiable=
information, or completely overwrite the dataset without authentication. 2= 026-06-29 9.8 CVE-2026-56782 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 56782 ] gradio-app--gradio Gradio before 6.16.0 contain a path traversal vu= lnerability in the FileExplorer component's preprocess() method that allows=
unauthenticated attackers to escape the configured root directory by suppl= ying path segments containing directory traversal sequences or absolute pat= hs. Attackers can provide crafted path segments that cause os.path.join to = discard the root_dir prefix entirely, resulting in arbitrary file read or e= xposure of sensitive files outside the intended directory. 2026-07-01 7.5 C= VE-2026-49119 [ https://www.cve.org/CVERecord?id=3DCVE-2026-49119 ] Grav--G= rav Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabi= lities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework= \Cache\Adapter\FileCache, and Session - deserialize untrusted data without = restricting allowed classes, enabling PHP object injection and, via a gadge=
t chain, arbitrary code execution where an attacker controls the serialized=
input. Additionally, InstallCommand's git clone operation passes the branc=
h, url, and path parameters into a shell command without escaping, allowing=
OS command injection via plugin/theme installation (which requires admin a= ccess). A Twig security blocklist bypass (server-side template injection) i=
s also present. The issues are fixed in 2.0.0-beta.2. 2026-06-30 9.8 CVE-20= 26-56700 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56700 ] Greg Winiars= ki--WPAdverts Unauthenticated Cross Site Scripting (XSS) in WPAdverts <=3D = 2.3.1 versions. 2026-07-02 7.1 CVE-2026-57366 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-57366 ] Guangzhou Red Sea Cloud Computing Co., Ltd.--Red S=
ea Cloud eHR Redsea Cloud eHR contains an arbitrary file upload vulnerabili=
ty that allows unauthenticated attackers to achieve remote code execution b=
y uploading malicious files through the PtFjk.mob servlet endpoint. Attacke=
rs can submit a multipart POST request with a JSP webshell disguised using =
a spoofed image/jpeg Content-Type to bypass the absence of extension and MI=
ME type validation, with the uploaded file stored at a predictable path und=
er the uploadfile directory and executed directly by the web server. Exploi= tation evidence was first observed by the Shadowserver Foundation on 2024-1= 1-03 (UTC). 2026-07-02 9.8 CVE-2024-14037 [ https://www.cve.org/CVERecord?i= d=3DCVE-2024-14037 ] guardian--language-system Guardian language-system pas= ses the id GET parameter directly into an unsanitized SQL query in job_info= .php (line 16): SELECT * FROM jobs where id =3D '\".$_GET['id'].\"'. No aut= hentication is required. An unauthenticated attacker can perform error-base=
d SQL injection to extract the database version, current user, schema names=
, and table contents. 2026-07-01 9.8 CVE-2026-34099 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-34099 ] guardian--language-system Guardian language-= system passes the id GET parameter directly into an unsanitized SQL query i=
n media.php (line 17): SELECT id, filename, extension, type, duration, owne=
r, private FROM files where id =3D '\".$_GET['id'].\"'. An authenticated at= tacker can perform error-based SQL injection to extract database contents. = 2026-07-01 9.8 CVE-2026-34100 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -34100 ] guardian--language-system Guardian language-system passes the id G=
ET parameter directly into an unsanitized SQL query in text_file.php (line = 17): SELECT id, filename, extension, type, duration, owner, private FROM fi= les where id =3D '\".$_GET['id'].\"'. An authenticated attacker can perform=
error-based SQL injection to extract database contents. 2026-07-01 9.8 CVE= -2026-34101 [ https://www.cve.org/CVERecord?id=3DCVE-2026-34101 ] guardian-= -language-system Guardian language-system passes the id GET parameter direc= tly into an unsanitized SQL query in job_info_get.php (line 16): SELECT * F= ROM jobs where input1 =3D '\".$_GET['id'].\"'. An authenticated attacker ca=
n perform error-based SQL injection to extract database contents. 2026-07-0=
1 9.8 CVE-2026-34102 [ https://www.cve.org/CVERecord?id=3DCVE-2026-34102 ] = guardian--language-system Guardian language-system passes the id GET parame= ter directly into an unsanitized SQL query in subtitles.php (line 16): SELE=
CT id, filename, extension, type FROM files where id =3D '\".$_GET['id'].\"=
'. An authenticated attacker can perform error-based SQL injection to extra=
ct database contents. 2026-07-01 9.8 CVE-2026-34103 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-34103 ] guardian--language-system Guardian language-= system passes the name GET parameter directly into an unsanitized SQL query=
in designer.php (line 124): SELECT * FROM complex WHERE name=3D'\".$_GET['= name'].\"'. An authenticated attacker can perform error-based SQL injection=
to extract database contents. 2026-07-01 9.8 CVE-2026-34104 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-34104 ] guardian--language-system Guardian = language-system passes the id GET parameter directly into an unsanitized SQ=
L query in translate_text.php (line 15): SELECT id, filename, extension, ty=
pe FROM files where id =3D '\".$_GET['id'].\"'. An authenticated attacker c=
an perform error-based SQL injection to extract database contents. 2026-07-=
01 9.8 CVE-2026-34105 [ https://www.cve.org/CVERecord?id=3DCVE-2026-34105 ]=
guardian--language-system Guardian language-system passes the id GET param= eter directly into a PHP exec() call in subtitles.php (line 19) without san= itization: exec(\"php jobs/subtitle_rendering.php \".$login_session.\" \".$= _GET['id'].\" ...\"). No authentication is required. An unauthenticated rem= ote attacker can append shell metacharacters to the id parameter to execute=
arbitrary OS commands on the server. 2026-07-01 9.8 CVE-2026-34106 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-34106 ] guardian--language-system Gu= ardian language-system passes the id GET parameter directly into a PHP exec=
() call in translate.php (line 14) without sanitization: exec(\"php jobs/tr= anslate.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authenticatio=
n is required. An unauthenticated remote attacker can append shell metachar= acters to execute arbitrary OS commands on the server. 2026-07-01 9.8 CVE-2= 026-34107 [ https://www.cve.org/CVERecord?id=3DCVE-2026-34107 ] guardian--l= anguage-system Guardian language-system passes the id GET parameter directl=
y into a PHP exec() call in text.php (line 15) without sanitization: exec(\= "php jobs/text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authen= tication is required. An unauthenticated remote attacker can append shell m= etacharacters to execute arbitrary OS commands on the server. 2026-07-01 9.=
8 CVE-2026-34108 [ https://www.cve.org/CVERecord?id=3DCVE-2026-34108 ] guar= dian--language-system Guardian language-system passes the id GET parameter = directly into a PHP exec() call in speech.php (line 18) without sanitizatio=
n: exec(\"php jobs/speech_audio.php \".$login_session.\" \".$_GET['id'].\" = ...\"). No authentication is required. An unauthenticated remote attacker c=
an append shell metacharacters to execute arbitrary OS commands on the serv= er. 2026-07-01 9.8 CVE-2026-34109 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-34109 ] guardian--language-system Guardian language-system passes the =
id GET parameter directly into a PHP exec() call in complex_start.php (line=
14) without sanitization: exec(\"php jobs/complex.php \".$login_session.\"=
\".$_GET['id'].\" ...\"). No authentication is required. An unauthenticate=
d remote attacker can append shell metacharacters to execute arbitrary OS c= ommands on the server. 2026-07-01 9.8 CVE-2026-34110 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-34110 ] guardian--language-system Guardian language= -system passes the id GET parameter directly into a PHP exec() call in spee= chmac_text.php (line 18) without sanitization: exec(\"php jobs/speech_audio= _mac_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authenticat= ion is required. An unauthenticated remote attacker can append shell metach= aracters to execute arbitrary OS commands on the server. 2026-07-01 9.8 CVE= -2026-34111 [ https://www.cve.org/CVERecord?id=3DCVE-2026-34111 ] guardian-= -language-system Guardian language-system passes the id GET parameter direc= tly into a PHP exec() call in speechmac.php (line 18) without sanitization:=
exec(\"php jobs/speech_audio_mac.php \".$login_session.\" \".$_GET['id'].\=
" ...\"). No authentication is required. An unauthenticated remote attacker=
can append shell metacharacters to execute arbitrary OS commands on the se= rver. 2026-07-01 9.8 CVE-2026-34112 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-34112 ] guardian--language-system Guardian language-system passes th=
e id GET parameter directly into a PHP exec() call in speech_text.php (line=
18) without sanitization: exec(\"php jobs/speech_audio_text.php \".$login_= session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unau= thenticated remote attacker can append shell metacharacters to execute arbi= trary OS commands on the server. 2026-07-01 9.8 CVE-2026-34113 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-34113 ] guardian--language-system Guardia=
n language-system passes the id GET parameter directly into a PHP exec() ca=
ll in translate_text.php (line 18) without sanitization: exec(\"php jobs/tr= anslate_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authenti= cation is required. An unauthenticated remote attacker can append shell met= acharacters to execute arbitrary OS commands on the server. 2026-07-01 9.8 = CVE-2026-34114 [ https://www.cve.org/CVERecord?id=3DCVE-2026-34114 ] guardi= an--language-system Guardian language-system passes the id GET parameter di= rectly into a PHP exec() call in transcribe_amazon.php (line 15) without sa= nitization: exec(\"php jobs/transcribe_amazon.php \".$login_session.\" \".$= _GET['id'].\" ...\"). No authentication is required. An unauthenticated rem= ote attacker can append shell metacharacters to execute arbitrary OS comman=
ds on the server. 2026-07-01 9.8 CVE-2026-34115 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-34115 ] guardian--language-system Guardian language-syst=
em passes the id GET parameter directly into a PHP exec() call in transcrib= e.php (line 15) without sanitization: exec(\"php jobs/transcribe.php \".$lo= gin_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An = unauthenticated remote attacker can append shell metacharacters to execute = arbitrary OS commands on the server. 2026-07-01 9.8 CVE-2026-34116 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-34116 ] guardian--language-system Gua= rdian language-system passes the id GET parameter directly into a PHP exec(=
) call in text_to_subtitles.php (line 19) without sanitization: exec(\"php = jobs/text_to_subtitles.php \".$login_session.\" \".$_GET['id'].\" ...\"). N=
o authentication is required. An unauthenticated remote attacker can append=
shell metacharacters to execute arbitrary OS commands on the server. 2026-= 07-01 9.8 CVE-2026-34117 [ https://www.cve.org/CVERecord?id=3DCVE-2026-3411=
7 ] Gurmehub--POS Entegratr Unauthenticated Broken Access Control in POS En= tegrat=C3=83=C2=B6r <=3D 3.7.103 versions. 2026-07-02 8.2 CVE-2026-57688 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-57688 ] Haktan Suren--HandL UTM=
Grabber Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <=
=3D 2.9.2 versions. 2026-07-02 7.1 CVE-2026-57351 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-57351 ] Hanwang--e-Face General Management Platform A = vulnerability was determined in Hanwang e-Face General Management Platform = 6.3.5.4. This issue affects some unknown processing of the file /manage/res= ourceUpload/upload.do. Executing a manipulation of the argument File can le=
ad to unrestricted upload. The attack may be launched remotely. The exploit=
has been publicly disclosed and may be utilized. 2026-06-29 7.3 CVE-2026-1= 3547 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13547 ] Hanwang--e-Face = General Management Platform A vulnerability was identified in Hanwang e-Fac=
e General Management Platform 6.3.5.4. This impacts an unknown function of = the file /sysAuthStr/querySysAuthStr.do. The manipulation of the argument o= rder leads to sql injection. It is possible to initiate the attack remotely=
. The exploit is publicly available and might be used. 2026-07-05 7.3 CVE-2= 026-14737 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14737 ] Heateor Sup= port--Heateor Social Login Unauthenticated Cross Site Request Forgery (CSRF=
) in Heateor Social Login <=3D 1.1.39 versions. 2026-07-02 8.1 CVE-2026-577=
51 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57751 ] Hiroaki Miyashita-= -Custom Field Template Contributor SQL Injection in Custom Field Template <= =3D 2.7.8 versions. 2026-07-02 8.5 CVE-2026-57687 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-57687 ] Hitachi--Hitachi Virtual Storage Platform E390=
, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H Improper Authorizati=
on Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform=
. This issue affects Hitachi Virtual Storage Platform E390, E590, E790, E99=
0, E1090, E390H, E590H, E790H, E1090H: before DKCMAIN Ver. 93-07-26-xx/00, = GUM Ver. 93-07-26/00; Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5= 500H, 5200, 5600, 5200H, 5600H: before DKCMAIN Ver. 90-09-27-00/00, GUM Ver=
. 90-09-27/00; Hitachi Virtual Storage Platform G130, G150, G350, G370, G70=
0, G900, F350, F370, F700, F900: before DKCMAIN Ver. 88-08-16-xx/00, GUM Ve=
r. 88-08-20/00. 2026-06-29 8.3 CVE-2025-2902 [ https://www.cve.org/CVERecor= d?id=3DCVE-2025-2902 ] hiyouga--LlamaFactory LLaMA-Factory through 0.9.5 co= ntains a remote code execution vulnerability that allows attackers with Web=
UI access to execute arbitrary Python code by supplying a malicious model p= ath in the Chat or Training interfaces. The application passes user-supplie=
d model path input unvalidated into AutoTokenizer.from_pretrained() and Aut= oModel.from_pretrained() with a hardcoded trust_remote_code=3DTrue paramete=
r, causing the Hugging Face transformers library to fetch and execute arbit= rary code from a remote or local model repository with the privileges of th=
e server process. 2026-06-30 9.8 CVE-2026-58116 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-58116 ] HKUDS--DeepTutor DeepTutor before version 1.4.10=
contains an authorization bypass vulnerability that allows low-privilege u= sers to invoke unrestricted MCP tools due to the allowed_mcp_tools function=
returning None instead of a denied result when mcp_tools is omitted from a=
user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-i= njected content acting within a user session can enumerate and invoke any c= onfigured MCP tool, including filesystem, shell, and browser servers, gaini=
ng unauthorized access to sensitive deployment resources. 2026-06-30 8.8 CV= E-2026-58168 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58168 ] HKUDS--V= ibe-Trading Vibe-Trading before 0.1.10 builds the proposal file path by joi= ning a caller-supplied proposal identifier onto the broker proposals direct= ory without sanitization (agent/src/live/mandate/commit.py). A proposal ide= ntifier containing path traversal sequences causes the application to load =
an attacker-controlled JSON file as an authoritative live trading mandate. = Combined with the file upload endpoint, an admitted caller can write a JSON=
file to a known location and traverse to it, and because the ceilings vali= dation is skipped when ceilings are absent, the attacker fully controls the=
committed mandate. 2026-06-30 8.3 CVE-2026-58170 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-58170 ] HKUDS--Vibe-Trading Vibe-Trading before 0.1.10=
contains a DNS rebinding authentication bypass vulnerability that allows r= emote attackers to bypass bearer-token authentication by exploiting the ser= ver's trust of TCP peer addresses for loopback clients combined with missin=
g Host header validation while binding to 0.0.0.0 with credentialed CORS. A= ttackers can craft a malicious DNS rebinding page to issue authenticated re= quests to the local API server, reach the shell execution endpoint with a b= ash-enabled preset, and achieve remote code execution as the API process us=
er while also overwriting LLM and data-source settings to exfiltrate creden= tials. 2026-06-30 7.5 CVE-2026-58169 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-58169 ] home-assistant--core Home Assistant is open source home aut= omation software that puts local control and privacy first. Prior to 2025.5= .0, The iOS companion app ignores the SSID allowlist for internal networks.=
The app uses SSID to detect when to use the internal URL, but whenever the=
app cannot find any other URL to be used, it fallbacks to the internal URL=
as well, which can expose user's token when connected to a not secure netw= ork. This vulnerability is fixed in 2025.5.0. 2026-06-29 7.5 CVE-2026-55844=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-55844 ] hoppscotch--hoppscot=
ch Hoppscotch is an API development ecosystem. In self-hosted deployments o=
f hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated=
POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The = global NestJS ValidationPipe is configured without whitelist: true, so extr=
a properties on the request body that are not declared in SaveOnboardingCon= figRequest are not stripped and are iterated in the service layer as if the=
y were legitimate InfraConfig entries. Because keys such as JWT_SECRET and = SESSION_SECRET are valid InfraConfigEnum values and are not explicitly reje= cted during validation, an unauthenticated attacker who can reach a fresh i= nstance before onboarding completes (or when no users exist) can overwrite = these values in the database. Overwriting JWT_SECRET gives the attacker con= trol of the JWT signing key, allowing them to forge tokens for any user, in= cluding administrators, and results in full server compromise. The issue is=
fixed in hoppscotch 2026.5.0. 2026-07-01 10 CVE-2026-50160 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-50160 ] https://wpreviewslider.com/--WP Revi=
ew Slider Pro The WP Review Slider Pro plugin for WordPress is vulnerable t=
o SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs = AJAX action in versions up to, and including, 12.7.2. The parameter is read=
via $_POST['notinstring'] and passed through sanitize_text_field() - which=
strips HTML and whitespace but does not provide SQL safety. The value is t= hen concatenated directly into a numeric/unquoted `AND id NOT IN (...)` cla= use and executed via $wpdb->get_results() without $wpdb->prepare() or intva= l() casting. Because the value sits in an unquoted numeric context, WordPre= ss's wp_magic_quotes protection (which only escapes embedded quotes) is ine= ffective. The AJAX hook is registered via wp_ajax_nopriv_wprp_load_more_rev=
s, and the required check_ajax_referer nonce is publicly available via wp_l= ocalize_script on any frontend page that renders the plugin shortcode, so a=
n unauthenticated attacker who can reach a public page hosting the plugin c=
an extract arbitrary data from the database via blind/time-based injection.=
2026-07-02 7.5 CVE-2026-8441 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -8441 ] HubSpot--HubSpot Insertion of Sensitive Information Into Sent Data = vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issu=
e affects HubSpot: from n/a through 11.3.51. 2026-07-01 7.4 CVE-2026-57736 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-57736 ] Hyland--PACSgear Medi= aWriter PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on p= ort 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs Remo= teObj and UIRemoteObj, without any authentication requirement. By exploitin=
g the MarshalByRefObject object unmarshalling technique and implementing .N=
ET WebClient class methods, an unauthenticated remote attacker can read and=
write arbitrary files on the host filesystem. The ObjectURIs are identical=
across all installations by default. Chaining the arbitrary file write pri= mitive with DLL hijacking opportunities in the MediaWriter service (which r= uns as NT Authority\SYSTEM and loads missing DLLs such as CRYPTBASE.DLL fro=
m the application directory) enables unauthenticated remote code execution =
as SYSTEM upon service restart. 2026-07-01 9.8 CVE-2026-58127 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-58127 ] Hyland--PACSgear PACS Scan PACSgea=
r PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnera= bility that allows remote attackers to read and write arbitrary files by ex= ploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExch= Queue.exe without any authentication requirement. Attackers can chain the a= rbitrary file write primitive with DLL hijacking in PGImageExchangeQueueSvc= .exe, which loads missing DLLs such as CRYPTSP.DLL from the application dir= ectory, to achieve remote code execution as NT Authority\SYSTEM upon servic=
e restart. 2026-07-01 9.8 CVE-2026-58126 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-58126 ] IBM--Business Automation Manager Open Editions IBM Busi= ness Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to =
an XML external entity injection (XXE) attack when processing XML data. A r= emote attacker could exploit this vulnerability to expose sensitive informa= tion or consume memory resources. 2026-06-30 7.6 CVE-2026-13449 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-13449 ] IBM--Db2 IBM Db2 11.5.0 through = 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution du=
e to improper pre-auth DRDA handshake handling. 2026-06-30 9.8 CVE-2026-101=
09 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10109 ] IBM--DevOps Automa= tion IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalid= ate session IDs after expiration which could allow an authenticated user to=
impersonate another user on the system. 2026-06-30 8.1 CVE-2025-36359 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2025-36359 ] IBM--Langflow OSS IBM Lan= gflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret avail= able to the Langflow process, read and modify every flow, conversation, mes= sage, file upload, and saved component in the Langflow database, can connec=
t to internal services, abuse cloud metadata endpoints, laterally move to o= ther tenants on the same Langflow instance, and Establish persistence by mo= difying the public flow's `tool_code` so normal `/api/v1/build/...` calls b=
y any user re-execute attacker code at each build. 2026-06-30 10 CVE-2026-1= 0134 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10134 ] IBM--Langflow OS=
S IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared= -state handling that allows reuse of API clients across tenant boundaries. =
An authenticated attacker can manipulate cache state to cause requests from=
other users to be processed using incorrect upstream API credentials, lead= ing to cross-tenant billing and accountability misattribution. 2026-06-30 9=
.6 CVE-2026-10140 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10140 ] IBM= --Langflow OSS IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthentic= ated attackers to access protected MCP project resources and execute MCP op= erations due to improper authorization enforcement in the Streamable MCP tr= ansport endpoint. 2026-06-30 9.1 CVE-2026-7663 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-7663 ] IBM--Langflow OSS IBM Langflow OSS 1.0.0 through 1= .10.0 could allow arbitrary code execution due to improper validation of fl=
ow nodes with missing or empty component type fields. 2026-06-30 9.8 CVE-20= 26-7803 [ https://www.cve.org/CVERecord?id=3DCVE-2026-7803 ] IBM--Langflow = OSS IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to=
execute arbitrary code with full application privileges, compromising all = secrets, data, and system integrity. 2026-06-30 9.8 CVE-2026-7871 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-7871 ] IBM--Langflow OSS IBM Langflow = OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrar=
y OS commands and read sensitive files including credentials, enabling comp= lete system compromise and lateral movement. 2026-06-30 9.9 CVE-2026-7873 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-7873 ] IBM--Langflow OSS IBM L= angflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all sto= red credentials due to the use of a weak and reversible key derivation mech= anism for encryption at rest. 2026-06-30 9.1 CVE-2026-7874 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-7874 ] IBM--Langflow OSS IBM Langflow OSS 1.0=
.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection b= ypass vulnerability in the API Request component. An authenticated attacker=
with low-level privileges (flow author role) can bypass SSRF protections b=
y enabling the follow_redirects parameter and supplying a public URL that r= edirects to internal/localhost addresses. The vulnerability exists because = the application validates only the initial URL but does not re-validate red= irect destinations. This allows attackers to access internal HTTP services,=
localhost endpoints, cloud metadata services, and private network resource=
s that should be unreachable when SSRF protection is enabled. Successful ex= ploitation can lead to disclosure of sensitive information including creden= tials, tokens, internal API responses, and administrative panel data. 2026-= 06-30 8.5 CVE-2026-10129 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1012=
9 ] IBM--Langflow OSS IBM Langflow OSS 1.0.0 through 1.9.6 contains a missi=
ng authentication vulnerability in /api/v1/build_public_tmp/ endpoints that=
allows an unauthenticated attacker to read build event data or cancel jobs=
using a valid job identifier, resulting in information disclosure and deni=
al of service. 2026-06-30 8.2 CVE-2026-10560 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-10560 ] IBM--Langflow OSS IBM Langflow OSS 1.0.0 through 1.= 9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComp= onent in rss.py and SearXNG component in searxng.py make unvalidated HTTP r= equests to user-controlled URLs, bypassing SSRF protections introduced in v= ersion 1.9.3. An authenticated attacker can exploit this to access internal=
resources including cloud metadata services (AWS/Azure/GCP IMDS), potentia= lly exfiltrating IAM credentials and enumerating internal networks. The vul= nerability can also be triggered through prompt injection in agentic workfl= ows due to tool_mode=3DTrue exposure. 2026-06-30 8.2 CVE-2026-10564 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-10564 ] IBM--Langflow OSS IBM Langfl=
ow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vu= lnerability in the URL component ( src/lfx/src/lfx/components/data_source/u= rl.py ) due to a Time-of-Check/Time-of-Use (TOCTOU) race condition that can=
be exploited via DNS rebinding. 2026-06-30 7.1 CVE-2026-10546 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-10546 ] IBM--WebSphere Application Server=
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site = scripting vulnerability in the administrative console's integrated help sys= tem. 2026-06-30 9.3 CVE-2026-11708 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-11708 ] IBM--WebSphere Application Server IBM WebSphere Application S= erver 9.0, and 8.5 is affected by a cross-site scripting vulnerability in t=
he administrative console help system. 2026-06-30 9.3 CVE-2026-11712 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-11712 ] IBM--WebSphere Application = Server IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross= -site scripting vulnerability in the administrative console. 2026-06-30 8.5=
CVE-2026-11594 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11594 ] IBM--= WebSphere Application Server IBM WebSphere Application Server 9.0, and 8.5 = and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 ar=
e affected by an HTTP request smuggling vulnerability. 2026-06-30 7.4 CVE-2= 026-11541 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11541 ] IBM--WebSph= ere Application Server - Liberty IBM WebSphere Application Server - Liberty=
17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vul= nerability with the apiDiscovery-1.0 feature enabled. 2026-06-30 8.5 CVE-20= 26-11714 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11714 ] IBM--WebSphe=
re Application Server - Liberty IBM WebSphere Application Server - Liberty = 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vuln= erability with the adminCenter-1.0 feature enabled. 2026-06-30 7.1 CVE-2026= -11546 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11546 ] IBM--WebSphere=
Application Server - Liberty IBM WebSphere Application Server - Liberty 17= .0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability=
with the restConnector-2.0 feature enabled. 2026-06-30 7.2 CVE-2026-11806 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-11806 ] IBM--WebSphere Extrem=
e Scale IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three Obj= ectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableIn= putStream, ObjectInputStreamResolver) that install no JEP-290 class filter;=
when Coherence is on the classpath, multiple RCE gadget chains including R= emoteConstructor.readResolve and PriorityQueue/ExtractorComparator are conf= irmed working, allowing a post-login attacker who can write a session attri= bute or a LAN-adjacent attacker on the grid replication wire to execute arb= itrary code on peer WAS JVMs 2026-06-30 7.5 CVE-2026-13759 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-13759 ] IBM--WebSphere Extreme Scale IBM WebS= phere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine=
resolves attacker-supplied class names via Class.forName() and invokes the=
ir constructors with no allow-list at three distinct sinks (SELECT NEW, enu=
m literals, and reflection-based comparators); an authenticated remote atta= cker who can influence an application-built OQL query string can execute ar= bitrary constructors on the WAS JVM, and a SELECT DISTINCT variant using pl= anted grid values fires the same gadget post-readObject in a manner that su= rvives JEP-290 serialization filters across grid node boundaries 2026-06-30=
7.5 CVE-2026-13772 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13772 ] i= mithemes--NativeChurch Unauthenticated Cross Site Scripting (XSS) in Native= Church <=3D 4.8.8.2 versions. 2026-07-02 7.1 CVE-2026-27408 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-27408 ] impleCode--eCommerce Product Catalog=
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <=
=3D 3.5.4 versions. 2026-07-02 7.1 CVE-2026-57360 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-57360 ] iNET--iNET Webkit Contributor SQL Injection in=
iNET Webkit 1.2.4 versions. 2026-07-02 8.5 CVE-2026-57752 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-57752 ] itsourcecode--Baptism Information Man= agement System A weakness has been identified in itsourcecode Baptism Infor= mation Management System 1.0. The impacted element is an unknown function o=
f the file /delbaptism.php. This manipulation of the argument ID causes sql=
injection. The attack is possible to be carried out remotely. The exploit = has been made available to the public and could be used for attacks. 2026-0= 6-29 7.3 CVE-2026-13550 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13550=
] itsourcecode--Baptism Information Management System A security vulnerabi= lity has been detected in itsourcecode Baptism Information Management Syste=
m 1.0. This affects an unknown function of the file /editBaptism.php. Such = manipulation of the argument ID leads to sql injection. The attack may be p= erformed from remote. The exploit has been disclosed publicly and may be us= ed. 2026-06-29 7.3 CVE-2026-13551 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-13551 ] itsourcecode--Online Hotel Management System A vulnerability w=
as detected in itsourcecode Online Hotel Management System 1.0. This impact=
s an unknown function of the file /admin/mod_amenities/controller.php?actio= n=3Dedit. Performing a manipulation of the argument amen_id results in sql = injection. It is possible to initiate the attack remotely. The exploit is n=
ow public and may be used. 2026-06-29 7.3 CVE-2026-13552 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-13552 ] itsourcecode--Online Hotel Management S= ystem A flaw has been found in itsourcecode Online Hotel Management System = 1.0. Affected is an unknown function of the file /admin/mod_amenities/contr= oller.php?action=3Dadd. Executing a manipulation of the argument image can = lead to unrestricted upload. It is possible to launch the attack remotely. = The exploit has been published and may be used. 2026-06-29 7.3 CVE-2026-135=
53 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13553 ] itsourcecode--Onli=
ne Hotel Management System A vulnerability was found in itsourcecode Online=
Hotel Management System 1.0. Affected by this issue is some unknown functi= onality of the file /admin/mod_users/controller.php?action=3Dadd. The manip= ulation of the argument Name results in sql injection. The attack can be la= unched remotely. The exploit has been made public and could be used. 2026-0= 6-29 7.3 CVE-2026-13555 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13555=
] itsourcecode--Online Hotel Management System A vulnerability was identif= ied in itsourcecode Online Hotel Management System 1.0. The affected elemen=
t is an unknown function of the file /admin/login.php. The manipulation of = the argument email leads to sql injection. The attack may be initiated remo= tely. The exploit is publicly available and might be used. 2026-07-05 7.3 C= VE-2026-14688 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14688 ] Jacob N=
. Breetvelt--WP Photo Album Plus Unauthenticated Cross Site Scripting (XSS)=
in WP Photo Album Plus <=3D 9.2.02.004 versions. 2026-07-02 7.1 CVE-2026-5= 7675 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57675 ] JAIOTlink--C492A= -W6 Wi-Fi IP Camera JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.= 8.30.57701411 contain a hard-coded credentials vulnerability that allows ne= twork-adjacent attackers to gain unauthorized access by using the default a= dmin username with an empty password accepted by the anyka_ipc HTTP service=
on port 80. Attackers can authenticate with these hardcoded credentials to=
access camera snapshots, video streams, network configuration, and factory= -level API endpoints including the SetMAC command injection surface. 2026-0= 7-01 9.8 CVE-2026-58453 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58453=
] JAIOTlink--C492A-W6 Wi-Fi IP Camera JAIOTlink C492A-W6 Wi-Fi IP cameras = running firmware 4.8.30.57701411 contain an OS command injection vulnerabil= ity that allows authenticated attackers to achieve remote code execution by=
supplying a malicious Wireless parameter to the HTTP PUT NetSDK/Factory Se= tMAC endpoint. Attackers can craft a string beginning with a valid MAC-like=
prefix followed by a semicolon and a shell payload, which bypasses partial=
sscanf() validation and is passed unsanitized into an echo shell command e= xecuted through a system() wrapper. 2026-07-01 8.8 CVE-2026-58452 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-58452 ] JAIOTlink--C492A-W6 Wi-Fi IP C= amera JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 = contain a remote code execution vulnerability that allows authenticated att= ackers to execute arbitrary shell scripts by writing to the writable persis= tent JFFS2 storage path and triggering execution through the authenticated = HTTP endpoint. Attackers can stage a malicious script in the writable persi= stent storage and request the config endpoint to invoke it via popen(), ach= ieving persistent remote code execution that survives device reboots. 2026-= 07-01 7.5 CVE-2026-58454 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5845=
4 ] jairiidriss--restaurant-website-php-mysql A vulnerability was found in = jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee= 40cba67f3d35. This vulnerability affects unknown code of the file /admin/aj= ax_files of the component AJAX Endpoint. Performing a manipulation results =
in missing authentication. The attack is possible to be carried out remotel=
y. The exploit has been made public and could be used. This product adopts =
a rolling release strategy to maintain continuous delivery. Therefore, vers= ion details for affected or updated releases cannot be specified. The proje=
ct was informed of the problem early through an issue report but has not re= sponded yet. 2026-07-04 7.3 CVE-2026-14622 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-14622 ] jeecgboot--JeecgBoot JeecgBoot through 3.9.2 contains=
a broken access control vulnerability that allows authenticated low-privil= ege users to perform full create, read, update, and delete operations on Op= enAPI credentials by accessing the OpenApiAuthController and OpenApiPermiss= ionController endpoints which lack Shiro authorization annotations. Attacke=
rs can exploit the unenforced access controls to list, add, edit, and delet=
e all AK/SK credential pairs, with the list endpoint returning secret keys =
in plaintext, enabling credential theft and unauthorized invocation of the = OpenAPI surface. 2026-06-30 8.1 CVE-2026-58377 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-58377 ] jeecgboot--jimureport JimuReport through 2.5.0 ex= poses the POST /jmreport/auto/export endpoint without authentication: the h= andler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor ski=
ps all authentication and authorization, and the export service streams the=
rendered report for any supplied report id without verifying the auto-expo=
rt configuration flag. An unauthenticated remote attacker can enumerate Sno= wflake report identifiers and export the full contents of any report, inclu= ding the data returned by the report configured SQL queries and any credent= ials embedded in its data sources. 2026-06-30 7.5 CVE-2026-58375 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-58375 ] juicedata--juicefs JuiceFS thro= ugh 1.3.1, fixed in commit a46979c, contains an authentication bypass vulne= rability that allows unauthenticated remote attackers to access sensitive d= ebug and metrics endpoints by exploiting improper handler registration on t=
he shared http.DefaultServeMux. Attackers can request the /debug/pprof/cmdl= ine endpoint to obtain the process command line containing metadata engine = connection strings with database credentials, granting full read/write acce=
ss to filesystem metadata, while other pprof handlers leak internal state a=
nd profiling handlers enable denial of service. 2026-07-02 7.7 CVE-2026-590=
92 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59092 ] kirilkirkov--Ecomm= erce-CodeIgniter-Bootstrap A security vulnerability has been detected in ki= rilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3= eb973a1f5e6a7. The affected element is the function getCartItems in the lib= rary application/libraries/ShoppingCart.php. The manipulation of the argume=
nt shopping_cart leads to deserialization. The attack can be initiated remo= tely. The exploit has been disclosed publicly and may be used. Continious d= elivery with rolling releases is used by this product. Therefore, no versio=
n details of affected nor updated releases are available. The identifier of=
the patch is 49b20f53de2b7ec34e920b11c863f1491d911a04. It is recommended t=
o apply a patch to fix this issue. 2026-07-04 8.2 CVE-2026-14637 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-14637 ] kirilkirkov--Ecommerce-CodeIgni= ter-Bootstrap A security flaw has been discovered in kirilkirkov Ecommerce-= CodeIgniter-Bootstrap up to 222ff31c06687b1c6d0e1ab63953f82c3674c52b. This = issue affects some unknown processing of the file application/modules/vendo= r/controllers/AddProduct.php of the component Vendor Multi-Image Endpoint. = Performing a manipulation of the argument folder results in path traversal.=
It is possible to initiate the attack remotely. The exploit has been relea= sed to the public and may be used for attacks. This product is using a roll= ing release to provide continious delivery. Therefore, no version details f=
or affected nor updated releases are available. The patch is named 2a9497ff= 11f36e573ad99e1c357ff0e6ded49745. Applying a patch is the recommended actio=
n to fix this issue. 2026-07-04 7.3 CVE-2026-14635 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-14635 ] KongHQ--mcp-konnect A vulnerability exists in=
the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.=
0, which could allow a remote attacker to perform an indirect prompt inject= ion attack and execute unintended API requests. 2026-07-03 7.4 CVE-2026-133=
41 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13341 ] kstover--Ninja For=
ms The Contact Form Builder That Grows With You The Ninja Forms - The Conta=
ct Form Builder That Grows With You plugin for WordPress is vulnerable to u= nauthorized access of data due to a missing authorization check on the 'nin= ja-forms-views/token/refresh' REST callback in all versions up to, and incl= uding, 3.14.1. This makes it possible for unauthenticated attackers to view=
form submissions, which could potentially contain sensitive information. 2= 026-07-01 7.5 CVE-2026-1239 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 239 ] LadybirdBrowser--Ladybird Ladybird contains a dangling-reference memo= ry-safety flaw in its WebAssembly ESM-integration module loader. When a Jav= aScript function is imported into a WebAssembly module via the ESM path, We= bAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to=
create_host_function, whose host callback captures and later reads that re= ference; once the ESM link-loop iteration ends the FunctionType is destroye=
d, leaving the callback with a dangling reference (the normal instantiate p= ath uses a long-lived reference and is not affected). Stale result-type dat=
a lets the host callback return an empty result vector for a statically non= -empty result, so the destination register retains an attacker-influenced v= alue that is then consumed by the WASM-GC array.set handler, which bit-cast=
s the reference low bits to an ArrayInstance pointer after only a null chec=
k, yielding an arbitrary write. A web page can chain this into code executi=
on in the WebContent process. Verified reachable from HTML content without = any instrumentation or source modification. 2026-07-01 8.3 CVE-2026-58592 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-58592 ] latepoint--LatePoint C= alendar Booking Plugin for Appointments and Events The LatePoint - Calendar=
Booking Plugin for Appointments and Events plugin for WordPress is vulnera= ble to Privilege Escalation to Administrator in versions up to, and includi= ng, 5.6.3 This is due to an Insecure Direct Object Reference (IDOR) in the = create_or_update() function of OsOrdersController, which allows an authenti= cated Agent to supply an arbitrary order[customer_id] and overwrite any Lat= ePoint customer's email field (including one linked to a WordPress Administ= rator's account) through the public-scope customer set_data() call, combine=
d with a missing role verification in OsAuthHelper::authorize_customer() wh= ich logs in the linked WordPress user without checking its role. This makes=
it possible for authenticated attackers, with custom (Agent)-level access = and above, to elevate their privileges to Administrator. 2026-07-01 8.8 CVE= -2026-13228 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13228 ] LCweb--Pr= ivateContent Incorrect Privilege Assignment vulnerability in LCweb PrivateC= ontent allows Privilege Escalation. This issue affects PrivateContent: from=
n/a through 9.9.2. 2026-07-01 9.8 CVE-2026-57692 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-57692 ] leshchenko1979--fast-mcp-telegram fast-mcp-tel= egram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validate=
s HTTP Bearer tokens by joining the raw token string into a session-file pa= th. The verifier rejects the exact reserved token telegram, but it does not=
reject path separators or normalize the path before checking whether the s= ession file exists. A remote HTTP client can therefore authenticate as the = default legacy session with a token such as ../fast-mcp-telegram/telegram w= hen the documented default session file ~/.config/fast-mcp-telegram/telegra= m.session exists. This bypasses the reserved session name control that is i= ntended to prevent HTTP multi-user sessions from colliding with the default=
stdio or legacy account. With account-prefixed MCP tools enabled, the atta= cker still sees and calls the prefixed tools for the default account, so th=
e prefix middleware does not stop the session selection bypass. This vulner= ability is fixed in 0.19.1. 2026-07-02 9.4 CVE-2026-52830 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-52830 ] Levelfourdevelopment--WP EasyCart Cont= ributor SQL Injection in WP EasyCart <=3D 5.9.0 versions. 2026-07-02 8.5 CV= E-2026-57765 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57765 ] liftoff-= sr--CIPster A vulnerability was detected in liftoff-sr CIPster up to e8e9db= a09bf56962807d3504b783ccdb6287f3e4. Affected by this issue is the function = BufWriter::append of the component EtherNet IP Message Handler. Performing =
a manipulation results in out-of-bounds write. Remote exploitation of the a= ttack is possible. The exploit is now public and may be used. This product = follows a rolling release approach for continuous delivery, so version deta= ils for affected or updated releases are not provided. The patch is named 3= a0159ed43125dcd024a1965f0289cb186bae9ff. To fix this issue, it is recommend=
ed to deploy a patch. 2026-06-29 7.3 CVE-2026-13592 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-13592 ] LinuxCNC--LinuxCNC rtapi_app in linuxcnc-usp= ace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed S= UID root and loads shared library modules via dlopen() by using a user-supp= lied module name. Insufficient validation of the module name allows path tr= aversal, enabling an unprivileged local user to load an arbitrary shared li= brary. Because the process retains elevated privileges during module loadin=
g, this results in local privilege escalation to root. 2026-06-30 8.4 CVE-2= 026-58302 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58302 ] lobehub--lo= behub LobeChat before 2.2.10-canary.18 contains a server-side request forge=
ry vulnerability that allows authenticated attackers to direct internal HTT=
P requests to arbitrary URLs by supplying user-controlled input to the skil=
l import service (importFromUrl) and topic cover update (fetchImageFromUrl)=
endpoints, which use the global fetch without the project's ssrf-safe-fetc=
h wrapper. Attackers can target internal addresses such as cloud instance m= etadata endpoints through these unprotected code paths to disclose internal=
service responses and cloud credentials. 2026-07-02 7.7 CVE-2026-59095 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-59095 ] Melograno Venture Studio= --wpDataTables Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= =3D 6.5.1.1 versions. 2026-07-02 7.1 CVE-2026-57672 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-57672 ] Merkulove--OpenAI Chatbot for WordPress Help=
er Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPre=
ss - Helper <=3D 1.1.4 versions. 2026-07-02 7.5 CVE-2025-69134 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2025-69134 ] Metagauss--ProfileGrid Unauthenti= cated Cross Site Request Forgery (CSRF) in ProfileGrid <=3D 5.9.9.7 version=
s. 2026-07-02 8.8 CVE-2026-57759 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-57759 ] metagauss--ProfileGrid User Profiles, Groups and Communities Th=
e ProfileGrid - User Profiles, Groups and Communities plugin for WordPress =
is vulnerable to privilege escalation via account takeover in all versions =
up to, and including, 5.9.9.5. This is due to the plugin not validating a `= user_login` on registration forms that don't contain this parameter, and no=
t properly handling the error messages. This makes it possible for unauthen= ticated attackers to change email address of user account with ID=3D1 (usua= lly an administrator), and leverage that to reset the user's password and g= ain access to their account. 2026-06-30 9.8 CVE-2026-12073 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-12073 ] metagauss--RegistrationMagic Custom R= egistration Forms, User Registration, Payment, and User Login The Registrat= ionMagic - User Registration Forms Plugin plugin for WordPress is vulnerabl=
e to Cross-Site Request Forgery in all versions up to, and including, 6.0.9= .1. This is due to missing or incorrect nonce validation on the process_req= uest function. This makes it possible for unauthenticated attackers to esca= late the privileges of an arbitrary form submitter to administrator by crea= ting a malicious Chronos automation task that is executed via WordPress cro=
n via a forged request granted they can trick a site administrator into per= forming an action such as clicking on a link. 2026-07-01 8.8 CVE-2026-12158=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-12158 ] Microsoft--Azure Ope=
n AI Server-side request forgery (ssrf) in Azure OpenAI allows an authorize=
d attacker to elevate privileges over a network. 2026-07-02 9.9 CVE-2026-45= 499 [ https://www.cve.org/CVERecord?id=3DCVE-2026-45499 ] Microsoft--Micros= oft 365 Copilot Url redirection to untrusted site ('open redirect') in M365=
Copilot allows an unauthorized attacker to elevate privileges over a netwo= rk. 2026-07-02 9.3 CVE-2026-41106 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-41106 ] Microsoft--Microsoft Edge (Chromium-based) Access of resource = using incompatible type ('type confusion') in Microsoft Edge (Chromium-base=
d) allows an unauthorized attacker to execute code over a network. 2026-07-=
03 9 CVE-2026-58289 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58289 ] M= icrosoft--Microsoft Edge (Chromium-based) Use after free in Microsoft Edge = (Chromium-based) allows an authorized attacker to execute code over a netwo= rk. 2026-07-01 8.3 CVE-2026-50521 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-50521 ] Microsoft--Microsoft Edge (Chromium-based) Heap-based buffer o= verflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker =
to execute code over a network. 2026-07-03 8.8 CVE-2026-56645 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-56645 ] Microsoft--Microsoft Edge (Chromiu= m-based) Integer overflow or wraparound in Microsoft Edge (Chromium-based) = allows an unauthorized attacker to execute code over a network. 2026-07-03 = 8.8 CVE-2026-57974 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57974 ] Mi= crosoft--Microsoft Edge (Chromium-based) Use after free in Microsoft Edge (= Chromium-based) allows an unauthorized attacker to execute code over a netw= ork. 2026-07-03 8.8 CVE-2026-57981 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-57981 ] Microsoft--Microsoft Edge (Chromium-based) Improper authoriza= tion in Microsoft Edge (Chromium-based) allows an unauthorized attacker to = bypass a security feature over a network. 2026-07-03 8.7 CVE-2026-57983 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-57983 ] Microsoft--Microsoft Edg=
e (Chromium-based) Improper access control in Microsoft Edge (Chromium-base=
d) allows an unauthorized attacker to perform spoofing over a network. 2026= -07-03 8.1 CVE-2026-58282 [ https://www.cve.org/CVERecord?id=3DCVE-2026-582=
82 ] Microsoft--Microsoft Edge (Chromium-based) Access of resource using in= compatible type ('type confusion') in Microsoft Edge (Chromium-based) allow=
s an unauthorized attacker to perform spoofing over a network. 2026-07-03 8=
.1 CVE-2026-58283 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58283 ] Mic= rosoft--Microsoft Edge (Chromium-based) Improper authorization in Microsoft=
Edge (Chromium-based) allows an unauthorized attacker to execute code over=
a network. 2026-07-03 8.3 CVE-2026-58284 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-58284 ] Microsoft--Microsoft Edge (Chromium-based) Access of r= esource using incompatible type ('type confusion') in Microsoft Edge (Chrom= ium-based) allows an unauthorized attacker to execute code over a network. = 2026-07-03 8.3 CVE-2026-58285 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -58285 ] Microsoft--Microsoft Edge (Chromium-based) Improper access control=
in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf= orm spoofing over a network. 2026-07-03 8.1 CVE-2026-58286 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-58286 ] Microsoft--Microsoft Edge (Chromium-b= ased) Use after free in Microsoft Edge (Chromium-based) allows an unauthori= zed attacker to execute code over a network. 2026-07-03 8.3 CVE-2026-58287 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-58287 ] Microsoft--Microsoft = Edge (Chromium-based) Use after free in Microsoft Edge (Chromium-based) all= ows an unauthorized attacker to execute code over a network. 2026-07-03 8.3=
CVE-2026-58288 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58288 ] Micro= soft--Microsoft Edge (Chromium-based) External control of file name or path=
in Microsoft Edge (Chromium-based) allows an unauthorized attacker to exec= ute code over a network. 2026-07-03 8.1 CVE-2026-58293 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-58293 ] Microsoft--Microsoft Edge (Chromium-based=
) Access of resource using incompatible type ('type confusion') in Microsof=
t Edge (Chromium-based) allows an unauthorized attacker to bypass a securit=
y feature over a network. 2026-07-03 8.3 CVE-2026-58295 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-58295 ] Microsoft--Microsoft Edge (Chromium-base=
d) Access of resource using incompatible type ('type confusion') in Microso=
ft Edge (Chromium-based) allows an unauthorized attacker to execute code ov=
er a network. 2026-07-03 7.5 CVE-2026-57975 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-57975 ] Microsoft--Microsoft Edge (Chromium-based) Improper = neutralization of input during web page generation ('cross-site scripting')=
in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf= orm spoofing over a network. 2026-07-03 7.1 CVE-2026-57977 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-57977 ] Microsoft--Microsoft Edge (Chromium-b= ased) Use after free in Microsoft Edge (Chromium-based) allows an unauthori= zed attacker to execute code over a network. 2026-07-03 7.5 CVE-2026-57984 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-57984 ] Microsoft--Microsoft = Edge (Chromium-based) Improper input validation in Microsoft Edge (Chromium= -based) allows an unauthorized attacker to execute code over a network. 202= 6-07-03 7.6 CVE-2026-57985 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57= 985 ] Microsoft--Microsoft Edge (Chromium-based) Use after free in Microsof=
t Edge (Chromium-based) allows an unauthorized attacker to execute code ove=
r a network. 2026-07-03 7.5 CVE-2026-57986 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-57986 ] Microsoft--Microsoft Edge (Chromium-based) Relative p= ath traversal in Microsoft Edge (Chromium-based) allows an unauthorized att= acker to execute code over a network. 2026-07-03 7.1 CVE-2026-57988 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-57988 ] Microsoft--Microsoft Edge (C= hromium-based) Improper link resolution before file access ('link following=
') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to di= sclose information over a network. 2026-07-03 7.4 CVE-2026-57991 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-57991 ] Microsoft--Microsoft Edge (Chro= mium-based) Use after free in Microsoft Edge (Chromium-based) allows an una= uthorized attacker to execute code over a network. 2026-07-03 7.5 CVE-2026-= 57992 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57992 ] Microsoft--Micr= osoft Edge (Chromium-based) Server-side request forgery (ssrf) in Microsoft=
Edge (Chromium-based) allows an unauthorized attacker to perform spoofing = over a network. 2026-07-03 7.4 CVE-2026-57993 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-57993 ] Microsoft--Microsoft Edge (Chromium-based) Use aft=
er free in Microsoft Edge (Chromium-based) allows an unauthorized attacker =
to execute code over a network. 2026-07-03 7.5 CVE-2026-58276 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-58276 ] Microsoft--Microsoft Edge (Chromiu= m-based) Access of resource using incompatible type ('type confusion') in M= icrosoft Edge (Chromium-based) allows an unauthorized attacker to execute c= ode over a network. 2026-07-03 7.5 CVE-2026-58290 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-58290 ] Microsoft--Microsoft Edge (Chromium-based) Imp= roper input validation in Microsoft Edge (Chromium-based) allows an unautho= rized attacker to execute code over a network. 2026-07-03 7.5 CVE-2026-5829=
2 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58292 ] Microsoft--Microsof=
t Edge (Chromium-based) Use after free in Microsoft Edge (Chromium-based) a= llows an unauthorized attacker to execute code over a network. 2026-07-03 7=
.5 CVE-2026-58294 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58294 ] Mic= rosoft--Microsoft Edge (Chromium-based) Exposure of private personal inform= ation to an unauthorized actor in Microsoft Edge for Android allows an unau= thorized attacker to disclose information over a network. 2026-07-03 7.1 CV= E-2026-58296 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58296 ] Microsof= t--Microsoft Edge (Chromium-based) Exposure of private personal information=
to an unauthorized actor in Microsoft Edge for Android allows an unauthori= zed attacker to disclose information over a network. 2026-07-03 7.1 CVE-202= 6-58297 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58297 ] Microsoft--Mi= crosoft Edge (Chromium-based) Improper neutralization of input during web p= age generation ('cross-site scripting') in Microsoft Edge (Chromium-based) = allows an unauthorized attacker to perform spoofing over a network. 2026-07= -03 7.2 CVE-2026-58298 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58298 =
] Microsoft--Microsoft Edge (Chromium-based) Time-of-check time-of-use (toc= tou) race condition in Microsoft Edge for Android allows an unauthorized at= tacker to execute code over a network. 2026-07-03 7.5 CVE-2026-58299 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-58299 ] Microsoft--Microsoft Entra = Provisioning Service Server-side request forgery (ssrf) in Microsoft Entra = Provisioning Service (SyncFabric) allows an authorized attacker to elevate = privileges over a network. 2026-07-02 9.9 CVE-2026-57100 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-57100 ] Microsoft--Microsoft Exchange Online In= correct authorization in Microsoft Exchange Online allows an authorized att= acker to elevate privileges over a network. 2026-07-02 8.8 CVE-2026-54998 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-54998 ] microsoft--OpenAPI.NET=
The OpenAPI.NET SDK contains a useful object model for OpenAPI documents i=
n .NET along with common serializers to extract raw OpenAPI JSON and YAML d= ocuments from the model. From 2.0.0-preview11 until 2.7.5 and 3.5.4, a smal=
l OpenAPI document containing a circular schema reference can cause process=
termination through stack overflow in Microsoft.OpenApi. The issue affects=
OpenAPI document parsing through public OpenAPI.NET reader APIs and has be=
en confirmed across both JSON and YAML reader paths. This vulnerability is = fixed in 2.7.5 and 3.5.4. 2026-06-30 7.5 CVE-2026-49451 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-49451 ] mjperpinosa--stumasy A vulnerability was=
identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e9876= 09d9be. Impacted is the function eval of the file application/pages/imba_ca= lculator/calculate.php. The manipulation of the argument mathematical_sente= nce leads to code injection. The attack is possible to be carried out remot= ely. The exploit is publicly available and might be used. This product adop=
ts a rolling release strategy to maintain continuous delivery. Therefore, v= ersion details for affected or updated releases cannot be specified. The pr= oject was informed of the problem early through an issue report but has not=
responded yet. 2026-07-05 7.3 CVE-2026-14749 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-14749 ] mjperpinosa--stumasy A security flaw has been disc= overed in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9b=
e. The affected element is the function Notes_controller::accessing_diction= ary_authorization of the file application/PHP/objects/notes/accessing_dicti= onary_authorization.php. The manipulation of the argument Password results =
in sql injection. The attack may be performed from remote. The exploit has = been released to the public and may be used for attacks. This product utili= zes a rolling release system for continuous delivery, and as such, version = information for affected or updated releases is not disclosed. The project = was informed of the problem early through an issue report but has not respo= nded yet. 2026-07-05 7.3 CVE-2026-14750 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14750 ] mjperpinosa--stumasy A vulnerability was detected in mj= perpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This impa= cts an unknown function of the file /PHP/objects/notes of the component Not=
e Handler/Assignment Handler. Performing a manipulation of the argument ass= ignment_item_id results in authorization bypass. The attack can be initiate=
d remotely. The exploit is now public and may be used. Continious delivery = with rolling releases is used by this product. Therefore, no version detail=
s of affected nor updated releases are available. The project was informed =
of the problem early through an issue report but has not responded yet. 202= 6-07-05 7.3 CVE-2026-14753 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14= 753 ] modoboa--modoboa Modoboa before 2.9.0 contains an insecure direct obj= ect reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endp= oint that allows domain administrators to change any user's password. Attac= kers with domain admin privileges can bypass object-level access controls t=
o reset superadmin passwords and achieve full account takeover. 2026-06-29 = 7.5 CVE-2026-56780 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56780 ] Mo= reconvert Team--MC Woocommerce Wishlist Unauthenticated Cross Site Scriptin=
g (XSS) in MC Woocommerce Wishlist <=3D 1.9.19 versions. 2026-07-02 7.1 CVE= -2026-57356 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57356 ] msgpack--= msgpack-python MessagePack is the serializer implementation for Python msgp= ack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker r= euse after a caught error, potentially leading to a DoS attack. If the Unpa= cker is used repeatedly after an error occurs, the process may crash with a=
SEGV. This issue has been fixed in version 1.2.1. 2026-06-30 7.5 CVE-2026-= 57585 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57585 ] n8n--n8n The Ex= ecute Command node in n8n allows authenticated users to execute arbitrary c= ommands on the host system where n8n runs. Attackers with user access or co= mpromised credentials can exploit this node to run malicious commands, pote= ntially leading to data exfiltration, service disruption, or complete syste=
m compromise. 2026-07-04 8.8 CVE-2025-71380 [ https://www.cve.org/CVERecord= ?id=3DCVE-2025-71380 ] neuml--txtai txtai through 9.10.0, fixed in commit 1= 1b32da, exposes an API /reindex endpoint whose function body parameter is r= esolved through txtai.util.Resolver, which performs __import__ and getattr =
on the caller-supplied dotted path with no allowlist. When the API is expos=
ed with no TOKEN configured (authentication is opt-in, so all endpoints are=
unauthenticated) and the index is configured writable, a remote attacker c=
an set function to an arbitrary callable such as subprocess.getoutput, achi= eving remote code execution as the server process during reindexing. Exploi= tation requires those deployment conditions (API exposed, no TOKEN, writabl=
e index); it is not the default configuration. The fix gates the endpoint b= ehind a new reindex configuration flag. 2026-06-30 9.8 CVE-2026-58449 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-58449 ] NodeBB--NodeBB NodeBB does=
not bind the claimed author of an inbound ActivityPub object to the authen= ticated remote actor. The inbound middleware verifies the HTTP-signature ac= tor and checks the origin of object.id, but never validates that attributed=
To corresponds to the sender. In the object mock, attributedTo is used dire= ctly as a uid, and actors.assert silently ignores numeric identifiers (filt= ering them out without re-deriving the uid), so a federated remote actor ca=
n set attributedTo to a bare numeric value such as 1 and have the resulting=
post or private message created with that local uid as author, including t=
he administrator account. This lets a remote attacker forge posts and direc=
t messages attributed to arbitrary local users. Requires the ActivityPub/fe= deration feature to be enabled. 2026-07-01 7.5 CVE-2026-58593 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-58593 ] Notifiarr--dockwatch Dockwatch thr= ough 0.6.567 contains an unauthenticated OS command injection vulnerability=
that allows remote attackers to execute arbitrary shell commands by exploi= ting a missing exit() after an authentication redirect in loader.php combin=
ed with unsanitized input passed to shell_exec() in ajax/compose.php. Attac= kers can seed the required session flag through the incomplete auth check, = then inject arbitrary commands via the composePath POST parameter in the co= mposePull action to achieve full host compromise, facilitated by the standa=
rd deployment mounting of the Docker socket. 2026-07-02 9.8 CVE-2026-58455 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-58455 ] Novalnet--Novalnet Pa= yment Gateway for WooCommerce Unauthenticated PHP Object Injection in Noval= net Payment Gateway for WooCommerce <=3D 12.10.3 versions. 2026-07-02 9.8 C= VE-2026-57677 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57677 ] NVIDIA-= -AIStore framework NVIDIA AIStore framework contains a vulnerability where =
an attacker could bypass authentication. A successful exploit of this vulne= rability might lead to denial of service, escalation of privileges, informa= tion disclosure, and data tampering. 2026-07-01 9.8 CVE-2026-24270 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-24270 ] NVIDIA--BlueField GA NVIDIA C= onnectX and BlueField contain a vulnerability in the command interface wher=
e a local user with virtual function (VF) access may cause a write out of b= ounds by crafted input. A successful exploit of this vulnerability may lead=
to arbitrary code execution on the device. 2026-07-01 9 CVE-2025-23350 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2025-23350 ] NVIDIA--BlueField GA NVI= DIA ConnectX and BlueField contain a vulnerability in the command interface=
where a local user with virtual function (VF) access may cause a write out=
of bounds by crafted input. A successful exploit of this vulnerability may=
lead to arbitrary code execution on the device. 2026-07-01 9 CVE-2025-2335=
1 [ https://www.cve.org/CVERecord?id=3DCVE-2025-23351 ] NVIDIA--Container T= oolkit NVIDIA Container Toolkit for Linux contains a vulnerability where an=
attacker could cause a time-of-check time-of-use race condition. A success= ful exploit of this vulnerability might lead to code execution, escalation =
of privileges, and data tampering. 2026-07-01 8.5 CVE-2026-24260 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-24260 ] NVIDIA--Megatron-Bridge NVIDIA = Megatron Bridge for Linux contains a vulnerability where an attacker could = cause deserialization of untrusted data. A successful exploit of this vulne= rability might lead to code execution, escalation of privileges, data tampe= ring, and information disclosure. 2026-07-01 7.8 CVE-2026-24240 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-24240 ] NVIDIA--Megatron-Bridge NVIDIA M= egatron Bridge for Linux contains a vulnerability where an attacker could c= ause server-side request forgery. A successful exploit of this vulnerabilit=
y might lead to information disclosure. 2026-07-01 7.8 CVE-2026-24242 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-24242 ] NVIDIA--Megatron-Bridge NV= IDIA Megatron Bridge for Linux contains a vulnerability where an attacker c= ould cause deserialization of untrusted data. A successful exploit of this = vulnerability might lead to code execution, escalation of privileges, data = tampering, and information disclosure. 2026-07-01 7.8 CVE-2026-24243 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-24243 ] NVIDIA--Megatron-Bridge NVI= DIA Megatron Bridge for Linux contains a vulnerability where an attacker co= uld cause deserialization of untrusted data. A successful exploit of this v= ulnerability might lead to code execution, escalation of privileges, data t= ampering, and information disclosure. 2026-07-01 7.8 CVE-2026-24244 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-24244 ] NVIDIA--Megatron-Bridge NVID=
IA Megatron Bridge for Linux contains a vulnerability where an attacker cou=
ld cause deserialization of untrusted data. A successful exploit of this vu= lnerability might lead to code execution, escalation of privileges, data ta= mpering, and information disclosure. 2026-07-01 7.8 CVE-2026-24245 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-24245 ] NVIDIA--Megatron-Bridge NVIDI=
A Megatron Bridge for Linux contains a vulnerability where an attacker coul=
d cause improper control of dynamically managed code resources. A successfu=
l exploit of this vulnerability might lead to code execution, escalation of=
privileges, data tampering, and information disclosure. 2026-07-01 7.8 CVE= -2026-24246 [ https://www.cve.org/CVERecord?id=3DCVE-2026-24246 ] NVIDIA--M= egatron-Bridge NVIDIA Megatron Bridge for Linux contains a vulnerability wh= ere an attacker could cause deserialization of untrusted data. A successful=
exploit of this vulnerability might lead to code execution, escalation of = privileges, data tampering, and information disclosure. 2026-07-01 7.8 CVE-= 2026-24247 [ https://www.cve.org/CVERecord?id=3DCVE-2026-24247 ] NVIDIA--Me= gatron-Bridge NVIDIA Megatron Bridge for Linux contains a vulnerability whe=
re an attacker could cause improper control of code generation. A successfu=
l exploit of this vulnerability might lead to code execution, escalation of=
privileges, data tampering, and information disclosure. 2026-07-01 7.8 CVE= -2026-24248 [ https://www.cve.org/CVERecord?id=3DCVE-2026-24248 ] NVIDIA--M= egatron-Bridge NVIDIA Megatron Bridge for Linux contains a vulnerability wh= ere an attacker could cause deserialization of untrusted data. A successful=
exploit of this vulnerability might lead to code execution, escalation of = privileges, data tampering, and information disclosure. 2026-07-01 7.8 CVE-= 2026-24249 [ https://www.cve.org/CVERecord?id=3DCVE-2026-24249 ] NVIDIA--Me= gatron-Bridge NVIDIA Megatron Bridge for Linux contains a vulnerability whe=
re an attacker could cause improper validation of allowed inputs. A success= ful exploit of this vulnerability might lead to code execution, escalation =
of privileges, data tampering, and information disclosure. 2026-07-01 7.8 C= VE-2026-24250 [ https://www.cve.org/CVERecord?id=3DCVE-2026-24250 ] NVIDIA-= -Megatron-Bridge NVIDIA Megatron Bridge for Linux contains a vulnerability = where an attacker could cause improper control of dynamically managed code = resources. A successful exploit of this vulnerability might lead to code ex= ecution, escalation of privileges, data tampering, and information disclosu= re. 2026-07-01 7.8 CVE-2026-24251 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-24251 ] NVIDIA--Triton Inference Server NVIDIA Triton Inference Server=
for Linux contains a vulnerability where an attacker can cause improper ha= ndling of highly compressed data. A successful exploit of this vulnerabilit=
y might lead to denial of service. 2026-07-01 7.5 CVE-2026-24264 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-24264 ] OFFIS DICOM--DCMTK Toolkit A ma= licious or compromised server can make a DCMTK client using bit-preserving = C-GET storage mode write files outside the chosen output directory, using b= oth relative (../) paths and absolute paths. 2026-06-30 9.8 CVE-2026-50003 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-50003 ] OFFIS DICOM--DCMTK To= olkit An unauthenticated attacker can read worklist records from a director=
y outside the intended per-AE worklist storage area. In a multi-area deploy= ment, this can cross departmental or clinic data separation. 2026-06-30 8.2=
CVE-2026-52868 [ https://www.cve.org/CVERecord?id=3DCVE-2026-52868 ] OFFIS=
DICOM--DCMTK Toolkit An unauthenticated remote attacker can repeatedly sen=
d crafted connection requests to leak memory. In single-process deployments=
the memory grows until the service is killed and the port stops responding=
until restart. 2026-06-30 7.5 CVE-2026-35505 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-35505 ] OFFIS DICOM--DCMTK Toolkit An unauthenticated atta= cker can crash the worklist server with a single crafted query when the ser= ver has a valid Called AE Title / storage directory, the expected lockfile,=
and at least one matching worklist record. 2026-06-30 7.5 CVE-2026-44628 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-44628 ] OFFIS DICOM--DCMTK Too= lkit An unauthenticated remote attacker can repeatedly send a single crafte=
d connection request to leak memory. Against storescp in its default single= -process mode, memory grows quickly and the service is eventually killed, a= fter which it stops accepting connections until an operator restarts it. 20= 26-06-30 7.5 CVE-2026-50254 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5= 0254 ] ohler55--oj Oj (Optimized JSON) is a JSON parser and Object marshall=
er packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child,=
when invoked recursively over a deeply nested JSON document, overflows a f= ixed-size stack buffer and aborts the process, leading to DoS. In a two-ste=
p chain in ext/oj/fast.c, doc_each_child increments doc->where past the whe= re_path[MAX_STACK =3D 100] array with no bounds check and never restores it=
(the doc->where-- is missing), so calling each_child recursively from insi=
de the yield block drives doc->where beyond the array. On the next entry th=
e function copies the path into the 800-byte stack-local buffer save_path[M= AX_STACK] using wlen =3D doc->where - doc->where_path, so when the previous=
recursive call left doc->where past where_path[100] the wlen exceeds MAX_S= TACK and the memcpy overflows save_path on the C stack; because the Oj::Doc=
parser imposes no JSON nesting-depth limit (relying on a C-stack pressure = check), deeply nested attacker input reaches this path. This issue has been=
fixed in version 3.17.3. 2026-06-30 7.5 CVE-2026-54592 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-54592 ] open62541 project / o6 Automation GmbH--= open62541 An unauthenticated remote attacker can exhaust server memory via = the GetEndpoints Discovery Service in open62541. The endpointUrl field of G= etEndpointsRequest is not validated for length. An attacker can declare an = arbitrarily large string (up to ~4.09 GB via the UInt32 length field) deliv= ered across intermediate chunks without ever sending the final chunk. The s= erver buffers all chunks in RAM indefinitely until the SecureChannel times = out. The attack is pre-session and bypasses all encryption configurations. = The=C2=A0issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 thr= ough 1.5.4, master. 2026-07-02 7.5 CVE-2026-11946 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-11946 ] open62541 project / o6 Automation GmbH--open62= 541 An unauthenticated remote attacker can exhaust server memory via the Fi= ndServers Discovery Service in open62541. The serverUris field of FindServe= rsRequest is not validated for length or array size. An attacker can declar=
e an arbitrarily large string (up to ~3.9 GB) delivered across intermediate=
chunks without ever sending the final chunk. The server buffers all chunks=
in RAM indefinitely until the SecureChannel times out. The attack is pre-s= ession and bypasses all encryption configuration. The=C2=A0issue affects op= en62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master. 2026-= 07-02 7.5 CVE-2026-33592 [ https://www.cve.org/CVERecord?id=3DCVE-2026-3359=
2 ] OpenBMB--ChatDev OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6=
, contains a path traversal vulnerability that allows unauthenticated remot=
e attackers to write or delete arbitrary files by supplying a malicious mul= tipart filename in the file upload endpoint. Attackers can send a crafted f= ilename containing path traversal sequences or an absolute path to the POST=
uploads session endpoint, which constructs the destination path without sa= nitization in save_upload_file, causing file write and cleanup operations t=
o target attacker-chosen paths on the server filesystem. 2026-06-30 9.1 CVE= -2026-58166 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58166 ] openSUSE-= -buildservice A shellcode injection in the mercurial handler of the obs tar= _scm source service before version 0.12.4 could be used by attackers able t=
o provide a _service file to execute code as the source service or the loca=
l user checking out the malicious services 2026-07-02 10 CVE-2026-56004 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-56004 ] openwrt--luci-app-tailsc= ale-community luci-app-tailscale-community contains a command injection vul= nerability in the tailscale.do_login RPC method that allows authenticated u= sers to execute arbitrary commands as root. The vulnerability exists becaus=
e user-controlled loginserver and loginserver_authkey parameters are improp= erly quoted within a double-quoted shell command, allowing shell substituti= ons like $() to be evaluated by the outer shell before argument processing.=
2026-06-29 8.8 CVE-2026-57999 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-57999 ] openwrt--luci-app-travelmate luci-app-travelmate (and the travelm= ate package) contain a privilege-escalation flaw: a LuCI/rpcd session holdi=
ng the luci-app-travelmate write ACL is granted config-wide UCI write acces=
s to the travelmate configuration. While the LuCI UI restricts the auto-log=
in script picker to /etc/travelmate/*.login, this is only a frontend restri= ction. The backend travelmate service (running as root) reads the raw UCI '= script' and 'script_args' values and executes the configured path when the = captive-portal auto-login branch (f_check() in travelmate-functions.sh) is = reached. An attacker with delegated write permissions can set script to /bi= n/sh and script_args to attacker-controlled arguments, resulting in arbitra=
ry command execution as root. Confirmed in luci-app-travelmate/travelmate 2= .4.5-r3; the sink is still present in travelmate 2.4.6-1 and no patched ver= sion is known. 2026-07-02 7.5 CVE-2026-58652 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-58652 ] openwrt--luci-proto-openvpn luci-proto-openvpn thro= ugh 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerabi= lity in the generateKey ubus method where the cl_meta parameter is interpol= ated into a shell command without proper escaping or quoting. An authentica= ted LuCI user with OpenVPN protocol configuration access can inject arbitra=
ry shell metacharacters into cl_meta to execute commands as root via the po= pen function. 2026-06-29 8.8 CVE-2026-58000 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-58000 ] openziti--ziti OpenZiti through 2.0.0, fixed in comm=
it 3027fdf, contains a privilege escalation vulnerability that allows authe= nticated non-admin identities with fine-grained enrollment management permi= ssions to create enrollments for any identity, including the default admini= strator, because the ApplyCreate function in controller/model/enrollment_ma= nager.go verifies only that the target identity exists without performing a= uthorization checks binding the caller to the target identity. Attackers ca=
n redeem the resulting one-time token through the unauthenticated client AP=
I enrollment endpoint to obtain a client certificate authenticating as the = targeted admin identity, yielding full administrative control of the contro= ller and the zero-trust overlay it manages. 2026-06-30 8.8 CVE-2026-58165 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-58165 ] OPPO--O+ Connect Becau=
se O+ Connect's IPC service does not authenticate clients, external applica= tions can escalate privileges and perform sensitive actions through the IPC=
channel. 2026-06-29 7.3 CVE-2026-22078 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-22078 ] Optimole--Optimole Unauthenticated Cross Site Scripting=
(XSS) in Optimole <=3D 4.2.7 versions. 2026-07-02 7.1 CVE-2026-57673 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-57673 ] pathwaycom--pathway Pathwa=
y through 0.31.1, fixed in commit d09722e, document store applies a caller-= supplied glob pattern to indexed document paths using a hand-written recurs= ive matcher that branches two ways on each ** token without memoization, gi= ving exponential worst-case complexity. The filepath_globpattern value is t= aken from the body of the unauthenticated HTTP endpoints /v1/retrieve, /v1/= inputs and /v2/answer and compiled into a filter evaluated once per indexed=
document, with no length or **-count limit. A remote unauthenticated attac= ker can submit a short pattern containing many ** tokens to consume CPU for=
tens of seconds per request, and a small number of requests denies service=
. 2026-07-02 7.5 CVE-2026-59094 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-59094 ] Perfmatters--perfmatters Unauthenticated Cross Site Scripting (X= SS) in perfmatters <=3D 2.6.4 versions. 2026-07-02 7.1 CVE-2026-57671 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-57671 ] perfmatters--Perfmatters T=
he Perfmatters plugin for WordPress is vulnerable to Directory Traversal in=
all versions up to, and including, 2.6.4 via the 's' parameter. This makes=
it possible for unauthenticated attackers to read the contents of arbitrar=
y files on the server, which can contain sensitive information. Exploitatio=
n requires the Local Google Fonts feature to be enabled (disabled by defaul= t), pretty permalinks to be active, and RSS feed links to remain enabled in=
the plugin settings. 2026-07-02 7.5 CVE-2026-13251 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-13251 ] pfefferle--Webmention The Webmention plugin = for WordPress is vulnerable to Stored Cross-Site Scripting in versions up t=
o and including 5.8.0 via parser-derived 'avatar' and 'url' author metadata=
. This is due to insufficient input sanitization and output escaping on use= r-supplied MF2 author properties processed by the unauthenticated webmentio=
n REST endpoint and rendered directly into HTML 'value' attributes by the e= dit-comment-form template without esc_attr() or esc_url(). This makes it po= ssible for unauthenticated attackers to inject arbitrary web scripts in pag=
es that will execute whenever a privileged user (moderator or administrator=
) opens the affected comment edit screen. 2026-06-30 7.2 CVE-2026-10513 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-10513 ] phpMyFAQ--phpMyFAQ phpMy= FAQ before 4.1.5 contains a privilege escalation vulnerability in GroupCont= roller::updatePermissions that allows GROUP_EDIT administrators to grant ar= bitrary rights to groups without verifying they hold those rights themselve=
s. A delegated administrator can exploit this by assigning high-value permi= ssions to a group they belong to, inheriting those rights and escalating pr= ivileges up to full administrative control. 2026-06-30 8.8 CVE-2026-57995 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-57995 ] Picklescan--Picklescan=
Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getli= ncoef gadget in pickle __reduce__ methods, allowing arbitrary code executio=
n. Attackers can craft malicious pickle files that execute arbitrary Python=
code when loaded, bypassing Picklescan's safety checks and enabling supply= -chain poisoning of shared model files. 2026-07-04 8.1 CVE-2025-71372 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2025-71372 ] picklescan--picklescan pic= klescan before 0.0.30 fails to detect malicious pickle files using idlelib.= run.Executive.runcode in reduce methods. Attackers can embed undetected cod=
e in pickle files that executes during pickle.load, enabling remote code ex= ecution in PyTorch models and supply chain attacks. 2026-07-04 8.1 CVE-2025= -71342 [ https://www.cve.org/CVERecord?id=3DCVE-2025-71342 ] picklescan--pi= cklescan picklescan before 0.0.30 fails to detect malicious pickle files th=
at exploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in the re= duce method. Attackers can craft malicious pickle files with embedded code = that evades detection but executes arbitrary commands when pickle.load() is=
called. 2026-07-04 8.1 CVE-2025-71343 [ https://www.cve.org/CVERecord?id= =3DCVE-2025-71343 ] picklescan--picklescan picklescan before 0.0.30 fails t=
o detect malicious pickle files that invoke torch.utils.bottleneck.__main__= .run_autograd_prof function. Attackers can embed undetected code in pickle = files that executes during deserialization, enabling remote code execution.=
2026-07-04 8.1 CVE-2025-71345 [ https://www.cve.org/CVERecord?id=3DCVE-202= 5-71345 ] picklescan--picklescan picklescan before 0.0.33 fails to detect m= alicious pickle files using numpy.f2py.crackfortran.param_eval function in = reduce methods, allowing attackers to bypass security checks. Remote attack= ers can embed undetected code in pickle files that executes during deserial= ization, enabling arbitrary code execution in applications loading untruste=
d pickle data. 2026-07-04 8.1 CVE-2025-71347 [ https://www.cve.org/CVERecor= d?id=3DCVE-2025-71347 ] picklescan--picklescan picklescan before 0.0.29 fai=
ls to detect the built-in trace.Trace.run function when analyzing pickle fi= les, allowing attackers to embed undetected malicious code. Remote attacker=
s can craft malicious pickle files using trace.Trace.run in the reduce meth=
od to achieve arbitrary code execution when pickle.load processes the file.=
2026-06-30 8.1 CVE-2025-71349 [ https://www.cve.org/CVERecord?id=3DCVE-202= 5-71349 ] picklescan--picklescan picklescan before 0.0.28 fails to detect m= alicious pickle files using torch.utils.collect_env.run function in reduce = methods. Attackers can embed undetected code in pickle files that executes = remote commands when loaded by victims. 2026-06-30 8.1 CVE-2025-71350 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2025-71350 ] picklescan--picklescan pic= klescan before 0.0.29 fails to detect the built-in Python trace.Trace.runct=
x function when used in pickle file reduce methods, allowing attackers to e= xecute arbitrary code. Remote attackers can craft malicious pickle files wi=
th trace.Trace.runctx payloads that bypass picklescan detection and execute=
code upon pickle.load() invocation. 2026-06-30 8.1 CVE-2025-71352 [ https:= //www.cve.org/CVERecord?id=3DCVE-2025-71352 ] picklescan--picklescan pickle= scan before 0.0.28 fails to detect malicious pickle files that exploit torc= h._dynamo.guards.GuardBuilder.get function in reduce methods. Attackers can=
craft pickle files with embedded code that evades picklescan detection and=
executes arbitrary commands when loaded. 2026-07-04 8.1 CVE-2025-71353 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2025-71353 ] picklescan--picklescan p= icklescan before 0.0.28 fails to detect malicious torch.fx.experimental.sym= bolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pickle f= iles. Attackers can embed undetected code in pickle files that executes rem= ote code when loaded by victims. 2026-07-04 8.1 CVE-2025-71356 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2025-71356 ] picklescan--picklescan picklescan=
before 0.0.29 fails to detect malicious pickle payloads that utilize lib2t= o3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code e= xecution. Attackers can craft pickle files embedding dangerous code that ev= ades picklescan detection and executes during pickle.load() deserialization=
. 2026-07-04 8.1 CVE-2025-71359 [ https://www.cve.org/CVERecord?id=3DCVE-20= 25-71359 ] picklescan--picklescan picklescan before 0.0.29 fails to detect = malicious pickle files using idlelib.calltip.get_entity function in reduce = methods. Attackers can embed undetected code in pickle files that executes = remote commands when loaded by victims. 2026-07-04 8.1 CVE-2025-71360 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2025-71360 ] picklescan--picklescan pic= klescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2p= y.crackfortran functions call eval on arbitrary strings. Attackers can embe=
d malicious code in pickle files that executes when loaded from untrusted s= ources. 2026-07-04 8.1 CVE-2025-71362 [ https://www.cve.org/CVERecord?id=3D= CVE-2025-71362 ] picklescan--picklescan picklescan before 0.0.30 fails to d= etect cProfile.run function calls in pickle reduce methods, allowing attack= ers to execute arbitrary code. Remote attackers can craft malicious pickle = files with cProfile.run payloads that bypass picklescan detection and achie=
ve code execution upon deserialization. 2026-06-30 8.1 CVE-2025-71363 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2025-71363 ] picklescan--picklescan pic= klescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubproce= ssTransport._start function in pickle reduce methods, allowing remote code = execution. Attackers can craft malicious pickle files embedding this built-=
in function that evade detection but execute arbitrary commands when loaded=
. 2026-07-04 8.1 CVE-2025-71364 [ https://www.cve.org/CVERecord?id=3DCVE-20= 25-71364 ] picklescan--picklescan picklescan before 0.0.28 fails to detect = malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pi= ckle files, allowing attackers to bypass safety checks. Remote attackers ca=
n embed undetected code in pickle files to achieve arbitrary code execution=
when victims load the files. 2026-07-04 8.1 CVE-2025-71366 [ https://www.c= ve.org/CVERecord?id=3DCVE-2025-71366 ] picklescan--picklescan picklescan be= fore 0.0.34 fails to detect _operator.attrgetter function calls in pickle p= ayloads, allowing attackers to bypass security checks. Remote attackers can=
craft malicious pickle files using _operator.attrgetter in reduce methods =
to execute arbitrary code when pickle.load() processes the file. 2026-07-04=
8.1 CVE-2025-71367 [ https://www.cve.org/CVERecord?id=3DCVE-2025-71367 ] p= icklescan--picklescan picklescan before 0.0.30 fails to detect the doctest.= debug_script function when analyzing pickle files, allowing attackers to ex= ecute arbitrary code. Remote attackers can craft malicious pickle files emb= edding doctest.debug_script calls that bypass picklescan detection and exec= ute arbitrary commands upon pickle.load invocation. 2026-06-30 8.1 CVE-2025= -71368 [ https://www.cve.org/CVERecord?id=3DCVE-2025-71368 ] picklescan--pi= cklescan picklescan before 0.0.28 fails to detect malicious pickle files th=
at use torch.utils.data.datapipes.utils.decoder.basichandlers in reduce met= hods, allowing attackers to bypass safety checks. Remote attackers can embe=
d undetected malicious code in pickle files that executes during deserializ= ation, enabling remote code execution. 2026-07-04 8.1 CVE-2025-71369 [ http= s://www.cve.org/CVERecord?id=3DCVE-2025-71369 ] picklescan--picklescan pick= lescan before 0.0.29 fails to detect malicious pickle files using code.Inte= ractiveInterpreter.runcode in reduce methods. Attackers can craft pickle pa= yloads that bypass picklescan detection and execute arbitrary code when loa= ded via pickle.load(). 2026-06-30 8.1 CVE-2025-71371 [ https://www.cve.org/= CVERecord?id=3DCVE-2025-71371 ] picklescan--picklescan picklescan before 0.= 0.33 fails to detect operator.methodcaller function calls in pickle files, = allowing attackers to bypass security checks. Remote attackers can craft ma= licious pickle payloads using operator.methodcaller that execute arbitrary = code when loaded, compromising systems relying on picklescan for validation=
. 2026-07-04 8.1 CVE-2025-71373 [ https://www.cve.org/CVERecord?id=3DCVE-20= 25-71373 ] picklescan--picklescan picklescan before 0.0.29 fails to detect = the built-in python profile.Profile.run function when used in pickle reduce=
methods, allowing attackers to execute arbitrary code. Remote attackers ca=
n craft malicious pickle files that bypass picklescan detection and achieve=
code execution upon deserialization. 2026-06-30 8.1 CVE-2025-71374 [ https= ://www.cve.org/CVERecord?id=3DCVE-2025-71374 ] picklescan--picklescan pickl= escan before 0.0.34 fails to detect the _operator.methodcaller built-in fun= ction when scanning pickle files for malicious code. Attackers can craft ma= licious pickle payloads using _operator.methodcaller that evade detection a=
nd execute arbitrary code when loaded by pickle.load(). 2026-07-04 8.1 CVE-= 2025-71375 [ https://www.cve.org/CVERecord?id=3DCVE-2025-71375 ] pinpoint-a= pm--pinpoint Pinpoint through 3.1.0 contains a server-side request forgery = vulnerability in the webhook registration endpoint that allows authenticate=
d users to register internal URLs due to missing SSRF protection. Attackers=
can trigger alarm threshold breaches to force the server to issue POST req= uests to internal hosts and metadata endpoints, enabling unauthorized acces=
s to internal network resources. 2026-06-29 8.5 CVE-2026-57947 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-57947 ] ploudapp--pCloud WP Backup Unauth= enticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <=3D 2.0.2 = versions. 2026-07-02 7.1 CVE-2026-57757 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-57757 ] PluginOps--Landing Page Builder Unauthenticated Cross S= ite Scripting (XSS) in Landing Page Builder <=3D 1.5.3.5 versions. 2026-06-=
29 7.1 CVE-2026-57337 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57337 ]=
printcart--Printcart Web to Print Product Designer for WooCommerce The Pri= ntcart Web to Print Product Designer for WooCommerce plugin for WordPress i=
s vulnerable to Arbitrary File Deletion in versions up to, and including, 2= .5.2 This is due to insufficient path validation in the store_design_data()=
function, which constructs a filesystem path from the user-supplied 'nbd_i= tem_key' POST parameter sanitized only with sanitize_text_field() - which d= oes not strip path traversal sequences - and then passes that path directly=
to Nbdesigner_IO::delete_folder() and PHP's rename(). The nonce protecting=
the nbd_save_customer_design AJAX action is freely obtainable by unauthent= icated users via the nbd_check_use_logged_in endpoint. This makes it possib=
le for unauthenticated attackers to delete arbitrary files on the affected = site's server which may make remote code execution possible. 2026-07-03 9.1=
CVE-2026-9725 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9725 ] qlstudi= o--Export User Data The Export User Data plugin for WordPress is vulnerable=
to arbitrary file deletion due to insufficient file path validation in the=
unserialize function in all versions up to, and including, 2.2.6. This mak=
es it possible for authenticated attackers, with subscriber-level access an=
d above, to delete arbitrary files on the server, which can easily lead to = remote code execution when the right file is deleted (such as wp-config.php=
). Successful exploitation requires an administrator to trigger a user data=
export while a subscriber-level (or higher) user has stored a crafted seri= alized XLSXWriter object payload as their display name. 2026-06-30 8 CVE-20= 26-12240 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12240 ] QuantumCloud= --ChatBot Unauthenticated Cross Site Scripting (XSS) in ChatBot <=3D 8.3.2 = versions. 2026-07-02 7.1 CVE-2026-57362 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-57362 ] QuantumCloud--Simple Link Directory Unauthenticated Cro=
ss Site Scripting (XSS) in Simple Link Directory <=3D 15.0.5 versions. 2026= -07-02 7.1 CVE-2026-57682 [ https://www.cve.org/CVERecord?id=3DCVE-2026-576=
82 ] quantumcloud--WPBot AI ChatBot for Live Support, Lead Generation, AI S= ervices The WPBot - AI ChatBot for Live Support, Lead Generation, AI Servic=
es plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th=
e 'conversation' parameter in all versions up to, and including, 8.4.9 due =
to insufficient input sanitization and output escaping. This makes it possi= ble for unauthenticated attackers to inject arbitrary web scripts in pages = that will execute whenever a user accesses an injected page. The AJAX nonce=
required to authenticate the save request is publicly emitted on every fro= ntend page via wp_localize_script, making it freely obtainable by any anony= mous visitor and removing any practical barrier to exploitation. 2026-07-01=
7.2 CVE-2026-13731 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13731 ] R= adiusTheme--Classified Listing Unauthenticated Cross Site Scripting (XSS) i=
n Classified Listing <=3D 5.4.2 versions. 2026-07-02 7.1 CVE-2026-57344 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-57344 ] Raera - Ankara Web Desig=
n and Digital Advertising Agency--Destekz Improper neutralization of specia=
l elements used in an SQL command ('SQL injection') vulnerability in Raera =
- Ankara Web Design and Digital Advertising Agency Destekz allows SQL Injec= tion. This issue affects Destekz: through 02062026.=C2=A0NOTE: The vendor w=
as contacted and it was learned that the product is not supported. 2026-07-=
03 9.8 CVE-2026-4321 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4321 ] R= ARLAB--WinRAR An out-of-bounds heap write exists in the RAR5 recovery-volum=
e (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp=
). The RecItems vector is sized only when the first .rev file in a set is p= rocessed; subsequent .rev files supply an independent RecNum value that is = validated against that file's own TotalCount field but never against the ac= tual size of RecItems. A crafted set of two or more .rev files can therefor=
e write an attacker-controlled 32-bit value (the header's RevCRC field) to = RecItems[RecNum] at an attacker-controlled offset up to 65534 * sizeof(RecV= olItem) bytes past the allocation, corrupting adjacent heap objects. Trigge= ring requires the victim to run a recovery/test operation on an attacker-su= pplied .rev set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive'=
, or auto-recovery when extracting a volume set with a missing .rar part). = This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR=
3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23. 2026-07-01 7.8 CVE= -2026-14191 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14191 ] RealMag77= 7--BEAR Unauthenticated Cross Site Scripting (XSS) in BEAR <=3D 1.1.8 versi= ons. 2026-06-29 7.1 CVE-2026-57320 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-57320 ] Red Hat--Red Hat Enterprise Linux 10 A flaw was found in HPLI=
P (HP Linux Imaging and Printing Software). This vulnerability, an incomple=
te fix for CVE-2026-8631, may allow a remote attacker to escalate privilege=
s or achieve arbitrary code execution. This can occur through an integer ov= erflow in the hpcups processing path when handling specially crafted print = data. 2026-07-03 9.8 CVE-2026-14544 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-14544 ] Red Hat--Red Hat Enterprise Linux 6 A flaw was found in Yelp=
due to an overly permissive Content Security Policy (CSP) implementation p= rovided by yelp-xsl. A malicious Flatpak application can open crafted help = content through the OpenURI portal. By embedding an untrusted CSS styleshee=
t within a structured SVG document, attacker-controlled content can bypass = Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML i= nclusions and disclose arbitrary user-readable host files through remote CS=
S resource requests. This may result in the unauthorized disclosure of sens= itive information. 2026-06-29 7.1 CVE-2026-13601 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-13601 ] Red Hat--Red Hat Enterprise Linux 6 A flaw was = found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer o= verflow vulnerability allows a remote attacker to cause arbitrary code exec= ution or a denial of service (DoS) by tricking a user into opening a specia= lly crafted PSP image file. The vulnerability occurs because the software i= ncorrectly calculates buffer sizes when processing low bit-depth images, le= ading to an overwrite of adjacent memory. 2026-07-03 7.3 CVE-2026-58379 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-58379 ] Red Hat--Red Hat Hardene=
d Images A flaw was found in libtiff. A remote attacker could exploit this = vulnerability by providing a specially crafted PixarLog-compressed TIFF ima= ge. This issue occurs when decoding Pixarlog codec images with the PIXARLOG= DATAFMT_8BITABGR output format and a specific stride value, leading to a he= ap-based buffer overflow. This could potentially result in arbitrary code e= xecution or a denial of service (DoS). 2026-06-29 7.3 CVE-2026-12912 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-12912 ] Red Hat--Red Hat Hardened I= mages A double free issue has been identified in libarchive's RAR5 reader. = During parsing of a specially crafted RAR5 archive, the filtered_buf pointe=
r may remain stale after being freed during unpacking state reinitializatio=
n. Subsequent processing of another archive entry can trigger a second free=
of the same memory region, resulting in a double-free condition. Successfu=
l exploitation may cause applications using the vulnerable libarchive API t=
o terminate unexpectedly, leading to a denial of service. 2026-06-30 7.5 CV= E-2026-14164 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14164 ] Red Hat-= -Red Hat OpenShift Dev Spaces A flaw was found in the vscode-java extension=
, which provides Java language support for Visual Studio Code. The extensio=
n incorrectly trusts all Markdown content in JavaDoc hovers, allowing a mal= icious Java file to include hidden commands. If a user clicks a specially c= rafted link within a JavaDoc hover popup, an attacker can execute arbitrary=
VS Code commands, which can lead to full system compromise in trusted work= spaces. 2026-06-29 8.8 CVE-2026-12856 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-12856 ] Red Hat--Red Hat Satellite 6.16 for RHEL 8 A flaw was foun=
d in Foreman. The Usergroup model in Foreman does not properly validate rol=
e assignments against the calling user's permissions. This allows an authen= ticated user with usergroup management permissions to attach arbitrary role=
s, including administrative roles, to a user group and then add themselves =
as a member. Successful exploitation of this vulnerability leads to full pr= ivilege escalation, granting the attacker administrator-level access. 2026-= 07-01 8.8 CVE-2026-5136 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5136 =
] Repute InfoSystems--ARForms Unauthenticated Cross Site Scripting (XSS) in=
ARForms <=3D 7.1.2 versions. 2026-06-29 7.1 CVE-2026-57338 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-57338 ] Repute Infosystems--BookingPress App= ointment Booking Pro The BookingPress Appointment Booking Pro plugin for Wo= rdPress is vulnerable to SQL Injection via the 'store_service_date' paramet=
er of the bpa_assign_staffmember_to_slots() function in versions up to and = including 5.7.1. This is due to the explicit use of stripslashes_deep() on = user-supplied POST data before it is interpolated verbatim into a SQL LIKE = clause without use of $wpdb->prepare() or any parameterization. This makes =
it possible for unauthenticated attackers to append additional SQL queries = into already existing queries that can be used to extract sensitive informa= tion from the database. 2026-07-01 7.5 CVE-2026-11823 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-11823 ] Reputeinfosystems--ARMember Premium Contri= butor PHP Object Injection in ARMember Premium <=3D 7.0 versions. 2026-07-0=
2 8.8 CVE-2026-27060 [ https://www.cve.org/CVERecord?id=3DCVE-2026-27060 ] = ReviewX--ReviewX Unauthenticated Cross Site Scripting (XSS) in ReviewX <=3D=
2.3.10 versions. 2026-07-02 7.1 CVE-2026-57359 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-57359 ] RT-Thread--RT-Thread A vulnerability was identif= ied in RT-Thread up to 5.0.2. Affected by this vulnerability is the functio=
n recvmsg in the library bsp/loongson/ls1cdev/libraries/ls1c_can.h of the c= omponent ls1c CAN Handler. Such manipulation leads to stack-based buffer ov= erflow. Local access is required to approach this attack. The exploit is pu= blicly available and might be used. The vendor was contacted early about th=
is disclosure but did not respond in any way. 2026-07-03 7.8 CVE-2026-14605=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14605 ] RT-Thread--RT-Thread=
A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by = this issue is the function CAN_Receive in the library bsp/synwit/libraries/= SWM341_CSL/CMSIS/DeviceSupport/SWM341.h of the component SWM341 CAN Handler=
. Performing a manipulation results in stack-based buffer overflow. The att= ack needs to be approached locally. The exploit has been released to the pu= blic and may be used for attacks. The vendor was contacted early about this=
disclosure but did not respond in any way. 2026-07-03 7.8 CVE-2026-14606 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-14606 ] Ruijie--RG-UAC A vulne= rability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted eleme=
nt is an unknown function of the file user_auth_commit.php. Performing a ma= nipulation of the argument upload_image results in unrestricted upload. The=
attack is possible to be carried out remotely. The exploit has been made p= ublic and could be used. 2026-07-05 7.3 CVE-2026-14736 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-14736 ] Rustaurius--Five Star Business Profile an=
d Schema Editor Arbitrary Code Execution in Five Star Business Profile and = Schema <=3D 2.3.19 versions. 2026-07-02 9.1 CVE-2026-27436 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-27436 ] SaturdayDrive--Ninja Forms - File Upl= oads The Ninja Forms - File Uploads plugin for WordPress is vulnerable to A= rbitrary File Read via the attach_files() function in versions up to, and i= ncluding, 3.3.29. This is due to the get_files_for_attachment() function ac= cepting a raw attacker-controlled 'files' array when the process() method r= eturns early due to a client-supplied saveProgress flag, bypassing all uplo=
ad validation, path normalization, and database record creation steps, and = allowing an attacker-supplied file_path value to reach wp_mail() as an emai=
l attachment with only a file_exists() check. This makes it possible for un= authenticated attackers to read arbitrary files on the affected site's serv= er. 2026-07-02 7.5 CVE-2026-13369 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-13369 ] Search Atlas Group--Search Atlas SEO Unauthenticated Cross Sit=
e Scripting (XSS) in Search Atlas SEO <=3D 2.6.6 versions. 2026-07-02 7.1 C= VE-2026-57357 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57357 ] seaweed= fs--seaweedfs SeaweedFS before 4.34 contains a path traversal vulnerability=
in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S=
3 principals with write access to a single bucket to delete arbitrary objec=
ts in other tenants' buckets by supplying object keys containing ../ sequen= ces in the DeleteObjects XML request body. Attackers can bypass authorizati=
on controls through a confused deputy condition, as the validateRequestPath=
middleware only inspects URL-captured path variables and never examines re= quest-body keys, allowing the filer path to collapse directory traversal se= quences and resolve deletions outside the authorized bucket. 2026-06-30 8.1=
CVE-2026-58372 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58372 ] Shenz= hen Aitemi E Commerce Co. Ltd.--M300 Wi-Fi Repeater Shenzhen Aitemi M300 Wi= -Fi Repeater (hardware model MT02) contains an unauthenticated OS command i= njection vulnerability that allows network-adjacent attackers to execute ar= bitrary shell commands by injecting unsanitized input through the smacfilte= r_conf handler in the commuos web backend. Attackers can append semicolon-d= elimited payloads to the name, enable, or mac GET parameters, which are pas= sed without sanitization into sprintf() to build uci shell commands execute=
d via doSystemCmdComlib(), granting full root-level control of the device. = 2026-07-01 9.8 CVE-2026-58457 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -58457 ] Shenzhen Landray Software Co., Ltd.--Landry Office Automation (OA)=
Landray OA contains an unauthenticated HQL injection vulnerability that al= lows unauthenticated attackers to query arbitrary Hibernate entity classes =
by injecting malicious HQL syntax into the uid POST parameter of the wechat= LoginHelper.do endpoint. Attackers can exploit the lack of input sanitizati=
on in the string-concatenated filter expression passed to the Hibernate fin= dList() call to extract sensitive data such as administrator password hashe=
s and, with sufficient database privileges, perform file-write operations e= nabling remote code execution. Exploitation evidence was first observed by = the Shadowserver Foundation on 2024-03-11 (UTC). 2026-07-02 7.5 CVE-2024-58= 352 [ https://www.cve.org/CVERecord?id=3DCVE-2024-58352 ] shimosyan--phpUpl= oader phpUploader before 2.0.2 contains an unauthenticated information disc= losure vulnerability that allows remote attackers to access the full conten=
ts of the uploaded-files database table by visiting any page of the applica= tion. The index model executes an unbounded SELECT query and embeds the com= plete JSON-encoded result set in an inline script block, exposing uploader =
IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerpr= ints. 2026-06-29 7.5 CVE-2026-56124 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-56124 ] Shopify Help Center--Shopify Contributor Local File Inclusio=
n in Shopify <=3D 1.0.0 versions. 2026-07-02 7.5 CVE-2026-57748 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-57748 ] SigNoz--signoz SigNoz through 0.= 130.1 contains a SQL injection vulnerability that allows authenticated atta= ckers to execute arbitrary ClickHouse queries by injecting URL-encoded quot=
es into the rule ID path parameter of the alert-history endpoints. Attacker=
s can manipulate the unsanitized rule ID interpolated into ClickHouse queri=
es to read all stored traces, logs, and metrics, or abuse the url() functio=
n to perform server-side request forgery. 2026-06-29 8.5 CVE-2026-57955 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-57955 ] Snowflake--Snowflake CLI=
Improper neutralization of attacker-controlled content in Snowflake CLI ve= rsions prior to 3.19 allowed unintended SQL execution. By supplying crafted=
repository content, project configuration, manifest data, or specification=
input, an attacker could cause Snowflake CLI to execute unintended SQL in = the context of the victim user's Snowflake session. Successful exploitation=
requires the victim to process attacker-controlled content through a vulne= rable command path and is limited by the privileges assigned to that sessio=
n. The fix is available in Snowflake CLI version 3.19. Users must manually = upgrade. 2026-06-29 8.3 CVE-2026-13744 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13744 ] Snowflake--Snowflake CLI Improper neutralization in the=
Snowpark annotation processor callback template in Snowflake CLI versions = prior to 3.19 allowed arbitrary code execution during application bundling =
or deployment. An attacker could exploit this by supplying crafted project = content that is interpolated into generated Python code, causing Snowflake = CLI to execute attacker-controlled code in the local context of the user ru= nning the CLI. Successful exploitation requires the victim to run the relev= ant bundling or deployment workflow against attacker-controlled project con= tent, and any resulting code runs with the privileges of that local executi=
on context. The fix is available in Snowflake CLI version 3.19, and users m= ust manually upgrade. 2026-06-29 8.8 CVE-2026-13749 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-13749 ] SourceCodester--Class and Exam Timetabling S= ystem A vulnerability was identified in SourceCodester Class and Exam Timet= abling System 1.0/5.php. Affected by this vulnerability is an unknown funct= ionality of the file /preview5.php. Such manipulation of the argument cours= e_year_section leads to sql injection. The attack may be performed from rem= ote. The exploit is publicly available and might be used. 2026-06-29 7.3 CV= E-2026-13521 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13521 ] SourceCo= dester--Class and Exam Timetabling System A flaw has been found in SourceCo= dester Class and Exam Timetabling System 1.0. Impacted is an unknown functi=
on of the file /edit_class.php. This manipulation of the argument ID causes=
sql injection. The attack may be initiated remotely. The exploit has been = published and may be used. 2026-06-29 7.3 CVE-2026-13526 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-13526 ] SourceCodester--Class and Exam Timetabl= ing System A vulnerability has been found in SourceCodester Class and Exam = Timetabling System 1.0. The affected element is an unknown function of the = file /preview4.php. Such manipulation of the argument course_year_section l= eads to sql injection. The attack may be launched remotely. The exploit has=
been disclosed to the public and may be used. 2026-06-29 7.3 CVE-2026-1352=
7 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13527 ] SourceCodester--Cla=
ss and Exam Timetabling System A vulnerability was determined in SourceCode= ster Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerab= ility is an unknown functionality of the file /edit_class1.php. Executing a=
manipulation of the argument ID can lead to sql injection. The attack can =
be launched remotely. The exploit has been publicly disclosed and may be ut= ilized. 2026-06-29 7.3 CVE-2026-13565 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-13565 ] SourceCodester--Class and Exam Timetabling System A vulner= ability was identified in SourceCodester Class and Exam Timetabling System = 1.0. Affected by this issue is some unknown functionality of the file /prev= iew3.php. The manipulation of the argument course_year_section leads to sql=
injection. The attack may be initiated remotely. The exploit is publicly a= vailable and might be used. 2026-06-29 7.3 CVE-2026-13566 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-13566 ] SourceCodester--Class and Exam Timetab= ling System A vulnerability was determined in SourceCodester Class and Exam=
Timetabling System 1.0. Affected by this vulnerability is an unknown funct= ionality of the file /edit_course.php. Executing a manipulation of the argu= ment ID can lead to sql injection. The attack can be executed remotely. The=
exploit has been publicly disclosed and may be utilized. 2026-07-04 7.3 CV= E-2026-14641 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14641 ] SourceCo= dester--Class and Exam Timetabling System A vulnerability was identified in=
SourceCodester Class and Exam Timetabling System 1.0. Affected by this iss=
ue is some unknown functionality of the file /edit_class2.php. The manipula= tion of the argument ID leads to sql injection. The attack is possible to b=
e carried out remotely. The exploit is publicly available and might be used=
. 2026-07-04 7.3 CVE-2026-14642 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-14642 ] SourceCodester--Class and Exam Timetabling System A security vul= nerability has been detected in SourceCodester Class and Exam Timetabling S= ystem 1.0. This vulnerability affects unknown code of the file /edit_exam.p= hp. The manipulation of the argument ID leads to sql injection. The attack = may be initiated remotely. The exploit has been disclosed publicly and may =
be used. 2026-07-05 7.3 CVE-2026-14732 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14732 ] SourceCodester--Class and Exam Timetabling System A vul= nerability was detected in SourceCodester Class and Exam Timetabling System=
1.0. This issue affects some unknown processing of the file /edit_coursea.= php. The manipulation of the argument ID results in sql injection. The atta=
ck may be launched remotely. The exploit is now public and may be used. 202= 6-07-05 7.3 CVE-2026-14733 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14= 733 ] SourceCodester--Class and Exam Timetabling System A flaw has been fou=
nd in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an = unknown function of the file /edit_product.php. This manipulation of the ar= gument ID causes sql injection. Remote exploitation of the attack is possib= le. The exploit has been published and may be used. 2026-07-05 7.3 CVE-2026= -14734 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14734 ] SourceCodester= --Class and Exam Timetabling System A vulnerability was detected in SourceC= odester Class and Exam Timetabling System 1.0. Impacted is an unknown funct= ion of the file /edit_room.php. Performing a manipulation of the argument I=
D results in sql injection. It is possible to initiate the attack remotely.=
The exploit is now public and may be used. 2026-07-05 7.3 CVE-2026-14770 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-14770 ] SourceCodester--Class = and Exam Timetabling System A flaw has been found in SourceCodester Class a=
nd Exam Timetabling System 1.0/1.php. The affected element is an unknown fu= nction of the file /edit_exam1.php. Executing a manipulation of the argumen=
t ID can lead to sql injection. It is possible to launch the attack remotel=
y. The exploit has been published and may be used. 2026-07-05 7.3 CVE-2026-= 14771 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14771 ] SourceCodester-= -Class and Exam Timetabling System A vulnerability has been found in Source= Codester Class and Exam Timetabling System 1.0/1.php. The impacted element =
is an unknown function of the file /edit_course1.php. The manipulation of t=
he argument ID leads to sql injection. The attack can be initiated remotely=
. The exploit has been disclosed to the public and may be used. 2026-07-05 = 7.3 CVE-2026-14772 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14772 ] So= urceCodester--Inventory Management System A weakness has been identified in=
SourceCodester Inventory Management System 1.0. This vulnerability affects=
unknown code of the file /api/users_handler.php of the component User Regi= stration Endpoint. This manipulation of the argument role causes improper a= ccess controls. Remote exploitation of the attack is possible. The exploit = has been made available to the public and could be used for attacks. 2026-0= 6-29 7.3 CVE-2026-13568 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13568=
] SourceCodester--Multi-Vendor Online Grocery Management System A weakness=
has been identified in SourceCodester Multi-Vendor Online Grocery Manageme=
nt System 1.0. This affects the function save_users of the file classes/Use= rs.php. This manipulation causes improper authorization. Remote exploitatio=
n of the attack is possible. The exploit has been made available to the pub= lic and could be used for attacks. 2026-07-05 7.3 CVE-2026-14690 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-14690 ] SourceCodester--Multi-Vendor On= line Grocery Management System A vulnerability was found in SourceCodester = Multi-Vendor Online Grocery Management System 1.0. This affects the functio=
n save_client of the file classes/Users.php of the component Registration H= andler. The manipulation of the argument Name results in sql injection. It =
is possible to launch the attack remotely. The exploit has been made public=
and could be used. 2026-07-05 7.3 CVE-2026-14695 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-14695 ] SourceCodester--Onlne Examination & Learning M= anagement System A flaw has been found in SourceCodester Onlne Examination =
& Learning Management System 1.0. The impacted element is an unknown functi=
on of the file register.php of the component Registration Endpoint. Executi=
ng a manipulation of the argument role can lead to improper privilege manag= ement. The attack can be executed remotely. The exploit has been published = and may be used. The name of the affected product appears to have a typo in=
it. 2026-07-05 7.3 CVE-2026-14719 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-14719 ] SourceCodester--Onlne Examination & Learning Management Syste=
m A security vulnerability has been detected in SourceCodester Onlne Examin= ation & Learning Management System 1.0. This affects an unknown part of the=
file /ajax_enroll.php of the component Enrollment Management. The manipula= tion of the argument student_id/schedule_id/action leads to improper author= ization. The attack is possible to be carried out remotely. The exploit has=
been disclosed publicly and may be used. The name of the affected product = appears to have a typo in it. 2026-07-05 7.3 CVE-2026-14778 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-14778 ] SourceCodester--Pizzafy E-Commerce S= ystem A security flaw has been discovered in SourceCodester Pizzafy E-Comme= rce System 1.0. This vulnerability affects unknown code of the file /admin/= ajax.php?action=3Dconfirm_order. The manipulation of the argument ID result=
s in sql injection. The attack can be launched remotely. The exploit has be=
en released to the public and may be used for attacks. 2026-07-05 7.3 CVE-2= 026-14713 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14713 ] SourceCodes= ter--Simple and Nice Shopping Cart Script A vulnerability was found in Sour= ceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknow=
n function of the file /admin/login.php of the component Admin Login. The m= anipulation of the argument Username results in sql injection. The attack m=
ay be launched remotely. The exploit has been made public and could be used=
. 2026-07-04 7.3 CVE-2026-14652 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-14652 ] SourceCodester--Simple and Nice Shopping Cart Script A vulnerabi= lity was determined in SourceCodester Simple and Nice Shopping Cart Script = 1.0. This impacts an unknown function of the file /admin/mensproductdeleteq= uery.php. This manipulation of the argument user_id causes sql injection. R= emote exploitation of the attack is possible. The exploit has been publicly=
disclosed and may be utilized. 2026-07-04 7.3 CVE-2026-14653 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-14653 ] SourceCodester--Simple and Nice Sh= opping Cart Script A vulnerability was identified in SourceCodester Simple = and Nice Shopping Cart Script 1.0. Affected is an unknown function of the f= ile /admin/girlsproductdeletequery.php. Such manipulation of the argument u= ser_id leads to sql injection. The attack can be executed remotely. The exp= loit is publicly available and might be used. 2026-07-04 7.3 CVE-2026-14654=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14654 ] Spencer Haws--Link W= hisper Free Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free=
<=3D 0.9.4 versions. 2026-06-29 7.1 CVE-2026-57333 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-57333 ] StoneFly--Storage Concentrator Storage Conce= ntrator (SC & SCVM) contains a command injection vulnerability in the ms_se= rvice.pl service, which listens on TCP port 9000 by default and accepts cus= tom network packets to perform device actions. An unauthenticated remote at= tacker can send a specially crafted packet containing a malicious payload t= hat is processed without adequate sanitization, resulting in arbitrary comm= and execution with root-level privileges. 2026-06-30 10 CVE-2026-56413 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-56413 ] StoneFly--Storage Concent= rator Storage Concentrator (SC & SCVM) contains hardcoded credentials for n= umerous internal services embedded within a configuration file. While the c= redentials are stored in an encoded format, the encoding can be reversed to=
plaintext. The exposed credentials span a broad range of internal services=
, including database accounts, licensing, replication services, and third-p= arty integrations, meaning successful exploitation of this vulnerability co= uld provide an attacker with unauthorized access to multiple interconnected=
systems. 2026-06-30 9.2 CVE-2026-50110 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-50110 ] StoneFly--Storage Concentrator Storage Concentrator (SC=
& SCVM) is vulnerable to SQL injection through cookie values processed by = the login.pl and debug.pl scripts. The cookie value is incorporated directl=
y into database queries without adequate sanitization, allowing an unauthen= ticated remote attacker to manipulate those queries and extract sensitive i= nformation from the underlying database, including session tokens, password=
hashes, and stored secret keys. 2026-06-30 9.3 CVE-2026-55721 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-55721 ] Stonefly--Storage Concentrator St= orage Concentrator (SC & SCVM) contains a command injection vulnerability w= ithin the debug.pl script that is reachable without authentication. A remot=
e attacker can submit a specially crafted HTTP request containing a malicio=
us payload that is processed without adequate input sanitization, resulting=
in arbitrary command execution with root-level privileges on the underlyin=
g system. 2026-06-30 10 CVE-2026-56415 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-56415 ] StylemixThemes--Pearl - Corporate Business Unauthentica= ted Local File Inclusion in Pearl - Corporate Business <=3D 3.4.10 versions=
. 2026-07-02 8.1 CVE-2026-27412 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-27412 ] SUSE--libzypp A relative path traversal bug problem when process= ing repository metadata in libzypp before 17.38.10 could be used by remote = attackers supplying repositories to overwrite files on the system, leading =
to denial of service or privilege escalation. 2026-06-29 8.8 CVE-2026-25707=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-25707 ] SUSE--libzypp A rela= tive path traversal in the "keyhint" option in repomd.xml parsing of libzyp=
p before 17.38.12 can be used by attackers able to supply a malicious repos= itory to inject or overwrite files in the target system as root. 2026-07-02=
8.4 CVE-2026-44941 [ https://www.cve.org/CVERecord?id=3DCVE-2026-44941 ] S= USE--Rancher Missing validation of "valuesFrom" references in Helm Deployer=
of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before = 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to ac= cess fleet credentials of other tenants. 2026-07-02 9.9 CVE-2026-44935 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-44935 ] SUSE--Rancher Incorrect a= uthentication caching in the team member ship expansion of the Rancher Gith=
ub authentication provider caused it granting principal access to any logge=
d in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2. 2026-06-30 8.8 CVE= -2026-41053 [ https://www.cve.org/CVERecord?id=3DCVE-2026-41053 ] swaldman-= -mchange-commons-java mchange-commons-java is a Java library of shared util= ity classes used by mchange projects like the c3p0 connection pool. Prior t=
o version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.nami= ng.JavaBeanObjectFactory) will construct objects of arbitrary classes and i= nitialize "JavaBean"-style properties, which for certain classes enables JN=
DI injection and "deserialization gadgets." Such initialization is unsafe f=
or some classes: for example, setting the contentType property of a Swing J= EditorPane to text/html and its text property to HTML containing a styleshe=
et <link> will provoke an HTTP GET on an arbitrary URL, potentially from wi= thin a trusted security domain. The problem is aggravated by the library's = ReferenceIndirector, through which malicious JNDI Reference objects can be = smuggled in for dereferencing wherever an application reads a Java-serializ=
ed object. This has been resolved in version 0.6.0. 2026-07-01 7.1 CVE-2026= -55153 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55153 ] SysBasics--Cus= tomize My Account for WooCommerce Unauthenticated Cross Site Scripting (XSS=
) in Customize My Account for WooCommerce <=3D 4.3.9 versions. 2026-07-02 7=
.1 CVE-2026-57358 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57358 ] Ten= da--JD12L A flaw has been found in Tenda JD12L 16.03.53.23. The impacted el= ement is the function formWifiBasicSet of the file /goform/WifiBasicSet. Ex= ecuting a manipulation of the argument security_5g can lead to stack-based = buffer overflow. The attack may be launched remotely. The exploit has been = published and may be used. 2026-06-29 8.8 CVE-2026-13517 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-13517 ] Tenda--JD12L A vulnerability has been f= ound in Tenda JD12L 16.03.53.23. This affects the function fromAddressNat o=
f the file /goform/addressNat. The manipulation of the argument page leads =
to stack-based buffer overflow. Remote exploitation of the attack is possib= le. The exploit has been disclosed to the public and may be used. 2026-06-2=
9 8.8 CVE-2026-13518 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13518 ] = Tenda--JD12L A vulnerability was found in Tenda JD12L 16.03.53.23. This imp= acts the function fromNatStaticSetting of the file /goform/NatStaticSetting=
. The manipulation of the argument page results in stack-based buffer overf= low. The attack can be executed remotely. The exploit has been made public = and could be used. 2026-06-29 8.8 CVE-2026-13519 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-13519 ] The Libreswan Project--libreswan Libreswan, via=
the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly = verify the length of the authentication hash when the SIG payload of an IKE=
v1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remot=
e attacker can use a variation on the Bleichenbacher attack to forge the SI=
G payload when small public exponents are being used (e.g., e=3D3), which c= ould lead to impersonation. Additionally, a remote attacker, by encoding a = shorter than expected hash in the SIG payload, could trigger an assertion l= eading to denial-of-service. The daemon aborts and restarts; continued expl= oitation causes sustained denial of service. Remote code execution is not p= ossible. X.509 certificate verifications of remote IKE peers are not affect= ed. 2026-07-02 8.1 CVE-2026-50721 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-50721 ] The Libreswan Project--libreswan Libreswan, via the function R= SA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify th=
e DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded = using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation o=
n the Bleichenbacher attack to forge the AUTH payload when small public exp= onents are used (e.g., e=3D3), leading to impersonation. Additionally, a re= mote attacker, by encoding a shorter than expected hash in the AUTH payload=
, could trigger an assertion leading to denial-of-service. The daemon abort=
s and restarts; continued exploitation causes sustained denial of service. = Remote code execution is not possible. X.509 certificate verifications of t=
he remote IKE peer are not affected. 2026-07-02 8.1 CVE-2026-50722 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-50722 ] The Libreswan Project--libres= wan An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon=
to crash and restart. Continued exploitation would cause a denial of servi= ce. The function reassemble_v2_incoming_fragments() would ignore unknown ou= ter payloads but still store these in a fixed size array msg_digest.digest[= PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_= roof < elemsof(md->digest)) causes the daemon to abort. No remote code exec= ution is possible. Any configuration that allows IKEv2 connections that do = not set fragmentation=3Dno are vulnerable. IKEv1 is not affected. 2026-07-0=
2 7.5 CVE-2026-12413 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12413 ] = ThemeBoy--SportsPress Pro Contributor Local File Inclusion in SportsPress P=
ro <=3D 2.7.29 versions. 2026-07-02 7.5 CVE-2026-57749 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-57749 ] ThemeGoods--Artale | Wedding Photography = WordPress Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Ph= otography WordPress <=3D 2.2.2 versions. 2026-07-02 7.1 CVE-2025-69152 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2025-69152 ] themeisle--Visualizer Tab= les & Charts Manager with Built-in AI Generator The Visualizer - Tables & C= harts Manager with Built-in AI Generator plugin for WordPress is vulnerable=
to authorization bypass in all versions up to, and including, 4.0.3. This =
is due to the plugin not properly verifying that a user is authorized to pe= rform an action. This makes it possible for unauthenticated attackers to ac= cess and export the contents of any visualizer chart on the site - includin=
g charts in draft, private, pending, future, or trash status - as CSV, Exce=
l, or HTML via the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpo= int. This bypass is particularly impactful because the standard WordPress R= EST endpoint for the non-public 'visualizer' custom post type correctly enf= orces capability checks and returns HTTP 401 to unauthenticated callers, wh= ereas this plugin-registered route circumvents that protection entirely. 20= 26-07-01 7.5 CVE-2026-13468 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 3468 ] ThemeMove--Unicamp Subscriber SQL Injection in Unicamp <=3D 2.2.2 ve= rsions. 2026-07-02 8.5 CVE-2025-69094 [ https://www.cve.org/CVERecord?id=3D= CVE-2025-69094 ] ThemePunch--Slider Revolution Improper Neutralization of I= nput During Web Page Generation ('Cross-site Scripting') vulnerability in T= hemePunch Slider Revolution allows Reflected XSS. This issue affects Slider=
Revolution: from 7.0.0 through 7.0.16. 2026-07-02 7.1 CVE-2026-57678 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-57678 ] ThemeREX--Booked Subscribe=
r Broken Access Control in Booked <=3D 3.0.0 versions. 2026-07-02 7.1 CVE-2= 026-57746 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57746 ] Themesuite-= -Automotive Car Dealership Business Unauthenticated Cross Site Scripting (X= SS) in Automotive Car Dealership Business <=3D 13.3.3 versions. 2026-07-02 = 7.1 CVE-2026-27426 [ https://www.cve.org/CVERecord?id=3DCVE-2026-27426 ] Th= emesuite--Automotive Listings Unauthenticated Cross Site Scripting (XSS) in=
Automotive Listings <=3D 18.6 versions. 2026-07-02 7.1 CVE-2026-27425 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-27425 ] Themify--Themify Popup De= serialization of Untrusted Data vulnerability in Themify Themify Popup allo=
ws Object Injection. This issue affects Themify Popup: from n/a through 1.4= .3. 2026-07-02 8.8 CVE-2026-56037 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-56037 ] ThreeMammals--Ocelot Ocelot through 24.1.0, fixed in commit f1= 56fd4, contains a security control bypass vulnerability that allows denied = clients to circumvent IP-based access restrictions by sending WebSocket upg= rade requests. The WebSocket upgrade pipeline branch configured via MapWhen=
in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests = from blocked IP addresses to be proxied to downstream services without enfo= rcement of the configured allow/block list. 2026-06-30 9.1 CVE-2026-58172 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-58172 ] tiddly-gittly--TidGi-D= esktop A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.=
0. This impacts an unknown function of the file src/services/wiki/wikiWorke= r/loadWikiTiddlersWithSubWikis.ts of the component Git Repository Import. T=
he manipulation results in code injection. The attack may be performed from=
remote. The exploit has been made public and could be used. 2026-07-05 7.3=
CVE-2026-14722 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14722 ] tinac= ms--tinacms Tina is a headless content management system. @tinacms/cli vers= ions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Fo= restry-to-Tina migration command. The internal helper addVariablesToCode un= quotes any value matching the marker "__TINA_INTERNAL__:::(.*?):::" inside = the stringified collection JSON. User-supplied label and name fields from .= forestry/**/*.yml are placed into that JSON without any sanitisation. An at= tacker who controls a Forestry-style project can therefore inject arbitrary=
JavaScript into the generated tina/templates.{ts,js} file. The injected co=
de is written at module top level, so it executes the moment the developer = runs tinacms dev or tinacms build, with the developer's privileges. This is= sue has been fixed in version 2.4.3. 2026-07-01 7.8 CVE-2026-54074 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-54074 ] tinypng--TinyPNG JPEG, PNG & = WebP image compression The TinyPNG - JPEG, PNG & WebP image compression plu= gin for WordPress is vulnerable to arbitrary file deletion due to insuffici= ent file path validation in the delete_converted_image_size function in all=
versions up to, and including, 3.6.13. This makes it possible for authenti= cated attackers, with author-level access and above, to delete arbitrary fi= les on the server, which can easily lead to remote code execution when the = right file is deleted (such as wp-config.php). An attacker can exploit this=
by injecting an arbitrary server file path into the 'convert.path' field o=
f the 'tiny_compress_images' post meta on an attachment they own, then trig= gering attachment deletion to invoke the vulnerable code path. 2026-07-02 8=
.1 CVE-2026-7311 [ https://www.cve.org/CVERecord?id=3DCVE-2026-7311 ] TR7 C= yber Defense Inc.--WAF-ASP Missing authentication for critical function vul= nerability in TR7 Cyber --Defense Inc. WAF-ASP allows Authentication Abuse.=
This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117. 2026-07-0=
2 9.8 CVE-2026-4767 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4767 ] tr= ailofbits--fickling Trail of Bits fickling versions up to and including 0.1= .10 do not include the Python standard library modules _posixsubprocess, si= te, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these mo= dules are absent from the denylist, fickling's check_safety() function retu= rns LIKELY_SAFE with zero findings for pickle payloads that invoke dangerou=
s functions including _posixsubprocess.fork_exec (C-level process spawner c= apable of executing arbitrary binaries), site.execsitecustomize (executes a= rbitrary site customization code), and atexit._run_exitfuncs (triggers all = registered exit handler callbacks). The fickling.load() API chains check_sa= fety() into pickle.loads() as an explicit security gate; a LIKELY_SAFE verd= ict causes the payload to be deserialized and executed. This shares the sam=
e root cause as CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-20= 25-67747 (marshal/types). OvertlyBadEvals does not flag these modules becau=
se they are standard library imports. UnsafeImports does not flag them beca= use they are not in the denylist. The UnusedVariables heuristic is defeated=
by the SETITEMS opcode pattern. 2026-07-04 8.8 CVE-2026-14534 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-14534 ] trailofbits--fickling In Trail of=
Bits fickling versions up to and including 0.1.11, the UnsafeImportsML ana= lysis pass unconditionally calls AnalysisContext.shorten_code(node) on ever=
y import node it inspects, regardless of whether the import is flagged as u= nsafe. This call registers the shortened code representation in the shared = AnalysisContext.reported_shortened_code set. When the MLAllowlist analysis = pass subsequently runs, it calls the same shorten_code() method, receives a= lready_reported=3DTrue for every import, and executes a continue statement = that skips its allowlist check entirely. This renders MLAllowlist dead code=
for all imports - it never evaluates whether an import is in the ML allowl= ist or not. The MLAllowlist pass was designed to catch imports of modules o= utside the known-safe ML ecosystem (torch, numpy, transformers, etc.) that = slip past the UnsafeImports denylist. With MLAllowlist inoperative, any sta= ndard library module not in the UNSAFE_IMPORTS denylist can be invoked via = pickle deserialization while fickling's check_safety() returns LIKELY_SAFE.=
The fickling.load() API chains check_safety() into pickle.loads() as an ex= plicit security gate, meaning a LIKELY_SAFE verdict causes the payload to b=
e deserialized and executed. The root cause is shared mutable state between=
independently-correct analysis passes - UnsafeImportsML works as designed =
in isolation, MLAllowlist works as designed in isolation, but the shared re= ported_shortened_code set causes UnsafeImportsML to poison MLAllowlist's de= duplication logic. 2026-07-04 8.8 CVE-2026-14535 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-14535 ] tranmautritam--TheFox Unauthenticated Cross Sit=
e Scripting (XSS) in TheFox <=3D 3.9.76 versions. 2026-07-02 7.1 CVE-2026-2= 7430 [ https://www.cve.org/CVERecord?id=3DCVE-2026-27430 ] TUBITAK BILGEM S= oftware Technologies Research Institute--Pardus Domain Joiner Invocation of=
process using visible sensitive information vulnerability in TUBITAK BILGE=
M Software Technologies Research Institute Pardus Domain Joiner allows Exca= vation. This issue affects Pardus Domain Joiner: from 0.5.2 before 0.5.4. 2= 026-07-05 7.9 CVE-2026-12250 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 12250 ] TUBITAK BILGEM Software Technologies Research Institute--Pardus Upd= ate Missing Authorization vulnerability in TUBITAK BILGEM Software Technolo= gies Research Institute Pardus Update allows Privilege Escalation. This iss=
ue affects Pardus Update: from <=3D0.6.3 before 0.6.6. 2026-07-05 7.8 CVE-2= 026-6509 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6509 ] TUBITAK BILGE=
M Software Technologies Research Institute--Pardus-Parental-Control Incorre=
ct Permission Assignment for Critical Resource, Improper Access Control vul= nerability in TUBITAK BILGEM Software Technologies Research Institute Pardu= s-Parental-Control allows DNS Spoofing. This issue affects Pardus-Parental-= Control: from <=3D0.5.1 before 0.7.0. 2026-07-05 8.8 CVE-2026-9085 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-9085 ] TUBITAK BILGEM Software Techno= logies Research Institute--pardus-software Improper neutralization of argum= ent delimiters in a command ('argument injection') vulnerability in TUBITAK=
BILGEM Software Technologies Research Institute pardus-software allows Arg= ument Injection. This issue affects pardus-software: from <=3D 1.0.4 before=
1.0.5. 2026-07-03 8.8 CVE-2026-14459 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-14459 ] TUBITAK BILGEM Software Technologies Research Institute--p= ardus-software Missing Authorization vulnerability in TUBITAK BILGEM Softwa=
re Technologies Research Institute pardus-software allows Argument Injectio=
n. This issue affects pardus-software: from <=3D 1.0.4 before 1.0.5. 2026-0= 7-03 8.8 CVE-2026-14460 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14460=
] Ubiquiti Inc--Dream Machines A malicious actor with access to the networ=
k and under certain network configurations could exploit an Improper Access=
Control vulnerability found in certain devices running UniFi OS to make un= authorized changes to such UniFi OS devices. 2026-07-02 9 CVE-2026-55116 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-55116 ] Ubiquiti Inc--Dream Mac= hines A malicious actor with access to the network and low privileges and u= nder certain conditions could exploit an Improper Access Control vulnerabil= ity found in UniFi OS with UniFi Protect Application to escalate privileges=
on the host device. 2026-07-02 7.5 CVE-2026-55112 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-55112 ] Ubiquiti Inc--UniFi Access Application A mali= cious actor with access to the network and low privileges could exploit an = Improper Input Validation vulnerability found in UniFi Access Application t=
o execute a Command Injection on the host device. 2026-07-02 9.9 CVE-2026-5= 0748 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50748 ] Ubiquiti Inc--Un= iFi Access Application A malicious actor with access to the network and hig=
h privileges could exploit an Improper Access Control vulnerability found i=
n UniFi Access Application to escalate privileges on the host device. 2026-= 07-02 9.1 CVE-2026-54400 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5440=
0 ] Ubiquiti Inc--UniFi Access Application A malicious actor with access to=
the network could exploit a Path Traversal vulnerability found in UniFi Ac= cess Application to access files on the host device. 2026-07-02 8.6 CVE-202= 6-55117 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55117 ] Ubiquiti Inc-= -UniFi Connect Application A malicious actor with access to the network cou=
ld exploit an Improper Access Control vulnerability found in UniFi Connect = Application to execute a Command Injection on the host device. 2026-07-02 1=
0 CVE-2026-50746 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50746 ] Ubiq= uiti Inc--UniFi Network Application A malicious actor with access to the ne= twork and high privileges could exploit a Path Traversal vulnerability foun=
d in self-hosted instances of UniFi Network Application to escalate write p= ermission on the host device. 2026-07-02 8.7 CVE-2026-54406 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-54406 ] Ubiquiti Inc--UniFi Network Applicat= ion A malicious actor with access to the network and low privileges could e= xploit an Improper Access Control vulnerability found in UniFi Network Appl= ication to escalate privileges within the UniFi Network Application. 2026-0= 7-02 8.8 CVE-2026-55114 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55114=
] Ubiquiti Inc--UniFi Network Application A malicious actor with access to=
the network,low privileges and under certain conditions could exploit an I= mproper Access Control vulnerability found in UniFi Network Application to = escalate privileges within the UniFi Network Application. 2026-07-02 8.3 CV= E-2026-55118 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55118 ] Ubiquiti=
Inc--UniFi Network Application A malicious actor with access to the networ=
k could exploit an Improper Input Validation vulnerability found in UniFi N= etwork Application to execute a Denial of Service (DoS) attack on the appli= cation. 2026-07-02 7.5 CVE-2026-54405 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-54405 ] Ubiquiti Inc--UniFi Network Application A malicious actor = with access to the network and under certain conditions could exploit an In= correct Authorization vulnerability found in UniFi Network Application to p= ersist privileges within UniFi Network Application after such access had be=
en removed. 2026-07-02 7.5 CVE-2026-56842 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-56842 ] Ubiquiti Inc--UniFi OS Server A malicious actor with a= ccess to the network and low privileges could exploit an Improper Input Val= idation vulnerability found in UniFi OS to execute a Command Injection on t=
he host device. 2026-07-02 9.9 CVE-2026-54402 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-54402 ] Ubiquiti Inc--UniFi OS Server A malicious actor wi=
th access to the network could exploit a Path Traversal vulnerability found=
in certain devices running UniFi OS to bypass authentication of such UniFi=
OS devices or instances. 2026-07-02 8.6 CVE-2026-54403 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-54403 ] Ubiquiti Inc--UniFi OS Server A maliciou=
s actor with access to the network and low privileges could exploit a serie=
s of authenticated SQL Injection vulnerabilities found in UniFi OS to escal= ate privileges within such UniFi OS devices or instances. 2026-07-02 8.8 CV= E-2026-54404 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54404 ] Ubiquiti=
Inc--UniFi OS Server A malicious actor with access to the network and low = privileges could exploit a Server-Side Request Forgery (SSRF) to escalate p= rivileges within such UniFi OS devices or instances. 2026-07-02 7.7 CVE-202= 6-54401 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54401 ] Ubiquiti Inc-= -UniFi OS Server A malicious actor who lures an authenticated user to a mal= icious page could exploit a Cross-Origin Resource Sharing (CORS) misconfigu= ration found in UniFi OS to trigger actions in UniFi OS using that user's s= ession. 2026-07-02 7.5 CVE-2026-55110 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-55110 ] Ubiquiti Inc--UniFi Protect Application A malicious actor = with access to the network and low privileges could exploit a Server-Side R= equest Forgery (SSRF) in UniFi Protect Application to escalate privileges o=
n the host device. 2026-07-02 9.9 CVE-2026-55115 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-55115 ] Ubiquiti Inc--UniFi Protect Application A malic= ious actor with access to the network could exploit an Improper Access Cont= rol vulnerability found in UniFi Protect Application to bypass authenticati=
on in certain UniFi Protect Application API endpoints. 2026-07-02 8.6 CVE-2= 026-54407 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54407 ] Ubiquiti In= c--UniFi Protect Application A malicious actor with access to the network c= ould exploit an Improper Access Control vulnerability found in UniFi Protec=
t Application to bypass authentication for data streaming. 2026-07-02 8.6 C= VE-2026-54408 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54408 ] Ubiquit=
i Inc--UniFi Protect Application A malicious actor with access to the netwo=
rk and low privileges could exploit an authenticated SQL Injection vulnerab= ility found in UniFi Protect Application to escalate privileges on the host=
device. 2026-07-02 8.8 CVE-2026-56841 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-56841 ] Ubiquiti Inc--UniFi Protect Application A malicious act=
or with access to the network and under certain conditions could exploit an=
Improper Initialization vulnerability found in UniFi Protect Application t=
o bypass authentication in UniFi Protect Cameras. 2026-07-02 7.5 CVE-2026-5= 4409 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54409 ] Ubiquiti Inc--Un= iFi Protect Floodlight A malicious actor with access to the network could e= xploit a Path Traversal vulnerability found in UniFi Protect Floodlight dev= ices to access files on the UniFi Protect Floodlight. 2026-07-02 7.5 CVE-20= 26-55111 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55111 ] Ubiquiti Inc= --UniFi Talk Application A malicious actor with access to the network and l=
ow privileges could exploit a series of authenticated SQL Injection vulnera= bilities found in UniFi Talk Application to escalate privileges on the host=
device. 2026-07-02 9.9 CVE-2026-50747 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-50747 ] Ubiquiti Inc--UniFi Talk Application A malicious actor = with access to the network and low privileges could exploit an Improper Acc= ess Control vulnerability found in UniFi Talk Application to escalate privi= leges within the UniFi Talk Application. 2026-07-02 8.1 CVE-2026-55119 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-55119 ] Ubiquiti Inc--UniFi Talk = Application A malicious actor with access to the network could exploit a Se= rver-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Applicat= ion to execute a Denial of Service (DoS) attack and bypass authentication i=
n certain UniFi Talk API endpoints. 2026-07-02 7.5 CVE-2026-55113 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-55113 ] Unisoc (Shanghai) Technologies=
Co., Ltd.--SC7731E/SC9832E/SC9863A/T310/T610/T618/T7200/T7225/T7250/T7255/= T7280/T7300/T8100/T9100/T8200/T8300 In IMS, there is a possible out of boun=
ds read due to a missing bounds check. This could lead to remote denial of = service with no additional execution privileges needed. 2026-07-03 7.5 CVE-= 2026-4967 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4967 ] Unity--Parse=
c An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Wind= ows hosts leads to a potential Elevation of Privilege. This issue affects P= arsec through v2026-05-04.0. The patched version is=C2=A0Parsec for Windows=
version 150-104a. A user can generate a situation where there is an instan=
ce of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled val=
ue of the AppData environment variable. 2026-07-04 8.4 CVE-2026-54424 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-54424 ] UTT--HiPER 1250GW A vulner= ability has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. This = affects an unknown function of the file /goform/ConfigWirelessBase_5g of th=
e component Web Endpoint. The manipulation of the argument ssid leads to st= ack-based buffer overflow. The attack is possible to be carried out remotel=
y. The exploit has been disclosed to the public and may be used. 2026-07-05=
8.8 CVE-2026-14721 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14721 ] u= vnc--UltraVNC UltraVNC repeater through 1.8.2.2 initializes the HTTP admini= stration server with a hardcoded default password. In repeater/webgui/setti= ngs.c:197, when settings2.txt is absent on first run the repeater writes th=
e literal string "adminadmi2" as the admin password via strcpy_s(saved_pass= word, 64, "adminadmi2"). The HTTP Basic-auth handler wi_decode_auth() check=
s this password without rate-limiting or lockout. Any remote attacker who c=
an reach the repeater HTTP port (default TCP 80) can authenticate as admini= strator using the well-known default credential on a fresh or unmodified in= stallation, gaining full control of the repeater configuration including al= low/deny rules and session visibility. 2026-07-01 9.1 CVE-2026-7839 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-7839 ] uvnc--UltraVNC UltraVNC repea= ter through 1.8.2.2 contains a global buffer overflow in its embedded HTTP = administration server. The functions wi_senderr() and wi_replyhdr() in repe= ater/webgui/webutils.c write the caller-supplied HTTP request URI into a fi= xed 1000-byte global buffer (hdrbuf) via unchecked sprintf calls. The HTTP = receive buffer accepts URIs up to approximately 150 KB (WI_RXBUFSIZE =3D 15= 3600), so an unauthenticated attacker who can reach the repeater HTTP port = (default TCP 80) can overflow hdrbuf by at least 500 bytes with a single HT=
TP request containing a URI of 1500 bytes or longer, corrupting adjacent .b= ss-segment globals. The overflow occurs before any authentication check, ma= king it reachable without credentials. A remote, unauthenticated attacker c=
an achieve arbitrary code execution on the host running the repeater. 2026-= 07-01 9.8 CVE-2026-7840 [ https://www.cve.org/CVERecord?id=3DCVE-2026-7840 =
] uvnc--UltraVNC UltraVNC viewer through 1.8.2.2 contains an integer overfl=
ow leading to a heap buffer overflow in the RFB protocol failure-response p= arsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied=
reasonLen field (type CARD32) is passed as reasonLen+1 to CheckBufferSize(=
). Because both operands are unsigned 32-bit, a reasonLen of 0xFFFFFFFF ove= rflows to 0, causing CheckBufferSize to allocate only 256 bytes. The subseq= uent ReadString(m_netbuf, reasonLen) call then performs ReadExact for the o= riginal 4 GiB length into that 256-byte heap buffer. This overflow is reach= able via rfbConnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post= -handshake) message types without successful authentication. A malicious VN=
C server, or any man-in-the-middle on the RFB stream, can trigger this cond= ition when the victim viewer connects, potentially resulting in remote code=
execution as the user running the viewer. The crash was confirmed with Add= ressSanitizer on a portable reproduction harness (heap-buffer-overflow WRIT=
E at offset 256). 2026-07-01 8.8 CVE-2026-7838 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-7838 ] uvnc--UltraVNC UltraVNC repeater through 1.8.2.2 c= ontains a post-authentication out-of-bounds write in the allow/deny rule pa= rser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule = token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte desti= nation), the code unconditionally writes a NUL terminator at temp1[rule1][l= en] =3D 0 without clamping len to the destination size. When an authenticat=
ed administrator saves a rule with a token length equal to or greater than = the destination size, the NUL byte is written one or more bytes past the en=
d of the stack-allocated array, corrupting adjacent stack data. An attacker=
who has obtained admin credentials (including via CVE-2026-7839 default pa= ssword) can trigger this to gain code execution on the repeater host. 2026-= 07-01 7.2 CVE-2026-7829 [ https://www.cve.org/CVERecord?id=3DCVE-2026-7829 =
] uvnc--UltraVNC UltraVNC through 1.8.2.2 uses inadequate cryptography in t=
he MS-Logon II authentication scheme (rfbUltraVNC_MsLogonIIAuth). In rfb/dh= .cpp the Diffie-Hellman key exchange is performed with parameters that fit =
in an unsigned 64-bit integer (DH_MAX_BITS controls the prime size). A 64-b=
it DH key can be broken by Pollard's rho algorithm in under one second on c= urrent hardware. Additionally, the private exponent is generated by the rng=
() function, which multiplies three libc rand() values seeded from time(NUL= L). With approximately 31 bits of internal state and a time-based seed, the=
private exponent is recoverable in under a minute by a passive observer. A=
network attacker who can observe the MS-Logon II handshake (via sniffing, = recording, or man-in-the-middle) can derive the shared DH key and decrypt t=
he encapsulated username and password, resulting in full credential disclos= ure. This affects legacy MS-Logon II connections; MS-Logon III (X25519 + AE= S-256-GCM) is unaffected. 2026-07-01 7.4 CVE-2026-7830 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-7830 ] uvnc--UltraVNC UltraVNC viewer through 1.8= .2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit mes= sage handler. In vncviewer/ClientConnection.cpp, when the server-supplied n= ameLength equals exactly 2024 the code declares a 2024-byte stack buffer _d= n[2024] and calls ReadString(_dn, 2024). ReadString writes the NUL terminat=
or at buf[length], i.e., _dn[2024], one byte past the end of the stack buff= er. A malicious VNC server can trigger this condition by advertising a desk= top name of length 2024 in its ServerInit message. On release builds withou=
t stack canaries the single-byte NUL overwrite adjacent stack data. On buil=
ds with /GS stack protection the canary is corrupted and the process termin= ates, resulting in denial of service. User interaction (connecting the view=
er to the malicious server) is required. 2026-07-01 7.5 CVE-2026-7831 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-7831 ] videowhisper--Paid Videocha=
t Turnkey Site Performer Arbitrary File Deletion in Paid Videochat Turnkey = Site <=3D 7.4.8 versions. 2026-06-29 9.9 CVE-2026-57331 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-57331 ] wagtail--wagtail Wagtail is an open sour=
ce content management system built on Django. In versions prior to 7.0.8, 7= .3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists o=
n the dynamic image URL generator view within the Wagtail admin interface. =
A user with a limited-permission editor account for the Wagtail admin could=
craft a URL that, when viewed by a user with higher privileges, could perf= orm actions with that user's credentials. The vulnerability is present for = all sites, even if they do not enable the dynamic image serve view. The vul= nerability is not exploitable by an ordinary site visitor without access to=
the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and=
7.4.2. 2026-07-01 7.3 CVE-2026-54263 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-54263 ] Wavlink--WL-NU516U1-A A vulnerability was identified in Wa= vlink WL-NU516U1-A M16U1_V240425. The impacted element is the function sub_= 407504 of the file /cgi-bin/wireless.cgi of the component POST Parameter Ha= ndler. Such manipulation of the argument Guest_ssid leads to stack-based bu= ffer overflow. The attack can be executed remotely. The exploit is publicly=
available and might be used. It is suggested to upgrade the affected compo= nent. The vendor was contacted early, responded in a very professional mann=
er and quickly released a fixed version of the affected product. 2026-06-29=
8.8 CVE-2026-13539 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13539 ] w= eaviate--weaviate Weaviate before 1.38.0 does not verify that a principal p= erforming an RBAC role assignment holds the permissions granted by the assi= gned role. The assignRoleToUser and assignRoleToGroup handlers (POST /authz= /users/{id}/assign and /authz/groups/{id}/assign) authorize only that the c= aller may assign roles to the target user or group, not the permissions con= tained in the assigned roles, unlike role creation which enforces that a us=
er can only create roles with permissions less than or equal to its own. A = user holding only the delegated assign_and_revoke_users or assign_and_revok= e_groups permission can assign the built-in admin role, or any high-privile=
ge custom role, to itself or others, escalating to full administrative cont= rol of the database. 2026-07-02 8.8 CVE-2026-59093 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-59093 ] webandprint--AR for WooCommerce The AR for Wo= oCommerce plugin for WordPress is vulnerable to Directory Traversal in all = versions up to, and including, 8.40 via the 'file' parameter parameter. Thi=
s makes it possible for unauthenticated attackers to read the contents of a= rbitrary files on the server, which can contain sensitive information. The = three intended access controls all fail: valid nonces are freely minted by = unauthenticated callers via the nopriv ar_get_fresh_nonce and ar_process_us= er_image AJAX handlers; the AES-256-CBC encryption key is derived from get_= option('ar_licence_key'), which returns false on default free installations=
and yields a predictable key attackers can use to encrypt their own path p= ayloads; and the Referer check is trivially bypassed because the Referer he= ader is attacker-controlled. 2026-07-03 7.5 CVE-2026-14352 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-14352 ] webandprint--AR for WordPress The AR = for WordPress plugin for WordPress is vulnerable to Directory Traversal in = all versions up to, and including, 8.40 via the 'file' parameter parameter.=
This makes it possible for unauthenticated attackers to read the contents =
of arbitrary files on the server, which can contain sensitive information. = Exploitation requires an attacker to first obtain a valid nonce and secure = nonce via the publicly accessible ar_get_fresh_nonce and ar_process_user_im= age nopriv AJAX handlers, and to reproduce the encryption key locally - bot=
h steps are fully achievable by an unauthenticated attacker on any default = free or unlicensed installation where ar_licence_key is unset. 2026-07-03 7=
.5 CVE-2026-14327 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14327 ] web= aways--NEX-Forms Ultimate Forms Plugin for WordPress The NEX-Forms - Ultima=
te Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored = Cross-Site Scripting via '_name[]' Array Parameter in all versions up to, a=
nd including, 9.2.2 due to insufficient input sanitization and output escap= ing. This makes it possible for unauthenticated attackers to inject arbitra=
ry web scripts in pages that will execute whenever a user accesses an injec= ted page. The wp_kses() output filtering pass provides no mitigation becaus=
e NEXForms_allowed_tags() explicitly permits &lt;script&gt;, &lt;iframe src= /srcdoc&gt;, and JS event handlers such as onClick, onBlur, and onChange in=
its allow-list. 2026-07-01 7.2 CVE-2026-12142 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-12142 ] webaways--NEX-Forms Ultimate Forms Plugin for Wor= dPress The NEX-Forms - Ultimate Forms Plugin for WordPress plugin for WordP= ress is vulnerable to Stored Cross-Site Scripting via the 'real_val__' para= meter in all versions up to, and including, 9.2.2 due to insufficient input=
sanitization and output escaping. This makes it possible for unauthenticat=
ed attackers to inject arbitrary web scripts in pages that will execute whe= never a user accesses an injected page. The submission endpoint is register=
ed via wp_ajax_nopriv_submit_nex_form with no nonce verification, making it=
fully accessible to unauthenticated attackers without any CSRF token. 2026= -07-03 7.2 CVE-2026-13040 [ https://www.cve.org/CVERecord?id=3DCVE-2026-130=
40 ] Webraketen--Internal Links Manager Unauthenticated Cross Site Scriptin=
g (XSS) in Internal Links Manager <=3D 3.0.3 versions. 2026-07-02 7.1 CVE-2= 026-57345 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57345 ] wedevs--Dok=
an Pro The Dokan Pro plugin for WordPress is vulnerable to privilege escala= tion via update_capabilities REST Endpoint in all versions up to, and inclu= ding, 5.0.4. This is due to the `update_capabilities()` REST handler accept= ing arbitrary capability strings from the request body and passing them dir= ectly to WP_User::add_cap() with no allowlist validation, only verifying th=
at the caller holds the dokandar capability. This makes it possible for aut= henticated attackers with a self-provisioned Vendor-level access and above,=
on sites with the Vendor Staff module enabled, to grant arbitrary WordPres=
s capabilities, including administrator, to any vendor_staff account, leadi=
ng to a full site takeover. 2026-07-01 8.8 CVE-2026-12224 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-12224 ] woodpecker-ci--woodpecker Woodpecker b= efore 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.= Author. For the GitLab forge driver, pipeline.Author is populated from the = git commit author name (commit.author.name) carried in the webhook payload,=
which is attacker-controlled and not verified by GitLab. A user who can op=
en a merge request from a fork can set the commit author name to match an e= ntry in ApprovalAllowedUsers, causing needsApproval to return false so the = pipeline runs without the required approval. This defeats the fork-approval=
security boundary and allows execution of attacker-controlled pipeline ste=
ps on a Woodpecker agent and exfiltration of CI secrets exposed to the run.=
Other built-in forge drivers (Gitea, Forgejo, GitHub, Bitbucket) derive pi= peline.Author from the forge-validated sender/actor identity and are not af= fected. 2026-06-30 8.1 CVE-2026-58370 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-58370 ] WP Swings--Wallet System for WooCommerce Subscriber Broken=
Access Control in Wallet System for WooCommerce <=3D 2.7.6 versions. 2026-= 06-29 7.1 CVE-2026-57332 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5733=
2 ] WPXPO--WowAddons Unauthenticated Cross Site Scripting (XSS) in WowAddon=
s <=3D 1.6.14 versions. 2026-07-02 7.1 CVE-2026-57686 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-57686 ] xdan--jodit Jodit Editor is a WYSIWYG edit=
or with written in pure TypeScript file and image editing capabilities. In = versions prior to 4.12.28, the built-in clean-html sanitizer can be bypasse=
d by a MathML/<style> carrier that hides a dangerous element from the sanit= izer's element walk, so a no-interaction event handler survives into the ed= itor value, potentially causing Mutation XSS. When an application supplies = attacker-influenced HTML to the editor's value-set or insertion paths, the = sanitized output still contains a live <img ... onload=3D...> (or another n= on-onerror handler such as onfocus). A consumer that renders that output (e= lement.innerHTML =3D editor.value) executes the handler with no user intera= ction. This issue has been fixed in version 4.12.28. 2026-07-01 7.2 CVE-202= 6-58263 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58263 ] XplodedThemes= --WPIDE File Manager & Code Editor Unauthenticated Cross Site Request Forge=
ry (CSRF) in WPIDE - File Manager & Code Editor <=3D 3.5.6 versions. 2026-0= 7-02 8.8 CVE-2026-57766 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57766=
] Yonyou Network Technology Co., Ltd.--KSOA Yonyou KSOA 9.0 contains an un= authenticated arbitrary file upload vulnerability in the com.sksoft.bill.Im= ageUpload servlet that allows unauthenticated attackers to upload arbitrary=
files by submitting a POST request with attacker-controlled filepath and f= ilename parameters without any authentication, file type, extension, or con= tent validation. Attackers can upload a JSP webshell by specifying a malici= ous filename and root filepath, with the uploaded file stored under the pic= tures directory and directly executed by the web server, resulting in unaut= henticated remote code execution. Exploitation evidence was first observed =
by the Shadowserver Foundation on 2023-11-07 (UTC). 2026-07-02 9.8 CVE-2022= -50973 [ https://www.cve.org/CVERecord?id=3DCVE-2022-50973 ] Yunai--ruoyi-v= ue-pro ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a br= oken access control vulnerability in ErpSaleOrderController that allows att= ackers with erp:sale-out permissions to gain unauthorized access to sale or= der operations by exploiting an incorrect permission namespace enforcement.=
Attackers holding shipment-level permissions can perform unauthorized crea= te, update, delete, and read operations on financially sensitive sale order=
s due to the controller enforcing erp:sale-out instead of the intended erp:= sale-order namespace. 2026-06-29 8.1 CVE-2026-57950 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-57950 ] YunaiV--ruoyi-vue-pro A vulnerability was fo= und in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.04-jdk8-SNAPSHOT. The = impacted element is the function generateUploadPath of the file yudao-modul= e-infra/src/main/java/cn/iocoder/yudao/module/infra/service/file/FileServic= eImpl.java of the component AppFileController File Upload Endpoint. Perform= ing a manipulation results in path traversal. Remote exploitation of the at= tack is possible. The exploit has been made public and could be used. The p= atch is named 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended t=
o apply a patch to fix this issue. This product is published by multiple ve= ndors. 2026-06-29 7.3 CVE-2026-13528 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-13528 ] zedeus--nitter Nitter's /video media proxy endpoint fails t=
o validate target URLs against Twitter/X domains and uses a hardcoded defau=
lt HMAC key, allowing unauthenticated attackers to compute valid HMACs for = arbitrary URLs. Attackers can retrieve HTTP responses from any host reachab=
le by the server, including cloud metadata services and internal network re= sources. 2026-06-29 8.6 CVE-2026-56285 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-56285 ] zephyrproject--zephyr The IPv6 Neighbor Discovery handl= ers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_n= a_input) used an incorrect boolean expression that combined the RFC 4861 va= lidity checks with the ICMPv6 code check using the wrong operator precedenc=
e: the form was '((length/hop/source/target checks) && (icmp_hdr-code !=3D = 0))'. Because every legitimate ND message carries ICMPv6 code 0, an attacke=
r setting code =3D=3D 0 (the normal value) caused the entire predicate to e= valuate false, so the packet was never dropped and all of the other checks = were silently skipped. The bypassed checks include the mandatory Hop Limit = =3D=3D 255 verification (which proves an ND packet originated on-link and w=
as not forwarded) and, for Router Advertisements, the requirement that the = source be a link-local address, as well as multicast-target sanity checks. =
As a result, an adjacent on-link attacker - and, because the Hop-Limit-255 = guard is bypassed, potentially a remote/off-link attacker whose packets wou=
ld otherwise be rejected - can have forged Router Advertisement, Neighbor S= olicitation, and Neighbor Advertisement messages accepted. A forged RA lets=
the attacker reconfigure the victim's default router, on-link prefixes (SL= AAC), MTU, reachable/retransmit timers, and (with CONFIG_NET_IPV6_RA_RDNSS)=
DNS servers, while forged NS/NA enable neighbor-cache poisoning, enabling = man-in-the-middle, traffic redirection, and denial of service. The flaw is =
an input-validation/authentication weakness rather than a memory-safety iss= ue: the underlying packet-parsing primitives (net_pkt_get_data, net_pkt_rea=
d, net_pkt_skip) are independently bounds-safe and the validated 'length' i=
s the true buffer length, so skipping the length check causes no out-of-bou= nds access. The defect has existed since the logic was introduced in 2018 a=
nd shipped in all releases through v4.4.0; it is fixed by splitting the con= dition so any failing check drops the packet. 2026-06-29 8.1 CVE-2026-7656 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-7656 ] zephyrproject--zephyr = Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem res= ource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SYSTEM=
is enabled) that serves files from a configured root directory. Before thi=
s fix, both the HTTP/1 and HTTP/2 front-ends placed the raw, attacker-contr= olled request path into client-url_buffer (assembled in on_url() for HTTP/1=
and copied verbatim from the :path pseudo-header for HTTP/2) without resol= ving ./.. segments. The static-FS handler then built the on-disk filename b=
y directly concatenating the configured root with that raw URL (snprintk(fn= ame, ..., "%s%s", static_fs_detail-fs_path, client-url_buffer) at http_serv= er_http1.c:603 and http_server_http2.c:490) and opened it with fs_open(fnam=
e, FS_O_READ). Because the handler is reached via wildcard/leading-dir (fnm= atch FNM_LEADING_DIR) or fallback resource matching, a request such as GET = /<prefix/../../<file is dispatched to the handler and, after the underlying=
filesystem (e.g. LittleFS/FAT) resolves the .. segments, escapes the confi= gured web root, letting an unauthenticated remote client read arbitrary rea= dable files on the mounted volume (information disclosure). The HTTP server=
requires no TLS or authentication to reach this path. The fix adds http_se= rver_remove_dot_segments(), which canonicalizes the path portion of the URL=
before resource lookup in both protocol handlers, neutralizing the travers= al. Affects releases v4.0.0 through v4.4.0 for deployments that register a = static-filesystem resource. 2026-06-29 7.5 CVE-2026-8023 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-8023 ] Zozothemes--Zegen Subscriber Arbitrary F= ile Upload in Zegen <=3D 1.1.9 versions. 2026-07-02 9.9 CVE-2026-27419 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-27419 ]=20

Back to top [ #top ]

Medium Vulnerabilities

Primary
Vendor -- Product Description Published CVSS Score Source Info 666ghj--Bett= aFish A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impac= ted is the function _deduplicate_results of the file InsightEngine/agent.py=
of the component InsightEngine search-result Deduplication. Executing a ma= nipulation can lead to partial string comparison. The attack can be launche=
d remotely. The exploit has been publicly disclosed and may be utilized. Th=
e pull request to fix this issue awaits acceptance. 2026-07-05 5.3 CVE-2026= -14687 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14687 ] acl project--a=
cl acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU=
) race condition vulnerability that allows local attackers to escalate priv= ileges by replacing a pathname component with a symbolic link between an ls= tat() check and subsequent symlink-following operations such as stat(), cho= wn(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a = pathname component can redirect file access control list operations to arbi= trary files when getfacl, setfacl, or chacl is invoked by a privileged proc= ess over an attacker-controlled path, resulting in local privilege escalati= on. 2026-06-29 6.3 CVE-2026-54370 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-54370 ] AD-Security--AD_Miner A vulnerability was determined in AD-Sec= urity AD_Miner 1.9.0. Affected is the function request_a of the file ad_min= er/scripts/analyse_cache.py of the component Cache Handler. This manipulati=
on of the argument sys.argv[1] causes deserialization. The attack can only =
be executed locally. The pull request to fix this issue awaits acceptance. = 2026-07-05 5.3 CVE-2026-14723 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -14723 ] Addify--Tax Exempt for WooCommerce Customer Path Traversal in Tax = Exempt for WooCommerce <=3D 1.9.3 versions. 2026-07-02 6.5 CVE-2026-49779 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-49779 ] Adobe--ColdFusion Cold= Fusion versions 2025.9, 2023.20 and earlier are affected by an Improper Lim= itation of a Pathname to a Restricted Directory ('Path Traversal') vulnerab= ility that could result in a Security feature bypass. An attacker could lev= erage this vulnerability to gain limited read and write access to unauthori= zed files or directories outside the intended restrictions. Exploitation of=
this issue does not require user interaction. 2026-06-30 6.5 CVE-2026-4831=
4 [ https://www.cve.org/CVERecord?id=3DCVE-2026-48314 ] Ads WPQuads--Ads by=
WPQuads Subscriber Broken Access Control in Ads by WPQuads <=3D 3.0.3 vers= ions. 2026-06-29 6.5 CVE-2026-57335 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-57335 ] agentejo--Cockpit CMS A security vulnerability has been dete= cted in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the fu= nction Spyc::YAMLLoad of the file /config/config.yaml of the component htac= cess Handler. Such manipulation leads to files or directories accessible. I=
t is possible to launch the attack remotely. The exploit has been disclosed=
publicly and may be used. Configuration settings should be changed. The ve= ndor was contacted early about this disclosure but did not respond in any w= ay. 2026-06-29 5.3 CVE-2026-13533 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-13533 ] AIAnytime--Awesome-MCP-Server A flaw has been found in AIAnyti=
me Awesome-MCP-Server up to a884bb51bcd99e08e14fd712c749d55d9d9a13ab. Affec= ted by this issue is some unknown functionality of the file mcp-wiki/src/mc= p_wiki/server.py of the component mcp-wiki/wiki-summary. This manipulation =
of the argument url causes server-side request forgery. The attack may be i= nitiated remotely. The exploit has been published and may be used. This pro= duct uses a rolling release model to deliver continuous updates. As a resul=
t, specific version information for affected or updated releases is not ava= ilable. The project was informed of the problem early through an issue repo=
rt but has not responded yet. 2026-07-05 6.3 CVE-2026-14748 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-14748 ] andrasweb--PixMagix WordPress Image = Editor The PixMagix - WordPress Image Editor plugin for WordPress is vulner= able to Directory Traversal in all versions up to, and including, 1.7.2 via=
the move_image_on_server function. This makes it possible for authenticate=
d attackers, with author-level access and above, to write files with attack= er-controlled content to arbitrary locations on the server. The unsanitized=
'layers[].id' parameter is concatenated into a filesystem path and passed =
to PHP's copy() function, allowing traversal sequences (e.g. '../../') to e= scape the intended upload directory and write attacker-supplied file conten=
ts to arbitrary paths accessible by the web server process. The save_templa=
te REST endpoint is gated by the create_projects permission (edit_pixmagix =
+ upload_files), which Author-level users hold by default after plugin acti= vation, making this exploitable by any Author on sites running PixMagix. 20= 26-06-30 6.5 CVE-2026-11367 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 1367 ] Andrew Fiebert--Simple URLs Author Cross Site Scripting (XSS) in Sim= ple URLs <=3D 151 versions. 2026-07-02 5.9 CVE-2026-57762 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-57762 ] api-platform--core API Platform Core i=
s a system to create hypermedia-driven REST and GraphQL APIs. In versions p= rior to 4.1.30, 4.2.26 and 4.3.12, the serializer's AbstractItemNormalizer = does not validate the resource type returned when resolving relation IRIs, = allowing type confusion where a resource of an unintended type can be silen= tly assigned to a relation property. An attacker who can submit write reque= sts (POST/PUT/PATCH) to an API Platform endpoint with writable relations ca=
n supply a relation IRI pointing to a resource of a different type than the=
relation's declared class. Because getResourceFromIri() does not pass an $= operation to IriConverter::getResourceFromIri(), the is_a type guard at Iri= Converter.php:86 is skipped. For untyped relation properties (legacy @var-o= nly style), the wrong-typed object is silently assigned, corrupting invaria= nts and potentially feeding downstream logic that assumes the declared type=
(CWE-843). For typed properties (modern PHP 8.x), the substitution is bloc= ked by Symfony's PropertyAccessor with an InvalidTypeException. This issue = has been fixed in versions 4.1.30, 4.2.26 and 4.3.12. 2026-07-01 6.5 CVE-20= 26-54164 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54164 ] api-platform= --core API Platform Core is a system to create hypermedia-driven REST and G= raphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a = missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes=
a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated pe=
r request to decide whether a property is exposed. The componentsCache arra=
ys in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Ser= ializer\ItemNormalizer are keyed on $context['cache_key'], which is set unc= onditionally before delegating to the parent normalizer. The component stru= cture (attributes, relationships, links) computed for one request can there= fore be reused for a subsequent request whose user has a different set of a= ccessible properties. A user with lower privileges may end up seeing the st= ructure of properties that the security predicate would otherwise have hidd=
en for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.= 12. 2026-07-01 5.9 CVE-2026-49858 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-49858 ] AsyncHttpClient--async-http-client The AsyncHttpClient (AHC) l= ibrary allows Java applications to easily execute HTTP requests and asynchr= onously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and = from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie und=
er the value of its Domain attribute without verifying that the responding = host is allowed to set a cookie for that domain, leading to a cookie tossin=
g / cookie injection issue. A host the client connects to can therefore pla=
nt a cookie scoped to an unrelated domain, and the client will then send th=
at cookie on later requests to that domain. Applications that use a single = AsyncHttpClient instance - and thus the default, shared CookieStore - to re= ach both an attacker-influenced host and a trusted host are impacted. This = issue has been fixed in versions 2.16.0 and 3.0.11. 2026-07-01 4 CVE-2026-5= 5688 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55688 ] Averta LTD--Shor= tcodes and extra features for Phlox theme Improper Neutralization of Input = During Web Page Generation ('Cross-site Scripting') vulnerability in Averta=
LTD Shortcodes and extra features for Phlox theme allows DOM-Based XSS. Th=
is issue affects Shortcodes and extra features for Phlox theme: from n/a th= rough 2.17.16. 2026-07-01 6.5 CVE-2026-57737 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-57737 ] AWS--AWS CLI Overly permissive file permissions in = AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the=
umask has not been configured to restrict file permissions (the default on=
most systems) may allow other local users on the same host to read credent= ials written by certain CLI subcommands (aws codeartifact login, aws iam cr= eate-virtual-mfa-device, aws deploy register). To remediate this issue, use=
rs should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later. 2026-07= -01 5.5 CVE-2026-13769 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13769 =
] beardev--JoomSport for Sports: Team & League, Football, Hockey & more The=
JoomSport - for Sports: Team & League, Football, Hockey & more plugin for = WordPress is vulnerable to Missing Authorization to Arbitrary Group Deletio=
n in versions up to, and including, 5.7.8. This is due to a missing capabil= ity check in the joomsport_season_groupdel() AJAX handler, which only verif= ies a nonce before executing a DELETE query on attacker-supplied group IDs.=
This makes it possible for authenticated attackers, with Subscriber-level = access and above, to delete arbitrary JoomSport group records. 2026-07-01 4=
.3 CVE-2026-12133 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12133 ] bea= rdev--JoomSport for Sports: Team & League, Football, Hockey & more The Joom= Sport - for Sports: Team & League, Football, Hockey & more plugin for WordP= ress is vulnerable to authorization bypass in all versions up to, and inclu= ding, 5.7.8. This is due to the plugin not properly verifying that a user i=
s authorized to perform an action. This makes it possible for authenticated=
attackers, with subscriber-level access and above, to create arbitrary sea= son groups or modify existing group names, participants, and round-type opt= ions. Exploitation requires obtaining the joomsportajaxnonce, which is expo= sed on frontend pages that render a JoomSport shortcode. 2026-07-02 4.3 CVE= -2026-12134 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12134 ] BMC--Cont= rol-M/Enterprise Manager The Control-M/Enterprise Manager uses weak protect= ions for stored hashes of account passwords, potentially allowing offline p= assword recovery attacks if credential data is obtained by an attacker. Thi=
s vulnerability affects Control-M/Enterprise Manager unsupported versions 9= .0.20.x and potentially earlier unsupported versions 2026-07-01 5.6 CVE-202= 6-10540 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10540 ] Capgo--Capgo = Capgo before 12.128.2 allows multiple public channels for the same app and = platform to coexist simultaneously, while unnamed /updates requests without=
defaultChannel implicitly resolve to a single hidden winner channel. An au= thorized app or channel manager can create ambiguous default update state a=
nd silently influence which bundle unnamed clients receive, breaking releas=
e routing integrity and predictability. 2026-06-30 6.5 CVE-2026-56328 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-56328 ] Capgo--Capgo Capgo console= .capgo.app/login before 12.128.2 accepts access_token and refresh_token in = URL query parameters, automatically authenticating users without confirmati= on. Attackers can craft malicious links to force victims into attacker-cont= rolled sessions, exposing tokens in browser history and logs. 2026-06-30 5.=
4 CVE-2026-56224 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56224 ] Capg= o--Capgo Capgo before 12.128.2 contains an information disclosure vulnerabi= lity in the /private/validate_password_compliance endpoint that returns dif= ferent error responses for malformed, non-existent, and existing organizati=
on IDs. Unauthenticated attackers can enumerate valid organization UUIDs by=
observing response status codes and error messages, allowing confirmation =
of organization existence. 2026-06-30 5.3 CVE-2026-56318 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-56318 ] Capgo--Capgo Capgo before 12.128.2 cont= ains an information disclosure vulnerability in the public.invite_user_to_o=
rg RPC function that allows unauthenticated attackers to enumerate organiza= tion existence by observing distinct error responses. Attackers can call th=
e SECURITY DEFINER function with a publishable API key to determine if an o= rganization ID exists based on NO_ORG versus NO_RIGHTS responses, enabling = tenant enumeration attacks. 2026-06-30 5.3 CVE-2026-56327 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-56327 ] Capgo--Capgo Capgo before 12.128.2 con= tains improper error handling in the /private/accept_invitation endpoint th=
at returns HTTP 500 instead of safe 4xx errors when magic_invite_string is = invalid. Attackers can trigger this vulnerability using only the public key=
by submitting malformed magic_invite_string values to cause server errors = and leak internal processing details. 2026-06-30 5.3 CVE-2026-56331 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-56331 ] Capgo--Capgo Capgo before 12= .128.2 contains a server-side validation bypass vulnerability in organizati=
on security settings that allows authenticated org admins to persist invali=
d security policy state. Attackers can bypass backend validation by directl=
y updating the public.orgs table from the browser, circumventing field-leve=
l validation checks for max_apikey_expiration_days and other security-sensi= tive configuration parameters. 2026-06-30 4.3 CVE-2026-56333 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-56333 ] Capgo--Capgo Capgo before 12.128.2 = lacks an UPDATE row-level security policy for the build_requests table, pre= venting API-key and anonymous access from persisting builder status updates=
. Attackers can exploit this missing policy to cause build status and error=
details to remain unpersisted, leaving build_requests rows stuck in pendin=
g state with null last_error values. 2026-06-30 4.3 CVE-2026-56334 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-56334 ] ccfos--nightingale Nightingal=
e (n9e) before 9.0.0-beta.2 exposes full datasource configurations, includi=
ng plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwo= rds, and mTLS client keys, to any authenticated low-privilege (Standard rol=
e) user through POST /api/n9e/datasource/list. The route is registered with= out an admin authorization gate, unlike the sibling datasource mutation rou= tes, and the open-source DatasourceFilter does not redact secret fields, so=
the secret-bearing settings, http, and auth objects are serialized in the = response. The disclosed credentials enable access to the connected downstre=
am systems. 2026-06-30 6.5 CVE-2026-58167 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-58167 ] ChaN--FatFs FatFs R0.16 and earlier exhibits a stale d= irty-cache skip via unsigned-subtraction wrap in f_read() / f_write() (fp->= sect - sect < cc) during interleaved read/write on fragmented filesystems. = This maps to CWE-191 (Integer Underflow). Estimated CVSS v3.1 vector: CVSS:= 3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (6.1, Medium). The estimated CISA S= SVC vectors are Exploitation: PoC, Technical Impact: Total. 2026-07-01 6.1 = CVE-2026-6685 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6685 ] ChaN--Fa= tFs FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic b=
ug when crafted metadata causes n_fatent - 2 to be zero during write/sync o= perations. This maps to CWE-369 (Divide By Zero). Estimated CVSS v3.1 vecto=
r: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). Network-deli= vered update media can make this remote in some pipelines. The estimated CI=
SA SSVC vectors are Exploitation: PoC, Technical Impact: Partial. 2026-07-0=
1 4.6 CVE-2026-6683 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6683 ] Ch= aN--FatFs FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 =3D 1' = contains an issue where an unbounded loop count derived from GPT header fie=
ld GPTH_PtNum, enabling extremely long or effectively infinite mount-time s= cans. This maps to CWE-835 (Loop with Unreachable Exit Condition). Estimate=
d CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medi= um). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impac=
t: Partial. 2026-07-01 4.6 CVE-2026-6684 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-6684 ] ChaN--FatFs FatFs R0.16 and earlier contains an uninitia= lized cluster exposure when f_lseek() extends files beyond EOF without zero= -filling newly allocated clusters. This maps to CWE-908 (Use of Uninitializ=
ed Resource). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/= C:H/I:N/A:N (4.6, Medium). The estimated CISA SSVC vectors are Exploitation=
: PoC, Technical Impact: Partial. 2026-07-01 4.6 CVE-2026-6686 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-6686 ] CherryHQ--cherry-studio A security=
vulnerability has been detected in CherryHQ cherry-studio up to 1.9.6. Thi=
s vulnerability affects unknown code of the file src/main/services/mcp/oaut= h/callback.ts of the component MCP OAuth Local Callback Server. The manipul= ation of the argument code leads to improper authorization. The attack can =
be initiated remotely. The attack is considered to have high complexity. It=
is stated that the exploitability is difficult. The exploit has been discl= osed publicly and may be used. The pull request to fix this issue awaits ac= ceptance. 2026-06-29 5.6 CVE-2026-13524 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13524 ] CherryHQ--cherry-studio A vulnerability was detected in=
CherryHQ cherry-studio up to 1.9.7. This affects the function sha256 of th=
e file src/main/services/memory/MemoryService.ts of the component CherryIN = Preload API. Performing a manipulation of the argument state results in aut= horization bypass. The attack can be initiated remotely. The attack's compl= exity is rated as high. It is indicated that the exploitability is difficul=
t. The exploit is now public and may be used. The vendor explains, that "[m= ]emory is planned to be removed in v2 version." 2026-06-29 5 CVE-2026-13534=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-13534 ] code-projects--Asses= sment Management A flaw has been found in code-projects Assessment Manageme=
nt 1.0. This issue affects some unknown processing of the file /lecturer/ma= rking-scheme.php of the component Database Query Handler. This manipulation=
of the argument squestions[] causes sql injection. The attack can be initi= ated remotely. The exploit has been published and may be used. 2026-07-04 6=
.3 CVE-2026-14657 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14657 ] cod= e-projects--Assessment Management A vulnerability was detected in code-proj= ects Assessment Management 1.0. This vulnerability affects unknown code of = the file /lecturer/marking-scheme.php. The manipulation of the argument sma= rksrange[] results in sql injection. It is possible to launch the attack re= motely. The exploit is now public and may be used. 2026-07-04 6.3 CVE-2026-= 14658 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14658 ] code-projects--= Assessment Management A security vulnerability has been detected in code-pr= ojects Assessment Management 1.0. This affects an unknown part of the file = /admin/remove-user.php. The manipulation of the argument ID leads to cross = site scripting. It is possible to initiate the attack remotely. The exploit=
has been disclosed publicly and may be used. 2026-07-04 4.3 CVE-2026-14656=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14656 ] code-projects--Inter= nship Management System A vulnerability was detected in code-projects Inter= nship Management System 1.0. This affects an unknown function of the file e= mployer/details/change_password.php of the component Password Change Endpoi= nt. The manipulation of the argument Current results in sql injection. The = attack can be executed remotely. The exploit is now public and may be used.=
2026-07-05 6.3 CVE-2026-14701 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-14701 ] code-projects--Online Examination A vulnerability was identified =
in code-projects Online Examination 1.0. This affects an unknown part of th=
e file /update.php?q=3Daddquiz of the component Quiz Creation Feature. The = manipulation of the argument name/total/right/wrong/time/tag/desc leads to = sql injection. The attack can be initiated remotely. The exploit is publicl=
y available and might be used. 2026-07-05 6.3 CVE-2026-14706 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-14706 ] code-projects--Online Music Site A = security flaw has been discovered in code-projects Online Music Site 1.0. T= his affects an unknown part of the file /Frontend/Feedback.php of the compo= nent POST Request Handler. The manipulation of the argument fname/femail/fa= ddress/fmessage results in cross site scripting. The attack may be launched=
remotely. The exploit has been released to the public and may be used for = attacks. 2026-06-29 4.3 CVE-2026-13567 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13567 ] CodeAstro--Apartment Visitor Management System A securi=
ty flaw has been discovered in CodeAstro Apartment Visitor Management Syste=
m 1.0. The impacted element is an unknown function of the file /apartment-v= isitor/add-apartment.php. The manipulation of the argument apartmentno resu= lts in sql injection. The attack may be launched remotely. The exploit has = been released to the public and may be used for attacks. 2026-07-05 6.3 CVE= -2026-14689 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14689 ] CodeAstro= --Apartment Visitor Management System A vulnerability was identified in Cod= eAstro Apartment Visitor Management System 1.0. Affected by this issue is s= ome unknown functionality of the file /apartment-visitor/search-result.php =
of the component POST Parameter Handler. The manipulation of the argument s= earchdata leads to sql injection. Remote exploitation of the attack is poss= ible. The exploit is publicly available and might be used. 2026-07-05 6.3 C= VE-2026-14766 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14766 ] CodeAst= ro--Complaint Management System A security flaw has been discovered in Code= Astro Complaint Management System 1.0. The affected element is the function=
deletereport of the file application/controllers/Report.php of the compone=
nt Report Endpoint. The manipulation results in authorization bypass. The a= ttack can be executed remotely. The exploit has been released to the public=
and may be used for attacks. 2026-06-29 5.4 CVE-2026-13549 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-13549 ] CodeAstro--Ecommerce Website A vulne= rability has been found in CodeAstro Ecommerce Website 1.0. This impacts an=
unknown function of the file /ecommerce-website-php/customer/my_account.ph= p?edit_account. Such manipulation of the argument c_name leads to sql injec= tion. The attack may be launched remotely. The exploit has been disclosed t=
o the public and may be used. 2026-07-04 6.3 CVE-2026-14639 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-14639 ] CodeAstro--Ecommerce Website A secur= ity flaw has been discovered in CodeAstro Ecommerce Website 1.0. This affec=
ts an unknown part of the file /ecommerce-website-php/customer/confirm.php =
of the component POST Parameter Handler. The manipulation of the argument i= nvoice_no results in sql injection. The attack can be executed remotely. Th=
e exploit has been released to the public and may be used for attacks. 2026= -07-05 6.3 CVE-2026-14767 [ https://www.cve.org/CVERecord?id=3DCVE-2026-147=
67 ] CodeAstro--Human Resource Management System A vulnerability was detect=
ed in CodeAstro Human Resource Management System 1.0. This issue affects th=
e function emselectByCode of the file application/models/Employee_model.php=
of the component Update_Earn_Leave Endpoint. The manipulation of the argum= ent emid results in sql injection. The attack can be launched remotely. The=
exploit is now public and may be used. 2026-06-29 6.3 CVE-2026-13525 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-13525 ] CodeAstro--Human Resource = Management System A flaw has been found in CodeAstro Human Resource Managem= ent System 1.0. This vulnerability affects the function GetFileInfo of the = file hrsystem/application/models/Employee_model.php of the component View E= ndpoint. Executing a manipulation of the argument ID can lead to sql inject= ion. The attack can be launched remotely. The exploit has been published an=
d may be used. 2026-06-29 6.3 CVE-2026-13535 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-13535 ] CodeAstro--Human Resource Management System A vulne= rability was found in CodeAstro Human Resource Management System 1.0. Impac= ted is an unknown function. The manipulation results in cross-site request = forgery. The attack may be launched remotely. The exploit has been made pub= lic and could be used. 2026-06-29 4.3 CVE-2026-13537 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-13537 ] codename065--Download Manager The Download = Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting v=
ia 'no_data_msg' Shortcode Attribute in all versions up to, and including, = 3.3.60 due to insufficient input sanitization and output escaping. This mak=
es it possible for authenticated attackers, with contributor-level access a=
nd above, to inject arbitrary web scripts in pages that will execute whenev=
er a user accesses an injected page. Although wp_kses_post is applied to po=
st content on save, it only strips HTML tokens and does not neutralize C-st= yle escape sequences embedded within shortcode attribute values, meaning co= ntributors can craft a payload that survives the kses filter and is silentl=
y reconstructed into a raw script tag at render time. 2026-07-01 6.4 CVE-20= 26-13733 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13733 ] codepeople--= Appointment Booking Calendar The Appointment Booking Calendar plugin for Wo= rdPress is vulnerable to Sensitive Information Exposure in all versions up = to, and including, 1.4.02 via the cpabc_appointments_filter_list. This make=
s it possible for authenticated attackers, with contributor-level access an=
d above, to extract customer names, email addresses, phone numbers, appoint= ment comments, and other booking personally identifiable information. 2026-= 07-01 4.3 CVE-2026-12113 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1211=
3 ] Codexpert Inc--ThumbPress Missing Authorization vulnerability in Codexp= ert Inc ThumbPress allows Exploiting Incorrectly Configured Access Control = Security Levels. This issue affects ThumbPress: from n/a through 6.3.2. 202= 6-07-01 4.3 CVE-2026-57720 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57= 720 ] Colissimo--Colissimo Officiel : Mthodes de livraison pour WooCommerce=
Unauthenticated Insecure Direct Object References (IDOR) in Colissimo Offi= ciel : M=C3=83=C2=A9thodes de livraison pour WooCommerce <=3D 2.9.0 version=
s. 2026-06-29 6.5 CVE-2026-57341 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-57341 ] coollabsio--coolify Coolify is an open-source and self-hostable=
tool for managing servers, applications, and databases. Prior to 4.0.0-bet= a.464, the executeInDocker() helper wraps commands in bash -c '{$command}' = without escaping single quotes. User-controlled docker_compose_custom_build= _command and docker_compose_custom_start_command fields are interpolated di= rectly, allowing a single quote to break out of the bash -c argument and ex= ecute commands on the managed server host (outside the intended Docker cont= ainer context). This vulnerability is fixed in 4.0.0-beta.464. 2026-06-30 6=
.6 CVE-2026-27955 [ https://www.cve.org/CVERecord?id=3DCVE-2026-27955 ] coo= llabsio--coolify Coolify is an open-source and self-hostable tool for manag= ing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /ap= i/v1/deployments/{uuid}` in DeployController.php retrieves deployment detai=
ls without validating that the deployment belongs to the authenticated user=
's team. Any authenticated API user can read deployment records from other = teams by providing a valid deployment UUID. This vulnerability is fixed in = 4.0.0-beta.464. 2026-06-30 5 CVE-2026-27881 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-27881 ] coollabsio--coolify Coolify is an open-source and se= lf-hostable tool for managing servers, applications, and databases. Prior t=
o 4.0.0-beta.464, the `GET /api/v1/deployments/{uuid}` endpoint allows any = authenticated user to access deployment details belonging to any team, bypa= ssing team-based authorization. The $teamId is extracted from the authentic= ation token but never used to scope the database query. This vulnerability =
is fixed in 4.0.0-beta.464. 2026-06-30 5 CVE-2026-27883 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-27883 ] coollabsio--coolify Coolify is an open-s= ource and self-hostable tool for managing servers, applications, and databa= ses. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-consta= nt-time string comparison operator (!=3D=3D) to validate the webhook secret=
token. This implementation is vulnerable to timing attacks, which could al= low an attacker to gradually discover the secret token by measuring respons=
e time differences. This vulnerability is fixed in 4.0.0-beta.461. 2026-06-=
30 4.8 CVE-2026-27882 [ https://www.cve.org/CVERecord?id=3DCVE-2026-27882 ]=
coollabsio--coolify Coolify is an open-source and self-hostable tool for m= anaging servers, applications, and databases. Prior to 4.0.0-beta.464, `GET=
/api/v1/servers/{server_uuid}/domains?uuid=3D{app_uuid}` bypasses team sco= ping when the optional uuid query parameter is provided. Any authenticated = API user can enumerate domain names (FQDNs) of applications belonging to ot= her teams. This vulnerability is fixed in 4.0.0-beta.464. 2026-06-30 4.3 CV= E-2026-27956 [ https://www.cve.org/CVERecord?id=3DCVE-2026-27956 ] creative= mindssolutions--CM Business Directory Optimise and showcase local business = The CM Business Directory - Optimise and showcase local business plugin for=
WordPress is vulnerable to Stored Cross-Site Scripting via Business Addres=
s Meta Fields in all versions up to, and including, 1.5.7 due to insufficie=
nt input sanitization and output escaping. This makes it possible for authe= nticated attackers, with contributor-level access and above, to inject arbi= trary web scripts in pages that will execute whenever a user accesses an in= jected page. Because the malicious payload is stored in post meta rather th=
an post_content, WordPress's unfiltered_html capability restriction does no=
t apply, meaning contributors who lack that capability can still inject exe= cutable HTML via the address meta fields such as cmbd_address, cmbd_cityTow=
n, cmbd_stateCounty, cmbd_postalcode, cmbd_region, and cmbd_country. 2026-0= 7-03 6.4 CVE-2026-8892 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8892 ]=
crmperks--Database for Contact Form 7, WPforms, Elementor forms The Databa=
se for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vul= nerable to Arbitrary File Copy via the create_entry_el() function in versio=
ns up to, and including, 1.5.1. The function reads raw_value from Elementor=
Pro's Form_Record object for upload-type fields and passes it directly to = PHP's copy() without validating that the value corresponds to a legitimatel=
y uploaded file - when no file is present in $_FILES, raw_value reflects th=
e attacker-controlled POST string. copy() accepts both local filesystem pat=
hs and URL sources, so the attacker can target any file readable by the PHP=
process or supply an attacker-controlled remote URL. Elementor Pro is a pr= erequisite for triggering the code path (it owns the elementor_pro/forms/ne= w_record hook and populates the Form_Record object), but the bug itself is = entirely in Contact Form Entries' handler. This could allow unauthenticated=
attackers to disclose arbitrary files on the affected site's server. The f= ile is copied to a directory unknown to the attacker; the hashed directory = name provides defense-in-depth but is generated from non-cryptographic sour= ces (uniqid() + rand()) and should not be relied upon as the primary mitiga= tion. 2026-07-02 6.5 CVE-2026-9145 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-9145 ] Crocoblock. Jetimpex Inc.--JetReviews Subscriber Cross Site Sc= ripting (XSS) in JetReviews <=3D 3.0.0.1 versions. 2026-07-02 6.5 CVE-2026-= 57354 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57354 ] cvat-ai--cvat C= VAT before 2.69.0 contains an improper authorization vulnerability in Quali= tyReportViewSet.get_queryset that allows authenticated attackers to enumera=
te quality report identifiers belonging to other organizations by exploitin=
g a missing check_object_permissions call on the parent_id query parameter =
of the quality reports API endpoint. Attackers can send requests with seque= ntial integer parent_id values and distinguish between existing and non-exi= sting reports via HTTP 500 versus HTTP 404 response differences, disclosing=
cross-organization report existence without returning report content. 2026= -06-30 4.3 CVE-2026-58373 [ https://www.cve.org/CVERecord?id=3DCVE-2026-583=
73 ] DALIBO--PostgreSQL Anonymizer PostgreSQL Anonymizer contains a vulnera= bility that allows unprivileged masked users to repeatedly call the anon.ha= sh() function and collects (seed, hash_output) pairs to perform an offline = brute-force attack and deduce the salt. The problem is resolved in PostgreS=
QL Anonymizer 3.1.2 and later versions 2026-06-30 4.3 CVE-2026-13455 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-13455 ] DeepMyst--Mysti A weakness = has been identified in DeepMyst Mysti 0.4.0. Affected is the function _isTr= ackedConversation of the file src/managers/ChannelBridge.ts of the componen=
t Contact Tracking. This manipulation of the argument _channelType causes i= mproper authorization. The attack may be initiated remotely. A high degree =
of complexity is needed for the attack. The exploitability is told to be di= fficult. The exploit has been made available to the public and could be use=
d for attacks. Patch name: 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48. It is = suggested to install a patch to address this issue. 2026-06-29 5 CVE-2026-1= 3591 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13591 ] DeepMyst--Mysti =
A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected = element is the function initProjectMemory of the file src/managers/MemoryMa= nager.ts of the component Per-Project Auto-Memory Handler. Such manipulatio=
n of the argument workspacePath leads to exposure of resource. The attack m=
ay be performed from remote. Upgrading to version 0.4.0 is sufficient to fi=
x this issue. The name of the patch is 6d709229b5199f6769fb3cf763e5122dcc43= c079. It is advisable to upgrade the affected component. 2026-07-03 4.3 CVE= -2026-14611 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14611 ] Dell--Ins= piron 15 3520 Dell Client Platform BIOS contains an Authentication Bypass b=
y Primary Weakness vulnerability. An unauthenticated attacker with physical=
access could potentially exploit this vulnerability, leading to Informatio=
n Disclosure. 2026-07-03 5.3 CVE-2026-35159 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-35159 ] Dell--PowerProtect Data Domain Dell PowerProtect Dat=
a Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 thr= ough 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 re= lease versions 7.13.1.0 through 7.13.1.70 contain an improper neutralizatio=
n of special Elements used in an OS command ('OS command Injection') vulner= ability. A high privileged attacker with remote access could potentially ex= ploit this vulnerability, leading to command execution. 2026-07-03 6.5 CVE-= 2026-26355 [ https://www.cve.org/CVERecord?id=3DCVE-2026-26355 ] Dell--Powe= rProtect Data Domain Dell PowerProtect Data Domain, versions 7.7.1.0 throug=
h 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release ve= rsion 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7= .13.1.70 contain an integer overflow or wraparound vulnerability. An unauth= enticated attacker with remote access could potentially exploit this vulner= ability, leading to denial of service. 2026-07-03 6.5 CVE-2026-46463 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-46463 ] Dell--PowerProtect Data Dom= ain Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an improper neutralization of special elements used in an OS command ('OS c= ommand Injection') vulnerability. A high privileged attacker with local acc= ess could potentially exploit this vulnerability, leading to arbitrary comm= and execution. 2026-07-03 6.7 CVE-2026-49813 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-49813 ] Dell--PowerProtect Data Domain Dell PowerProtect Da=
ta Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 th= rough 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 r= elease versions 7.13.1.0 through 7.13.1.70 contain an improper neutralizati=
on of special elements used in an OS command ('OS command Injection') vulne= rability. A high privileged attacker with local access could potentially ex= ploit this vulnerability, leading to Command execution. 2026-07-03 6.7 CVE-= 2026-54483 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54483 ] Dell--Powe= rProtect Data Domain Dell PowerProtect Data Domain, versions 7.7.1.0 throug=
h 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release ve= rsion 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7= .13.1.70 contain an use of externally-controlled format string vulnerabilit=
y. A high privileged attacker with remote access could potentially exploit = this vulnerability, leading to Information disclosure and denial of service=
. 2026-07-03 5.5 CVE-2026-46465 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-46465 ] Dell--PowerProtect Data Domain Dell PowerProtect Data Domain, ve= rsions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.1=
0, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versio=
ns 7.13.1.0 through 7.13.1.70 contain an insertion of sensitive information=
into log file vulnerability. A low privileged attacker with local access c= ould potentially exploit this vulnerability, leading to information exposur=
e. 2026-07-03 5.8 CVE-2026-46467 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-46467 ] Dell--PowerProtect Data Domain Dell PowerProtect Data Domain, v= ersions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.= 10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi= ons 7.13.1.0 through 7.13.1.70 contain an improper access control vulnerabi= lity in the RBAC. A low privileged attacker with remote access could potent= ially exploit this vulnerability, leading to information tampering. 2026-07= -03 4.3 CVE-2026-41123 [ https://www.cve.org/CVERecord?id=3DCVE-2026-41123 =
] Dell--PowerProtect Data Domain Dell PowerProtect Data Domain, versions 7.= 7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS202=
5 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1=
.0 through 7.13.1.70 contain an incorrect permission Assignment for critica=
l resource vulnerability. A high privileged attacker with local access coul=
d potentially exploit this vulnerability, leading to unauthorized access. 2= 026-07-03 4.4 CVE-2026-44268 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 44268 ] Dell--PowerProtect Data Domain Dell PowerProtect Data Domain, versi= ons 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, = LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions = 7.13.1.0 through 7.13.1.70 contain an improper link resolution before file = access ('link following') vulnerability. A high privileged attacker with lo= cal access could potentially exploit this vulnerability, leading to unautho= rized access. 2026-07-03 4.4 CVE-2026-44269 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-44269 ] Dell--PowerProtect Data Domain Dell PowerProtect Dat=
a Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 thr= ough 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 re= lease versions 7.13.1.0 through 7.13.1.70 contain an improper link resoluti=
on before file access ('Link following') vulnerability. A high privileged a= ttacker with remote access could potentially exploit this vulnerability, le= ading to information disclosure. 2026-07-03 4.9 CVE-2026-46464 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-46464 ] Dell--PowerProtect Data Domain De=
ll PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release = version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8= .3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an imp= roper link resolution before file access ('Link following') vulnerability. =
A high privileged attacker with local access could potentially exploit this=
vulnerability, leading to information exposure. 2026-07-03 4.4 CVE-2026-46= 468 [ https://www.cve.org/CVERecord?id=3DCVE-2026-46468 ] Dell--PowerProtec=
t Data Domain Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, = LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8= .3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.7=
0 contain an incorrect authorization vulnerability. A high privileged attac= ker with local access could potentially exploit this vulnerability, leading=
to unauthorized command execution. 2026-07-03 4.2 CVE-2026-46730 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-46730 ] DivvyDrive Information Technol= ogies Inc.--DivvyDrive Improper neutralization of input during web page gen= eration ('cross-site scripting') vulnerability in DivvyDrive Information Te= chnologies Inc. DivvyDrive allows Stored XSS. This issue affects DivvyDrive=
: from 4.8.2.23 before v.4.8.3.1. 2026-07-01 6.4 CVE-2026-5220 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-5220 ] DivvyDrive Information Technologie=
s Inc.--DivvyDrive Improper neutralization of input during web page generat= ion ('cross-site scripting') vulnerability in DivvyDrive Information Techno= logies Inc. DivvyDrive allows Stored XSS. This issue affects DivvyDrive: fr=
om v.4.8.2.23 before v.4.8.3.1. 2026-07-01 5.4 CVE-2026-6283 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-6283 ] Documenso--Documenso A vulnerability=
was detected in Documenso up to 2.11.0. Affected by this vulnerability is =
an unknown functionality of the file packages/auth/server/lib/utils/handle-= oauth-callback-url.ts of the component Google OAuth Login. The manipulation=
results in improper authentication. It is possible to launch the attack re= motely. This attack is characterized by high complexity. The exploitation a= ppears to be difficult. The exploit is now public and may be used. The pull=
request to fix this issue awaits acceptance. 2026-06-29 5.6 CVE-2026-13543=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-13543 ] drfuri--Martfury - W= ooCommerce Marketplace WordPress Theme Subscriber Broken Access Control in = Martfury - WooCommerce Marketplace WordPress Theme <=3D 3.2.8 versions. 202= 6-07-02 4.3 CVE-2026-57685 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57= 685 ] dromara--RuoYi-Vue-Plus RuoYi-Vue-Plus through 5.6.2, fixed in commit=
88d03d9, exposes workflow task management endpoints under /workflow/task (= FlwTaskController) without any permission check: the controller declares no=
class-level or method-level authorization annotation, so the endpoints are=
gated only by global authentication. Any authenticated user, regardless of=
assigned role, can therefore reassign workflow approval tasks to arbitrary=
users via updateAssignee (defeating segregation of duties in the approval = process), urge arbitrary tasks, and enumerate all pending and finished task=
s via the pageByAllTaskWait and pageByAllTaskFinish listing endpoints. The = issue was resolved by adding permission identifiers (SaCheckPermission) to = these endpoints. 2026-06-30 6.5 CVE-2026-58176 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-58176 ] dylan ngo--Woostify Sites Library Unauthenticated=
Broken Access Control in Woostify Sites Library <=3D 1.6.2 versions. 2026-= 07-02 5.3 CVE-2025-66076 [ https://www.cve.org/CVERecord?id=3DCVE-2025-6607=
6 ] e4jvikwp--VikBooking Hotel Booking Engine & PMS The VikBooking Hotel Bo= oking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Si=
te Scripting via the 'layoutstyle' parameter in all versions up to, and inc= luding, 1.8.12 due to insufficient input sanitization and output escaping. = This makes it possible for unauthenticated attackers to inject arbitrary we=
b scripts in pages that execute if they can successfully trick a user into = performing an action such as clicking on a link. Exploitation requires the = targeted page to render the [vikbooking view=3D"roomslist"] shortcode, as t=
he vulnerable layoutstyle parameter is only processed in that view context.=
2026-07-01 6.1 CVE-2026-12754 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-12754 ] Eclipse Foundation--Eclipse Open VSX In Open VSX Registry before = 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Con= tent-Type: text/html and without a Content-Security-Policy or Content-Dispo= sition: attachment response header. An unauthenticated attacker can registe=
r a publisher account, upload a VSIX containing a crafted HTML payload, and=
induce an authenticated user to visit the resulting URL. The browser rende=
rs the file inline in the open-vsx.org origin context, enabling session tok=
en exfiltration, persistent Personal Access Token (PAT) generation, and una= uthorized publication of malicious extension versions. Because Open VSX ext= ensions are distributed to VS Code, VSCodium, Cursor, Windsurf, and compati= ble editors, a compromised extension update constitutes a supply chain atta=
ck against all downstream users. 2026-07-01 4.1 CVE-2026-13323 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-13323 ] edge22--GenerateBlocks The Genera= teBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting = via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versio=
ns up to, and including, 2.2.1 due to insufficient input sanitization and o= utput escaping. This makes it possible for authenticated attackers, with co= ntributor-level access and above, to inject arbitrary web scripts in pages = that will execute whenever a user accesses an injected page. A contributor-= level attacker can store a JavaScript payload in their own profile descript= ion (allowlisted by get_safe_user_meta_keys()) and prepend 'javascript:' vi=
a the linkMetaFieldType attribute, creating a fully attacker-controlled hre=
f that executes when any user, including an administrator, clicks the rende= red headline link. 2026-07-03 6.4 CVE-2026-9756 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-9756 ] Edimax--EW-7478APC A security vulnerability has b= een detected in Edimax EW-7478APC 1.04. The affected element is the functio=
n formAccept of the file /goform/formAccept of the component POST Request H= andler. The manipulation of the argument submit-url leads to os command inj= ection. The attack is possible to be carried out remotely. The exploit has = been disclosed publicly and may be used. The vendor was contacted early abo=
ut this disclosure but did not respond in any way. 2026-06-29 6.3 CVE-2026-= 13560 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13560 ] Edimax--EW-7478= APC A vulnerability was detected in Edimax EW-7478APC 1.04. The impacted el= ement is the function formiNICbasic of the file /goform/formiNICbasic of th=
e component POST Request Handler. The manipulation of the argument rootAPma=
c results in os command injection. The attack may be performed from remote.=
The exploit is now public and may be used. The vendor was contacted early = about this disclosure but did not respond in any way. 2026-06-29 6.3 CVE-20= 26-13561 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13561 ] Edimax--EW-7= 478APC A vulnerability was detected in Edimax EW-7478APC 1.04. This vulnera= bility affects the function formStaDrvSetup of the file /goform/formStaDrvS= etup of the component POST Request Handler. The manipulation of the argumen=
t rootAPmac results in os command injection. The attack can be executed rem= otely. The exploit is now public and may be used. The vendor was contacted = early about this disclosure but did not respond in any way. 2026-06-29 6.3 = CVE-2026-13581 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13581 ] Eksaga=
te Electronic Engineering and Computer Industry Trade Inc.--SYSGUARD 6001 I= mproper neutralization of input during web page generation ('cross-site scr= ipting') vulnerability in Eksagate Electronic Engineering and Computer Indu= stry Trade Inc. SYSGUARD 6001 allows Stored XSS. This issue affects SYSGUAR=
D 6001: from 2.0.2 before 6.1.4.0.=C2=A0 NOTE: The vendor was contacted and=
it was learned that the product is not supported. 2026-06-30 6.1 CVE-2026-= 8403 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8403 ] Elastic--Elastic = Defend Incorrect Authorization (CWE-863) in Elastic Defend can lead to unau= thorized information disclosure via Accessing Functionality Not Properly Co= nstrained by ACLs (CAPEC-1). Under certain conditions, a low-privileged aut= henticated user can access response action data that they are not authorize=
d to view. 2026-07-01 5.3 CVE-2026-56152 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-56152 ] Elastic--Elasticsearch Uncontrolled Resource Consumptio=
n (CWE-400) in Elasticsearch can lead to a denial of service via Excessive = Allocation (CAPEC-130). An authenticated user can submit a specially crafte=
d bulk request that causes sustained high CPU consumption, which can render=
the affected node unable to process requests. 2026-07-01 6.5 CVE-2026-4909=
0 [ https://www.cve.org/CVERecord?id=3DCVE-2026-49090 ] Elastic--Elasticsea= rch Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial =
of service via Excessive Allocation (CAPEC-130). An authenticated user can = submit a specially crafted query that causes excessive resource consumption=
while the request is processed, which may render the affected node unavail= able. 2026-07-01 6.5 CVE-2026-56148 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-56148 ] Elastic--Elasticsearch Allocation of Resources Without Limit=
s or Throttling (CWE-770) in Elasticsearch can lead to a denial of service = via Excessive Allocation (CAPEC-130). A user with elevated privileges can s= ubmit a specially crafted machine learning request that causes excessive me= mory consumption, which may render the affected node unavailable. 2026-07-0=
1 4.9 CVE-2026-56149 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56149 ] = Elastic--Fleet Server Allocation of Resources Without Limits or Throttling = (CWE-770) in Fleet Server can lead to a denial of service via Excessive All= ocation (CAPEC-130). An attacker can submit a specially crafted request to =
an upload endpoint that causes excessive memory consumption, which may rend=
er Fleet Server unavailable. 2026-07-01 6.5 CVE-2026-56150 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-56150 ] Elastic--Kibana Allocation of Resourc=
es Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of=
service via Excessive Allocation (CAPEC-130). An authenticated user can su= bmit a specially crafted bulk deletion request that causes excessive resour=
ce consumption, which may render Kibana unavailable. 2026-07-01 6.5 CVE-202= 6-49087 [ https://www.cve.org/CVERecord?id=3DCVE-2026-49087 ] Elastic--Kiba=
na Improper Input Validation (CWE-20) in Kibana can lead to a denial of ser= vice via Input Data Manipulation (CAPEC-153). An authenticated user can sub= mit a specially crafted Fleet policy input that is not correctly validated,=
which can render Fleet agent, server, and policy management functionality = unavailable. 2026-07-01 6.5 CVE-2026-56151 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-56151 ] Elastic--Kibana Insertion of Sensitive Information in=
to Log File (CWE-532) in Kibana can lead to information disclosure. When th=
e optional application performance monitoring (APM) instrumentation is enab= led, sensitive request header values could be recorded in application logs,=
where they may be accessible to operators with log access. 2026-07-01 4.4 = CVE-2026-49088 [ https://www.cve.org/CVERecord?id=3DCVE-2026-49088 ] engage= mentanalytics--Plugin for Google Analytics by IO technologies The Plugin fo=
r Google Analytics by IO technologies plugin for WordPress is vulnerable to=
Cross-Site Request Forgery in versions up to, and including, 1.1. This is = due to missing or incorrect nonce validation on the Google Analytics settin=
gs page (ga.php). This makes it possible for unauthenticated attackers to u= pdate the plugin's stored Google Analytics tracking ID option (io-ga-id) vi=
a a forged request granted they can trick a site administrator into perform= ing an action such as clicking on a link. 2026-06-30 4.3 CVE-2026-8944 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-8944 ] envothemes--Envo's Templat=
es & Widgets for Elementor and WooCommerce The Envo's Templates & Widgets f=
or Elementor and WooCommerce plugin for WordPress is vulnerable to unauthor= ized access of data due to a missing authorization check on the Envo Tabs (= and Off Canvas) widget's template rendering in versions up to, and includin=
g, 1.4.26. The render() method of the Tabs widget passes a user-controlled = template/post ID directly to Elementor's get_builder_content_for_display() = without verifying the referenced post's status (published/private/draft) or=
the visitor's authorization to view it. This makes it possible for authent= icated attackers, with Author-level access and above, to disclose the conte= nts of private Elementor-driven pages and templates to anonymous visitors b=
y configuring an Envo Tabs widget on a public post to reference the private=
content's ID (which can be supplied by editing the underlying Elementor wi= dget JSON via the Elementor editor REST API). 2026-07-02 4.3 CVE-2026-11600=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-11600 ] EstrellaXD--Auto_Ban= gumi AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF)=
vulnerability that allows unauthenticated remote attackers to probe intern=
al network services by supplying arbitrary host values to an unprotected se= tup endpoint. Attackers can send requests to the POST /api/v1/setup/test-do= wnloader endpoint during the initial setup window, causing the server to is= sue HTTP GET requests to internal or reserved addresses and leak informatio=
n through echoed connection-error messages. 2026-07-02 5.8 CVE-2026-59101 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-59101 ] expresstech--Quiz and = Survey Master (QSM) Easy Quiz and Survey Maker The Quiz and Survey Master (= QSM) - Easy Quiz and Survey Maker plugin for WordPress is vulnerable to aut= horization bypass in all versions up to, and including, 11.1.4. This is due=
to the plugin not properly verifying that a user is authorized to perform =
an action. This makes it possible for authenticated attackers, with contrib= utor-level access and above, to modify quizzes they do not own, overwrite q= uiz results pages, and reroute quiz-result notification emails to attacker-= controlled addresses. An attacker first calls the /quiz/structure endpoint = with an arbitrary victim quiz ID to obtain a valid nonce bound to that quiz=
ID and their own user ID, then presents that nonce to the /quizzes/{id}/em= ails save endpoint, which accepts it without verifying quiz ownership. 2026= -07-03 4.3 CVE-2026-9230 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9230=
] Feehi--CMS A flaw has been found in Feehi CMS up to 2.1.1. Affected by t= his issue is some unknown functionality of the file /api/users of the compo= nent API. This manipulation causes improper access controls. The attack can=
be initiated remotely. The exploit has been published and may be used. The=
project was informed of the problem early through an issue report but has = not responded yet. 2026-06-29 6.3 CVE-2026-13544 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-13544 ] figureone--Insert Pages The Insert Pages plugin=
for WordPress is vulnerable to Stored Cross-Site Scripting via post custom=
field keys (meta key names) in all versions up to, and including, 3.11.4. = This is due to insufficient output escaping in the the_meta() function: whi=
le the custom field VALUE is sanitized with wp_kses_post(), the custom fiel=
d KEY ($key) is interpolated into the rendered HTML (lines 1786-1791) and e= choed (line 1806) without any escaping when an inserted page is rendered wi=
th the [insert page=3D'ID' display=3D'all'] shortcode. This makes it possib=
le for authenticated attackers, with author-level access and above, to inje=
ct arbitrary web scripts in pages that will execute whenever a user accesse=
s an injected page. 2026-07-02 6.4 CVE-2026-10089 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-10089 ] foliovision--FV Flowplayer Video Player The FV=
Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross= -Site Scripting via the 'video_player' shortcode 'align' attribute in all v= ersions up to, and including, 7.5.51.7212 due to insufficient input sanitiz= ation and output escaping on user supplied attributes. This makes it possib=
le for authenticated attackers, with contributor-level access and above, to=
inject arbitrary web scripts in pages that will execute whenever a user ac= cesses an injected page. 2026-07-01 6.4 CVE-2026-12135 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-12135 ] forgejo--forgejo Forgejo before 15.0.3 co= ntains a stored cross-site scripting vulnerability that allows authenticate=
d attackers to execute arbitrary JavaScript in other users' browsers by set= ting a full name containing an HTML payload and triggering an Actions run. = When the DEFAULT_SHOW_FULL_NAME option is enabled, the run description is a= ssembled server-side with the user's display name interpolated into an HTML=
string via a translation function that does not escape its arguments, and = the frontend renders the result using a Vue v-html binding, causing script = execution for any user who views the affected Actions run page. 2026-07-02 = 5.4 CVE-2026-59102 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59102 ] Fu= elthemes--Werkstatt Subscriber Broken Access Control in Werkstatt <=3D 4.7.=
2 versions. 2026-07-02 4.3 CVE-2026-57689 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-57689 ] Fuelthemes--Werkstatt Unauthenticated Cross Site Reque=
st Forgery (CSRF) in Werkstatt <=3D 4.7.2 versions. 2026-07-02 4.3 CVE-2026= -57690 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57690 ] Gardyn--Gardyn=
Home Firmware The admin panel lacks standard security headers, enabling cl= ickjacking and cross-site scripting attacks. 2026-07-02 5.4 CVE-2026-54477 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-54477 ] Gardyn--Gardyn Home F= irmware The Azure Blob Storage container used for Gardyn device logs is pub= licly listable without authentication. A malicious user would be able to ac= cess any device log file available in the blob storage container. 2026-07-0=
2 5.3 CVE-2026-55726 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55726 ] = genua--genucenter The genucenter web interface before version 8.0p11 unnece= ssarily exposes sensitive SNMP authentication and encryption keys in its HT=
TP responses to users with the "Service" or "Admin" role. 2026-07-01 4.3 CV= E-2026-13211 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13211 ] GitBucke= t--GitBucket A security flaw has been discovered in GitBucket up to 4.46.1.=
This affects the function Git.cloneRepository.setURI of the file src/main/= scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a = manipulation of the argument url results in server-side request forgery. Th=
e attack is possible to be carried out remotely. The exploit has been relea= sed to the public and may be used for attacks. The patch is named 487a9b980= f56aa73b6a044b1e86a92eed5043215. To fix this issue, it is recommended to de= ploy a patch. 2026-06-29 6.3 CVE-2026-13540 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-13540 ] Gitea--Gitea Open Source Git Server SSRF via HTTP Re= direct in Repository Migration 2026-07-03 6.5 CVE-2026-58418 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-58418 ] Gitea--Gitea Open Source Git Server=
Gitea versions up to and including 1.26.1 do not apply public-only token f= iltering consistently to the user organization API, leaving an incomplete f=
ix for CVE-2025-68941. 2026-07-03 4.3 CVE-2026-25714 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-25714 ] Gitea--Gitea Open Source Git Server Gitea v= ersions up to and including 1.26.2 allow repository RSS and Atom feed endpo= ints to bypass API access token scope checks, exposing private repository c= ommit data to tokens without the required repository scope. 2026-07-03 4.3 = CVE-2026-27761 [ https://www.cve.org/CVERecord?id=3DCVE-2026-27761 ] Gitea-= -Gitea Open Source Git Server Gitea versions up to and including 1.26.1 do = not enforce repository-unit authorization on issue-template API endpoints. = 2026-07-03 4.3 CVE-2026-27783 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -27783 ] GNOME--GLib A flaw was found in GLib. An off-by-one error can occu=
r in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c fil=
e when doing an alignment padding check because the bounds check uses > ins= tead of >=3D, causing an out-of-bounds read of only 1 byte. This issue can = cause a minor information disclosure of 1 byte and a denial of service when=
the out-of-bounds read crosses a page boundary. 2026-06-30 6.5 CVE-2026-58= 010 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58010 ] GNOME--GLib A fla=
w was found in GLib. An out-of-bounds read of only 2 bytes can occur in the=
g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid = GDateTime object produced by the g_date_time_add_full function is processed=
. This flaw can corrupt the date output and potentially cause logic errors = that may lead to a denial of service. 2026-06-30 6.5 CVE-2026-58011 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-58011 ] GNOME--GLib A flaw was found=
in GLib. A buffer over-read can occur in the g_regex_replace function when=
used with the `G_REGEX_RAW` compile flag and case-change replacement escap=
es because the string_append function processes matched substrings using UT= F-8 functions that assume valid UTF-8 input, even when the string is treate=
d as raw bytes. This vulnerability can cause a minor information disclosure=
of 1-5 bytes and a denial of service when the buffer over-read crosses a p= age boundary. 2026-06-30 6.5 CVE-2026-58012 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-58012 ] GNOME--GLib A flaw was found in GLib. A buffer over-= read can occur in g_io_channel_read_line_backend() in the giochannel.c file=
when a custom line terminator with a length greater than one is set, causi=
ng memcmp to read past the GString buffer. This vulnerability can cause a m= inor information disclosure of 7 bytes or a denial of service when the buff=
er over-read crosses a page boundary. 2026-06-30 6.5 CVE-2026-58013 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-58013 ] GNOME--GLib A flaw was found=
in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL=
authentication mechanism does not validate the cookie_context parameter re= ceived from the server. A malicious D-Bus server can supply a cookie_contex=
t containing path traversal sequences, causing the client to read an arbitr= ary file and exfiltrate sensitive data by verifying guessed file contents a= gainst a generated hash. 2026-06-30 5.9 CVE-2026-58015 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-58015 ] Gordon Bhme--Structured Content Contribut=
or Cross Site Scripting (XSS) in Structured Content <=3D 1.7.0 versions. 20= 26-07-02 6.5 CVE-2026-57763 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5= 7763 ] GotoHTTP--GotoHTTP A vulnerability has been found in GotoHTTP up to = 10.2. This issue affects some unknown processing of the file /reg.12x. The = manipulation of the argument sn leads to cross site scripting. The attack m=
ay be initiated remotely. The exploit has been disclosed to the public and = may be used. The vendor explains: "We immediately removed unnecessary param= eter echo from source code. However the URL in the issue description will n= ever be used in browser nor exposed to user, so it will not bring secure pr= oblem in fact. So we don't upgrade server right now, it will be included in=
next version together with other features." 2026-06-29 4.3 CVE-2026-13536 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-13536 ] guardian--language-sy= stem Guardian language-system fails to sanitize the name GET parameter befo=
re outputting it into an HTML input value attribute in designer.php (line 5= 7). An authenticated attacker can craft a URL containing script tags that e= xecute in the victim's browser session. 2026-07-01 4.6 CVE-2026-34096 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-34096 ] guardian--language-system = Guardian language-system fails to sanitize the id GET parameter before inse= rting it into multiple HTML form action attributes in text_file.php (lines = 94, 101, 323, 403, 826, 852). An authenticated attacker can craft a URL tha=
t injects script tags executing in the victim's browser session. 2026-07-01=
4.6 CVE-2026-34097 [ https://www.cve.org/CVERecord?id=3DCVE-2026-34097 ] g= uardian--language-system Guardian language-system fails to sanitize the id = GET parameter before inserting it into HTML source and form action attribut=
es in media.php (lines 119, 129). An authenticated attacker can craft a URL=
that injects script tags executing in the victim's browser session. 2026-0= 7-01 4.6 CVE-2026-34098 [ https://www.cve.org/CVERecord?id=3DCVE-2026-34098=
] HashiCorp--Vault HashiCorp Vault and Vault Enterprise prior to 2.0.1 aud=
it device validation logic did not consistently apply plugin directory prot= ections when the legacy file audit path option was used. This vulnerability=
(CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17. 2026-07-0=
1 4.4 CVE-2026-5051 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5051 ] HC= LSoftware--HCL DevOps Deploy / HCL Launch HCL DevOps Deploy / HCL Launch is=
susceptible to an exposure of sensitive information vulnerability in outpu=
t logs. This exposure could allow an attacker with access to the logs to po= tentially obtain sensitive values related to that step. 2026-06-29 4.3 CVE-= 2026-56457 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56457 ] HiEventsDe= v--Hi.Events Hi.Events through 1.9.0 public check-in list endpoints use sho= rt_id as sole access control, allowing unauthenticated access to retrieve f= ull attendee lists including emails and personal information. Attackers wit=
h knowledge of the short_id can call GET /api/public/check-in-lists/{short_= id}/attendees to read attendee data and create or delete check-in records w= ithout authentication. 2026-06-29 6.5 CVE-2026-57960 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-57960 ] HiEventsDev--Hi.Events Hi.Events through 1.= 9.0 contains a promo code validation vulnerability where reservation valida= tes usage count before asynchronous UpdateEventStatisticsJob increments it,=
allowing attackers to redeem limited promo codes unlimited times. Attacker=
s can sequentially reserve multiple orders with the same restricted promo c= ode, each reading order_usage_count=3D0 and passing validation, then comple=
te them all at discounted prices without concurrent requests. 2026-06-29 5.=
9 CVE-2026-57959 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57959 ] Hita= chi--Hitachi Virtual Storage Platform 5100, 5200, 5500, 5600, 5100H, 5200H,=
5500H, 5600H, VX8 Information exposure vulnerability in Hitachi Storage Na= vigator. This issue affects Hitachi Virtual Storage Platform 5100, 5200, 55= 00, 5600, 5100H, 5200H, 5500H, 5600H, VX8: before DKCMAIN Ver. 90-09-24-00/= 00, SVP Ver. 90-09-24/00, before DKCMAIN Ver. 90-08-86-00/00, SVP Ver. 90-0= 8-86/00; Hitachi Virtual Storage Platform G1000, G1500, F1500, VX7: before = DKCMAIN Ver. 80-06-96-00/00, SVP Ver. 80-06-91/00. 2026-06-29 6.8 CVE-2025-= 7386 [ https://www.cve.org/CVERecord?id=3DCVE-2025-7386 ] HKUDS--Vibe-Tradi=
ng Vibe-Trading before 0.1.10 contains a path traversal vulnerability that = allows attackers to write files outside the intended memory root directory =
by supplying a malicious memory_type value containing path traversal sequen= ces through the remember tool. Attackers can manipulate the memory_type par= ameter in the persistent memory store to cause the application to write arb= itrary Markdown files to unintended locations on the filesystem. 2026-06-30=
6.5 CVE-2026-58173 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58173 ] H= KUDS--Vibe-Trading Vibe-Trading before 0.1.10 constructs the swarm run dire= ctory by joining a caller-supplied run identifier onto the runs base direct= ory without validation in run_dir (agent/src/swarm/store.py). A crafted run=
identifier supplied through the MCP swarm tools causes the application to = read arbitrary run.json files outside the runs directory and to overwrite e= xisting run.json files at traversed locations. 2026-06-30 4.2 CVE-2026-5817=
1 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58171 ] Hono--Hono Hono bef= ore 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when t=
he origin is not set to "*", the middleware copies the Vary header from the=
incoming request into the response. Because Vary is a response header that=
should be managed by the server, an attacker can supply arbitrary Vary val= ues that are reflected into the response, potentially causing cache key pol= lution and inconsistent CORS enforcement in environments that rely on share=
d caches or proxies. 2026-06-30 6.5 CVE-2025-71381 [ https://www.cve.org/CV= ERecord?id=3DCVE-2025-71381 ] horde--imp Horde IMP before 7.0.1 contains a = path traversal vulnerability in lib/Compose.php that allows authenticated a= ttackers to read arbitrary files from the server filesystem by embedding tr= aversal sequences after a CKEditor path prefix in img src URLs. Attackers c=
an bypass the stripos() prefix validation by appending sequences such as tr= aversal segments after the matching prefix, causing file_get_contents() to = read sensitive files whose contents are then exfiltrated as MIME parts in o= utgoing email; unauthenticated exploitation is also achievable via CSRF aga= inst an active authenticated session. 2026-07-01 6.5 CVE-2026-58451 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-58451 ] IBM--App Connect Enterprise = IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through = 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vu= lnerable to SQL injection. A remote attacker could socially engineer a user=
into accidentally creating files they may not be aware of. 2026-06-30 4.7 = CVE-2026-3602 [ https://www.cve.org/CVERecord?id=3DCVE-2026-3602 ] IBM--Db2=
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX a=
nd Windows (includes Db2 Connect Server) could allow an=C2=A0authenticated = user to cause a denial of service due to improper neutralization of special= =C2=A0elements in the data query logic of XMLTable-derived columns. 2026-06= -30 6.5 CVE-2026-11906 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11906 =
] IBM--Db2 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Lin= ux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive=
information to an authenticated user from the monitoring and event tables.=
2026-06-30 5.5 CVE-2025-36372 [ https://www.cve.org/CVERecord?id=3DCVE-202= 5-36372 ] IBM--UCD - IBM DevOps Deploy IBM UCD - IBM DevOps Deploy 8.1 thro= ugh 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource Sharing (CO= RS) which could allow an attacker to carry out privileged actions and retri= eve sensitive information as the domain name is not being limited to only t= rusted domains. 2026-06-30 5.4 CVE-2026-12084 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-12084 ] IBM--UCD - IBM UrbanCode Deploy IBM UCD - IBM Urba= nCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 throu=
gh 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy=
could disclose sensitive configurations and secrets to authenticated users=
in API responses that could be used in further attacks against the system.=
2026-06-30 6.5 CVE-2026-12085 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-12085 ] IBM--UCD - IBM UrbanCode Deploy IBM UCD - IBM UrbanCode Deploy 7.=
2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deplo=
y 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 stores=
potentially sensitive information in log files that could be read by a loc=
al user. 2026-06-30 6.2 CVE-2026-12086 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-12086 ] IBM--watsonx.data intelligence IBM watsonx.data intelli= gence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to stored cross-site scripti= ng. This vulnerability allows an authenticated user to embed arbitrary Java= Script code in the Web UI thus altering the intended functionality potentia= lly leading to credentials disclosure within a trusted session. 2026-06-30 = 6.4 CVE-2025-36320 [ https://www.cve.org/CVERecord?id=3DCVE-2025-36320 ] IB= M--watsonx.data intelligence IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.= 2.2, 5.3.0 could allow an authenticated user to bypass security controls an=
d perform unauthorized actions due to client-side enforcement of sever-side=
security. 2026-06-30 6.5 CVE-2025-36327 [ https://www.cve.org/CVERecord?id= =3DCVE-2025-36327 ] IBM--watsonx.data intelligence IBM watsonx.data intelli= gence 5.2.2, 5.3.0, 5.3.1, 5.3.1 through patch-1 transmits data in clear te=
xt that could allow an attacker to obtain sensitive information using man i=
n the middle techniques. 2026-06-30 5.9 CVE-2025-12530 [ https://www.cve.or= g/CVERecord?id=3DCVE-2025-12530 ] IBM--watsonx.data intelligence IBM watson= x.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to HTML inject= ion. A remote attacker could inject malicious HTML code, which when viewed,=
would be executed in the victim's Web browser within the security context =
of the hosting site. 2026-06-30 5.7 CVE-2025-36321 [ https://www.cve.org/CV= ERecord?id=3DCVE-2025-36321 ] IBM--watsonx.data intelligence IBM watsonx.da=
ta intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to cross-site scri= pting. This vulnerability allows an authenticated user to embed arbitrary J= avaScript code in the Web UI thus altering the intended functionality poten= tially leading to credentials disclosure within a trusted session. 2026-06-=
30 5.4 CVE-2025-36323 [ https://www.cve.org/CVERecord?id=3DCVE-2025-36323 ]=
IBM--watsonx.data intelligence IBM watsonx.data intelligence 5.2.0, 5.2.1,=
5.2.2, 5.3.0 transmits data in clear text that could allow an attacker to = obtain sensitive information using man in the middle techniques. 2026-06-30=
5.9 CVE-2025-36336 [ https://www.cve.org/CVERecord?id=3DCVE-2025-36336 ] I= BM--watsonx.data intelligence IBM watsonx.data intelligence 5.2.0, 5.2.1, 5= .2.2, 5.3.0 could allow an authenticated user to cause a temporary denial u= sing a specially crafted HTTP request due to improper allocation of resourc=
e throttling. 2026-06-30 4.3 CVE-2025-36319 [ https://www.cve.org/CVERecord= ?id=3DCVE-2025-36319 ] IBM--watsonx.data intelligence IBM watsonx.data inte= lligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 s vulnerable to server-side request for= gery (SSRF). This may allow an authenticated attacker to send unauthorized = requests from the system, potentially leading to network enumeration or fac= ilitating other attacks. 2026-06-30 4.3 CVE-2025-36324 [ https://www.cve.or= g/CVERecord?id=3DCVE-2025-36324 ] IBM--watsonx.data intelligence IBM watson= x.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacke=
r to obtain sensitive information when a detailed technical error message i=
s returned in the browser.=C2=A0 This information could be used in further = attacks against the system. 2026-06-30 4.3 CVE-2025-36328 [ https://www.cve= .org/CVERecord?id=3DCVE-2025-36328 ] IBM--watsonx.data intelligence IBM wat= sonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authentica= ted user to perform unauthorized actions due to the improper enforcement of=
behavioral workflow. 2026-06-30 4.3 CVE-2025-36333 [ https://www.cve.org/C= VERecord?id=3DCVE-2025-36333 ] IBM--WebSphere Application Server IBM WebSph= ere Application Server 9.0, and 8.5 could allow a remote attacker to obtain=
sensitive information from the administrative console's integrated help sy= stem. 2026-06-30 4.3 CVE-2026-11595 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-11595 ] IBM--WebSphere Extreme Scale IBM WebSphere Extreme Scale 8.6= .1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSp= here eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacke= r-controlled IOR string during Java deserialization, turning any unfiltered=
ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chose=
n host; when chained with the IBM ORB's getUserException class-instantiatio=
n flaw (WAS-26), this SSRF escalates to remote code execution on the callin=
g JVM. 2026-06-30 6 CVE-2026-13773 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-13773 ] IBM--WebSphere Extreme Scale IBM WebSphere Extreme Scale 8.6.= 1.0 through 8.6.1.6 could allow an adjacent attacker to cause a denial of s= ervice due to improper validation in the XDF decoder. The application proce= sses deeply nested Protocol Buffers messages and attacker-controlled length=
prefixes without sufficient bounds checking, which may allow an attacker o=
n the same network to trigger a StackOverflowError or OutOfMemoryError, res= ulting in a crash of the WebSphere Application Server JVM. 2026-06-30 6.5 C= VE-2026-9002 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9002 ] icegram--= Email Subscribers & Newsletters Email Marketing, Post Notifications & Newsl= etter Plugin for WordPress The Email Subscribers & Newsletters - Email Mark= eting, Post Notifications & Newsletter Plugin for WordPress plugin for Word= Press is vulnerable to authorization bypass in all versions up to, and incl= uding, 5.9.27. This is due to the plugin not properly verifying that a user=
is authorized to perform an action. This makes it possible for authenticat=
ed attackers, with contributor-level access and above, to overwrite plugin = mail settings (from name and from email address), create audience lists, in= sert arbitrary contacts into those lists, create and overwrite newsletter b= roadcasts and post notifications, add workflows, and queue and dispatch mas=
s email to arbitrary recipients. 2026-07-02 4.3 CVE-2026-11592 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-11592 ] ImageMagick--ImageMagick ImageMag= ick is free and open-source software used for editing and manipulating digi= tal images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow i=
n the XCF decoder can result in an out of bounds read when a crafted image =
is read, potentially resulting in a crash. This issue has been fixed in ver= sions 6.9.13-51 and 7.1.2-26. 2026-07-01 6.5 CVE-2026-53466 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-53466 ] ImageMagick--ImageMagick ImageMagick=
is free and open-source software used for editing and manipulating digital=
images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains=
a possible heap information disclosure vulnerability because part of the p= ixels are left unchanged. This issue has been fixed in versions 6.9.13-51 a=
nd 7.1.2-26. 2026-07-01 5.3 CVE-2026-53467 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-53467 ] ImageMagick--ImageMagick ImageMagick is free and open= -source software used for editing and manipulating digital images. Prior to=
versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted = 8BIM profile with a specific format string a use-after-free will occur. Thi=
s issue has been fixed in versions 6.9.13-51 and 7.1.2-26. 2026-07-01 5.5 C= VE-2026-55510 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55510 ] ImageMa= gick--ImageMagick ImageMagick is free and open-source software used for edi= ting and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2= -26, a heap buffer overflow occurs in the MVG decoder that could result in =
an out of bounds write when processing a crafted image. This issue has been=
fixed in versions 6.9.13-51 and 7.1.2-26. 2026-07-01 5.9 CVE-2026-55577 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-55577 ] ImageMagick--ImageMagic=
k ImageMagick is free and open-source software used for editing and manipul= ating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing d= epth check in the MVG decoder will result in a stack overflow when a crafte=
d image is provided. This issue has been fixed in versions 6.9.13-51 and 7.= 1.2-26. 2026-07-01 5.3 CVE-2026-55594 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-55594 ] ImageMagick--ImageMagick ImageMagick is free and open-sour=
ce software used for editing and manipulating digital images. Prior to vers= ion 7.1.2-26, an incorrect handling of arguments can cause a heap buffer ov= er-write in the JP2 encoder. This issue has been fixed in version7.1.2-26. = 2026-07-01 5.5 CVE-2026-55597 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -55597 ] ImageMagick--ImageMagick In versions prior to 7.1.2-26he, the `-co= ncatenate` operation is missing policy checks, potentially resulting in bot=
h reading and writing to paths disallowed by the security policy. This issu=
e has been fixed in version 7.1.2-26. 2026-07-01 5.5 CVE-2026-55628 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-55628 ] ImageMagick--ImageMagick Ima= geMagick is free and open-source software used for editing and manipulating=
digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing i= nvalid arguments to the connected-components option an infinite loop will o= ccur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26. 2026-07= -01 4.7 CVE-2026-55595 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55595 =
] infiniflow--ragflow RAGFlow before 0.26.3 stores an agent pipeline (DSL) = node name without sanitization: the agent update endpoint normalizes the su= bmitted DSL via normalize_dsl, which only performs JSON serialization valid= ation and preserves the node name verbatim. The dataflow-result web UI then=
renders that name into the "Rerun from current step" confirmation modal vi=
a dangerouslySetInnerHTML, and the i18next configuration sets escapeValue:f= alse, so the value is inserted into the DOM without HTML encoding. An authe= nticated workspace user who can create or edit an agent can inject arbitrar=
y JavaScript that executes in the session of another workspace member who o= pens the dataflow result and clicks rerun, enabling session/token theft and=
account takeover across the user trust boundary. 2026-07-02 5.4 CVE-2026-5= 8579 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58579 ] inovector--mixpo=
st Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerab= ility that allows unauthenticated attackers to execute arbitrary JavaScript=
in authenticated users' browsers by crafting malicious OAuth callback URLs=
with unsanitized error query parameters. Attackers can exploit the OAuth c= allback controller's failure to sanitize error parameters before rendering = them through Laravel flash messages via the Vue v-html directive to hijack = authenticated user sessions or perform unauthorized actions. 2026-06-29 6.1=
CVE-2026-57958 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57958 ] Inves= tintech--SlimPDFReader A security flaw has been discovered in Investintech = SlimPDFReader up to 2.0.14. Affected by this issue is the function SlimPDFR= eader!Investintech::PCV::TeighaDo+0x25cde0 of the file SlimPDFReader.exe of=
the component PDF File Handler. Performing a manipulation results in out-o= f-bounds read. It is possible to initiate the attack remotely. This vulnera= bility only affects products that are no longer supported by the maintainer=
. 2026-06-29 4.3 CVE-2026-13522 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-13522 ] invoiceninja--invoiceninja Invoice Ninja through 5.13.26 contain=
s an open redirect vulnerability in the client portal login that allows una= uthenticated attackers to redirect authenticated victims to attacker-contro= lled external URLs by injecting a malicious value into the intended query p= arameter. Attackers can craft a client login link with an external URL in t=
he intended parameter, which is stored in the session without host validati=
on and emitted verbatim via a bare redirect in the ContactLoginController a= uthenticated() handler after the victim completes a legitimate login, enabl= ing phishing attacks. 2026-06-30 4.3 CVE-2026-58450 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-58450 ] its-a-feature--Mythic Mythic before 3.4.0.60=
contains a broken hasura permission filter on the payload_build_step table=
with an always-satisfied _or condition that bypasses operation-scoped acce=
ss controls. Authenticated operators and spectators can query payload_build= _step to read step_stdout, step_stderr, step_name, and step_description acr= oss all operations on the server. 2026-06-29 6.5 CVE-2026-57951 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-57951 ] its-a-feature--Mythic Mythic bef= ore 3.4.0.60 contains an authorization bypass vulnerability in four REST en= dpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, = c2profile_get_ioc_webhook, c2profile_sample_message_webhook) that fail to v= erify payload ownership. An operator in one operation can invoke these endp= oints with a known payload UUID from another operation to access that opera= tion's C2 profile configuration including encryption keys and callback para= meters. 2026-06-29 5.3 CVE-2026-57952 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-57952 ] its-a-feature--Mythic Mythic before 3.4.0.60 contains an a= uthorization bypass vulnerability that allows authenticated spectator-role = users to perform unauthorized write operations by accessing the eventing_im= port_automatic_webhook endpoint registered under spectator-permitted middle= ware. Attackers with spectator role can exploit this misconfigured access c= ontrol to create and delete automation workflows, making unauthorized modif= ications to operation automation configuration and EventGroups. 2026-06-29 = 5.4 CVE-2026-57953 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57953 ] it= sourcecode--Hospital Management System A vulnerability was determined in it= sourcecode Hospital Management System 1.0. Affected is an unknown function =
of the file /appointmentapproval.php of the component Appointment Handler. = This manipulation of the argument editid causes sql injection. The attack i=
s possible to be carried out remotely. The exploit has been publicly disclo= sed and may be utilized. 2026-06-29 6.3 CVE-2026-13520 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-13520 ] itsourcecode--Hospital Management System =
A vulnerability was identified in itsourcecode Hospital Management System 1= .0. This impacts an unknown function of the file /appointmentdetail.php of = the component Appointment Handler. The manipulation of the argument editid = leads to sql injection. The attack is possible to be carried out remotely. = The exploit is publicly available and might be used. 2026-06-29 6.3 CVE-202= 6-13530 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13530 ] itsourcecode-= -Hospital Management System A security flaw has been discovered in itsource= code Hospital Management System 1.0. Affected is an unknown function of the=
file /department.php. The manipulation of the argument editid results in s=
ql injection. The attack may be performed from remote. The exploit has been=
released to the public and may be used for attacks. 2026-06-29 6.3 CVE-202= 6-13531 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13531 ] itsourcecode-= -Hospital Management System A weakness has been identified in itsourcecode = Hospital Management System 1.0. Affected by this vulnerability is an unknow=
n functionality of the file /departmentDoctor.php. This manipulation of the=
argument deptid causes sql injection. It is possible to initiate the attac=
k remotely. The exploit has been made available to the public and could be = used for attacks. 2026-06-29 6.3 CVE-2026-13532 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-13532 ] itsourcecode--Hospital Management System A weakn= ess has been identified in itsourcecode Hospital Management System 1.0. Thi=
s impacts an unknown function of the file /doctorchangepassword.php. Execut= ing a manipulation of the argument newpassword can lead to sql injection. T=
he attack may be performed from remote. The exploit has been made available=
to the public and could be used for attacks. 2026-06-29 6.3 CVE-2026-13541=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-13541 ] itsourcecode--Hospit=
al Management System A security vulnerability has been detected in itsource= code Hospital Management System 1.0. Affected is an unknown function of the=
file /doctorprofile.php. The manipulation of the argument doctorname leads=
to sql injection. It is possible to initiate the attack remotely. The expl= oit has been disclosed publicly and may be used. 2026-06-29 6.3 CVE-2026-13= 542 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13542 ] itsourcecode--Hos= pital Management System A vulnerability was identified in itsourcecode Hosp= ital Management System 1.0. Impacted is an unknown function of the file /do= ctortimings.php. The manipulation of the argument editid leads to sql injec= tion. Remote exploitation of the attack is possible. The exploit is publicl=
y available and might be used. 2026-06-29 6.3 CVE-2026-13548 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-13548 ] itsourcecode--Hospital Management S= ystem A vulnerability has been found in itsourcecode Hospital Management Sy= stem 1.0. The impacted element is an unknown function of the file /insertbi= llingrecord.php. The manipulation of the argument patientid leads to sql in= jection. It is possible to initiate the attack remotely. The exploit has be=
en disclosed to the public and may be used. 2026-06-29 6.3 CVE-2026-13572 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-13572 ] itsourcecode--Hospital=
Management System A security flaw has been discovered in itsourcecode Hosp= ital Management System 1.0. Affected by this vulnerability is an unknown fu= nctionality of the file /patientdetail.php. Performing a manipulation of th=
e argument editid results in sql injection. The attack may be initiated rem= otely. The exploit has been released to the public and may be used for atta= cks. 2026-06-29 6.3 CVE-2026-13578 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-13578 ] itsourcecode--Hospital Management System A weakness has been = identified in itsourcecode Hospital Management System 1.0. Affected by this=
issue is some unknown functionality of the file /patientchangepassword.php=
. Executing a manipulation of the argument newpassword can lead to sql inje= ction. The attack may be launched remotely. The exploit has been made avail= able to the public and could be used for attacks. 2026-06-29 6.3 CVE-2026-1= 3579 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13579 ] itsourcecode--Ho= spital Management System A flaw has been found in itsourcecode Hospital Man= agement System 1.0. Affected by this issue is some unknown functionality of=
the file /medicine.php. This manipulation of the argument editid causes sq=
l injection. Remote exploitation of the attack is possible. The exploit has=
been published and may be used. 2026-07-04 6.3 CVE-2026-14619 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-14619 ] itsourcecode--Hospital Management=
System A flaw has been found in itsourcecode Hospital Management System 1.=
0. This affects an unknown function of the file /patient.php. This manipula= tion of the argument editid causes sql injection. The attack may be initiat=
ed remotely. The exploit has been published and may be used. 2026-07-04 6.3=
CVE-2026-14638 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14638 ] itsou= rcecode--Hospital Management System A vulnerability has been found in itsou= rcecode Hospital Management System 1.0. Impacted is an unknown function of = the file /patientappointment.php. Such manipulation of the argument patient=
e leads to sql injection. The attack can be launched remotely. The exploit = has been disclosed to the public and may be used. 2026-07-04 6.3 CVE-2026-1= 4659 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14659 ] itsourcecode--Ho= spital Management System A vulnerability has been found in itsourcecode Hos= pital Management System 1.0. Affected is an unknown function of the file /p= atientorder.php. Such manipulation of the argument editid leads to sql inje= ction. The attack may be performed from remote. The exploit has been disclo= sed to the public and may be used. 2026-07-05 6.3 CVE-2026-14703 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-14703 ] itsourcecode--Hospital Manageme=
nt System A vulnerability was detected in itsourcecode Hospital Management = System 1.0. The affected element is an unknown function of the file /patien= tlogin.php. Performing a manipulation of the argument loginid results in sq=
l injection. Remote exploitation of the attack is possible. The exploit is = now public and may be used. 2026-07-05 6.3 CVE-2026-14717 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-14717 ] itsourcecode--Hospital Management Syst=
em A security flaw has been discovered in itsourcecode Hospital Management = System 1.0. Affected by this issue is some unknown functionality of the fil=
e /patientprofile.php. Performing a manipulation of the argument patientnam=
e results in sql injection. The attack can be initiated remotely. The explo=
it has been released to the public and may be used for attacks. 2026-07-05 = 6.3 CVE-2026-14730 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14730 ] it= sourcecode--Hospital Management System A weakness has been identified in it= sourcecode Hospital Management System 1.0. This affects an unknown part of = the file /patientreport.php. Executing a manipulation of the argument editi=
d can lead to sql injection. The attack can be launched remotely. The explo=
it has been made available to the public and could be used for attacks. 202= 6-07-05 6.3 CVE-2026-14731 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14= 731 ] itsourcecode--Hospital Management System A vulnerability was found in=
itsourcecode Hospital Management System 1.0. This affects an unknown funct= ion of the file /payment.php. The manipulation of the argument patientid re= sults in sql injection. The attack can be launched remotely. The exploit ha=
s been made public and could be used. 2026-07-05 6.3 CVE-2026-14773 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-14773 ] itsourcecode--Hospital Manag= ement System A vulnerability was determined in itsourcecode Hospital Manage= ment System 1.0. This impacts an unknown function of the file /paymentdisch= arge.php. This manipulation of the argument patientid causes sql injection.=
The attack may be initiated remotely. The exploit has been publicly disclo= sed and may be utilized. 2026-07-05 6.3 CVE-2026-14774 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-14774 ] itsourcecode--Online Hotel Management Sys= tem A vulnerability has been found in itsourcecode Online Hotel Management = System 1.0. Affected by this vulnerability is an unknown functionality of t=
he file /admin/mod_amenities/controller.php?action=3Dadd of the component P= OST Request Handler. The manipulation of the argument Name leads to cross s= ite scripting. The attack can be initiated remotely. The exploit has been d= isclosed to the public and may be used. 2026-06-29 4.3 CVE-2026-13554 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-13554 ] itsourcecode--Online Hotel=
Management System A vulnerability was determined in itsourcecode Online Ho= tel Management System 1.0. This affects an unknown part of the file /admin/= mod_users/controller.php?action=3Dedit of the component POST Request Handle=
r. This manipulation of the argument Name causes cross site scripting. The = attack may be initiated remotely. The exploit has been publicly disclosed a=
nd may be utilized. 2026-06-29 4.3 CVE-2026-13556 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-13556 ] itsourcecode--Online Hotel Management System A=
vulnerability was identified in itsourcecode Online Hotel Management Syste=
m 1.0. This vulnerability affects unknown code of the file /admin/mod_room/= controller.php?action=3Dadd of the component POST Request Handler. Such man= ipulation of the argument Name leads to cross site scripting. The attack ma=
y be launched remotely. The exploit is publicly available and might be used=
. 2026-06-29 4.3 CVE-2026-13557 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-13557 ] iv-org--Invidious Invidious through 2.20260626.0, fixed in commi=
t 77ad416, contains a broken object level authorization vulnerability that = allows authenticated attackers to delete videos from other users' playlists=
by supplying an arbitrary global video index in the remove_video action of=
the playlist endpoint. Attackers can obtain per-video index values from th=
e public playlist JSON API and submit them to the playlist video deletion e= ndpoint without ownership validation, permanently removing videos from play= lists they do not own. 2026-06-30 6.5 CVE-2026-58447 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-58447 ] jetmonsters--Hotel Booking Lite Subscriber = Sensitive Data Exposure in Hotel Booking Lite <=3D 6.0.3 versions. 2026-07-=
02 6.5 CVE-2026-57347 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57347 ]=
jetmonsters--JetFormBuilder Dynamic Blocks Form Builder The JetFormBuilder=
- Dynamic Blocks Form Builder plugin for WordPress is vulnerable to author= ization bypass in all versions up to, and including, 3.6.3. This is due to = the plugin not properly verifying that a user is authorized to perform an a= ction. This makes it possible for unauthenticated attackers to retrieve eve=
ry distinct value stored under any arbitrary wp_postmeta key on the site - = including WooCommerce billing PII such as _billing_email, _billing_phone, a=
nd _billing_address fields, order totals, attachment paths, and any third-p= arty plugin credentials or tokens stored in post meta - provided at least o=
ne published JetFormBuilder form with a get_from_db generator field exists =
on the site. Exploitation requires that the target site has at least one pu= blished jet-form-builder post containing a field whose generator_function i=
s set to get_from_db; an attacker must supply a matching form ID, field nam=
e, and generator ID in the request, but all of these can be discovered by b= rowsing the site's public forms. 2026-07-02 5.3 CVE-2026-13459 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-13459 ] jetmonsters--JetWidgets For Eleme= ntor The JetWidgets For Elementor plugin for WordPress is vulnerable to Sto= red Cross-Site Scripting in versions up to and including 1.0.21. This is du=
e to insufficient output escaping and missing server-side validation of the=
Animated Box widget's animation_effect setting before it is rendered insid=
e an HTML class attribute. This makes it possible for authenticated attacke= rs, with author-level access and above, to inject arbitrary web scripts in = pages that will execute whenever a user accesses an injected page. 2026-07-=
01 6.4 CVE-2026-11380 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11380 ]=
jetmonsters--MotoPress Appointment Booking The MotoPress Appointment Booki=
ng plugin for WordPress is vulnerable to generic SQL Injection via the 's' = parameter in all versions up to, and including, 2.4.5 due to insufficient e= scaping on the user supplied parameter and lack of sufficient preparation o=
n the existing SQL query. This makes it possible for authenticated attacker=
s, with custom-level access and above, to append additional SQL queries int=
o already existing queries that can be used to extract sensitive informatio=
n from the database. Exploitation requires the mpa_appointment_employee cus= tom role, meaning any user assigned this role can perform the attack. 2026-= 07-01 6.5 CVE-2026-13454 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1345=
4 ] jetmonsters--MotoPress Appointment Booking The MotoPress Appointment Bo= oking plugin for WordPress is vulnerable to Authorization Bypass Through Us= er-Controlled Key in all versions up to, and including, 2.4.4. This is due =
to the `POST /motopress/appointment/v1/bookings` REST endpoint being regist= ered with `'permission_callback' =3D> '__return_true'`, allowing unauthenti= cated access, while the `createBooking` handler in `BookingsRestController.= php` accepts an attacker-supplied `payment_details.booking_id` value and lo= ads the referenced booking via `findById()` without verifying that the call=
er owns or has any rights to that booking. This makes it possible for unaut= henticated attackers to overwrite the customer name, email address, phone n= umber, and `customer_id` of any non-confirmed victim booking by submitting =
a request with no reservation items, causing `BookingService::createBooking= ()` to load the existing victim booking object and persist it with attacker= -controlled customer data. Victim booking IDs can be harvested prior to exp= loitation without authentication by querying the also-publicly-accessible `= GET /motopress/appointment/v1/bookings/reservations` endpoint with a guessa= ble `service_id` and date range, and only bookings whose status is not `STA= TUS_CONFIRMED` (e.g., pending or auto-draft) are valid targets. 2026-07-03 = 5.3 CVE-2026-9180 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9180 ] jgwh= ite33--WP Google Review Slider The Wp Google Places Review Slider plugin fo=
r WordPress is vulnerable to Reflected Cross-Site Scripting via the 'place'=
parameter in versions up to, and including, 18.1. This is due to insuffici= ent input sanitization and output escaping in admin/partials/googlecrawl_df= s.php, where the $_GET['place'] value is URL-decoded, stripslashes()'d, and=
echoed directly into an HTML value attribute with no esc_attr() call when = the supplied place is not already a stored key in the wprev_google_crawls o= ption. This makes it possible for unauthenticated attackers to inject arbit= rary web scripts in pages that execute if they can successfully trick a use=
r into performing an action such as clicking on a specially crafted link. 2= 026-07-01 6.1 CVE-2026-13015 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 13015 ] joedolson--My Calendar Accessible Event Manager The My Calendar - A= ccessible Event Manager plugin for WordPress is vulnerable to Insecure Dire=
ct Object Reference in all versions up to, and including, 3.7.14 via the 'v= cal' parameter due to missing validation on a user controlled key. This mak=
es it possible for unauthenticated attackers to enumerate occurrence IDs an=
d access the full iCalendar export of non-public, draft, trashed, and perso= nal calendar events, disclosing sensitive event metadata including titles, = descriptions, dates, locations, organizer and host details, permalinks, and=
related calendar metadata. 2026-07-02 5.3 CVE-2026-11896 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-11896 ] Keksdieb--ez Form Calculator Premium U= nauthenticated Broken Access Control in ez Form Calculator Premium <=3D 2.1= 4.1.2 versions. 2026-07-02 5.3 CVE-2026-57750 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-57750 ] kirilkirkov--Ecommerce-CodeIgniter-Bootstrap A wea= kness has been identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up=
to 23105f25dadf57b4314fc015a63a7c6e910c89df. Impacted is the function do_u= pload_others_images of the file application/modules/vendor/controllers/AddP= roduct.php of the component Vendor Image Manager. Executing a manipulation =
of the argument folder can lead to path traversal. It is possible to launch=
the attack remotely. This product takes the approach of rolling releases t=
o provide continious delivery. Therefore, version details for affected and = updated releases are not available. This patch is called de1c9e73ccf3bd032d= 9a0525c4752290d959dd8b. It is best practice to apply a patch to resolve thi=
s issue. 2026-07-04 5.4 CVE-2026-14636 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14636 ] kirilkirkov--Ecommerce-CodeIgniter-Bootstrap A vulnerab= ility was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 95dfa8= cebbb87ab46ae450643a07241274a74dce. Affected by this issue is the function = setReferrer of the file application/core/MY_Controller.php of the component=
Trusted Backend Interface. The manipulation of the argument href results i=
n open redirect. The attack can be executed remotely. The exploit has been = made public and could be used. This product implements a rolling release fo=
r ongoing delivery, which means version information for affected or updated=
releases is unavailable. The patch is identified as 213babdbaa949e94557246= 414db0130e01394517. A patch should be applied to remediate this issue. 2026= -07-04 4.3 CVE-2026-14632 [ https://www.cve.org/CVERecord?id=3DCVE-2026-146=
32 ] kirilkirkov--Ecommerce-CodeIgniter-Bootstrap A vulnerability was deter= mined in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 49b20f53de2b7ec3= 4e920b11c863f1491d911a04. This affects an unknown part of the file /index.p= hp/api/product/set of the component Hidden REST API Endpoint. This manipula= tion of the argument title/description causes cross site scripting. The att= ack is possible to be carried out remotely. The exploit has been publicly d= isclosed and may be utilized. This product adopts a rolling release strateg=
y to maintain continuous delivery. Therefore, version details for affected =
or updated releases cannot be specified. Patch name: d9785f995da77bdc62fb2d= 34bad5f7a162c9ad23. To fix this issue, it is recommended to deploy a patch.=
2026-07-04 4.3 CVE-2026-14633 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-14633 ] kirilkirkov--Ecommerce-CodeIgniter-Bootstrap A vulnerability was = identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 213babdbaa9= 49e94557246414db0130e01394517. This vulnerability affects the function chec= kForPostRequests of the file application/core/MY_Controller.php of the comp= onent Subscribed Emails Admin Page. Such manipulation of the argument User-= Agent leads to cross site scripting. The attack may be performed from remot=
e. The exploit is publicly available and might be used. This product utiliz=
es a rolling release system for continuous delivery, and as such, version i= nformation for affected or updated releases is not disclosed. The name of t=
he patch is 23105f25dadf57b4314fc015a63a7c6e910c89df. It is advisable to im= plement a patch to correct this issue. 2026-07-04 4.3 CVE-2026-14634 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-14634 ] kodezen--Academy LMS WordPr= ess LMS Plugin for Complete eLearning Solution The Academy LMS - WordPress = LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerab=
le to Insecure Direct Object Reference in versions up to, and including, 3.= 8.1. This is due to the '/topics' REST API endpoint being registered with a=
permission callback set to '__return_true', allowing unauthenticated acces=
s to course curriculum data without verifying the course's post status or u= ser enrollment. This makes it possible for unauthenticated attackers to acc= ess detailed curriculum information for private, draft, scheduled, or passw= ord-protected courses by enumerating course IDs. 2026-07-02 5.3 CVE-2026-53=
48 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5348 ] latepoint--LatePoin=
t Calendar Booking Plugin for Appointments and Events The LatePoint - Calen= dar Booking Plugin for Appointments and Events plugin for WordPress is vuln= erable to authorization bypass in all versions up to, and including, 5.6.1.=
This is due to the plugin not properly verifying that a user is authorized=
to perform an action. This makes it possible for unauthenticated attackers=
to modify the personally identifiable information (first name, last name, = phone number, and notes) of any existing customer record, including those l= inked to administrator accounts, by submitting the booking form with a know=
n customer's email address. Exploitation requires the plugin to be configur=
ed with guest bookings enabled (is_customer_auth_disabled() returning true)=
, which is necessary for the vulnerable unauthenticated code path in proces= s_step_customer() to be reached. 2026-07-03 5.3 CVE-2026-11398 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-11398 ] latepoint--LatePoint Calendar Boo= king Plugin for Appointments and Events The LatePoint - Calendar Booking Pl= ugin for Appointments and Events plugin for WordPress is vulnerable to Inse= cure Direct Object Reference in all versions up to, and including, 5.6.2 vi=
a the 'service_id' parameter due to missing validation on a user controlled=
key. This makes it possible for unauthenticated attackers to create approv=
ed bookings against services explicitly restricted to admins and agents, co= nsuming restricted appointment capacity and triggering unauthorized booking=
s for admin/agent-only services. The bypass works via both the params[booki= ng][service_id] parameter in steps__load_step and the presets[selected_serv= ice] parameter in steps__start, both of which are publicly accessible witho=
ut authentication. 2026-07-02 5.3 CVE-2026-12657 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-12657 ] LibrePhotos--librephotos LibrePhotos before 1.0=
.0 contains a broken object level authorization vulnerability in the SetPho= tosShared endpoint that allows authenticated users to grant themselves acce=
ss to other users' private photos by bypassing ownership validation. Attack= ers can manipulate shared_to relations without proper owner checks to read = arbitrary private photos belonging to other users. 2026-06-29 5.9 CVE-2026-= 57943 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57943 ] LibreTranslate-= -LibreTranslate LibreTranslate through 1.9.7, fixed in commit 397fd22, cont= ains an IP spoofing vulnerability in the get_remote_address() function that=
allows unauthenticated attackers to spoof client IP addresses by injecting=
arbitrary values into the X-Forwarded-For header without trusted proxy val= idation. Attackers can bypass per-IP rate limiting and flood bans by supply= ing forged addresses in the X-Forwarded-For header to enable unlimited API = abuse. 2026-06-29 5.3 CVE-2026-57942 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-57942 ] LinkWhisper--Link Whisper Premium Subscriber Broken Access = Control in Link Whisper Premium <=3D 2.9.0 versions. 2026-07-02 6.5 CVE-202= 6-57353 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57353 ] Livemesh--Liv= emesh Addons for WPBakery Page Builder Contributor Cross Site Scripting (XS=
S) in Livemesh Addons for WPBakery Page Builder <=3D 3.9.4 versions. 2026-0= 7-02 6.5 CVE-2026-57754 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57754=
] lobehub--lobehub LobeChat before version 2.2.10-canary.15 contains a reg= ular expression denial of service (ReDoS) vulnerability that allows authent= icated attackers to block the Node.js event loop by supplying a catastrophi= c-backtracking pattern in a GitHub repository URL path during skill import.=
Attackers can craft a malicious basePath value containing unescaped regex = metacharacters such as catastrophic-backtracking patterns, which are inject=
ed into a dynamically constructed regular expression in the findSkillMd fun= ction and executed synchronously against archive entries, denying service t=
o all concurrent users for tens of seconds per request. 2026-07-02 6.5 CVE-= 2026-58578 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58578 ] lobehub--l= obehub LobeChat through 2.2.9 contains a broken access control vulnerabilit=
y in the retrieval-augmented-generation semantic search functionality that = allows authenticated attackers to access other users' data by exploiting mi= ssing user-identifier predicates in the chunk model semanticSearch method. = Attackers can supply arbitrary victim file or knowledge-base identifiers th= rough the chunk retrieval and chat knowledge-base paths to retrieve text co= ntent, file names, and metadata belonging to other users. 2026-07-02 6.5 CV= E-2026-59098 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59098 ] lobehub-= -lobehub LobeChat through 2.2.9 server-database deployments are vulnerable =
to broken object-level authorization in MessageModel. The updateMessagePlug= in, updatePluginState, updatePluginError, updateTTS and updateTranslate met= hods filter target rows by message id alone, omitting the userId scope that=
sibling methods apply, and findMessagePlugin reads back by id alone. Reach= able via the corresponding tRPC message procedures, an authenticated user w=
ho knows another user's message identifier can overwrite that victim's plug=
in tool-call metadata, plugin state/error, text-to-speech and translation r= ecords on the same instance, and the tampered content is served back to the=
victim. Exploitation requires knowledge of the victim's non-enumerable mes= sage identifier. 2026-07-02 5.9 CVE-2026-58580 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-58580 ] lobehub--lobehub LobeChat through 2.2.9 contains =
a broken object level authorization vulnerability that allows authenticated=
attackers to access and modify other users' chat-group agent data by suppl= ying arbitrary group identifiers. Attackers can invoke the getGroupAgents, = updateAgentInGroup, and removeAgentsFromGroup operations without user-scope=
d predicates to read agent listings, modify agent roles and ordering, and r= emove agents from chat groups belonging to other users. 2026-07-02 5 CVE-20= 26-59100 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59100 ] mainwp--Main=
WP Subscriber Broken Access Control in MainWP <=3D 6.1.1 versions. 2026-06-=
29 6.3 CVE-2026-57327 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57327 ]=
Matteo Manna--Simple User Avatar Authorization Bypass Through User-Control= led Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting = Incorrectly Configured Access Control Security Levels. This issue affects S= imple User Avatar: from n/a through 4.9. 2026-06-29 4.3 CVE-2026-57676 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-57676 ] Microsoft--Azure Synapse = Improper access control in Azure Synapse allows an authorized attacker to e= levate privileges over a network. 2026-07-02 4.8 CVE-2026-26145 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-26145 ] Microsoft--Microsoft Edge (Chrom= ium-based) Microsoft Edge (Chromium-based) Spoofing Vulnerability 2026-07-0=
3 6.5 CVE-2026-45489 [ https://www.cve.org/CVERecord?id=3DCVE-2026-45489 ] = Microsoft--Microsoft Edge (Chromium-based) Exposure of sensitive informatio=
n to an unauthorized actor in Microsoft Edge (Chromium-based) allows an una= uthorized attacker to perform spoofing over a network. 2026-07-03 6.5 CVE-2= 026-56646 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56646 ] Microsoft--= Microsoft Edge (Chromium-based) Server-side request forgery (ssrf) in Micro= soft Edge (Chromium-based) allows an unauthorized attacker to perform spoof= ing over a network. 2026-07-03 6.5 CVE-2026-57987 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-57987 ] Microsoft--Microsoft Edge (Chromium-based) Ope= ration on a resource after expiration or release in Microsoft Edge (Chromiu= m-based) allows an unauthorized attacker to disclose information over a net= work. 2026-07-03 6.1 CVE-2026-58291 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-58291 ] Microsoft--Microsoft Edge (Chromium-based) Absolute path tra= versal in Microsoft Edge for Android allows an unauthorized attacker to dis= close information locally. 2026-07-03 6.2 CVE-2026-58300 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-58300 ] Microsoft--Microsoft Edge (Chromium-bas= ed) Relative path traversal in Microsoft Edge for Android allows an unautho= rized attacker to disclose information locally. 2026-07-03 6.8 CVE-2026-585=
22 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58522 ] Microsoft--Microso=
ft Edge (Chromium-based) Improper access control in Microsoft Edge for Andr= oid allows an unauthorized attacker to bypass a security feature over a net= work. 2026-07-03 6.5 CVE-2026-58523 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-58523 ] Microsoft--Microsoft Edge (Chromium-based) User interface (u=
i) misrepresentation of critical information in Microsoft Edge (Chromium-ba= sed) allows an unauthorized attacker to perform spoofing over a network. 20= 26-07-03 5.4 CVE-2026-45488 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4= 5488 ] Microsoft--Microsoft Edge (Chromium-based) Server-side request forge=
ry (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacke=
r to perform spoofing over a network. 2026-07-03 5.4 CVE-2026-58278 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-58278 ] Microsoft--Microsoft Edge (C= hromium-based) Improper neutralization of input during web page generation = ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unaut= horized attacker to perform spoofing over a network. 2026-07-03 5.4 CVE-202= 6-58524 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58524 ] Microsoft--Mi= crosoft Edge (Chromium-based) Concurrent execution using shared resource wi=
th improper synchronization ('race condition') in Microsoft Edge (Chromium-= based) allows an authorized attacker to disclose information locally. 2026-= 07-03 4.2 CVE-2026-55945 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5594=
5 ] Microsoft--Microsoft Edge (Chromium-based) Insufficient ui warning of d= angerous operations in Microsoft Edge (Chromium-based) allows an unauthoriz=
ed attacker to perform spoofing over a network. 2026-07-03 4.3 CVE-2026-585=
97 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58597 ] Misbah WP--Mosaic = Gallery - Advanced Gallery Contributor Cross Site Scripting (XSS) in Mosaic=
Gallery &#8211; Advanced Gallery <=3D 1.2.0 versions. 2026-07-02 6.5 CVE-2= 026-57755 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57755 ] mjperpinosa= --stumasy A weakness has been identified in mjperpinosa stumasy up to 327d1= b0f2915ba79d7ef8ebb74553e987609d9be. The impacted element is the function N= otes_controller::search_scratch_data of the file application/PHP/objects/no= tes/search_scratch_data.php. This manipulation of the argument field_name c= auses sql injection. It is possible to initiate the attack remotely. The ex= ploit has been made available to the public and could be used for attacks. = This product is using a rolling release to provide continious delivery. The= refore, no version details for affected nor updated releases are available.=
The project was informed of the problem early through an issue report but = has not responded yet. 2026-07-05 6.3 CVE-2026-14751 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-14751 ] n8n--n8n n8n before 2.8.0 contains an authe= ntication bypass vulnerability allowing authenticated SSO users to disable = SSO enforcement through the API. Attackers can create local password creden= tials to authenticate directly, bypassing organizational SSO policies and i= dentity-provider-enforced multi-factor authentication. 2026-06-30 6.3 CVE-2= 026-56350 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56350 ] n8n--n8n n8=
n contains a stored cross-site scripting vulnerability in the Chat Trigger = node's Custom CSS field due to a misconfiguration of the sanitize-html libr= ary. Affected releases are those before 1.123.27, the 2.0.0 through 2.13.2 = line, and 2.14.0 (fixed in 1.123.27, 2.13.3, and 2.14.1). An authenticated = user with permission to create or modify workflows can inject JavaScript th=
at bypasses sanitization, resulting in stored XSS against any user who visi=
ts the public chat page. 2026-06-30 5.4 CVE-2026-56356 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-56356 ] n8n--n8n n8n before 2.25.7 and 2.26.x bef= ore 2.26.2 contains an abstract syntax tree (AST) security validator bypass=
in the Python Code node. An authenticated user with permission to create o=
r modify workflows containing a Python Code node can bypass the validator a=
nd access the task executor module namespace. The issue only affects self-h= osted instances where the Python Task Runner is enabled; where N8N_BLOCK_RU= NNER_ENV_ACCESS is configured to allow it, this can disclose environment va= riables accessible to the task runner process. 2026-06-30 5 CVE-2026-56777 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-56777 ] Nathanbarry--Kit (for= merly ConvertKit) for WooCommerce Unauthenticated Sensitive Data Exposure i=
n Kit (formerly ConvertKit) for WooCommerce <=3D 2.1.5 versions. 2026-07-02=
5.3 CVE-2026-57753 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57753 ] n= esquena--hermes-webui Hermes WebUI before 0.51.521 validates the workspace =
of an imported session under the active named profile but constructs the Se= ssion object without setting its profile in the /api/session/import handler=
, so the imported session is persisted with a null profile. Because a null = profile is treated as the default profile by the profile authorization chec=
k, a user on the default profile can export the imported session transcript=
and use its session identifier to read files from the named profile's work= space, defeating the application's profile isolation. 2026-06-30 6.5 CVE-20= 26-58174 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58174 ] netdata--net= data Netdata before 2.3.1 reflects the user-supplied love query parameter o=
f the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the gen= erated SVG document (into a text element) without HTML or XML escaping, and=
serves the response with Content-Type image/svg+xml. An attacker can craft=
a URL such as /api/v2/ilove.svg?love=3D<script>...</script>; when a victim=
navigates to it the injected script executes in the victim browser in the = origin of the Netdata instance (reflected cross-site scripting). These endp= oints are registered with HTTP_ACL_NOCHECK and anonymous access and, becaus=
e bearer-token protection is disabled by default, are reachable without aut= hentication on a default Netdata agent. The issue was resolved by removing = the ilove endpoint. 2026-07-02 6.1 CVE-2025-71385 [ https://www.cve.org/CVE= Record?id=3DCVE-2025-71385 ] nextlevelbuilder--GoClaw A security vulnerabil= ity has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impac= ted is the function MethodRouter.Handle of the file internal/gateway/router= .go of the component WebSocket RPC Handler. Such manipulation leads to inco= rrect authorization. The attack may be launched remotely. The exploit has b= een disclosed publicly and may be used. The project was informed of the pro= blem early through an issue report. 2026-07-05 6.3 CVE-2026-14716 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-14716 ] nikhilgadhiya--Product Video G= allery for Woocommerce The Product Video Gallery for Woocommerce plugin for=
WordPress is vulnerable to Stored Cross-Site Scripting via custom_thumbnai=
l Parameter in all versions up to, and including, 1.5.1.8 due to insufficie=
nt input sanitization and output escaping. This makes it possible for authe= nticated attackers, with shop manager-level access and above, to inject arb= itrary web scripts in pages that will execute whenever a user accesses an i= njected page. 2026-07-02 4.4 CVE-2026-10104 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-10104 ] NousResearch--hermes-agent A security flaw has been = discovered in NousResearch hermes-agent up to 0.15.2. The affected element =
is the function shell.exec of the file tui_gateway/server.py. The manipulat= ion results in protection mechanism failure. It is possible to launch the a= ttack remotely. The exploit has been released to the public and may be used=
for attacks. The vendor was contacted early about this disclosure but did = not respond in any way. 2026-07-04 6.3 CVE-2026-14625 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-14625 ] NousResearch--hermes-agent A security vuln= erability has been detected in NousResearch hermes-agent up to 0.15.2. This=
affects the function DiscordAdapter._is_allowed_user of the file gateway/p= latforms/discord.py of the component Discord Platform Integration. Such man= ipulation leads to improper authentication. The attack can be launched remo= tely. This attack is characterized by high complexity. The exploitability i=
s reported as difficult. The exploit has been disclosed publicly and may be=
used. The vendor was contacted early about this disclosure but did not res= pond in any way. 2026-07-04 5.6 CVE-2026-14627 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-14627 ] NousResearch--hermes-agent A vulnerability was de= tected in NousResearch hermes-agent up to 2026.5.16. This impacts the funct= ion extract_media of the file gateway/platforms/base.py of the component Li=
ve Webhook Endpoint. Performing a manipulation results in path traversal. T=
he attack may be initiated remotely. The exploit is now public and may be u= sed. The vendor was contacted early about this disclosure but did not respo=
nd in any way. 2026-07-04 5.3 CVE-2026-14628 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-14628 ] NousResearch--hermes-agent A weakness has been iden= tified in NousResearch hermes-agent up to 2026.4.30. The impacted element i=
s the function AIAgent.run_conversation of the file run_agent.py of the com= ponent HTTP API. This manipulation of the argument todos causes denial of s= ervice. The attack can be initiated remotely. The exploit has been made ava= ilable to the public and could be used for attacks. The vendor was contacte=
d early about this disclosure but did not respond in any way. 2026-07-04 4.=
3 CVE-2026-14626 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14626 ] Nous= Research--hermes-agent A vulnerability was determined in NousResearch herme= s-agent 2026.5.29.2. The impacted element is the function skill_view of the=
file tools/skills_tool.py. Executing a manipulation of the argument Name c=
an lead to path traversal. The attack can be launched remotely. The exploit=
has been publicly disclosed and may be utilized. This patch is called 56f8= 33efa427ccb444c0f9ad1759af1012f2124d. It is advisable to implement a patch =
to correct this issue. 2026-07-05 4.3 CVE-2026-14783 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-14783 ] NVIDIA--Triton Inference Server NVIDIA Trit=
on Inference Server for Linux contains a vulnerability where an attacker ca=
n cause a use-after-free issue. A successful exploit of this vulnerability = might lead to denial of service. 2026-07-01 5.9 CVE-2026-24266 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-24266 ] octagonwebstudio--Premium Addons = for KingComposer The Premium Addons for KingComposer plugin for WordPress i=
s vulnerable to unauthorized modification and loss of data in versions up t=
o, and including, 1.1.1. This is due to missing authorization and capabilit=
y checks on the add_custom_sidebar() and remove_custom_sidebar() AJAX handl= ers, both of which are exposed through wp_ajax_nopriv_* hooks and write dir= ectly to the octagon_custom_sidebar option via update_option(). This makes =
it possible for unauthenticated attackers to create arbitrary custom widget=
areas or delete existing custom sidebars, which can cause widgets assigned=
to those areas to silently lose their registration and stop rendering. 202= 6-06-30 5.3 CVE-2026-12349 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12= 349 ] ohler55--oj Oj (Optimized JSON) is a JSON parser and Object marshalle=
r packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object m= ode reads uninitialized stack memory (and, for long keys, reads out of boun= ds) when parsing a JSON object whose key is 254 bytes or longer. The intern=
ed bytes can surface to the caller, disclosing process stack memory. In ext= /oj/intern.c, form_attr() handles the long-key path by allocating a heap bu= ffer, `b`, populating it with the attribute name, and then freeing it - but=
it passed the uninitialized stack buffer buf (not b) to rb_intern3(). rb_i= ntern3 therefore reads len + 1 bytes of uninitialized stack memory. When th=
e key length is >=3D 256, it also reads out of bounds past the 256-byte buf=
. The resulting bytes are interned and can reach the caller via the produce=
d Symbol or via the EncodingError message raised on invalid UTF-8, leaking = process stack contents. This issue has been fixed in version 3.17.3. 2026-0= 6-30 5.3 CVE-2026-54500 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54500=
] omec-project--amf A vulnerability was determined in omec-project amf up =
to 2.1.1. This issue affects the function RRCInactiveTransitionReport of th=
e component NGAP Message Handler. Executing a manipulation can lead to deni=
al of service. The attack may be performed from remote. The exploit has bee=
n publicly disclosed and may be utilized. This patch is called 34bc6724acc9= 7dba1f8691e586da95b042cb612d. A patch should be applied to remediate this i= ssue. 2026-07-04 4.3 CVE-2026-14623 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-14623 ] omec-project--amf A vulnerability was identified in omec-pro= ject amf up to 2.0.2/2.1.1. Impacted is an unknown function of the file /go= /src/amf/ngap/handler.go of the component NGSetupRequest Handler. The manip= ulation leads to denial of service. It is possible to initiate the attack r= emotely. The exploit is publicly available and might be used. The identifie=
r of the patch is 34bc6724acc97dba1f8691e586da95b042cb612d. To fix this iss= ue, it is recommended to deploy a patch. 2026-07-04 4.3 CVE-2026-14624 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-14624 ] onnx--onnx A weakness has=
been identified in onnx up to 1.21.x. This vulnerability affects the funct= ion convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the c= omponent onnxruntime. This manipulation causes out-of-bounds read. It is po= ssible to initiate the attack remotely. The exploit has been made available=
to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb625= 75236ef6e4944980c40e045. It is recommended to apply a patch to fix this iss= ue. 2026-07-04 4.3 CVE-2026-14647 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-14647 ] opajaap--WP Photo Album Plus The WP Photo Album Plus plugin fo=
r WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' = parameter in all versions up to, and including, 9.1.13.005 due to insuffici= ent input sanitization and output escaping. This makes it possible for auth= enticated attackers, with contributor-level access and above, to inject arb= itrary web scripts in pages that will execute whenever a user accesses an i= njected page. A contributor-level attacker can embed the malicious [photo] = shortcode in a post submitted for review, causing the stored payload to exe= cute when an administrator or any other user views the post. 2026-07-01 6.4=
CVE-2026-10095 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10095 ] Open = Asset Import Library--Assimp A vulnerability was determined in Open Asset I= mport Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter= ::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component=
PLY Model Handler. This manipulation causes double free. The attack can be=
initiated remotely. The exploit has been publicly disclosed and may be uti= lized. The project was informed of the problem early through an issue repor=
t. 2026-07-03 6.3 CVE-2026-14604 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-14604 ] Open Asset Import Library--Assimp A security vulnerability has = been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by = this vulnerability is the function Assimp::SceneCombiner::Copy of the file = code/Common/SceneCombiner.cpp of the component Model File Handler. Such man= ipulation of the argument width/height leads to heap-based buffer overflow.=
An attack has to be approached locally. The exploit has been disclosed pub= licly and may be used. This and similar defects are tracked and handled via=
issue #6128. 2026-07-01 5.3 CVE-2025-15666 [ https://www.cve.org/CVERecord= ?id=3DCVE-2025-15666 ] Open Asset Import Library--Assimp A flaw has been fo= und in Open Asset Import Library Assimp up to 6.0.5. Impacted is the functi=
on Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoa= der.cpp of the component CSM File Handler. This manipulation causes heap-ba= sed buffer overflow. The attack is restricted to local execution. The explo=
it has been published and may be used. Patch name: eb84eec580d3f4ba2f0fd874= 09b7d0744620f11e. Applying a patch is the recommended action to fix this is= sue. 2026-07-03 5.3 CVE-2026-14610 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-14610 ] open-telemetry--opentelemetry-java-instrumentation OpenTeleme= try Java Instrumentation provides OpenTelemetry auto-instrumentation and in= strumentation libraries for Java. In versions prior to 2.28.0, the JDBC aut= o-instrumentation may fail to sanitize passwords in SQL CONNECT statements = when the password is double-quoted. As a result, clear-text database passwo= rds can be added to trace span attributes and exported to observability bac= kends. This issue has been fixed in version 2.28.0. 2026-07-01 6.5 CVE-2026= -54704 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54704 ] open-telemetry= --opentelemetry-java-instrumentation OpenTelemetry Java Instrumentation pro= vides OpenTelemetry auto-instrumentation and instrumentation libraries for = Java. In versions prior to 2.27.0, the RMI context propagation payload read=
er limits the number of context entries but does not limit the aggregate si=
ze of the strings read from the stream. An attacker who can reach an RMI en= dpoint on an instrumented JVM can send an oversized context propagation pay= load. This can cause excessive memory allocation while the JVM reads the pa= yload, potentially leading to denial of service. The issue affects only dep= loyments where RMI instrumentation is enabled and an RMI endpoint is networ= k-reachable. This issue has been fixed in version 2.27.0. 2026-07-01 5.3 CV= E-2026-54712 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54712 ] open-web= ui--open-webui Open WebUI before 0.6.27 contains a server-side request forg= ery vulnerability in the /api/v1/retrieval/process/web endpoint that allows=
authenticated users to bypass SSRF protections. Attackers can manipulate U=
RL parameters with location redirect headers to access internal services an=
d potentially execute commands via instance secrets. 2026-06-30 5 CVE-2026-= 56399 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56399 ] Open5GS--Open5G=
S A vulnerability was detected in Open5GS up to 2.7.7. Affected by this vul= nerability is the function amf_nnrf_handle_nf_discover of the file src/amf/= nnrf-handler.c of the component AMF. The manipulation results in denial of = service. The attack may be launched remotely. The exploit is now public and=
may be used. The patch is identified as fb5f67703de0213fb9c6e6ef3b48b6c170= 7e9503. It is best practice to apply a patch to resolve this issue. 2026-07= -04 4.3 CVE-2026-14618 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14618 =
] openGauss-server--openGauss-server-7.0.0-RC2 See CVE Link for Additional = Details 2026-06-30 5.9 CVE-2026-14178 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-14178 ] Paolo--GeoDirectory Subscriber Server Side Request Forgery=
(SSRF) in GeoDirectory <=3D 2.8.161 versions. 2026-07-02 6.4 CVE-2026-5768=
1 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57681 ] papermark--papermar=
k Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) = misconfiguration vulnerability that allows unauthenticated remote attackers=
to perform credentialed cross-origin requests by exploiting the TUS-based = viewer upload endpoint reflecting arbitrary request Origins with Access-Con= trol-Allow-Credentials set to true. Attackers can lure authenticated victim=
s to malicious pages that silently issue credentialed cross-origin requests=
to upload arbitrary files into victim datarooms and read credentialed resp= onses. 2026-06-29 4.7 CVE-2026-57957 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-57957 ] parorrey--JSON API User The JSON API User plugin for WordPr= ess is vulnerable to Stored Cross-Site Scripting via the 'content' paramete=
r of the post_comment API endpoint in versions up to, and including, 4.1.0 = This is due to insufficient input sanitization in the post_comment() functi= on, which passes the attacker-controlled comment_content value directly to = wp_insert_comment() without applying any HTML sanitization, and additionall=
y allows the caller to set comment_approved=3D1 to self-approve the comment=
and bypass moderation. This makes it possible for authenticated attackers,=
with subscriber-level access and above, to inject arbitrary web scripts in=
pages that will execute whenever a user accesses an injected page. 2026-07= -03 6.4 CVE-2026-9626 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9626 ] = parseablehq--parseable Parseable before 2.9.2 contains an information discl= osure vulnerability in the notification-target API endpoints that returns w= ebhook tokens and basic-auth credentials in cleartext due to commented-out = secret-masking functionality. Any authenticated user with the GetAlert acti= on, including low-privilege reader roles, can recover credentials and inter= nal endpoint URLs for all configured notification targets by querying GET /= api/v1/targets or related endpoints. 2026-06-29 6.5 CVE-2026-56783 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-56783 ] photoprism--photoprism PhotoP= rism before 260601-a7d098548 contains a broken access control vulnerability=
that allows authenticated non-admin users to modify other users' profile i= nformation by sending requests to arbitrary user endpoints. Attackers can e= xploit the missing session-to-user identifier validation in the PUT users A=
PI endpoint to overwrite another user's profile details without authorizati= on. 2026-06-29 4.3 CVE-2026-57945 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-57945 ] php--php In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3= .32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm im= plementation in OpenSSL extension contains a buffer allocation flaw. The ou= tput buffer for the AES key-wrap-with-padding operation is sized from the p= laintext length without accounting for RFC 5649 expansion. This may cause O= penSSL to write beyond allocated memory, corrupting heap metadata and trigg= ering application abort. 2026-07-03 5.6 CVE-2026-14355 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-14355 ] pinpoint-apm--pinpoint Pinpoint through v= ersion 3.1.0 contains an insecure session management vulnerability that all= ows attackers to access the pinpointJwt session cookie due to missing HttpO= nly and Secure attributes, enabling JavaScript access via document.cookie a=
nd cleartext transmission over HTTP. Attackers can exploit stored or reflec= ted cross-site scripting vulnerabilities to exfiltrate the session token or=
intercept it through network sniffing to perform session hijacking. 2026-0= 6-29 6.8 CVE-2026-57948 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57948=
] PraisonAI--PraisonAI PraisonAI before 0.1.7 fails to validate that proje= ct_id in issue create and update request bodies belongs to the URL workspac=
e. An attacker can create issues referencing projects from other workspaces=
, causing cross-tenant data pollution in project statistics aggregation wit= hout workspace constraints. 2026-07-02 4.3 CVE-2026-58653 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-58653 ] presenton--presenton Presenton before = 0.8.8-beta bundles an MCP server that, on server/Docker deployments configu= red with session authentication (AUTH_USERNAME/AUTH_PASSWORD), is reachable=
unauthenticated at /mcp because the nginx front-end does not apply the aut= h_request gate to that path and the MCP server auto-mints a valid internal = session token for the configured user. A remote unauthenticated attacker ca=
n invoke MCP tools such as generate_presentation, performing authenticated = application actions, consuming the operators configured LLM API keys, and c= reating presentations in the operators instance. The Electron desktop build=
is not affected (MCP disabled). 2026-06-30 6.5 CVE-2026-58446 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-58446 ] properfraction--CrawlWP SEO Cross= -Site Request Forgery (CSRF) vulnerability in properfraction CrawlWP SEO al= lows Cross Site Request Forgery. This issue affects CrawlWP SEO: from n/a t= hrough 3.0.16. 2026-07-05 4.3 CVE-2026-59520 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-59520 ] propertyhive--Houzez Property Feed The Houzez Prope= rty Feed plugin for WordPress is vulnerable to SQL Injection via the 'order= by' parameter in all versions up to, and including, 2.5.46 due to insuffici= ent escaping on the user supplied parameter and lack of sufficient preparat= ion on the existing SQL query in the prepare_items() method of the Houzez_P= roperty_Feed_Admin_Logs_Export_Table (and Houzez_Property_Feed_Admin_Logs_I= mport_Table) class. The user-controlled $_GET['orderby'] and $_GET['order']=
values are filtered only with sanitize_text_field() and then concatenated = into the SQL format string before $wpdb->prepare() is called - prepare() on=
ly parameterizes the appended LIMIT/OFFSET clause and cannot retroactively = secure the already-tainted ORDER BY clause. This makes it possible for auth= enticated attackers, with Administrator-level access and above, to append a= dditional SQL queries into already existing queries that can be used to ext= ract sensitive information from the database. 2026-07-02 4.9 CVE-2026-13357=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-13357 ] qodeinteractive--Qi = Blocks The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct = Object Reference in all versions up to, and including, 1.4.9 via the 'page_= id' parameter due to missing validation on a user controlled key. This make=
s it possible for authenticated attackers, with author-level access and abo= ve, to modify the stored Qi Blocks styles of arbitrary posts, templates, or=
widgets they do not own - including site-wide surfaces via the reserved 't= emplate' and 'widget' page_id values - enabling unauthorized frontend defac= ement, content hiding, and degradation of any page on the site. The endpoin= t's permission_callback checks only the generic edit_posts and publish_post=
s capabilities, meaning any user with the built-in Author role satisfies th=
e check regardless of post ownership. 2026-07-01 4.3 CVE-2026-10096 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-10096 ] radareorg--radare2 A vulnera= bility was determined in radareorg radare2 up to 6.1.6. This affects the fu= nction core_anal_bytes of the file libr/core/cmd_anal.inc. This manipulatio=
n causes integer overflow. The attack needs to be launched locally. The exp= loit has been publicly disclosed and may be utilized. It is suggested to in= stall a patch to address this issue. 2026-07-05 5.3 CVE-2026-14757 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-14757 ] RadiusTheme--Classified Listi=
ng Subscriber Broken Access Control in Classified Listing <=3D 5.4.2 versio= ns. 2026-07-02 6.5 CVE-2026-57355 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-57355 ] Raera - Ankara Web Design and Digital Advertising Agency--Dest= ekz Improper neutralization of input during web page generation ('cross-sit=
e scripting') vulnerability in Raera - Ankara Web Design and Digital Advert= ising Agency Destekz allows Reflected XSS. This issue affects Destekz: thro= ugh 02062026.=C2=A0NOTE: The vendor was contacted and it was learned that t=
he product is not supported. 2026-07-03 6.1 CVE-2026-4322 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-4322 ] Red Hat--Red Hat Build of Keycloak A fl=
aw was found in the Identity Provider (IdP) mapper component of Keycloak, w= hich is used to manage how user information from external services is mappe=
d to Keycloak users. An administrator with limited permissions to manage id= entity providers can exploit this flaw by creating a "Hardcoded Role" mappe=
r that assigns high-level administrative roles (like realm-admin) to themse= lves or others. This allows a restricted administrator to bypass security c= hecks and gain full control over the entire realm. 2026-06-30 6.5 CVE-2026-= 12388 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12388 ] Red Hat--Red Ha=
t Build of Keycloak A flaw was found in Keycloak. A highly privileged user = with `manage-clients` permission can exploit this vulnerability by injectin=
g a hardcoded role mapper into any client. This action allows the user to b= ypass existing scope restrictions and inject the `realm-admin` role into ge= nerated tokens, resulting in privilege escalation and full administrative a= ccess to the realm. 2026-06-30 6.5 CVE-2026-4629 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-4629 ] Red Hat--Red Hat Build of Keycloak A flaw was fo= und in the ClientResource component of Keycloak's admin services when Fine-= Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegat=
ed administrator, who should only have limited control over specific client=
s, to attach or remove hidden client scopes that they are not authorized to=
see or manage. As a result, an attacker could inject unauthorized data or = permissions into the security tokens issued to end-users, potentially trick= ing other applications into granting higher levels of access than intended.=
2026-07-03 5.4 CVE-2026-14614 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-14614 ] Red Hat--Red Hat Build of Keycloak A vulnerability was discovered=
in Keycloak's Admin UI extension that allows certain administrative users =
to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv=
2) are enabled, an administrator who should only be able to search for user=
s (but not view their full details) can use a specific "brute-force-user" e= ndpoint to access a user's full profile. This includes sensitive informatio=
n and security metadata. The issue occurs because the system fails to check=
if the administrator has the required "view" permission for that specific = user when using this particular search path. 2026-06-30 4.3 CVE-2026-14209 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14209 ] Red Hat--Red Hat Buil=
d of Keycloak A vulnerability was discovered in Keycloak's administrative i= nterface that allows certain administrators to see information about groups=
they shouldn't have access to. When the new Fine-Grained Admin Permissions=
(FGAP v2) are turned on, an administrator who is allowed to see a specific=
"role" can also see a list of all groups assigned to that role. The system=
fails to check if the administrator has permission to see those specific g= roups. This could allow a restricted administrator to discover "hidden" gro= ups and see their details, such as internal names and custom settings, whic=
h might contain sensitive deployment information. 2026-07-03 4.3 CVE-2026-1= 4613 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14613 ] Red Hat--Red Hat=
Build of Keycloak A flaw was found in the Fine-Grained Admin Permissions (= FGAP) v2 implementation within Keycloak's administrative services. When FGA=
P v2 is enabled, the system fails to properly filter child groups based on = the caller's specific permissions when requested through a parent group. Th=
is allows a delegated administrator to view details of child groups they ar=
e not authorized to access directly, including group names, paths, and cust=
om attributes. 2026-07-03 4.3 CVE-2026-14615 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-14615 ] Red Hat--Red Hat Build of Keycloak A flaw exists in=
the org.keycloak.broker.oidc package where the OIDC broker incorrectly syn= chronizes the email_verified claim. When an OIDC identity provider is confi= gured with trustEmail=3Dtrue and the userinfo endpoint is enabled, Keycloak=
retrieves the email address from the userinfo response but retrieves the e= mail_verified status exclusively from the id_token. The root cause is a lac=
k of validation ensuring that the email_verified claim in the id_token actu= ally refers to the email address returned by the userinfo endpoint. If thes=
e two sources return different email addresses, the id_token's email_verifi= ed=3Dtrue claim is blindly applied to the userinfo email. Exploitation Cond= itions: The OIDC identity provider must have trustEmail set to true (non-de= fault). The userinfo endpoint must be enabled (default). The attacker must = control or have compromised the upstream OIDC provider. Concrete Impact: Ma=
rk arbitrary email addresses as verified in the Keycloak database. Bypass e= mail-based security controls or verification workflows. Potential account t= akeover if the application relies solely on the email_verified flag from th=
e IdP to link accounts. 2026-07-05 4.8 CVE-2026-14781 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-14781 ] Red Hat--Red Hat Enterprise Linux 10 A fla=
w was found in sssd. When authenticating with a YubiKey, the SSSD PAM respo= nder can crash due to a use-after-free vulnerability, where a memory pointe=
r is incorrectly handled. A local attacker could exploit this flaw by manip= ulating smartcard or YubiKey contents, leading to a denial of service that = disrupts authentication. This vulnerability also presents a potential for p= rivilege escalation, although it is difficult to exploit. 2026-06-30 6.4 CV= E-2026-12610 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12610 ] Red Hat-= -Red Hat Enterprise Linux 10 A flaw was found in p11-kit. The RPC message a= ttribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_mess= age_get_attribute_array_value() form a mutually-recursive call chain with n=
o recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRA= P_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker=
with local access to the p11-kit RPC Unix domain socket can send a special=
ly crafted request with deeply nested template attributes, causing stack ex= haustion and crashing the p11-kit server process and its dependent services=
. 2026-06-29 6.2 CVE-2026-13757 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-13757 ] Red Hat--Red Hat Enterprise Linux 10 A flaw was found in dhcpcd'=
s IPv6 Neighbor Discovery Router Advertisement processing. A specially craf= ted IPv6 Router Advertisement containing a zero-length Neighbor Discovery o= ption can bypass validation during packet storage and later be reparsed wit= hout adequate validation, causing the parser to enter a non-advancing loop.=
Successful exploitation may result in excessive CPU consumption, leading t=
o a denial of service. 2026-07-01 6.5 CVE-2026-14258 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-14258 ] Red Hat--Red Hat Enterprise Linux 10 RAOP m= odule accepts unbounded Content-Length values and does not check the pw_arr= ay_add() return. 2026-07-01 6.5 CVE-2026-14324 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-14324 ] Red Hat--Red Hat Enterprise Linux 10 Multiple unb= ounded alloca() calls in the PulseAudio protocol server. 2026-07-01 5.5 CVE= -2026-14330 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14330 ] Red Hat--= Red Hat Enterprise Linux 10 A flaw was found in spice-vdagent. A malicious =
or compromised SPICE host can trigger an integer overflow by sending a spec= ially crafted message. This vulnerability can lead to a heap buffer overflo=
w, causing the spice-vdagent daemon to crash and resulting in a Denial of S= ervice (DoS) for the virtual machine. This issue requires the SPICE host to=
be untrusted or compromised for exploitation. 2026-06-29 5.1 CVE-2026-5796=
5 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57965 ] Red Hat--Red Hat En= terprise Linux 10 Two off-by-one errors in the FreeIPA ipa-otpd daemon's OA= uth2 device authorization handler can cause out-of-bounds memory access whe=
n processing an oversized response from a configured external OAuth2/OIDC I= dentity Provider. An attacker who controls or can man-in-the-middle the IdP=
endpoint may be able to trigger ipa-otpd to write or read one byte past th=
e end of a fixed-size buffer. Exploitation requires FreeIPA to be configure=
d with an external IdP, attacker control or MITM of that IdP, and a user to=
initiate the OAuth2 device authorization flow. The most likely impact is l= imited denial of service affecting the ipa-otpd daemon. 2026-07-03 4.2 CVE-= 2026-14612 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14612 ] Red Hat--R=
ed Hat Enterprise Linux 10 A path traversal vulnerability was found in spic= e-vdagent. This flaw allows a malicious or compromised SPICE host to write = arbitrary files to any location on the guest operating system. This occurs = because the filename provided by the SPICE host during file transfers is no=
t properly sanitized before being used. An attacker could exploit this to w= rite to sensitive locations with the privileges of the spice-vdagent proces=
s, typically the logged-in user. This issue requires the SPICE host to be u= ntrusted or compromised for exploitation. 2026-06-29 4.4 CVE-2026-57966 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-57966 ] Red Hat--Red Hat Enterpr= ise Linux 6 A flaw was found in GIMP's PSP file format parser. A double-fre=
e condition occurs in the read_layer_block() function when processing a spe= cially crafted PSP file. This could allow an attacker to cause memory corru= ption, potentially leading to denial of service or arbitrary code execution=
. 2026-07-02 6.1 CVE-2026-58381 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-58381 ] Red Hat--Red Hat Hardened Images A flaw was found in the libblki=
d library of util-linux. During nested partition probing, the BSD, Minix, S= olaris x86, and UnixWare partition probers cache a raw pointer to a parent = partition entry in a dynamically allocated array. When subsequent partition=
additions cause the array to be reallocated, this pointer becomes stale, l= eading to a heap use-after-free read. An attacker who can present a crafted=
block device image (for example, via USB insertion or a loop-mounted disk = image) can trigger this flaw without user interaction, as libblkid is invok=
ed automatically by udev/udisks as root on block-device hot-plug events. Th=
is could lead to limited information disclosure or denial of service. 2026-= 06-29 6.8 CVE-2026-13595 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1359=
5 ] Red Hat--Red Hat Satellite 6 A flaw has been found in foreman when HTTP=
parameters are modified in http_proxies_controller and http_proxy files. A= ttackers can perform an SSRF attack and steal cloud metadata service on AWS= /GCP/Azure environment through foreman component. 2026-06-30 4.4 CVE-2026-1= 3316 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13316 ] Red Hat--Red Hat=
Satellite 6.16 for RHEL 8 A flaw was found in Foreman. This broken access = control vulnerability allows an authenticated user with host-edit permissio=
ns to retarget an existing lookup value override to a different host. This =
is achieved by modifying the match field through nested host attributes, ef= fectively bypassing authorisation checks. The consequence is the potential = for unauthorised modification of managed host configurations across differe=
nt organisational and location boundaries. 2026-07-01 6.5 CVE-2026-5135 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-5135 ] Red Hat--Red Hat Satellit=
e 6.16 for RHEL 8 A flaw was found in foreman. Authenticated users with 'vi= ew_keypairs' permission can bypass taxonomy scoping, allowing them to downl= oad private SSH (Secure Shell) keys from other organizations by directly qu= erying key pair IDs. This vulnerability leads to cross-tenant data exposure=
in multi-tenant deployments, potentially compromising sensitive informatio=
n. 2026-07-01 6.5 CVE-2026-5142 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-5142 ] Red Hat--Red Hat Satellite 6.16 for RHEL 8 A flaw was found in Fo= reman. An authenticated user with host-edit permissions could exploit a cro= ss-tenant information disclosure vulnerability. This flaw occurs because th=
e taxonomy_scope controller method does not properly validate organization = and location IDs from nested request parameters, bypassing existing authori= zation checks. This allows the user to leak sensitive infrastructure metada= ta, including subnet topology, IP ranges, gateways, DNS servers, and VLAN I= Ds, from organizations and locations they are not authorized to access. 202= 6-07-01 4.3 CVE-2026-5138 [ https://www.cve.org/CVERecord?id=3DCVE-2026-513=
8 ] rilwis--Slim SEO A Fast & Automated SEO Plugin For WordPress The Slim S=
EO - A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vu= lnerable to Unauthorized Private Content Disclosure in all versions up to, = and including, 4.9.8 via the `/wp-json/slim-seo/meta-tags/ai` REST API endp= oint. This is due to the endpoint's `permission_callback` performing only a=
top-level `edit_posts` capability check without verifying that the request= ing user has read access to the specific post supplied via the `object.ID` = parameter, allowing the `generate` function to pass the attacker-controlled=
post ID to `Data::get_post_content()`, which calls `get_post()` regardless=
of post status or ownership. This makes it possible for authenticated atta= ckers with Contributor-level access and above to retrieve AI-generated summ= aries of the raw `post_content` of arbitrary posts they are not authorized =
to view - including private posts, drafts, pending, future, and password-pr= otected content authored by other users - with the substance of the protect=
ed content disclosed via the HTTP response. 2026-07-01 4.3 CVE-2026-12408 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-12408 ] rometheme--RTMKit The = RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi=
a the Advanced Heading widget's 'Background Text' parameter in versions up = to, and including, 2.0.7 This is due to insufficient output escaping on the=
'background_text_heading' setting in the render() function, which concaten= ates the value directly into an HTML attribute without applying esc_attr().=
This makes it possible for authenticated attackers, with contributor-level=
access and above, to inject arbitrary web scripts in pages that will execu=
te whenever a user accesses an injected page. 2026-07-03 6.4 CVE-2026-8351 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-8351 ] rometheme--RTMKit The = RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Loca=
l File Inclusion in versions up to, and including, 2.0.7 This is due to ins= ufficient path validation on the 'template' parameter in the render_templat=
es AJAX endpoint, which is used directly in a require/include statement wit= hout sanitization. This makes it possible for authenticated attackers, with=
Contributor-level access and above, to include and execute files on the se= rver ending in _templates.php, allowing the execution of any PHP code in th= ose files. 2026-07-03 4.3 CVE-2026-5137 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-5137 ] RT-Thread--RT-Thread A weakness has been identified in R= T-Thread up to 5.0.2. This affects the function sys_getaddrinfo of the file=
components/lwp/lwp_syscall.c. Executing a manipulation of the argument ai_= addr can lead to memory corruption. The attack can only be executed locally=
. The exploit has been made available to the public and could be used for a= ttacks. The pull request to fix this issue awaits acceptance. 2026-07-03 5.=
5 CVE-2026-14607 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14607 ] RT-T= hread--RT-Thread A flaw has been found in RT-Thread up to 5.2.2. Affected i=
s the function read/write/sys_ioctl of the file components/lwp/lwp_syscall.=
c of the component Parameter Handler. Executing a manipulation can lead to = divide by zero. The attack may be launched remotely. The exploit has been p= ublished and may be used. The pull request to fix this issue awaits accepta= nce. 2026-07-04 4.3 CVE-2026-14629 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-14629 ] Samsung Open Source--Escargot Time-of-check time-of-use (TOCT= OU) race condition vulnerability in Samsung Open Source Escargot allows Lev= eraging Race Conditions. This issue affects Escargot: bab3a5797557014ce3c2e= 28419a6310cfba90d0d. 2026-06-30 5.9 CVE-2026-14160 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-14160 ] SaturdayDrive--Ninja Forms - File Uploads The=
Ninja Forms - File Uploads plugin for WordPress is vulnerable to authoriza= tion bypass in all versions up to, and including, 3.3.29. This is due to th=
e plugin not properly verifying that a user is authorized to perform an act= ion. This makes it possible for unauthenticated attackers to read all plugi=
n debug log entries stored in the wp_nf3_log table or permanently delete al=
l rows from that table. 2026-07-03 5.3 CVE-2026-12557 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-12557 ] seladb--PcapPlusPlus A vulnerability was d= etermined in seladb PcapPlusPlus 25.05. The impacted element is the functio=
n pcpp::SSLClientHelloMessage::getHandshakeVersion of the file Packet++/src= /SSLHandshake.cpp of the component TLS Hello Handler. Executing a manipulat= ion of the argument handshakeVersion can lead to heap-based buffer overflow=
. It is possible to launch the attack remotely. This attack is characterize=
d by high complexity. The exploitability is regarded as difficult. The expl= oit has been publicly disclosed and may be utilized. This patch is called 9= 8e671010bc7c87b95898c22ae289220ae92542b. It is best practice to apply a pat=
ch to resolve this issue. 2026-06-29 5.6 CVE-2026-13588 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-13588 ] seladb--PcapPlusPlus A vulnerability was=
identified in seladb PcapPlusPlus 25.05. This affects the function pcpp::T= elnetLayer::getSubCommand of the file Packet++/src/TelnetLayer.cpp of the c= omponent Telnet Subnegotiation Packet Handler. The manipulation leads to he= ap-based buffer overflow. The attack can be initiated remotely. The complex= ity of an attack is rather high. The exploitability is reported as difficul=
t. The exploit is publicly available and might be used. The identifier of t=
he patch is 98e671010bc7c87b95898c22ae289220ae92542b. It is recommended to = apply a patch to fix this issue. 2026-06-29 5.6 CVE-2026-13589 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-13589 ] seladb--PcapPlusPlus A security f= law has been discovered in seladb PcapPlusPlus 25.05. This impacts the func= tion pcpp::ModbusLayer::getLength in the library Packet++/header/ModbusLaye= r.h of the component Modbus Protocol Handler. The manipulation of the argum= ent length results in heap-based buffer overflow. The attack can be launche=
d remotely. A high complexity level is associated with this attack. The exp= loitability is said to be difficult. The exploit has been released to the p= ublic and may be used for attacks. The patch is identified as 4c90c3e3418a2= b09dc82b7ca5775e9c1e22fe454. Applying a patch is advised to resolve this is= sue. 2026-06-29 5.6 CVE-2026-13590 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-13590 ] Sendcloud--Sendcloud Shipping Missing Authorization vulnerabi= lity in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configur=
ed Access Control Security Levels. This issue affects Sendcloud Shipping: f= rom n/a through 1.0.29. 2026-07-02 5.3 CVE-2026-57760 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-57760 ] shohei.tanaka--Japanized For WooCommerce U= nauthenticated Broken Access Control in Japanized For WooCommerce <=3D 2.9.=
12 versions. 2026-06-29 6.5 CVE-2026-57340 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-57340 ] ShortPixel--Enable Media Replace Improper Neutralizat= ion of Input During Web Page Generation ('Cross-site Scripting') vulnerabil= ity in ShortPixel Enable Media Replace allows Stored XSS. This issue affect=
s Enable Media Replace: from n/a through 4.2.1. 2026-07-01 5.9 CVE-2026-577=
22 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57722 ] ShortPixel--ShortP= ixel Adaptive Images Subscriber Cross Site Scripting (XSS) in ShortPixel Ad= aptive Images <=3D 3.11.3 versions. 2026-07-02 6.5 CVE-2026-57342 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-57342 ] Siemens--Mendix Studio Pro 10.=
11 A vulnerability has been identified in Mendix Studio Pro 10.11 (All vers= ions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.13 (All=
versions), Mendix Studio Pro 10.14 (All versions), Mendix Studio Pro 10.15=
(All versions), Mendix Studio Pro 10.16 (All versions), Mendix Studio Pro = 10.17 (All versions), Mendix Studio Pro 10.18 (All versions), Mendix Studio=
Pro 10.19 (All versions), Mendix Studio Pro 10.20 (All versions), Mendix S= tudio Pro 10.21 (All versions), Mendix Studio Pro 10.22 (All versions), Men= dix Studio Pro 10.23 (All versions), Mendix Studio Pro 10.24 (All versions =
< V10.24.21), Mendix Studio Pro 11.0 (All versions), Mendix Studio Pro 11.1=
(All versions), Mendix Studio Pro 11.10 (All versions), Mendix Studio Pro = 11.11 (All versions), Mendix Studio Pro 11.2 (All versions), Mendix Studio = Pro 11.3 (All versions), Mendix Studio Pro 11.4 (All versions), Mendix Stud=
io Pro 11.5 (All versions), Mendix Studio Pro 11.6 (All versions < V11.6.7)=
, Mendix Studio Pro 11.7 (All versions), Mendix Studio Pro 11.8 (All versio= ns), Mendix Studio Pro 11.9 (All versions). Affected versions of Mendix Stu= dio Pro do not properly validate or sanitize project files processed during=
the build pipeline. This could allow an attacker who tricks a user into op= ening and running a specially crafted malicious project locally on their sy= stem to execute arbitrary code in the context of that user. 2026-06-30 5.4 = CVE-2026-48192 [ https://www.cve.org/CVERecord?id=3DCVE-2026-48192 ] SigNoz= --signoz SigNoz through 0.130.1 contains a broken access control vulnerabil= ity that allows authenticated users to access other organizations' alert ru= les by supplying a target rule UUID, as the alert rule store predicates fai=
l to filter by organization ID. Attackers can read, edit, and delete alert = rules belonging to other organizations by exploiting the missing tenant iso= lation check, bypassing multi-tenant access controls. 2026-06-29 6.4 CVE-20= 26-57956 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57956 ] silverstripe= --silverstripe-framework Silverstripe Framework is a PHP framework which po= wers the Silverstripe CMS. In versions prior to 6.2.2, the "Insert media fr=
om web" functionality in the CMS is vulnerable to XSS from a specially craf= ted embed. This issue was fixed in version 6.2.2/ 2026-07-01 5.4 CVE-2026-5= 4720 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54720 ] smub--WPForms AI=
Form Builder for WordPress Contact Forms, Payment Forms, Survey Form, Quiz=
& More The WPForms - Easy Form Builder for WordPress - Contact Forms, Paym= ent Forms, Surveys, & More plugin for WordPress is vulnerable to Improper N= eutralization of CRLF Sequences ('CRLF Injection') in all versions up to, a=
nd including, 1.10.2 This is due to `get_reply_to_address()` processing the=
Reply-To display name through smart-tag expansion with context `'notificat= ion'` instead of `'notification-reply-to'`, which bypasses email-address va= lidation while `wpforms_sanitize_textarea_field()` intentionally preserves = CR/LF characters that are never stripped before the display name is concate= nated into the raw `Reply-To:` mail header string. This makes it possible f=
or unauthenticated attackers to inject arbitrary additional email headers -=
such as `Bcc:` - into outgoing notification emails, silently blind-copying=
all notification email copies to an attacker-controlled address. Exploitat= ion requires that a form notification is configured to use a Paragraph Text=
(textarea) field as the Reply-To display name via a Smart Tag. 2026-07-01 = 5.3 CVE-2026-12127 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12127 ] Sn= owflake--Snowflake CLI Improper restriction of file path resolution in Snow= flake CLI versions prior to 3.19 allowed arbitrary local file content to be=
read and transmitted to Snowflake services. An attacker could exploit this=
by supplying crafted repository or project content that referenced files o= utside the intended project boundary, causing Snowflake CLI to read local f= iles and upload or embed their contents during deployment or SQL template p= rocessing. Successful exploitation required the victim to process attacker-= controlled project content, and retrieval of exfiltrated data depended on a= ccess to the victim's Snowflake account artifacts such as query history or = uploaded stage content. The fix is available in Snowflake CLI version 3.19,=
and users must manually upgrade. 2026-06-29 6.3 CVE-2026-13748 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-13748 ] Snowflake--Snowflake CLI Imprope=
r neutralization of parameters in Snowflake CLI versions prior to 3.19 allo= wed unintended SQL execution. An attacker could exploit this by supplying c= rafted values to vulnerable command paths, causing Snowflake CLI to execute=
unintended SQL in the context of the user's Snowflake session. Successful = exploitation required crafted values to reach vulnerable parameters, includ= ing through socially engineered input, malicious repository configuration, =
or compromised automation feeding external values into the CLI, and impact =
is limited by the privileges assigned to the active session. The fix is ava= ilable in Snowflake CLI version 3.19, and users must manually upgrade. 2026= -06-29 6 CVE-2026-13752 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13752=
] Snowflake--Snowflake CLI Insertion of sensitive information into log fil=
es in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to=
be written to persistent local debug logs. An attacker could exploit this =
by obtaining read access to the affected user's local log files, causing cr= edentials such as passwords, tokens, or private key material to be exposed = without additional application-level safeguards. Successful exploitation re= quires credentials to be present in the affected connection context and the=
resulting logs to be accessible from the local environment. The fix is ava= ilable in Snowflake CLI version 3.19, and users must manually upgrade. 2026= -06-29 5.5 CVE-2026-13750 [ https://www.cve.org/CVERecord?id=3DCVE-2026-137=
50 ] Snowflake--Snowflake CLI Improper handling of untrusted remote referen= ces in Snowflake CLI versions prior to 3.19 allowed server-side request for= gery. The SQL statement reader's !source/!load directives could reference r= emote URLs that were retrieved at runtime without sufficient restriction on=
the request destination. By supplying crafted SQL content processed throug=
h a vulnerable command path, an attacker could cause the victim's environme=
nt to issue unintended outbound requests to internal or otherwise non-publi=
c network locations, and could cause remote SQL content to be retrieved and=
executed in the context of the victim user's session. Successful exploitat= ion requires the victim to process attacker-controlled content through a vu= lnerable command path and is limited by the privileges available to that se= ssion and environment. The fix is available in Snowflake CLI version 3.19, = which adds an option to disable remote URL retrieval. 2026-06-29 4.1 CVE-20= 26-13751 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13751 ] Softaculous-= -FormLayer Insertion of Sensitive Information Into Sent Data vulnerability =
in Softaculous FormLayer allows Retrieve Embedded Sensitive Data. This issu=
e affects FormLayer: from n/a through 1.0.6. 2026-07-05 5.3 CVE-2026-59519 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-59519 ] SolarWinds--Database = Performance Analyzer SolarWinds Database Performance Analyzer was found to =
be affected by a stored cross-site scripting vulnerability, which when expl= oited, can lead to unintended script execution. 2026-06-30 5.6 CVE-2026-283=
22 [ https://www.cve.org/CVERecord?id=3DCVE-2026-28322 ] SourceCodester--CE=
T Automated Grading System with AI Predictive Analytics A vulnerability was=
detected in SourceCodester CET Automated Grading System with AI Predictive=
Analytics 1.0. This issue affects some unknown processing. The manipulatio=
n results in session fixiation. The attack can be executed remotely. The at= tack requires a high level of complexity. The exploitability is assessed as=
difficult. The exploit is now public and may be used. 2026-07-03 5.6 CVE-2= 026-14609 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14609 ] SourceCodes= ter--CET Automated Grading System with AI Predictive Analytics A security v= ulnerability has been detected in SourceCodester CET Automated Grading Syst=
em with AI Predictive Analytics 1.0. This vulnerability affects unknown cod=
e of the file /index.php?action=3Dview_student of the component POST Handle=
r. The manipulation of the argument ID leads to authorization bypass. Remot=
e exploitation of the attack is possible. The exploit has been disclosed pu= blicly and may be used. 2026-07-03 4.3 CVE-2026-14608 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-14608 ] SourceCodester--Multi-Vendor Online Grocer=
y Management System A security vulnerability has been detected in SourceCod= ester Multi-Vendor Online Grocery Management System 1.0. This impacts the f= unction update_settings_info of the file classes/SystemSettings.php of the = component Setting Handler. Such manipulation of the argument content[] lead=
s to code injection. The attack can be executed remotely. The exploit has b= een disclosed publicly and may be used. 2026-07-05 6.3 CVE-2026-14691 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-14691 ] SourceCodester--Multi-Vend=
or Online Grocery Management System A vulnerability was detected in SourceC= odester Multi-Vendor Online Grocery Management System 1.0/5.7.26. Affected =
is the function save_shop_type of the file classes/Master.php of the compon= ent POST Parameter Handler. Performing a manipulation results in sql inject= ion. The attack is possible to be carried out remotely. The exploit is now = public and may be used. 2026-07-05 6.3 CVE-2026-14692 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-14692 ] SourceCodester--Multi-Vendor Online Grocer=
y Management System A vulnerability has been found in SourceCodester Multi-= Vendor Online Grocery Management System 1.0. Affected by this issue is the = function cancel_order of the file classes/Master.php of the component POST = Parameter Handler. The manipulation of the argument ID leads to sql injecti= on. It is possible to initiate the attack remotely. The exploit has been di= sclosed to the public and may be used. 2026-07-05 6.3 CVE-2026-14694 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-14694 ] SourceCodester--Multi-Vendo=
r Online Grocery Management System A flaw has been found in SourceCodester = Multi-Vendor Online Grocery Management System 1.0. Affected by this vulnera= bility is the function cancel_order of the file classes/Master.php. Executi=
ng a manipulation can lead to improper authorization. The attack may be per= formed from remote. The exploit has been published and may be used. 2026-07= -05 5.4 CVE-2026-14693 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14693 =
] SourceCodester--Online Boat Reservation System A vulnerability was identi= fied in SourceCodester Online Boat Reservation System 1.0. Affected by this=
vulnerability is an unknown functionality. Such manipulation leads to sess= ion expiration. It is possible to launch the attack remotely. The exploit i=
s publicly available and might be used. 2026-07-05 6.3 CVE-2026-14725 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-14725 ] SourceCodester--Onlne Exam= ination & Learning Management System A vulnerability was identified in Sour= ceCodester Onlne Examination & Learning Management System 1.0. Affected is =
an unknown function of the file /process_lesson.php. Such manipulation of t=
he argument user_id leads to unrestricted upload. The attack may be launche=
d remotely. The exploit is publicly available and might be used. The name o=
f the affected product appears to have a typo in it. 2026-07-05 6.3 CVE-202= 6-14775 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14775 ] SourceCodeste= r--Onlne Examination & Learning Management System A security flaw has been = discovered in SourceCodester Onlne Examination & Learning Management System=
1.0. Affected by this vulnerability is the function pathinfo of the file /= upload_files.php of the component Filename Extension. Performing a manipula= tion results in unrestricted upload. Remote exploitation of the attack is p= ossible. The exploit has been released to the public and may be used for at= tacks. The name of the affected product appears to have a typo in it. 2026-= 07-05 6.3 CVE-2026-14776 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1477=
6 ] SourceCodester--Onlne Examination & Learning Management System A weakne=
ss has been identified in SourceCodester Onlne Examination & Learning Manag= ement System 1.0. Affected by this issue is some unknown functionality of t=
he file /announcements.php. Executing a manipulation can lead to unrestrict=
ed upload. The attack can be executed remotely. The exploit has been made a= vailable to the public and could be used for attacks. The name of the affec= ted product appears to have a typo in it. 2026-07-05 6.3 CVE-2026-14777 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-14777 ] SourceCodester--Simple F= ood Ordering System A flaw has been found in SourceCodester Simple Food Ord= ering System 1.0. The affected element is an unknown function of the file /= cart.php. Executing a manipulation of the argument item_price can lead to b= usiness logic errors. The attack may be performed from remote. The exploit = has been published and may be used. 2026-06-29 5.3 CVE-2026-13571 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-13571 ] SourceCodester--Syllabus-Align=
ed Learning Management and Examination System A security flaw has been disc= overed in SourceCodester Syllabus-Aligned Learning Management and Examinati=
on System 1.0. Impacted is an unknown function of the file upload_files.php=
. Performing a manipulation results in unrestricted upload. The attack may =
be initiated remotely. The exploit has been released to the public and may =
be used for attacks. 2026-07-05 6.3 CVE-2026-14698 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-14698 ] spacetime--Ad Inserter Ad Manager & AdSense A=
ds The Ad Inserter - Ad Manager & AdSense Ads plugin for WordPress is vulne= rable to Insecure Direct Object Reference in versions up to and including 2= .8.16 via the 'data' attribute of the [adinserter] shortcode. This is due t=
o the replace_ai_tags() function processing a {reusable-block-N} tag patter=
n that calls get_post_field('post_content', N) without verifying the reques= ting user's capability with current_user_can('read_post'), without restrict= ing the post type to 'wp_block', and without checking the post status. This=
makes it possible for authenticated attackers, with Contributor-level acce=
ss and above, to read the full content of arbitrary posts including Private=
, Draft, Pending, Trashed, and password-protected posts owned by other user=
s, by placing the shortcode in a post they own and previewing it. 2026-07-0=
3 4.3 CVE-2026-11900 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11900 ] = stellarwp--GiveWP Donation Plugin and Fundraising Platform The GiveWP - Don= ation Plugin and Fundraising Platform plugin for WordPress is vulnerable to=
Stored Cross-Site Scripting via the 'block_id' (and other) shortcode attri= butes of the 'givewp_campaign_comments' shortcode in versions up to, and in= cluding, 4.16.0. This is due to insufficient input sanitization and output = escaping on user supplied attributes in CampaignCommentsShortcode::parseAtt= ributes() and BlockRenderController::render(), where the blockId value is i= nterpolated directly into a single-quoted HTML attribute without esc_attr()=
. This makes it possible for authenticated attackers, with author-level acc= ess and above, to inject arbitrary web scripts in pages that will execute w= henever a user accesses an injected page. 2026-07-01 6.4 CVE-2026-13246 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-13246 ] stellarwp--GiveWP Donati=
on Plugin and Fundraising Platform The GiveWP - Donation Plugin and Fundrai= sing Platform plugin for WordPress is vulnerable to Stored Cross-Site Scrip= ting via the 'sequoia[introduction][image]' parameter in all versions up to=
, and including, 4.16.1 due to insufficient input sanitization and output e= scaping. This makes it possible for authenticated attackers, with Give Work= er-level access and above, to inject arbitrary web scripts in pages that wi=
ll execute whenever a user accesses an injected page. 2026-07-02 6.4 CVE-20= 26-13704 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13704 ] stellarwp--G= iveWP Donation Plugin and Fundraising Platform The GiveWP plugin for WordPr= ess is vulnerable to Cross-Site Request Forgery in versions up to, and incl= uding, 4.15.3 This is due to missing nonce validation on the give_set_notif= ication_status_handler() function. This makes it possible for unauthenticat=
ed attackers to disable donation email notifications via a forged request g= ranted they can trick a site administrator into performing an action such a=
s clicking on a link. 2026-07-01 4.3 CVE-2026-11981 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-11981 ] stellarwp--Kadence Blocks Page Builder Toolk=
it for Gutenberg Editor The Kadence Blocks - Page Builder Toolkit for Guten= berg Editor plugin for WordPress is vulnerable to authorization bypass in a=
ll versions up to, and including, 3.7.7. This is due to the plugin not prop= erly verifying that a user is authorized to perform an action. This makes i=
t possible for authenticated attackers, with contributor-level access and a= bove, to create arbitrary Media Library attachments by downloading remote i= mages to the site's uploads directory via wp_upload_bits() and wp_insert_at= tachment(), bypassing the upload_files capability boundary. 2026-07-01 4.3 = CVE-2026-12902 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12902 ] stella= rwp--Kadence Blocks Page Builder Toolkit for Gutenberg Editor The Kadence B= locks - Gutenberg Blocks for Page Builder Features plugin for WordPress is = vulnerable to Insecure Direct Object Reference in versions up to and includ= ing 3.7.7. This is due to a mismatch between the object used for authorizat= ion and the object actually accessed in the Optimize_Rest_Controller's crea= te_item(), get_item(), delete_item(), and bulk_delete_items() endpoints - a= uthorization is checked via current_user_can('edit_post'/'delete_post', $po= st_id) against the user-supplied post_id, while the storage layer keys anal= ysis records on sha256($post_path) from a separately supplied, attacker-con= trolled post_path parameter, with no enforcement that post_path corresponds=
to post_id. This makes it possible for authenticated attackers, with Contr= ibutor-level access and above, to read or delete optimizer analysis records=
belonging to posts owned by other users by submitting their own post_id (w= hich passes the capability check) together with the victim post's path. 202= 6-07-01 4.3 CVE-2026-12904 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12= 904 ] stephen-kruger--bluebox A vulnerability was found in stephen-kruger b= luebox up to 4.5.12. Affected by this vulnerability is an unknown functiona= lity. Performing a manipulation of the argument code results in cross site = scripting. It is possible to initiate the attack remotely. The exploit has = been made public and could be used. The project was informed of the problem=
early through an issue report. 2026-07-05 4.3 CVE-2026-14704 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-14704 ] stephenharris--Event Organiser The=
Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Sc= ripting in all versions up to, and including, 3.12.9. This is due to the 'e= o_events' shortcode accepting attacker-controlled 'no_events' content and r= endering it in event list templates without output escaping. This makes it = possible for authenticated attackers, with Contributor-level access and abo= ve, to inject arbitrary web scripts in pages that will execute whenever a u= ser accesses an injected page. 2026-07-01 6.4 CVE-2026-2387 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-2387 ] StoneFly--Storage Concentrator Storag=
e Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting = due to unsanitized content being echoed back in 404 error pages. An attacke=
r can craft a malicious URL that, when visited by an authenticated user, ca= uses arbitrary script content to execute within the victim's browser sessio=
n in the context of the application. This could be leveraged to steal sessi=
on cookies, redirect users, or perform unauthorized actions on behalf of th=
e victim. 2026-06-30 6.1 CVE-2026-50040 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-50040 ] Stormshield--Stormshield Network Security A vulnerabili=
ty was discovered on Stormshield Network Security 4.3.0=C2=A0 to 4.3.41 (in= cluded), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included) A revoke=
d client certificate can still be used to authenticate to the captive-admin=
portal, allowing an attacker who possesses the revoked certificate to gain=
administrative access. 2026-07-01 4.3 CVE-2026-8480 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-8480 ] Stormshield--Stormshield Network Security A = vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.4=
1 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (included) There =
is a possible leak of secret information if administration commands have be=
en passed with the CLI command line tool. Someone with SSH access to the fi= rewall (if SSH multiuser mode is enabled) could possibly get the proxy CA p= assphrase or TPM password. 2026-07-02 4.3 CVE-2026-8482 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-8482 ] strapi--strapi Strapi users-permissions p= lugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.a= lgorithm is not explicitly configured, allowing acceptance of HS384 and HS5=
12 tokens alongside HS256. Attackers possessing the jwtSecret can mint toke=
ns with non-standard HMAC variants to bypass algorithm restrictions and wea= ken authentication controls. 2026-06-29 4.8 CVE-2026-57997 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-57997 ] Strategy11 Team--Business Directory U= nauthenticated Cross Site Scripting (XSS) in Business Directory <=3D 6.4.22=
versions. 2026-06-29 6.5 CVE-2026-57326 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-57326 ] Strategy11 Team--Business Directory Subscriber Cross Si=
te Scripting (XSS) in Business Directory <=3D 6.4.22 versions. 2026-06-29 6=
.5 CVE-2026-57328 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57328 ] Str= ategy11 Team--Business Directory Unauthenticated Broken Access Control in B= usiness Directory <=3D 6.4.23 versions. 2026-06-29 6.6 CVE-2026-57339 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-57339 ] Stylemix--MasterStudy LMS = Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <=3D 3.7.27 versio= ns. 2026-06-29 6.5 CVE-2026-57330 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-57330 ] stylemix--Motors Car Dealership & Classified Listings Plugin T=
he Motors - Car Dealership & Classified Listings Plugin plugin for WordPres=
s is vulnerable to authorization bypass in all versions up to, and includin=
g, 1.4.111. This is due to the plugin not properly verifying that a user is=
authorized to perform an action. This makes it possible for authenticated = attackers, with subscriber-level access and above, to mark or unmark any ot= her user's car listing as sold by replaying a valid nonce harvested from th= eir own listing against an arbitrary victim post ID, triggering a site-wide=
'Sold' badge on the victim's listing and silently stripping its special_ca=
r featured post meta as a side effect. Exploitation requires the attacker t=
o hold an active listing of their own (obtainable by a Subscriber via the p= lugin's add-listing form) in order to harvest a valid nonce for the 'stm_ma= rk_as_sold_car' action, which can then be replayed against any other listin= g's post ID. 2026-07-01 4.3 CVE-2026-12435 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-12435 ] StylemixThemes--Motors Unauthenticated Broken Access = Control in Motors <=3D 5.6.80 versions. 2026-07-02 6.5 CVE-2026-27433 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-27433 ] Surbma--Surbma | Yoast SEO=
Breadcrumb Shortcode Contributor Cross Site Scripting (XSS) in Surbma | Yo= ast SEO Breadcrumb Shortcode <=3D 1.2 versions. 2026-07-02 6.5 CVE-2026-577=
64 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57764 ] taiga--taiga-back = Taiga before 6.10.2 contains a missing authorization vulnerability that all= ows unauthenticated remote attackers to create default due-date records in = any project by exploiting unprotected POST endpoints on the user-story, tas=
k, and issue due-date API viewsets. Attackers can supply an arbitrary proje=
ct identifier to these endpoints, which bypass permission checks and apply = the AllowAny default, to pre-empt project administrators from initializing = due dates by creating records before they can do so themselves. 2026-07-02 = 5.3 CVE-2026-59097 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59097 ] ta= skbuilder--Taskbuilder Project Management & Task Management Tool With Kanba=
n Board The Taskbuilder - Project Management & Task Management Tool With Ka= nban Board plugin for WordPress is vulnerable to generic SQL Injection via = the 'wppm_proj_filter' parameter in all versions up to, and including, 5.0.=
8 due to insufficient escaping on the user supplied parameter and lack of s= ufficient preparation on the existing SQL query. This makes it possible for=
authenticated attackers, with subscriber-level access and above, to append=
additional SQL queries into already existing queries that can be used to e= xtract sensitive information from the database. No nonce verification is pe= rformed on the wp_ajax_wppm_view_project_tasks handler, meaning any authent= icated session - including subscriber-level - can reach the vulnerable code=
path without any additional preconditions. 2026-07-01 6.5 CVE-2026-12090 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-12090 ] taskbuilder--Taskbuild=
er Project Management & Task Management Tool With Kanban Board The Taskbuil= der - Project Management & Task Management Tool With Kanban Board plugin fo=
r WordPress is vulnerable to generic SQL Injection via the 'task_search' pa= rameter in all versions up to, and including, 5.0.8 due to insufficient esc= aping on the user supplied parameter and lack of sufficient preparation on = the existing SQL query. This makes it possible for authenticated attackers,=
with subscriber-level access and above, to append additional SQL queries i= nto already existing queries that can be used to extract sensitive informat= ion from the database. The wppm_get_task_list AJAX handler performs no capa= bility check and no nonce verification, meaning any authenticated user incl= uding those with Subscriber-level access can invoke it directly. 2026-07-01=
6.5 CVE-2026-12110 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12110 ] t= eableio--teable Teable before 2026-06-15T04-43-24Z.1912 contains an imprope=
r access control vulnerability that allows anonymous attackers to access hi= dden field data by supplying arbitrary field IDs in the projection paramete=
r of the share view records endpoint. Attackers can enumerate hidden field = IDs from share metadata and specify them in projection parameters to read f= ield values that are intended to be restricted from public view. 2026-06-29=
5.3 CVE-2026-56781 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56781 ] t= hemegrill--Zakra The Zakra theme for WordPress is vulnerable to Stored Cros= s-Site Scripting via post meta values in all versions up to, and including,=
4.2.0. This is due to the theme registering three post meta fields (zakra_= menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_co= lor) with 'show_in_rest' =3D> true and 'auth_callback' =3D> '__return_true'=
, but without any sanitize_callback parameter in the register_post_meta() c= alls. While the classic editor save path applies sanitize_hex_color() sanit= ization, the REST API path completely bypasses this protection. The unsanit= ized meta values are then retrieved via get_post_meta() and concatenated di= rectly into CSS strings that are output through wp_add_inline_style() witho=
ut any escaping. This makes it possible for authenticated attackers, with C= ontributor-level access and above, to inject arbitrary web scripts in pages=
that will execute whenever a user accesses the injected page. 2026-07-03 6=
.4 CVE-2026-4804 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4804 ] theme= isle--RSS Aggregator by Feedzy Feed to Post, Autoblogging, News & YouTube V= ideo Feeds Aggregator The RSS Aggregator by Feedzy - Feed to Post, Autoblog= ging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnera= ble to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versi= ons up to, and including, 5.2.1 due to insufficient input sanitization and = output escaping. This makes it possible for authenticated attackers, with c= ontributor-level access and above, to inject arbitrary web scripts in pages=
that will execute whenever a user accesses an injected page. 2026-07-02 6.=
4 CVE-2026-13252 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13252 ] Them= eREX--Booked Unauthenticated Cross Site Request Forgery (CSRF) in Booked <=
=3D 3.0.0 versions. 2026-07-02 6.5 CVE-2026-57747 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-57747 ] Themeum--Kirki Unauthenticated Insecure Direct=
Object References (IDOR) in Kirki <=3D 6.0.11 versions. 2026-07-02 6.5 CVE= -2026-57680 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57680 ] themeum--= Kirki Freeform Page Builder, Website Builder & Customizer The Kirki - Freef= orm Page Builder, Website Builder & Customizer plugin for WordPress is vuln= erable to Sensitive Information Exposure in all versions up to, and includi= ng, 6.0.11 via the get_single_symbol. This makes it possible for unauthenti= cated attackers to extract the full builder metadata and rendered HTML of a=
ny kirki_symbol post - including unpublished drafts - by supplying a sequen= tial WordPress post ID. 2026-07-02 5.3 CVE-2026-12122 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-12122 ] themeum--Kirki Freeform Page Builder, Webs= ite Builder & Customizer The Kirki - Freeform Page Builder, Website Builder=
& Customizer plugin for WordPress is vulnerable to authorization bypass in=
all versions up to, and including, 6.0.11. This is due to the plugin not p= roperly verifying that a user is authorized to perform an action. This make=
s it possible for unauthenticated attackers to send arbitrary HTML-injected=
emails - including phishing messages embedding a real, valid WordPress pas= sword-reset URL for the targeted user - to any registered user via the site=
's own mail server, abusing its SPF/DKIM reputation. The attacker-controlle=
d emailSubject parameter is passed to wp_mail() with only sanitize_text_fie= ld() applied, while emailBody 'text' items are concatenated raw into the HT=
ML email body with no escaping, and 'chip' items can include the genuine Wo= rdPress password-reset link for the targeted account. 2026-07-02 5.3 CVE-20= 26-12472 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12472 ] themeum--Tut=
or LMS eLearning and online course solution The Tutor LMS - eLearning and o= nline course solution plugin for WordPress is vulnerable to Stored Cross-Si=
te Scripting via Lesson Attachment Title in all versions up to, and includi= ng, 3.9.13 due to insufficient input sanitization and output escaping. This=
makes it possible for authenticated attackers, with author-level access an=
d above, to inject arbitrary web scripts in pages that will execute wheneve=
r a user accesses an injected page. 2026-07-01 6.4 CVE-2026-13443 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-13443 ] thimpress--LearnPress WordPres=
s LMS Plugin for Create and Sell Online Courses The LearnPress - WordPress = LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulne= rable to Insecure Direct Object Reference in all versions up to, and includ= ing, 4.3.9.1 via the 'userId' parameter due to missing validation on a user=
controlled key. This makes it possible for authenticated attackers, with s= ubscriber-level access and above, to view the course enrollment progress an=
d completion data belonging to any instructor or administrator account on t=
he site. This IDOR does not apply when the target user is a regular subscri= ber, as the guard correctly blocks cross-subscriber access; exploitation is=
limited to cases where the victim user holds the LP_TEACHER_ROLE or admini= strator role. 2026-07-01 6.5 CVE-2026-11988 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-11988 ] thimpress--LearnPress WordPress LMS Plugin for Creat=
e and Sell Online Courses The LearnPress plugin for WordPress is vulnerable=
to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attr= ibute in versions up to, and including, 4.4.0. This is due to insufficient = input sanitization and output escaping in the FilterCourseTemplate::section= s() method at line 98, where the attacker-controlled attribute is inserted = into an HTML class attribute via sprintf('<form class=3D"%s">', $class_wrap= per_form) without esc_attr() escaping. The FilterCourseShortcode::render() = handler does not apply shortcode_atts() filtering, so raw user attributes f= low directly through do_action('learn-press/filter-courses/layout', $data) = into the template. This makes it possible for authenticated attackers, with=
contributor-level access and above, to inject arbitrary web scripts in pag=
es that will execute whenever a user accesses an injected page. 2026-07-01 = 6.4 CVE-2026-12732 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12732 ] Ti=
m Strifler--Exclusive Addons Elementor Insertion of Sensitive Information I= nto Sent Data vulnerability in Tim Strifler Exclusive Addons Elementor allo=
ws Retrieve Embedded Sensitive Data. This issue affects Exclusive Addons El= ementor: from n/a through 2.7.9.9. 2026-07-05 5.3 CVE-2026-59511 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-59511 ] TR7 Cyber Defense Inc.--WAF-ASP=
Improper neutralization of input during web page generation ('cross-site s= cripting') vulnerability in TR7 Cyber-Defense Inc. WAF-ASP allows Stored XS=
S. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117. 2026-07= -02 5.4 CVE-2026-4772 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4772 ] = TR7 Cyber Defense Inc.--WAF-ASP Improper neutralization of input during web=
page generation ('cross-site scripting') vulnerability in TR7 Cyber-Defens=
e Inc. Web Application Firewall allows DOM-Based XSS. This issue affects We=
b Application Firewall: from v1.0.42.239 before v1.4.0.117. 2026-07-02 4.6 = CVE-2026-4770 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4770 ] training= businesspros--Groundhogg CRM, Newsletters, and Marketing Automation The Gro= undhogg - CRM, Newsletters, and Marketing Automation plugin for WordPress i=
s vulnerable to generic SQL Injection via the 'select' parameter in all ver= sions up to, and including, 4.5.8 due to insufficient escaping on the user = supplied parameter and lack of sufficient preparation on the existing SQL q= uery. This makes it possible for authenticated attackers, with custom-level=
access and above, to append additional SQL queries into already existing q= ueries that can be used to extract sensitive information from the database.=
Exploitation requires the attacker to hold a Groundhogg custom role with t=
he view_contacts capability, which is granted by default to several built-i=
n Groundhogg roles above the base subscriber level. 2026-07-02 6.5 CVE-2026= -14029 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14029 ] tranmautritam-= -TheFox Contributor Cross Site Scripting (XSS) in TheFox <=3D 3.9.70 versio= ns. 2026-07-02 6.5 CVE-2026-57684 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-57684 ] ultimatemember--Ultimate Member User Profile, Registration, Lo= gin, Member Directory, Content Restriction & Membership Plugin The Ultimate=
Member - User Profile, Registration, Login, Member Directory, Content Rest= riction & Membership Plugin plugin for WordPress is vulnerable to Stored Cr= oss-Site Scripting via the 'about_me' parameter in all versions up to, and = including, 2.11.4 due to insufficient input sanitization and output escapin=
g. This makes it possible for authenticated attackers, with subscriber-leve=
l access and above, to inject arbitrary web scripts in pages that will exec= ute whenever a user accesses an injected page. 2026-07-03 6.4 CVE-2026-8489=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-8489 ] uvnc--UltraVNC UltraV=
NC repeater through 1.8.2.2 contains an integer overflow in the HTTP reques=
t logging path. In repeater/webgui/settings.c:336, the win_log() function a= llocates list nodes via malloc(sizeof(struct LIST) + strlen(line)), where l= ine is derived from HTTP request URIs. If strlen(line) is sufficiently larg=
e, the addition overflows to a value smaller than sizeof(struct LIST), caus= ing a heap allocation smaller than required. The subsequent strcpy of the f= ull string into the undersized allocation produces a heap buffer overflow. =
In the current implementation this overflow is bounded by the HTTP receive = buffer size (WI_RXBUFSIZE =3D 153600 bytes, well below SIZE_MAX on 32-bit b= uilds), limiting practical exploitability to a partial heap write. A remote=
unauthenticated attacker can trigger the theoretical overflow path by send= ing a maximally-sized URI in an HTTP request to the repeater HTTP port. 202= 6-07-01 5.3 CVE-2026-7828 [ https://www.cve.org/CVERecord?id=3DCVE-2026-782=
8 ] uvnc--UltraVNC UltraVNC through 1.8.2.2 uses a cryptographically weak p= seudo-random number generator to produce VNC authentication challenge bytes=
. In rfb/vncauth.c:119-129, the vncRandomBytes() function seeds libc rand()=
with time(0) + getpid() + rand() and generates a 16-byte challenge. The co= mbined seed space is approximately 31 bits (libc rand() internal state) and=
is entirely determined by publicly-observable values (wall-clock time and = process ID). An attacker who can observe the authentication exchange can en= umerate the seed space and predict the challenge within seconds, enabling f= orgery or offline brute-forcing of responses. Note: on Windows, the active = code path may use vncEncryptBytes2.cpp which calls CryptGenRandom; reachabi= lity on shipped Windows binaries requires compile-graph verification and is=
under investigation. 2026-07-01 4.8 CVE-2026-44040 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-44040 ] uvnc--UltraVNC UltraVNC through 1.8.2.2 cont= ains an out-of-bounds read in the wide-string to multibyte conversion helpe=
r. In rfb/dh.cpp:204, the vncWc2Mb() function passes a caller-supplied WCHA=
R pointer to wcslen() before any bounds check. If the caller provides a wid= e-character buffer that is not properly NUL-terminated, wcslen() reads past=
the end of the buffer until it encounters a NUL wchar, resulting in an out= -of-bounds read. Under typical Win32 API usage this requires an abnormal ca= ller contract. Impact is limited to a potential information disclosure from=
adjacent memory regions or a process crash (denial of service) if the over= -read crosses a page boundary. 2026-07-01 4.3 CVE-2026-44041 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-44041 ] UX-themes--Flatsome Contributor Bro= ken Access Control in Flatsome <=3D 3.20.5 versions. 2026-07-02 6.5 CVE-202= 6-57731 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57731 ] UX-themes--Fl= atsome Subscriber Broken Access Control in Flatsome <=3D 3.20.5 versions. 2= 026-07-02 4.3 CVE-2026-57730 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 57730 ] VillaTheme--ALD Dropshipping and Fulfillment for AliExpress and Woo= Commerce Unauthenticated Broken Authentication in ALD - Dropshipping and Fu= lfillment for AliExpress and WooCommerce <=3D 2.2.0 versions. 2026-07-02 4.=
8 CVE-2026-57352 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57352 ] vill= atheme--CURCY Multi Currency for WooCommerce Smoothly on WooCommerce 9.x Th=
e The CURCY - Multi Currency for WooCommerce - Smoothly on WooCommerce 9.x = plugin for WordPress is vulnerable to arbitrary shortcode execution in all = versions up to, and including, 2.2.14. This is due to the software allowing=
users to execute an action that does not properly validate a value before = running do_shortcode. This makes it possible for unauthenticated attackers =
to execute arbitrary shortcodes. 2026-07-03 5.4 CVE-2026-11778 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-11778 ] vjinfotech--WP Import Export Lite=
The WP Import Export Lite plugin for WordPress is vulnerable to Server-Sid=
e Request Forgery in all versions up to and including 3.9.30 via the wpie_i= mport_upload_file_from_url AJAX action. The plugin's URL downloader first c= alls wp_safe_remote_get() (which correctly blocks private/reserved IP range= s), but when that call returns a WP_Error - the exact outcome for any block=
ed internal host - the Download::download_file() method falls back to Guzzl= eHttp\Client::request() with the original attacker-supplied URL and no SSRF=
protection (and with TLS verification disabled). This makes it possible fo=
r authenticated attackers, with administrator-level access and above, to ma=
ke web requests to arbitrary locations originating from the web application=
and can be used to query and modify information from internal services suc=
h as the cloud metadata endpoint at 169. 2026-07-03 5.5 CVE-2026-11397 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-11397 ] Vsourz Digital--Advanced = Contact form 7 DB Subscriber Broken Access Control in Advanced Contact form=
7 DB <=3D 2.0.9 versions. 2026-07-02 6.5 CVE-2026-57669 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-57669 ] w1.fi--hostapd In hostapd before 2.12, =
a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operat= ion (MLO) association request processing allows an unauthenticated attacker=
within wireless range to send a crafted management frame containing a malf= ormed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_= ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can b=
e parsed as value 15, but the corresponding links[] storage only has valid = entries for lower link IDs (0 through 14). This causes an out-of-bounds wri=
te / small memory corruption during association processing before the 4-way=
handshake. The attack does not require network credentials, prior authenti= cation, or user interaction. The confirmed practical impact is denial of se= rvice through hostapd process termination. This affects hostapd v2.11 and n= ewer development snapshots before v2.12 when built with CONFIG_IEEE80211BE = enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.=
2026-06-30 6.5 CVE-2026-58374 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-58374 ] wagtail--wagtail Wagtail is an open source content management sys= tem built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a = missing permission check on the image preview endpoint, a user with access =
to the Wagtail admin can preview any image. The existing data of the image = object itself is not exposed. The vulnerability is not exploitable by an or= dinary site visitor without access to the Wagtail admin. This issue has bee=
n fixed in versions 7.0.8, 7.3.3, and 7.4.2. 2026-07-01 6.5 CVE-2026-54261 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-54261 ] wagtail--wagtail Wagt= ail is an open source content management system built on Django. In version=
s prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser's chose=
n endpoint incorrectly listed items for which the user has not been granted=
choose permission. A user with access to the Wagtail admin could see the f= ilename and name and URLs of documents and images in those collections. The=
vulnerability is not exploitable by an ordinary site visitor without acces=
s to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3,=
and 7.4.2. 2026-07-01 4.3 CVE-2026-54259 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-54259 ] wagtail--wagtail Wagtail is an open source content man= agement system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2=
, an authenticated admin user can trigger expensive rendition processing wi=
th purposefully crafted filter specs resulting in potentially service degra= dation. The vulnerability is not exploitable by an ordinary site visitor wi= thout access to the Wagtail admin. This issue has been fixed in versions 7.= 0.8, 7.3.3, and 7.4.2. 2026-07-01 4.3 CVE-2026-54260 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-54260 ] wagtail--wagtail Wagtail is an open source = content management system built on Django. In versions prior to 7.0.8, 7.3.=
3 and 7.4.2, a low-level user with the "Can submit translation" permission = can create translations for any page, including those they do not have perm= issions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.=
2026-07-01 4.3 CVE-2026-54262 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-54262 ] wappointment--Appointment Bookings for Zoom GoogleMeet and more W= appointment The Appointment Bookings for Zoom GoogleMeet and more - Wappoin= tment plugin for WordPress is vulnerable to Insecure Direct Object Referenc=
e in all versions up to and including 2.7.6 via the `appointmentkey` parame= ter due to the appointment `edit_key` - the sole authorization token consum=
ed by `tryCancel()` - being generated as a predictable, unsalted MD5 hash o=
f only `client_id` (a sequential integer), `start_at` (a publicly observabl=
e appointment timestamp), and `staff_id` (a small enumerable integer), with=
no secret salt or random component, and the unauthenticated cancellation a=
nd rescheduling REST endpoints performing no ownership or identity verifica= tion beyond matching this reconstructible key. This makes it possible for u= nauthenticated attackers to compute valid `edit_key` values for appointment=
s belonging to other users and cancel or reschedule those appointments arbi= trarily. Exploitation requires the `allow_cancellation` or `allow_reschedul= ing` setting to be enabled on the site, both of which are common configurat= ions for active booking deployments; an attacker can obtain the inputs need=
ed to reconstruct a victim's key by booking their own appointment to observ=
e their sequential `client_id` and correlating publicly visible appointment=
times and enumerable staff identifiers. 2026-07-02 5.3 CVE-2026-9188 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-9188 ] Wavlink--WL-NU516U1-A A vul= nerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. The affect=
ed element is the function sub_401D68 of the file /cgi-bin/wireless.cgi of = the component POST Parameter Handler. This manipulation of the argument SSI= D2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote exploita= tion of the attack is possible. The exploit has been publicly disclosed and=
may be utilized. The affected component should be upgraded. The vendor was=
contacted early, responded in a very professional manner and quickly relea= sed a fixed version of the affected product. 2026-06-29 6.3 CVE-2026-13538 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-13538 ] Webba Plugins--Webba = Booking Missing Authorization vulnerability in Webba Plugins Webba Booking = allows Exploiting Incorrectly Configured Access Control Security Levels. Th=
is issue affects Webba Booking: from n/a through 6.4.13. 2026-07-01 5.3 CVE= -2026-27409 [ https://www.cve.org/CVERecord?id=3DCVE-2026-27409 ] webpack-d= ev-server--webpack-dev-server webpack-dev-server versions 5.2.5 and earlier=
terminate the whole Node.js process when an unauthenticated peer sends eit= her a normal HTTP request with a malformed Host header or a WebSocket upgra=
de to the default /ws endpoint with a malformed Origin header. The malforme=
d value causes an uncaught exception in the host-validation path and crashe=
s the dev server. Impact is limited to availability of the development serv= er, no data disclosure, no code execution. Patches: upgrade to webpack-dev-= server 5.2.6. Workarounds: keep the dev server bound to localhost (the defa= ult) and do not expose it to untrusted networks. 2026-07-03 5.3 CVE-2026-14= 631 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14631 ] webpack-dev-serve= r--webpack-dev-server webpack-dev-server versions 5.2.5 and earlier expose = two internal developer endpoints, /webpack-dev-server/open-editor and /webp= ack-dev-server/invalidate, that perform state-changing actions on any GET r= equest without verifying that the request originated from the dev server's = own page. Any website a developer visits while the dev server is running ca=
n trigger these endpoints cross-origin with no interaction beyond the visit=
. An attacker can open an arbitrary existing local file in the developer's = editor, including files outside the project root, and repeated requests can=
spawn editor processes and force recompilations that degrade the developer=
's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none=
. 2026-07-03 4.7 CVE-2026-14620 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-14620 ] wedevs--weDocs: AI Powered Knowledge Base, Docs, Documentation, = Wiki & AI Chatbot The weDocs: AI Powered Knowledge Base, Docs, Documentatio=
n, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Sit=
e Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes in=
all versions up to, and including, 2.3.0 due to insufficient input sanitiz= ation and output escaping. This makes it possible for authenticated attacke= rs, with contributor-level access and above, to inject arbitrary web script=
s in pages that will execute whenever a user accesses an injected page. 202= 6-07-03 6.4 CVE-2026-12731 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12= 731 ] wedevs--weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki =
& AI Chatbot The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wi=
ki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scr= ipting via 'connectorWidth' Block Attribute in all versions up to, and incl= uding, 2.3.0 due to insufficient input sanitization and output escaping. Th=
is makes it possible for authenticated attackers, with contributor-level ac= cess and above, to inject arbitrary web scripts in pages that will execute = whenever a user accesses an injected page. 2026-07-03 6.4 CVE-2026-12734 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-12734 ] wedevs--weDocs: AI Powe= red Knowledge Base, Docs, Documentation, Wiki & AI Chatbot The weDocs: AI P= owered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for Wo= rdPress is vulnerable to Missing Authorization in versions up to and includ= ing 2.3.0. This is due to a missing capability check on the do_migration() = function registered as the wedocs_migrate_betterdocs_to_wedocs AJAX action,=
which performs no nonce verification via check_ajax_referer() and no capab= ility check via current_user_can() before executing sensitive operations. T= his makes it possible for authenticated attackers, with Subscriber-level ac= cess and above, to trigger a full BetterDocs-to-weDocs data migration, crea= ting and modifying 'docs' custom post type entries with attacker-controlled=
titles, updating site options, and deactivating the BetterDocs and BetterD= ocs Pro plugins via deactivate_plugins(). 2026-07-03 4.3 CVE-2026-12729 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-12729 ] weDevs--WP User Frontend=
Unauthenticated Broken Access Control in WP User Frontend <=3D 4.3.7 versi= ons. 2026-06-29 6.5 CVE-2026-57334 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-57334 ] weng-xianhu--EyouCMS A security vulnerability has been detect=
ed in weng-xianhu EyouCMS up to 1.7.1. This issue affects some unknown proc= essing of the file /index.php of the component API. Such manipulation of th=
e argument click_like leads to sql injection. The attack can be executed re= motely. The exploit has been disclosed publicly and may be used. The projec=
t was informed of the problem early through an issue report but has not res= ponded yet. 2026-06-29 4.7 CVE-2026-13569 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-13569 ] WofficeIO--Woffice Missing Authorization vulnerability=
in WofficeIO Woffice allows Exploiting Incorrectly Configured Access Contr=
ol Security Levels. This issue affects Woffice: from n/a before 5.4.33. 202= 6-07-01 5.3 CVE-2026-27435 [ https://www.cve.org/CVERecord?id=3DCVE-2026-27= 435 ] WOOCOMMERCE DESIGNER PRO--WooCommerce Designer Pro Subscriber Cross S= ite Scripting (XSS) in WooCommerce Designer Pro <=3D 1.9.34 versions. 2026-= 06-29 6.5 CVE-2026-57329 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5732=
9 ] woodpecker-ci--woodpecker Woodpecker before 3.15.0 registers the /api/o= rgs/lookup/*org_full_name endpoint without authentication middleware, and t=
he LookupOrg handler unconditionally dereferences the session user (user.Fo= rgeID, via ForgeFromUser) when selecting the forge to query. For an unauthe= nticated request session.User returns nil, so any unauthenticated HTTP requ= est triggers a NULL pointer dereference in the handler. The panic is recove= red by gin recovery middleware and the server continues serving (returning = HTTP 500), but each request writes a multi-line panic stack trace to the er= ror log. A low-bandwidth unauthenticated attacker can repeatedly probe the = endpoint to flood the logs (about 37 lines per request), inflating disk usa=
ge and downstream log-ingestion cost and burying legitimate log events. 202= 6-06-30 5.3 CVE-2026-58369 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58= 369 ] WP Reloaded--ApplyOnline Missing Authorization vulnerability in WP Re= loaded ApplyOnline allows Exploiting Incorrectly Configured Access Control = Security Levels. This issue affects ApplyOnline: from n/a through 2.6.7.6. = 2026-07-01 5.3 CVE-2026-57721 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -57721 ] wpchill--Kali Forms Contact Form & Drag-and-Drop Builder The Kali = Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress is vulner= able to Stored Cross-Site Scripting via the 'meta[kaliforms_field_component= s]' parameter in all versions up to, and including, 2.4.13 due to insuffici= ent input sanitization and output escaping. This makes it possible for auth= enticated attackers, with contributor-level access and above, to inject arb= itrary web scripts in pages that will execute whenever a user accesses an i= njected page. 2026-07-01 6.4 CVE-2026-9107 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-9107 ] wplegalpages--Cookie Banner for GDPR / CCPA WPLP Cooki=
e Consent The Cookie Banner for GDPR / CCPA - WPLP Cookie Consent plugin fo=
r WordPress is vulnerable to generic SQL Injection via the 's' parameter in=
all versions up to, and including, 4.3.5 due to insufficient escaping on t=
he user supplied parameter and lack of sufficient preparation on the existi=
ng SQL query. This makes it possible for authenticated attackers, with admi= nistrator-level access and above, to append additional SQL queries into alr= eady existing queries that can be used to extract sensitive information fro=
m the database. 2026-07-03 4.9 CVE-2026-12920 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-12920 ] wpmart--Team Members Multi Language Supported Team=
Plugin The Team Members - Multi Language Supported Team Plugin plugin for = WordPress is vulnerable to Stored Cross-Site Scripting via admin settings i=
n all versions up to, and including, 8.7 due to insufficient input sanitiza= tion and output escaping. This makes it possible for authenticated attacker=
s, with administrator-level permissions and above, to inject arbitrary web = scripts in pages that will execute whenever a user accesses an injected pag=
e. This only affects multi-site installations and installations where unfil= tered_html has been disabled. 2026-06-30 4.4 CVE-2026-12114 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-12114 ] wpqode--Editorial Rating Product Rev= iew & Rating System The Editorial Rating - Product Review & Rating System p= lugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Link = URL' Field in all versions up to, and including, 4.0.5 due to insufficient = input sanitization and output escaping. This makes it possible for authenti= cated attackers, with administrator-level access and above, to inject arbit= rary web scripts in pages that will execute whenever a user accesses an inj= ected page. The WordPress unfiltered_html capability exemption does not app=
ly here because the payload is stored in post meta (_wpas_er_options via up= date_post_meta) rather than in post_content or post_excerpt, meaning the re= striction affects all administrators regardless of their unfiltered_html st= atus. 2026-06-30 4.4 CVE-2026-12560 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-12560 ] WSO2--WSO2 API Manager The silent Just-In-Time (JIT) provisi= oning feature in federated authentication implementations fails to properly=
segregate user roles during account creation when a federated user shares =
a username with a local user. This allows the provisioning process to overw= rite existing roles of local users with roles assigned to the federated use=
r. Exploitation requires a federated identity provider (IDP) with silent JI=
T provisioning enabled and an attacker's knowledge of a local user's userna= me. When these conditions are met, a malicious individual can leverage the = JIT provisioning process to modify the roles of local users. The overwritte=
n roles are limited to those defined within the federated IDP, typically gr= anting minimal access rights unless explicitly configured otherwise by the = federated IDP administrator. 2026-07-04 4.8 CVE-2024-1248 [ https://www.cve= .org/CVERecord?id=3DCVE-2024-1248 ] yahoo--elide Elide through 7.1.17 fails=
to enforce @ReadPermission on client-supplied sort expressions in SortingI= mpl.getValidSortingRules, allowing attackers to sort collections by forbidd=
en fields. Attackers can infer hidden field values through row ordering ana= lysis, leaking relative field ordering across all rows via both JSON:API an=
d GraphQL read paths. 2026-06-29 4.3 CVE-2026-57954 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-57954 ] Yunai--ruoyi-vue-pro ruoyi-vue-pro through 2= 026.05, fixed in commit c779a47, contains a missing authorization vulnerabi= lity in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint t= hat allows authenticated users to read any follow-up record by iterating se= quential numeric IDs. Attackers can exploit this by sending requests with a= rbitrary ID parameters to access other users' follow-up notes, file attachm= ents, scheduling information, and business entity references without proper=
authorization checks. 2026-06-29 6.5 CVE-2026-57949 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-57949 ] YunaiV--yudao-cloud yudao-cloud before 2026= .06 contains a broken access control vulnerability in the BPM module that a= llows any authenticated user to access arbitrary process instance records b=
y supplying a caller-controlled process-instance identifier to an unprotect=
ed endpoint lacking the @PreAuthorize annotation. Attackers can query any p= rocess-instance identifier through the unguarded GET endpoint to read sensi= tive workflow data including submitted form variables, approver identities,=
approval and rejection comments, and process BPMN XML without ownership or=
tenant party verification. 2026-06-30 6.5 CVE-2026-58448 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-58448 ] YzmCMS--YzmCMS A vulnerability was det= ermined in YzmCMS up to 7.5. This affects an unknown function of the file /= application/install/index.php. Executing a manipulation of the argument sit= eurl can lead to sql injection. The attack can be executed remotely. A high=
complexity level is associated with this attack. The exploitability is rep= orted as difficult. The exploit has been publicly disclosed and may be util= ized. The vendor was contacted early about this disclosure but did not resp= ond in any way. 2026-06-29 5.6 CVE-2026-13529 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-13529 ] zephyrproject--zephyr mcumgr_serial_process_frag()=
in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on=
the result of smp_packet_alloc() before checking it for NULL. smp_packet_a= lloc() uses net_buf_alloc(K_NO_WAIT) against the shared MCUmgr packet pool = (CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT, default 4), which returns NULL when = the pool is exhausted. In default builds the __ASSERT_NO_MSG in net_buf_res=
et is a no-op, so net_buf_simple_reset writes through the NULL pointer (buf= ->len =3D 0; buf->data =3D buf->__buf), causing a fault/crash. The fragment=
data reaches this code from attacker-controlled bytes on the MCUmgr serial= /UART/shell-console transports (smp_uart.c, smp_raw_uart.c, smp_shell.c), a=
nd a fresh buffer is allocated at the start of essentially every new packet=
. An attacker on the serial/console link can flood the transport to drive t=
he 4-entry buffer pool to exhaustion and induce the NULL dereference, crash= ing the device (denial of service). The defect was introduced after the ori= ginal MCUmgr rework and shipped in Zephyr v4.4.0. The fix moves the NULL ch= eck ahead of net_buf_reset. 2026-06-29 6.2 CVE-2026-10648 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-10648 ] zephyrproject--zephyr The Zephyr net_b=
uf library (lib/net_buf/buf.c) manipulated both of its reference counts -- = the per-header buf->ref and the per-data-block ref_count at the start of ea=
ch variable/heap data allocation -- with plain non-atomic C operators (buf-= >ref++, if (--buf->ref > 0), if (--(*ref_count))). The API is documented as=
self-synchronizing: callers may share one buffer across threads (e.g. via = k_fifo) and each holder independently calls net_buf_unref() with no surroun= ding lock. Under true concurrency (SMP, or single-core preemption between t=
he non-atomic load and store while another context unrefs the same buffer),=
two holders can both observe the same prior reference value and both concl= ude they are the last reference. For heap/variable-data pools (mem_pool_dat= a_unref/heap_data_unref, used by zbus message subscribers, the IP stack RX/=
TX buffers when CONFIG_NET_BUF_FIXED_DATA_SIZE=3Dn, capture, wireguard, ISO= -TP and usbip) this produces a double k_heap_free()/k_free() of the same bl= ock -- heap-metadata corruption and a use-after-free on the heap-hardening = poison pattern. For the per-header refcount the buffer is returned to the p= ool free LIFO twice for any pool type (including fixed-data pools used by B= luetooth and networking), corrupting the free list so a later allocation ha= nds the same buffer to two owners. The fix converts both refcounts to atomi= c_inc/atomic_dec (overlaying buf->ref in an atomic_t-sized union and changi=
ng the data-block refcount from uint8_t to atomic_t). Impact is gated on ge= nuine concurrency and on an application architecture that shares one buffer=
among multiple independent unref'ers; the trigger is a refcount/timing rac=
e rather than packet content, so an external attacker has at most weak indi= rect influence over the race window. Affects all Zephyr releases through v4= .4.0. 2026-06-30 6.4 CVE-2026-10653 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-10653 ] zephyrproject--zephyr The asynchronous SNTP client in Zephyr=
(subsys/net/lib/sntp/sntp.c, sntp_close_async) closed the UDP socket file = descriptor directly from the calling thread immediately after detaching it = from the network socket service, without synchronizing with the socket-serv= ice poll thread. The socket service thread polls each socket via zvfs_poll,=
which (in zsock_poll_prepare_ctx) registers a k_poll_event pointing into t=
he socket's net_context (&ctx->recv_q) and then blocks in k_poll without ho= lding a reference or lock. net_context objects are allocated from a fixed p= ool (contexts[CONFIG_NET_MAX_CONTEXTS]) and reused after close. When sntp_c= lose_async is invoked from a different thread than the poll thread (in the = in-tree consumer subsys/net/lib/config/init_clock_sntp.c, the SNTP timeout = handler runs on the system workqueue while the socket service thread is blo= cked in poll on the same fd), the close frees and may reuse the net_context=
while the poll thread still has a poller node linked into the freed object=
, resulting in a use-after-free / object confusion of kernel poll structure=
s. The SNTP timeout path is the normal no-response failure mode, so a netwo=
rk peer or off-path attacker who drops or delays the SNTP/NTP response can = drive the racing close repeatedly (and periodically with NET_CONFIG_SNTP_IN= IT_RESYNC). The most likely consequence is a crash of the networking thread=
(denial of service), with potential memory corruption when the freed conte=
xt slot is reallocated. The fix defers the close to the socket service thre=
ad itself via net_socket_service_close (NET_SOCKET_SERVICE_CLOSE_SOCKETS), =
so the same thread that polls performs the close, eliminating the race. Aff= ected releases: v4.2.0 through v4.4.0. 2026-06-30 6.5 CVE-2026-10655 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-10655 ] zephyrproject--zephyr The Z= ephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controlle= r/ll_sw/isoal.c) fails to validate the length field of a framed ISO PDU sta=
rt segment. Per the Bluetooth specification a start segment (sc=3D0) always=
carries a 3-byte time_offset, so its segment-header len must be at least P= DU_ISO_SEG_TIMEOFFSET_SIZE (3). isoal_check_seg_header() accepted start seg= ments with len < 3 as valid, and isoal_rx_framed_consume() then computed le= ngth =3D seg_hdr->len - 3 in a uint8_t, underflowing to 253-255 when len is=
0-2. That oversized length is passed to isoal_rx_append_to_sdu(), whose co=
py is clamped only against the destination SDU buffer size, not the source = PDU length, so up to ~255 bytes of controller memory beyond the received PD=
U are copied (via sink_sdu_write_hci()/net_buf_add_mem) into an HCI ISO dat=
a packet and delivered to the host. The PDU and its segment headers are ent= irely attacker-controlled and arrive over the air, reachable through both t=
he CIS and BIS-sync HCI data paths (hci_driver.c) and the vendor data path = (ull_iso.c), so a remote CIS peer or a broadcaster the device is synced to = can trigger an out-of-bounds read causing information disclosure to the hos=
t and potential denial of service (faults or malformed oversized HCI ISO pa= ckets). The flaw affects all Zephyr releases since framed ISO reception was=
introduced in v3.0.0. The fix rejects sc=3D0 segments with len < 3 in isoa= l_check_seg_header() and adds a guard before the subtraction in isoal_rx_fr= amed_consume(). 2026-06-30 6.5 CVE-2026-9263 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-9263 ] zephyrproject--zephyr The USB CDC-NCM device class (= subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of us= bd_ep_enqueue() in its ethernet transmit callback cdc_ncm_send(). When the = enqueue fails, the function still calls k_sem_take(&data-sync_sem, K_FOREVE= R), blocking on a completion semaphore that is only ever signaled from the = bulk-IN transfer-completion callback. Because nothing was enqueued, that ca= llback never fires and the calling thread - a shared network traffic-class =
TX thread - deadlocks permanently while holding the interface TX lock, halt= ing transmission until reboot (and leaking the transmit buffer). The enqueu=
e fails under conditions controlled by the attached USB host: usbd_ep_enque= ue() returns -EPERM whenever the bus is suspended (a standard, persistent h= ost operation), and the underlying udc_ep_enqueue() returns -EPERM/-ENODEV =
on disconnect, bus reset, or endpoint disable. The cdc_ncm_send() guard onl=
y checks the DATA_IFACE_ENABLED and IFACE_UP flags, not the suspended state=
, so a packet transmitted while the host holds the bus suspended reaches th=
e failing enqueue and deadlocks the TX path. The realistic trigger is a bus=
suspend that occurs while the exported network interface is active and has=
traffic to send - host sleep, USB selective/auto-suspend, or hub power man= agement - after which any device-originated packet deadlocks the path, reco= verable only by reboot. The impact is a persistent loss of the virtual netw= ork connection between the host's NCM interface and the Zephyr device; beca= use the deadlocked thread is a shared traffic-class TX thread, egress on ot= her network interfaces can stall as well. There is no memory corruption or = information disclosure. The defect was introduced with the CDC-NCM driver a=
nd shipped in releases through v4.4.0; it is fixed by checking the usbd_ep_= enqueue() return value and freeing the buffer before the blocking wait. 202= 6-06-29 5.3 CVE-2026-10647 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10= 647 ] zephyrproject--zephyr Zephyr's DNS resolver (subsys/net/lib/dns) pars=
es resource records from DNS responses in dns_unpack_answer(), which valida= ted only the fixed RR header (type, class, TTL, rdlength) and accepted any = attacker-declared rdlength, including one extending past the end of the rec= eived datagram. The TXT and SRV consumers in dns_validate_record() (resolve= .c) then read up to rdlength bytes (clamped only to a record-type maximum s= uch as DNS_MAX_TEXT_SIZE, default 64, not to the packet) from the receive b= uffer via memcpy without their own bounds check, and pass the result to the=
application's resolve callback. A malicious or spoofed DNS server, an on-p= ath attacker forging UDP DNS replies, or (with mDNS/LLMNR enabled) any LAN = node can craft a truncated TXT or SRV response that causes an out-of-bounds=
read of adjacent receive-pool memory; the disclosed stale bytes (residual = contents of prior DNS packets / uninitialized pool memory) are returned to = the application as TXT/SRV record contents, an information leak, and may in=
some configurations cross the allocation boundary and fault, causing a den= ial of service. The read is bounded (~64 bytes for TXT, ~6 for SRV) and rea= d-only (no write). The fix rejects any record whose declared rdata extends = past dns_msg->msg_size at the single chokepoint in dns_unpack_answer(). Aff= ected: v4.3.0 and v4.4.0. 2026-06-30 4.8 CVE-2026-10652 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-10652 ] zephyrproject--zephyr The MAX32xxx USB d= evice controller driver (drivers/usb/udc/udc_max32.c, compatible adi_max32_= usbhs) dereferenced an endpoint buffer in its OUT and IN transfer-completio=
n handlers without checking it for NULL. udc_event_xfer_out_done() called n= et_buf_add(buf, ep_request->actlen) immediately after buf =3D udc_buf_get(e= p_cfg), where udc_buf_get() returns NULL when the endpoint FIFO is empty. A=
transfer-completion event is queued from interrupt context and processed a= synchronously by the driver thread; between queuing and processing, the end= point FIFO can be drained by host-controlled control flow - in particular u= dc_setup_received() drains the EP0 OUT/IN FIFOs whenever a new SETUP packet=
arrives, and dequeue/disable/purge paths drain it likewise. A USB host tha=
t aborts an in-flight EP0 control transfer with a new SETUP packet (legal U=
SB behavior) can therefore cause a stale XFER_OUT_DONE event to be processe=
d against an empty FIFO, producing net_buf_add(NULL, ...), a near-NULL poin= ter dereference that faults and crashes the device. No authentication is re= quired; the attacker is the USB host the device is connected to (physical b=
us access). Impact is denial of service (device crash). The defect was intr= oduced when the MAX32 UDC driver was added and shipped in Zephyr v4.4.0. Th=
e fix adds NULL-buffer checks that return early with UDC_EVT_ERROR/-ENOBUFS=
in both the OUT-done and IN-done handlers. 2026-07-05 4.6 CVE-2026-10656 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-10656 ] zhayujie--chatgpt-on-w= echat CowAgent A weakness has been identified in zhayujie chatgpt-on-wechat=
CowAgent 2.1.0. This issue affects the function verify_server of the file = channel/wechatmp/common.py of the component wx Endpoint. This manipulation =
of the argument wechatmp_token causes missing authentication. The attack ma=
y be initiated remotely. The exploit has been made available to the public = and could be used for attacks. Upgrading to version 2.1.1 is capable of add= ressing this issue. Patch name: 3d7c68bac6ee74fad63f43cf99e45c62e202ed55. I=
t is suggested to upgrade the affected component. The project confirms: "We= 've added an explicit non-empty check for wechatmp_token in verify_server()=
so that the /wx endpoint now fails closed with 403 Forbidden whenever the = token is missing or left at the default empty value, instead of relying on =
a signature check that silently degenerates to a predictable hash." 2026-07= -05 6.5 CVE-2026-14714 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14714 =
] Zozothemes--Corpkit Subscriber Sensitive Data Exposure in Corpkit <=3D 1.= 0.5 versions. 2026-07-02 6.5 CVE-2025-69132 [ https://www.cve.org/CVERecord= ?id=3DCVE-2025-69132 ]=20

Back to top [ #top ]

Low Vulnerabilities

Primary
Vendor -- Product Description Published CVSS Score Source Info code-project= s--Assessment Management A weakness has been identified in code-projects As= sessment Management 1.0. Affected by this issue is some unknown functionali=
ty of the file admin/view-users.php. Executing a manipulation of the argume=
nt User can lead to cross site scripting. The attack may be performed from = remote. The exploit has been made available to the public and could be used=
for attacks. 2026-07-04 2.4 CVE-2026-14655 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-14655 ] CodeAstro--Complaint Management System A security fl=
aw has been discovered in CodeAstro Complaint Management System 1.0. This i= ssue affects some unknown processing of the file /report/addreport of the c= omponent Report Handler. Performing a manipulation of the argument Report T= itle results in cross site scripting. Remote exploitation of the attack is = possible. The exploit has been released to the public and may be used for a= ttacks. 2026-06-29 3.5 CVE-2026-13558 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-13558 ] connorskees--grass A flaw has been found in connorskees gr= ass up to 0.13.4. The affected element is the function grass_compiler::raw_= to_parse_error of the component UTF-8 Character Handler. Executing a manipu= lation can lead to denial of service. The attack is restricted to local exe= cution. The exploit has been published and may be used. In Issue #117 with = similar structure the project maintainer explains: "DoS vulnerabilities are=
generally fine in Sass compilers -- they are trivially possible with recur= sive functions, infinite loops, nested mixins, etc. The description here is=
wrong. Compile time is not expected to be linear relative to the input, an=
d the @extend algorithm is definitionally exponential." 2026-07-04 3.3 CVE-= 2026-14650 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14650 ] connorskee= s--grass A vulnerability has been found in connorskees grass up to 0.13.4. = The impacted element is the function grass_compiler::selector::extend/grass= _compiler::evaluate::visitor. The manipulation leads to denial of service. = The attack must be carried out locally. The exploit has been disclosed to t=
he public and may be used. The project maintainer explains: "DoS vulnerabil= ities are generally fine in Sass compilers -- they are trivially possible w= ith recursive functions, infinite loops, nested mixins, etc. The descriptio=
n here is wrong. Compile time is not expected to be linear relative to the = input, and the @extend algorithm is definitionally exponential." 2026-07-04=
3.3 CVE-2026-14651 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14651 ] D= ell--PowerProtect Data Domain Dell PowerProtect Data Domain, versions 7.7.1=
.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r= elease version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 = through 7.13.1.70 contain an use of uninitialized resource vulnerability. A=
low privileged attacker with local access could potentially exploit this v= ulnerability, leading to information exposure. 2026-07-03 3.3 CVE-2026-5608=
5 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56085 ] Dell--PowerProtect = Data Domain Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LT= S2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3= .1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 = contain an Improper limitation of a pathname to a restricted directory ('pa=
th traversal') vulnerability. A high privileged attacker with local access = could potentially exploit this vulnerability, leading to Information exposu= re. 2026-07-03 2.3 CVE-2026-41124 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-41124 ] Dell--PowerProtect Data Domain Dell PowerProtect Data Domain, = versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1= .10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release vers= ions 7.13.1.0 through 7.13.1.70 contain an use of less trusted source vulne= rability. A high privileged attacker with remote access could potentially e= xploit this vulnerability, leading to information tampering. 2026-07-03 2.7=
CVE-2026-46466 [ https://www.cve.org/CVERecord?id=3DCVE-2026-46466 ] exo-e= xplore--exo A security flaw has been discovered in exo-explore exo up to 1.= 0.71. Affected is the function _image_cache_key of the file src/exo/worker/= engines/mlx/vision.py of the component Vision Feature Cache. The manipulati=
on results in use of weak hash. It is possible to launch the attack remotel=
y. A high complexity level is associated with this attack. The exploitabili=
ty is told to be difficult. The exploit has been released to the public and=
may be used for attacks. The pull request to fix this issue awaits accepta= nce. 2026-07-05 3.7 CVE-2026-14738 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-14738 ] FederatedAI--FATE A vulnerability has been found in Federated=
AI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.i= nitEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/brok= er/grpc/QueuePushReqStreamObserver.java of the component OSX Broker. Such m= anipulation of the argument rollSiteSessionId/dstRole/dstPartyId leads to e= xposure of data element to wrong session. The attack can be executed remote= ly. A high complexity level is associated with this attack. It is indicated=
that the exploitability is difficult. The exploit has been disclosed to th=
e public and may be used. The pull request to fix this issue awaits accepta= nce. 2026-07-04 3.1 CVE-2026-14621 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-14621 ] ForceInjection--AI-fundermentals A vulnerability has been fou=
nd in ForceInjection AI-fundermentals 2.0/3.0. Affected by this vulnerabili=
ty is the function get_conversation_history of the file 08_agentic_system/m= emory/langchain/code/smart_customer_service.py of the component Memory Reca=
ll Handler. The manipulation leads to use of weak hash. Remote exploitation=
of the attack is possible. A high degree of complexity is needed for the a= ttack. The exploitation appears to be difficult. The exploit has been discl= osed to the public and may be used. The identifier of the patch is f57277fd= d9ba373ace72d83c272023ec67f720d6. It is suggested to install a patch to add= ress this issue. The project confirms (translated from Chinese): "We now re= quire session ownership verification in methods such as `username`, `sessio= nowner`, etc., and we've chat()changed the generation of `sessionowner` to = include verified user identity and security context metadata." 2026-07-04 3=
.1 CVE-2026-14630 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14630 ] GPA= C--GPAC A weakness has been identified in GPAC up to 26.02.0. This affects =
an unknown part of the file src/utils/base_encoding.c of the component ISOB= MFF Parser. Executing a manipulation can lead to highly compressed data. Th=
e attack needs to be launched locally. The exploit has been made available =
to the public and could be used for attacks. This patch is called 297f2d8d1= f493d8b241330533cd47f7da758aeb3. A patch should be applied to remediate thi=
s issue. The vendor confirms: "We added a check on inflate output size, if =
it surpasses 32 times the input size we stop in error. This value could be = adjusted later." 2026-06-29 3.3 CVE-2026-13523 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-13523 ] HdrHistogram--HdrHistogram A vulnerability was de= tected in HdrHistogram up to 2.2.2. Affected by this issue is the function = org.HdrHistogram.AbstractHistogram.decodeFromCompressedByteBuffer of the fi=
le src/main/java/org/HdrHistogram/AbstractHistogram.java. The manipulation =
of the argument lengthOfCompressedContents results in uncontrolled memory a= llocation. The attack needs to be approached locally. The exploit is now pu= blic and may be used. The project was informed of the problem early through=
an issue report but has not responded yet. 2026-07-04 3.3 CVE-2026-14683 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-14683 ] HdrHistogram--HdrHisto= gram A flaw has been found in HdrHistogram up to 2.2.2. This affects the fu= nction org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file = src/main/java/org/HdrHistogram/AbstractHistogram.java. This manipulation of=
the argument numberOfSignificantValueDigits causes uncontrolled memory all= ocation. The attack can only be executed locally. The exploit has been publ= ished and may be used. The project was informed of the problem early throug=
h an issue report but has not responded yet. 2026-07-04 3.3 CVE-2026-14684 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14684 ] HdrHistogram--HdrHist= ogram A vulnerability has been found in HdrHistogram up to 2.2.2. This vuln= erability affects the function recordValueWithCount of the file src/main/ja= va/org/HdrHistogram/AbstractHistogram.java of the component AbstractHistogr= am. Such manipulation of the argument Count leads to state issue. The attac=
k can only be performed from a local environment. The exploit has been disc= losed to the public and may be used. The project was informed of the proble=
m early through an issue report but has not responded yet. 2026-07-04 3.3 C= VE-2026-14685 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14685 ] HdrHist= ogram--HdrHistogram A vulnerability was found in HdrHistogram up to 2.2.2. = This issue affects the function org.HdrHistogram.DoubleHistogram.recordValu=
e of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the co= mponent Range Check. Performing a manipulation results in incorrect compari= son. The attack is only possible with local access. The exploit has been ma=
de public and could be used. The project was informed of the problem early = through an issue report but has not responded yet. 2026-07-05 3.3 CVE-2026-= 14686 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14686 ] Hitachi--Hitach=
i Virtual Storage Platform One Block 23, 24, 26, 28 Lack of validation for = firmware update=C2=A0in Hitachi Hitachi Virtual Storage Platform One Block = 23, 24, 26, 28. This issue affects Hitachi Virtual Storage Platform One Blo=
ck 23, 24, 26, 28: before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00. 2026-06-=
29 3.7 CVE-2025-0824 [ https://www.cve.org/CVERecord?id=3DCVE-2025-0824 ] I= BM--InfoSphere Information Server IBM InfoSphere Information Server 11.7.0.=
0 through 11.7.1.6 is affected by an information disclosure vulnerability. = 2026-06-30 3.5 CVE-2026-9836 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 9836 ] ImageMagick--ImageMagick ImageMagick before 7.1.2-19 contains an off= -by-one error in morphology validation allowing out-of-bounds heap buffer r= eads. Attackers can trigger heap buffer overflow by providing incorrect mor= phology parameters causing single pixel memory access violations. 2026-06-3=
0 3.3 CVE-2026-56361 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56361 ] = ImageMagick--ImageMagick ImageMagick before 7.1.2-22 contains a division by=
zero vulnerability in binomial kernel processing that allows attackers to = cause denial of service. An attacker can supply a large binomial kernel val=
ue causing integer overflow, resulting in division by zero and application = crash. 2026-06-30 3.3 CVE-2026-56363 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-56363 ] ImageMagick--ImageMagick ImageMagick before 7.1.2-19 contai=
ns a memory leak vulnerability in the PNG encoder when writing MNG images. = Attackers can trigger the encoder failure condition to exhaust memory resou= rces and cause denial of service. 2026-06-30 3.7 CVE-2026-56365 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-56365 ] ImageMagick--ImageMagick ImageMa= gick before 7.1.2-22 contains an information disclosure vulnerability in th=
e PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exp= loit nonce reuse in the cipher implementation to recover plaintext informat= ion from encrypted images. 2026-06-30 3.7 CVE-2026-56369 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-56369 ] ImageMagick--ImageMagick ImageMagick be= fore 7.1.2-24 contains an incorrect policy check that allows attackers to c= reate or truncate files disallowed by security policies. Remote attackers c=
an bypass path policy restrictions in sandboxed conversion services to writ=
e arbitrary files outside intended boundaries. 2026-06-30 3.3 CVE-2026-5637=
7 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56377 ] ImageMagick--ImageM= agick ImageMagick before 7.1.2-13 contains a memory leak vulnerability in L= oadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device pr= ofile XML files with unclosed device elements. Attackers with write access =
to the OpenCL cache directory can place malicious XML files to exhaust memo=
ry and cause denial of service. 2026-06-30 1.9 CVE-2026-56364 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-56364 ] iv-org--Invidious Invidious before=
version 2.20260626.0 contains a broken access control vulnerability that a= llows unauthenticated attackers to retrieve private playlist contents by ac= cessing the RSS feed playlist endpoint without authentication. Attackers ca=
n supply a playlist ID to the feed endpoint to obtain the full playlist con= tents, owner email address, and associated video entries without any authen= tication. 2026-06-29 3.7 CVE-2026-57946 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-57946 ] langchain-ai--langgraph A vulnerability was determined =
in langchain-ai langgraph up to 1.2.4. The affected element is the function=
_freeze of the file libs/langgraph/langgraph/_internal/_cache.py of the co= mponent Task Result Cache. This manipulation of the argument default_cache_= key causes use of weak hash. The attack is possible to be carried out remot= ely. The complexity of an attack is rather high. The exploitability is desc= ribed as difficult. The exploit has been publicly disclosed and may be util= ized. The pull request to fix this issue awaits acceptance. 2026-07-05 3.1 = CVE-2026-14742 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14742 ] llvm--= llvm-project A vulnerability was found in llvm llvm-project up to 22.1.6. T= his affects the function llvm::StringMap::insert in the library /lib/IR/Val= ueSymbolTable.cpp of the component ValueSymbolTable Module. The manipulatio=
n results in stack-based buffer overflow. Attacking locally is a requiremen=
t. The exploit has been made public and could be used. The project was info= rmed of the problem early through an issue report but has not responded yet=
. 2026-06-29 3.3 CVE-2026-13573 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-13573 ] llvm--llvm-project A vulnerability was determined in llvm llvm-p= roject up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr i=
n the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File H= andler. This manipulation causes heap-based buffer overflow. It is possible=
to launch the attack on the local host. The exploit has been publicly disc= losed and may be utilized. The project was informed of the problem early th= rough an issue report but has not responded yet. 2026-06-29 3.3 CVE-2026-13= 574 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13574 ] mjperpinosa--stum= asy A security vulnerability has been detected in mjperpinosa stumasy up to=
327d1b0f2915ba79d7ef8ebb74553e987609d9be. This affects the function add_de= finition of the file application/PHP/objects/notes/add_into_dictionary.php.=
Such manipulation of the argument reference leads to cross site scripting.=
It is possible to launch the attack remotely. The exploit has been disclos=
ed publicly and may be used. This product takes the approach of rolling rel= eases to provide continious delivery. Therefore, version details for affect=
ed and updated releases are not available. The project was informed of the = problem early through an issue report but has not responded yet. 2026-07-05=
3.5 CVE-2026-14752 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14752 ] N= ousResearch--hermes-agent A security vulnerability has been detected in Nou= sResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStr= eamConsumer._filter_and_accumulate of the file gateway/stream_consumer.py o=
f the component Streaming Reasoning Tag Filter. The manipulation leads to i= mproper handling of case sensitivity. The attack may be initiated remotely.=
The attack's complexity is rated as high. The exploitability is told to be=
difficult. The exploit has been disclosed publicly and may be used. The pr= oject decided to not implement a dedicated fix: "[T]he analysis and the fix=
are both sound. It just lands below the bar for the maintenance cost of a = duplicated scrub path." 2026-07-03 3.1 CVE-2026-14617 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-14617 ] opencontainers--runc runc is a CLI tool fo=
r spawning and running containers according to the OCI specification. In ve= rsions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1,=
when setting up the container rootfs, setupPtmx and setupDevSymlinks call = os.Remove and os.Symlink with a filepath.Join string which allow an image w= ith /dev as a symlink to trick runc into deleting files called ptmx on the = host or creating a hardcoded set of symlinks with specific names and target=
s in an arbitrary pre-existing host directory. This issue is not exploitabl=
e under Docker, because Docker creates a top-level read-only layer that mas=
ks any malicious /dev=C2=A0symlink present in the container image - unlike = some other Linux container tooling, whose higher-level runtimes built on ru=
nc remain exposed to exploitation via a malicious image. This issue has bee=
n fixed in versions 1.3.6, 1.4.3 and 1.5.0. 2026-07-01 3.3 CVE-2026-41579 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-41579 ] radareorg--radare2 A v= ulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerab= ility affects the function cmd_anal_opcode of the file libr/core/cmd_anal.i= nc.c of the component hexpairs Parser. Such manipulation leads to integer o= verflow. The attack needs to be performed locally. The exploit is publicly = available and might be used. The name of the patch is 84e773986e7e5bb30453a= 9384f498ec0ccc9d0a9. A patch should be applied to remediate this issue. 202= 6-07-05 3.3 CVE-2026-14758 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14= 758 ] radareorg--radare2 A security flaw has been discovered in radareorg r= adare2 up to 6.1.6. This issue affects the function r_bin_java_inner_classe= s_attr_calc_size of the file shlr/java/class.c of the component RBinJava Li=
ne Number Table Parser. Performing a manipulation results in heap-based buf= fer overflow. The attack requires a local approach. The exploit has been re= leased to the public and may be used for attacks. The patch is named cd62d1= 5a6cbecdc67fd03f3ebdbbbeb741d18f87. To fix this issue, it is recommended to=
deploy a patch. 2026-07-05 3.3 CVE-2026-14759 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-14759 ] radareorg--radare2 A weakness has been identified=
in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arc= h_bits of the file libr/core/disasm.c of the component regprofile Handler. = Executing a manipulation can lead to use after free. The attack requires lo= cal access. The exploit has been made available to the public and could be = used for attacks. This patch is called 8b25c773785d85cb0103410a0905089d2869= 21c2. It is advisable to implement a patch to correct this issue. 2026-07-0=
5 3.3 CVE-2026-14760 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14760 ] = radareorg--radare2 A security vulnerability has been detected in radareorg = radare2 up to 6.1.6. The affected element is the function r_str_ndup/r_str_= append of the file libr/util/str.c. The manipulation leads to integer overf= low. An attack has to be approached locally. The exploit has been disclosed=
publicly and may be used. The identifier of the patch is a20a56917ae85d732= e683f8d9078bdcfee92446c. Applying a patch is the recommended action to fix = this issue. 2026-07-05 3.3 CVE-2026-14761 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-14761 ] ruby--json Ruby JSON is a JSON implementation for Ruby=
. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when=
the JSON generator is provided with an oversized streamed object. When str= eaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can wr= ite past the internal JSON generator buffer when a streamed object contains=
an attacker-controlled string near 16 KB. Exploitation would result in a r= eliable process crash/denial of service. This issue has been fixed in versi=
on 2.19.9. 2026-06-30 3.7 CVE-2026-54696 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-54696 ] seaweedfs--seaweedfs SeaweedFS before 4.30 reflects the=
callback query parameter verbatim into responses served with Content-Type = application/javascript in the shared writeJson helper (weed/server/common.g= o), with no callback-name validation, no X-Content-Type-Options: nosniff he= ader, and no CORS allow-list. Every JSON endpoint that uses writeJson - inc= luding the unauthenticated master endpoints /dir/status, /dir/lookup and /c= luster/status, the volume server /status, and the filer directory listing, = all reachable in the default configuration (no -whiteList, no security.toml=
, bound to 0.0.0.0) - can therefore be loaded cross-origin via a script tag=
with a chosen callback, letting a third-party web page read cluster topolo= gy, volume server URLs and gRPC ports, file identifiers, and directory list= ings. Because the callback string is reflected at the start of the body and=
no nosniff header is sent, MIME-sniffing clients may also interpret the re= flected content as HTML. 2026-06-30 3.1 CVE-2026-58371 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-58371 ] seladb--PcapPlusPlus A vulnerability was = found in seladb PcapPlusPlus 25.05. The affected element is the function pa= rse_by_block_type of the file light_pcapng.c of the component LightPcapNg P= arser. Performing a manipulation of the argument captured_packet_length res= ults in heap-based buffer overflow. It is possible to initiate the attack r= emotely. The attack's complexity is rated as high. The exploitability is de= scribed as difficult. The exploit has been made public and could be used. 2= 026-06-29 3.7 CVE-2026-13587 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 13587 ] Snowflake--Snowflake CLI Improper neutralization of local CLI param= eters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execut= ion. A user could trigger this issue by supplying crafted values to vulnera= ble Cortex SQL or object listing command paths, causing Snowflake CLI to ex= ecute unintended SQL in the context of that user's Snowflake session. Succe= ssful exploitation is constrained to self-injection because the vulnerable = parameters were supplied directly through local CLI arguments rather than t= hrough project files, repositories, or other external input sources, and im= pact is limited to the privileges already available to the current session.=
The fix is available in Snowflake CLI version 3.19, and users must manuall=
y upgrade. 2026-06-29 3.6 CVE-2026-13746 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13746 ] SourceCodester--Inventory Management System A vulnerabi= lity was detected in SourceCodester Inventory Management System 1.0. Impact=
ed is an unknown function of the file /api/users_handler.php of the compone=
nt User Registration Endpoint. Performing a manipulation of the argument fu= ll_name results in cross site scripting. The attack is possible to be carri=
ed out remotely. The exploit is now public and may be used. 2026-06-29 3.5 = CVE-2026-13570 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13570 ] TUBITA=
K BILGEM Software Technologies Research Institute--Pardus Pen Improper null=
termination vulnerability in TUBITAK BILGEM Software Technologies Research=
Institute Pardus Pen allows Overflow Buffers. This issue affects Pardus Pe=
n: from <=3D4.1.5 before 4.2.1. 2026-07-05 3.9 CVE-2026-12386 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-12386 ] uvnc--UltraVNC UltraVNC repeater t= hrough 1.8.2.2 contains an off-by-one error in the Base64 decode helper use=
d for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_= uudecode() function checks whether the input length exceeds the output buff=
er with a strict greater-than comparison (>), while the correct check shoul=
d be greater-than-or-equal (>=3D). When strlen(authdata) equals sizeof(deco= de), the decoded output length (approximately 3/4 of input) does not overfl=
ow the buffer in current practice because the outer HTTP request bounds con= strain the Authorization header. However, the defective check leaves a late=
nt off-by-one condition that could become exploitable if the buffering cons= traints change. The current risk is limited to a one-byte write at the boun= dary of a 1024-byte stack buffer under constrained conditions. 2026-07-01 3=
.7 CVE-2026-44042 [ https://www.cve.org/CVERecord?id=3DCVE-2026-44042 ] WSO= 2--WSO2 Identity Server In multi-tenanted deployments, the application cons= ent management mechanism fails to correctly isolate consent scopes between = tenants. Consent granted by a user for a specific SaaS application within o=
ne tenant can be incorrectly applied to SaaS applications with the same nam=
e in other tenants, leading to unintended cross-tenant consent sharing. Thi=
s vulnerability may result in the exposure of user data across tenants, ena= bling SaaS applications in different tenants to access and modify informati=
on without explicit user authorization. This can lead to unauthorized data = access and privacy violations. This vulnerability has no impact if the depl= oyment does not support multi-tenancy. 2026-07-04 3.5 CVE-2025-13475 [ http= s://www.cve.org/CVERecord?id=3DCVE-2025-13475 ] zcaceres--markdownify-mcp A=
weakness has been identified in zcaceres markdownify-mcp up to 1.1.0. The = affected element is the function assertPathAllowed of the file src/Markdown= ify.ts. Executing a manipulation can lead to symlink following. The attack = can only be executed locally. The pull request to fix this issue awaits acc= eptance. 2026-07-05 3.3 CVE-2026-14699 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14699 ] zcaceres--markdownify-mcp A flaw has been found in zcac= eres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile =
of the file src/Markdownify.ts of the component webpage-to-markdown/youtube= -to-markdown/bing-search-to-markdown. This manipulation causes insufficient=
ly random values. The attack is restricted to local execution. A high degre=
e of complexity is needed for the attack. The exploitability is said to be = difficult. The exploit has been published and may be used. The pull request=
to fix this issue awaits acceptance. 2026-07-05 2.5 CVE-2026-14702 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-14702 ] zephyrproject--zephyr A race=
condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/blueto= oth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session = disconnect. When the local device has initiated a session teardown (state B= T_RFCOMM_STATE_DISCONNECTING, DISC sent, RTX timer armed) and the connected=
peer concurrently sends its own DISC frame for dlci 0, rfcomm_handle_disc(=
) invokes rfcomm_session_disconnected(), which unconditionally forced the s= ession to BT_RFCOMM_STATE_DISCONNECTED without ever calling bt_l2cap_chan_d= isconnect(). Because the recovery timer was also cancelled and a later UA i=
s ignored in the DISCONNECTED state, the session becomes permanently wedged=
: the underlying L2CAP channel is never released and the session slot in th=
e fixed bt_rfcomm_pool[CONFIG_BT_MAX_CONN] array is never reclaimed (its co=
nn pointer stays set). Subsequent bt_rfcomm_dlc_connect() calls on that con= nection fail with -EINVAL due to the invalid session state, so RFCOMM servi=
ce is denied for that peer, and repeated occurrences can exhaust the sessio=
n pool. The DISC frame is peer-controlled over the air, but exploitation re= quires the peer's DISC to collide with a local-initiated disconnect (a high= -complexity timing race). Impact is availability/resource-leak only; there =
is no memory-safety, confidentiality, or integrity consequence. The defect = shipped in released versions (present in v4.4.0 and earlier). The fix only = transitions to DISCONNECTED when the session is not already in DISCONNECTIN=
G, preserving the proper L2CAP teardown path. 2026-06-30 3.1 CVE-2026-10654=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-10654 ] zephyrproject--zephy=
r Zephyr's DNS resolver detects mDNS (.local) queries in dns_resolve_name_i= nternal() (subsys/net/lib/dns/resolve.c) with memcmp(strrchr(query, '.'), "= .local", 7), which always reads a fixed 7 bytes from the suffix pointer. Wh=
en the resolved hostname's final label is shorter than 7 bytes (e.g. names = ending in .org, .com, .net, .io, or a trailing dot), the comparison reads 1=
-2 bytes past the string's NUL terminator. The hostname (query) is the call= er-supplied name passed through the standard getaddrinfo()/dns_get_addr_inf= o()/dns_resolve_name() path and is influenceable by operators or remote inp= uts (server names from configuration, parsed URLs, or app-facing interfaces=
). On a tightly-sized buffer with no slack (for example a userspace getaddr= info call where the hostname is copied with k_usermode_string_alloc_copy to=
exactly strlen+1 bytes), the over-read crosses the allocation boundary; if=
that boundary is unmapped (guard page, memory-domain boundary under MPU, o=
r an address sanitizer) the over-read faults, causing a denial of service. = The over-read bytes are never returned, so there is no information disclosu= re. The flaw is compiled only when CONFIG_MDNS_RESOLVER is enabled, exists = since v1.10.0, and is fixed by replacing the fixed-length memcmp with a NUL= -safe strcmp(ptr, ".local"). 2026-07-05 3.7 CVE-2026-10657 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-10657 ]=20

Back to top [ #top ]

Severity Not Yet Assigned=C2=A0

Primary
Vendor -- Product Description Published CVSS Score Source Info ail-project-= -ail-framework AIL Framework contains a path traversal vulnerability in its=
PDF object handling. Prior to commit 14c618fce4d1df02358717c48ea903706abec= df2, the PDF.get_filepath() function constructed a file path by joining the=
configured PDF storage directory with a path derived from a PDF object ide= ntifier, without verifying that the resolved path remained within the inten= ded PDF_FOLDER directory. An authenticated attacker able to invoke PDF obje=
ct operations with a crafted identifier could use relative traversal sequen= ces or absolute path components to cause AIL Framework to open files locate=
d outside the PDF storage directory. This could allow disclosure of files r= eadable by the AIL process, including application configuration, credential=
s, or other sensitive local data. This vulnerability is potential due to ad= ditional errors before being able to be executed. The fix canonicalises the=
resulting path with os.path.realpath() and rejects paths whose common dire= ctory is outside the configured PDF directory. 2026-07-05 not yet calculate=
d CVE-2026-59510 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59510 ] Alek= soid1978 MPC-BE--Aleksoid1978 MPC-BE A NULL pointer dereference in the AP4_= TkhdAtom::GetTrackId() function of Aleksoid1978 MPC-BE before commit 4341cb=
3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 fil=
e. 2026-07-01 not yet calculated CVE-2026-36909 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-36909 ] Aleksoid1978 MPC-BE--Aleksoid1978 MPC-BE An acce=
ss violation in the BaseSplitterFile::Read function of Aleksoid1978 MPC-BE = before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) v=
ia a crafted MP4 file. 2026-07-01 not yet calculated CVE-2026-36910 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-36910 ] Aleksoid1978 MPC-BE--Aleksoi= d1978 MPC-BE A division-by-zero vulnerability in the CStreamSwitcherOutputP= in::DecideBufferSize function of Aleksoid1978 MPC-BE before commit 4341cb3 = allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.=
2026-07-01 not yet calculated CVE-2026-36911 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-36911 ] Aleksoid1978 MPC-BE--Aleksoid1978 MPC-BE A NULL po= inter dereference in the AP4_AtomSampleTable::GetSample() function of Aleks= oid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of = Service (DoS) via a crafted MP4 file. 2026-07-01 not yet calculated CVE-202= 6-36912 [ https://www.cve.org/CVERecord?id=3DCVE-2026-36912 ] Alexantr--fil= emanager v.1.0 An issue in Alexantr filemanager v.1.0 allows a remote attac= ker to execute arbitrary code via the filemanager.php component 2026-06-29 = not yet calculated CVE-2026-37637 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-37637 ] allegroai--allegroai/clearml A vulnerability in allegroai/clea= rml versions up to and including 1.16.5 allows for relative path traversal = when extracting `.zip` archives using the `ZipFile.extractall()` method in = `StorageManager._extract_to_cache()`. This issue arises due to the lack of = path traversal validation, enabling an attacker to write arbitrary files to=
the filesystem. Attack vectors include dataset downloads, artifact downloa= ds, model downloads, and offline session imports. The vulnerability can lea=
d to remote code execution through methods such as cron job injection, SSH = key overwrite, or web shell deployment. The issue is resolved in version 2.= 1.6. 2026-07-01 not yet calculated CVE-2026-8387 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-8387 ] Altium--Altium Enterprise Server A path traversa=
l vulnerability exists in the Git Service component shared by Altium Enterp= rise Server and Altium 365. The service accepts a sequence of post-clone fi= le-manipulation operations that use user-supplied paths without validation,=
allowing an authenticated user with basic git access to move arbitrary fil=
es outside the intended repository area. This file-move primitive can be us=
ed to place attacker-controlled script content into directories where it is=
later executed by the service, resulting in remote code execution under th=
e Git Service account. On multi-tenant Altium 365 deployments, this could h= ave allowed access to data belonging to other tenants on the same infrastru= cture node. Altium Enterprise Server is fixed in 8.1.1. The issue has been = remediated across Altium 365 shared multi-tenant deployments at the service=
level; remediation is in progress on remaining Altium 365 deployments. 202= 6-07-01 not yet calculated CVE-2026-14439 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-14439 ] anthropics--claude-code Claude Code is an agentic codi=
ng tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote res= ponses to a hardcoded, predictable path (/tmp/claude/response.md) without U=
ID isolation, randomness, or symlink protection. The file was created world= -readable (0644) in a world-traversable directory (0755), allowing any loca=
l user to read a privileged user's Claude response, which could contain sec= rets or credentials. Additionally, because the path was static and predicta= ble, a local attacker could pre-create the directory and plant a symlink at=
the expected file path, causing the privileged process to follow the symli=
nk and overwrite an attacker-chosen file with the response text. Exploiting=
this required a local unprivileged user on the same system and a privilege=
d user to run the /copy command. This vulnerability is fixed in 2.1.128. 20= 26-06-29 not yet calculated CVE-2026-46406 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-46406 ] anthropics--claude-code Claude Code is an agentic cod= ing tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowe=
d creation of worktrees named ".git" and navigation to worktrees outside th=
e sandbox context, enabling git directory confusion attacks. By exploiting = symlink manipulation and git fsmonitor execution during worktree operations=
, an attacker could overwrite files in the user's home directory (such as .= zshenv), leading to code execution outside of seatbelt sandbox restrictions=
. Reliably exploiting this required the user to clone a malicious repositor=
y containing prompt injection content and run Claude Code against it. This = vulnerability is fixed in 2.1.163. 2026-06-29 not yet calculated CVE-2026-5= 5607 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55607 ] antonio-castello= n--module-auth @acastellon/auth is an authentication control system for mic= roservices. Versions prior to 2.3.0 appear to allow an unauthenticated auth= entication bypass in validateToken() through spoofable auth-user and Host r= equest headers. The validateToken middleware contains a service-to-service = bypass for auth-user: service-brother when req.get('host').startsWith(getHo= stName()). Both values involved in the check can be influenced by an unauth= enticated HTTP client: auth-user is a request header, and Host is also clie= nt-controlled. As a result, a remote unauthenticated attacker can send a re= quest with crafted headers and bypass token validation before the normal le= gacy/JWT/OIDC validation logic runs. A fix has been implemented in v2.3.0. = 2026-07-01 not yet calculated CVE-2026-58399 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-58399 ] Apache Software Foundation--Apache ActiveMQ Imprope=
r Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, A= pache ActiveMQ Stomp. A remote unauthenticated peer that can reach an expos=
ed STOMP connector can trigger denial-of-service behavior by sending a nega= tive content-length. For the NIO STOMP transport, an attacker can keep stre= aming body bytes and grow the per-connection command buffer beyond configur=
ed limits to cause OOM. For the blocking STOMP protocol, an error will inst= ead force abnormal transport exception handling for the affected connection=
and closure. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0=
before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7;=
Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7. Users are r= ecommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue. 20= 26-06-30 not yet calculated CVE-2026-49432 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-49432 ] Apache Software Foundation--Apache ActiveMQ Improper = Authorization vulnerability in Apache ActiveMQ. An authenticated low-privil= ege Web Console user by default can access /admin/* paths in the Web Consol=
e. The default Jetty settings incorrectly did not limit those paths to only=
admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 befo=
re 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, whic=
h fixes the issue. 2026-06-30 not yet calculated CVE-2026-49877 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-49877 ] Apache Software Foundation--Apac=
he ActiveMQ Improper Neutralization of Input During Web Page Generation ('C= ross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web=
Console. The browse page in the web console renders a message Id directly = without sanitization. This allows an authenticated producer to send a=C2=A0= message with a JMS message ID that has been=C2=A0crafted to contain HTML/Ja= vaScript such that when=C2=A0an administrator browses the queue in the Web = Console, the payload executes in their browser. This issue affects Apache A= ctiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Consol=
e: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade=
to version 6.2.7 or 5.19.8, which fixes the issue. 2026-06-30 not yet calc= ulated CVE-2026-52760 [ https://www.cve.org/CVERecord?id=3DCVE-2026-52760 ]=
Apache Software Foundation--Apache ActiveMQ Memory Allocation with Excessi=
ve Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache=
ActiveMQ Stomp. An unauthenticated client that opens a STOMP NIO connectio=
n can send header bytes that never terminate which makes the broker buffer = them without limit,=C2=A0exhausting=C2=A0the JVM heap. This issue affects A= pache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All=
: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Stomp: before 5.1= 9.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6= .2.7 or 5.19.8, which fixes the issue. 2026-06-30 not yet calculated CVE-20= 26-53916 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53916 ] Apache Softw= are Foundation--Apache ActiveMQ Memory Allocation with Excessive Size Value=
vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Cli= ent, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS b=
y sending a crafted OpenWire Message with a large encoded size value for th=
e map. OpenWire message property maps are unmarshaled without size validati= on=C2=A0which can trigger OOM and crash the broker. This issue affects Apac=
he ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: b= efore 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.=
8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0=
.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.=
8, which fixes the issue. 2026-06-30 not yet calculated CVE-2026-53917 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-53917 ] Apache Software Foundatio= n--Apache ActiveMQ Broker Improper Input Validation vulnerability in Apache=
ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that ha=
s access to publish or modify entries in LDAP that match the configured sea= rchBase and searchFilter can instantiate denied transports inside the broke=
r JVM. This can be used to fetch an attacker URL and spawn a second BrokerS= ervice inside the same JVM. This issue affects Apache ActiveMQ Broker: befo=
re 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.= 0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2= .7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixe=
s the issue. 2026-06-30 not yet calculated CVE-2026-49434 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-49434 ] Apache Software Foundation--Apache Act= iveMQ Broker Denial of Service via Out of Memory vulnerability in Apache Ac= tiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for = CVE-2026-49270=C2=A0an unauthenticated attacker can now cause broker OOM by=
sending an repeated BrokerInfo commands without sending=C2=A0a ConnectionI= nfo, until the broker will crash with OOM. This issue affects Apache Active=
MQ Broker: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache Activ= eMQ: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ Al=
l: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7. Users are recommende=
d to upgrade to version 6.2.7, which fixes the issue. 2026-06-30 not yet ca= lculated CVE-2026-50750 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50750=
] Apache Software Foundation--Apache ActiveMQ Broker Missing Authorization=
vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache Activ= eMQ. Apache ActiveMQ Classic temporary destinations are expected to be isol= ated to the connection that created them. The isolation can be broken as th=
is is only checked in the client, allowing a=C2=A0different connection to c= onsume from another connection's temporary destination. This issue affects = Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache Acti= veMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5= .19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version=
6.2.7, which fixes the issue. 2026-06-30 not yet calculated CVE-2026-54475=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-54475 ] Apache Software Foun= dation--Apache ActiveMQ Client Memory Allocation with Excessive Size Value = vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ A= ll. An unauthenticated network attacker can cause a broker DoS by sending a=
crafted WireFormatInfo frame with a malicious large size value. The value =
is not validate and causes the broker to attempt allocation during pre-auth=
negotiation which can trigger OOM and crash the broker. This issue affects=
Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache Act= iveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before = 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to versio=
n 6.2.7 or 5.19.8, which fixes the issue. 2026-06-30 not yet calculated CVE= -2026-50734 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50734 ] Apache So= ftware Foundation--Apache Gravitino SQL misconfiguration in the Gravitino U=
I, in versions 1.0.0 and below, can allow a malicious user to read or trunc= ate files. Users are recommended to upgrade to version 1.0.0, which fixes t= his issue. 2026-06-30 not yet calculated CVE-2025-53648 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2025-53648 ] Apache Software Foundation--Apache HttpC= omponents Core Uncontrolled Resource Consumption vulnerability in the HTTP/= 1.1 message parser=C2=A0in Apache HttpComponents Core (5.4.2 and earlier, 5= .5-beta1 and earlier) allows=C2=A0an remote attacker to cause a denial of s= ervice through memory exhaustion by sending messages with excessive number =
of headers / excessive header length 2026-07-01 not yet calculated CVE-2026= -54399 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54399 ] Apache Softwar=
e Foundation--Apache HttpComponents Core Allocation of resources without li= mits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Cor=
e (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to c= ause a denial of service through memory exhaustion by sending oversized com= pressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the=
configured header list size limit to be applied. 2026-07-01 not yet calcul= ated CVE-2026-54428 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54428 ] A= pache Software Foundation--Apache Lucene.Net Improper Limitation of a Pathn= ame to a Restricted Directory ('Path Traversal') vulnerability in Apache Lu= cene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.= Net.Replicator: from 4.8.0-beta00005 through 4.8.0-beta00017. Users are rec= ommended to upgrade to version 4.8.0-beta00018, which fixes the issue. 2026= -07-03 not yet calculated CVE-2026-47896 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-47896 ] Apache Software Foundation--Apache Lucene.Net Improper = Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulne= rability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue a= ffects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 before 4.8.0-beta= 00018. Users are recommended to upgrade to version 4.8.0-beta00018, which f= ixes the issue. 2026-07-03 not yet calculated CVE-2026-47897 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-47897 ] Apache Software Foundation--Apache = Lucene.Net Improper Restriction of XML External Entity Reference vulnerabil= ity in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue a= ffects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0= -beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, wh= ich fixes the issue. 2026-07-03 not yet calculated CVE-2026-47898 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-47898 ] Apache Software Foundation--Ap= ache Tomcat Improper Neutralization of Script-Related HTML Tags in a Web Pa=
ge (Basic XSS) vulnerability in the number guess example for Apache Tomcat.=
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.= 1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8= .5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of=
support may also be affected. Users are recommended to upgrade to version = 11.0.23, 10.1.56 or 9.0.119, which fix the issue. 2026-06-29 not yet calcul= ated CVE-2026-50229 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50229 ] A= pache Software Foundation--Apache Tomcat Always-Incorrect Control Flow Impl= ementation vulnerability in Apache Tomcat's rewrite valve meant that if the=
first condition in an OR chain matched, subsequent non-OR conditions were = skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, = from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 t= hrough 8.5.100. Other versions that have reached end of support may also be=
affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or = 9.0.119, which fix the issue. 2026-06-29 not yet calculated CVE-2026-53404 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-53404 ] Apache Software Found= ation--Apache Tomcat Detection of Error Condition Without Action vulnerabil= ity in Apache Tomcat when configuring CRLs for a FFM based connector. This = issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7=
through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upg= rade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue. 2026-06= -29 not yet calculated CVE-2026-53434 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-53434 ] Apache Software Foundation--Apache Tomcat Always-Incorrect=
Control Flow Implementation vulnerability in Apache Tomcat meant that spec= ial roles and empty authorisation constraints were not included when the ef= fective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M=
1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.= 0.118, from 8.5.0 through 8.5.100.=C2=A0Other versions that have reached en=
d of support may also be affected. Users are recommended to upgrade to vers= ion 11.0.23, 10.1.56 or 9.0.119 which fixes the issue. 2026-06-29 not yet c= alculated CVE-2026-55276 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5527=
6 ] Apache Software Foundation--Apache Tomcat Improper Authentication vulne= rability in Apache Tomcat allowed a replay attack against the EncryptionInt= erceptor in the cluster component. This issue affects Apache Tomcat: from 1= 1.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 throu=
gh 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users=
are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fix=
es the issue. 2026-06-29 not yet calculated CVE-2026-55955 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-55955 ] Apache Software Foundation--Apache To= mcat Improper Authorization vulnerability in Apache Tomcat leads to securit=
y constraints specified for the default servlet ignoring any method or meth=
od omission configured as part of the constraint. This issue affects Apache=
Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, fr=
om 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through=
7.0.109. Other versions that have reached end of support may also be affec= ted. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.11=
9, which fix the issue. 2026-06-29 not yet calculated CVE-2026-55956 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-55956 ] Apache Software Foundation-= -Apache Tomcat Missing Critical Step in Authentication vulnerability in Apa= che Tomcat when the JNDIRealm was configured to authenticate binds using GS= SAPI allowed attackers to authenticate without provided the correct passwor=
d. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10= .1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through = 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to ve= rsion 11.0.5, 10.1.37 or 9.0.101, which fixes the issue. 2026-06-29 not yet=
calculated CVE-2026-55957 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55= 957 ] Apple--iOS and iPadOS This issue was addressed with improved input va= lidation. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe = 26.5.2. An app may be able to cause unexpected system termination or corrup=
t kernel memory. 2026-06-29 not yet calculated CVE-2026-39868 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-39868 ] Apple--iOS and iPadOS The issue wa=
s addressed with improved memory handling. This issue is fixed in iOS 26.5.=
2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web=
content may lead to an unexpected process crash. 2026-06-29 not yet calcul= ated CVE-2026-43703 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43703 ] A= pple--iOS and iPadOS A double free issue was addressed with improved memory=
management. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tah=
oe 26.5.2. Processing maliciously crafted web content may lead to an unexpe= cted process crash. 2026-06-29 not yet calculated CVE-2026-43706 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-43706 ] Apple--iOS and iPadOS The issue=
was addressed with improved input sanitization. This issue is fixed in iOS=
26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be able to leak s= ensitive kernel state. 2026-06-29 not yet calculated CVE-2026-43722 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-43722 ] Apple--iOS and iPadOS The is= sue was addressed with improved input sanitization. This issue is fixed in = iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be able to cau=
se unexpected system termination or write kernel memory. 2026-06-29 not yet=
calculated CVE-2026-43724 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43= 724 ] Apple--iOS and iPadOS A race condition was addressed with improved st= ate handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. An app may be able to cause unexpected system termination. 2026= -06-29 not yet calculated CVE-2026-43743 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-43743 ] Apple--Safari An out-of-bounds access issue was address=
ed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS=
26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously craft=
ed web content may lead to an unexpected process crash. 2026-06-29 not yet = calculated CVE-2026-28979 [ https://www.cve.org/CVERecord?id=3DCVE-2026-289=
79 ] Apple--Safari The issue was addressed with improved memory handling. T= his issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. Processing maliciously crafted web content may lead to an unexp= ected process crash. 2026-06-29 not yet calculated CVE-2026-39872 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-39872 ] Apple--Safari The issue was ad= dressed with improved memory handling. This issue is fixed in Safari 26.5.2=
, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously = crafted web content may lead to an unexpected process crash. 2026-06-29 not=
yet calculated CVE-2026-43663 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-43663 ] Apple--Safari An out-of-bounds access issue was addressed with im= proved bounds checking. This issue is fixed in Safari 26.5.2, iOS 26.5.2 an=
d iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web con= tent may lead to an unexpected Safari crash. 2026-06-29 not yet calculated = CVE-2026-43676 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43676 ] Apple-= -Safari A use-after-free issue was addressed with improved memory managemen=
t. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macO=
S Tahoe 26.5.2. Processing maliciously crafted web content may lead to an u= nexpected process crash. 2026-06-29 not yet calculated CVE-2026-43699 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-43699 ] Apple--Safari A cross-orig=
in issue was addressed with improved tracking of security origins. This iss=
ue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.= 5.2. Processing maliciously crafted web content may disclose sensitive user=
information. 2026-06-29 not yet calculated CVE-2026-43700 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-43700 ] Apple--Safari The issue was addressed=
with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and=
iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious website may be able to proc= ess restricted web content outside the sandbox. 2026-06-29 not yet calculat=
ed CVE-2026-43701 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43701 ] App= le--Safari A use-after-free issue was addressed with improved memory manage= ment. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, m= acOS Tahoe 26.5.2. A malicious web extension may be able to cause an unexpe= cted process crash. 2026-06-29 not yet calculated CVE-2026-43704 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-43704 ] Apple--Safari A type confusion = issue was addressed with improved checks. This issue is fixed in Safari 26.= 5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing malicious=
ly crafted web content may lead to memory corruption. 2026-06-29 not yet ca= lculated CVE-2026-43705 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43705=
] Apple--Safari A memory corruption issue was addressed with improved memo=
ry handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26= .5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may le=
ad to an unexpected process crash. 2026-06-29 not yet calculated CVE-2026-4= 3707 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43707 ] Apple--Safari Th=
e issue was addressed with improved input validation. This issue is fixed i=
n Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malici= ous website may exfiltrate data cross-origin. 2026-06-29 not yet calculated=
CVE-2026-43708 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43708 ] Apple= --Safari A use-after-free issue was addressed with improved memory manageme= nt. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, mac=
OS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an = unexpected process crash. 2026-06-29 not yet calculated CVE-2026-43709 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-43709 ] Apple--Safari The issue w=
as addressed with improved memory handling. This issue is fixed in Safari 2= 6.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing malicio= usly crafted web content may lead to an unexpected process crash. 2026-06-2=
9 not yet calculated CVE-2026-43712 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-43712 ] Apple--Safari A permissions issue was addressed with additio= nal restrictions. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPad=
OS 26.5.2, macOS Tahoe 26.5.2. Visiting a website may leak sensitive data. = 2026-06-29 not yet calculated CVE-2026-43713 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-43713 ] Apple--Safari A use-after-free issue was addressed = with improved memory management. This issue is fixed in Safari 26.5.2, iOS = 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafte=
d web content may lead to memory corruption. 2026-06-29 not yet calculated = CVE-2026-43715 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43715 ] Apple-= -Safari The issue was addressed with improved memory handling. This issue i=
s fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2.=
Processing maliciously crafted web content may lead to an unexpected Safar=
i crash. 2026-06-29 not yet calculated CVE-2026-43716 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-43716 ] Apple--Safari A use-after-free issue was a= ddressed with improved memory management. This issue is fixed in Safari 26.= 5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing malicious=
ly crafted web content may lead to an unexpected Safari crash. 2026-06-29 n=
ot yet calculated CVE-2026-43717 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-43717 ] Apple--Safari A stack overflow was addressed with improved inpu=
t validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 2= 6.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may l= ead to an unexpected Safari crash. 2026-06-29 not yet calculated CVE-2026-4= 3718 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43718 ] Apple--Safari A = use-after-free issue was addressed with improved memory management. This is= sue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26= .5.2. Processing maliciously crafted web content may lead to an unexpected = Safari crash. 2026-06-29 not yet calculated CVE-2026-43720 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-43720 ] Apple--Safari This issue was addresse=
d through improved state management. This issue is fixed in Safari 26.5.2, = iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious website may b=
e able to silently hijack clipboard data. 2026-06-29 not yet calculated CVE= -2026-43721 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43721 ] Apple--Sa= fari The issue was addressed with improved input validation. This issue is = fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A=
malicious website may be able to process restricted web content outside th=
e sandbox. 2026-06-29 not yet calculated CVE-2026-43725 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-43725 ] Apple--Safari A use-after-free issue was=
addressed with improved memory management. This issue is fixed in Safari 2= 6.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing malicio= usly crafted web content may lead to an unexpected process crash. 2026-06-2=
9 not yet calculated CVE-2026-43726 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-43726 ] Apple--Safari A use-after-free issue was addressed with impr= oved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 an=
d iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web con= tent may lead to an unexpected Safari crash. 2026-06-29 not yet calculated = CVE-2026-43727 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43727 ] Apple-= -Safari A use-after-free issue was addressed with improved memory managemen=
t. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macO=
S Tahoe 26.5.2. Processing maliciously crafted web content may lead to memo=
ry corruption. 2026-06-29 not yet calculated CVE-2026-43731 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-43731 ] Apple--Safari A path handling issue = was addressed with improved validation. This issue is fixed in Safari 26.5.=
2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously=
crafted web content may disclose sensitive user information. 2026-06-29 no=
t yet calculated CVE-2026-43732 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-43732 ] Apple--Safari A use-after-free issue was addressed with improved=
memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iP= adOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content=
may lead to an unexpected process crash. 2026-06-29 not yet calculated CVE= -2026-43734 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43734 ] Apple--Sa= fari The issue was addressed with improved checks. This issue is fixed in S= afari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious=
website may exfiltrate data cross-origin. 2026-06-29 not yet calculated CV= E-2026-43735 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43735 ] Apple--S= afari The issue was addressed with improved memory handling. This issue is = fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. P= rocessing maliciously crafted web content may result in the disclosure of p= rocess memory. 2026-06-29 not yet calculated CVE-2026-43740 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-43740 ] Apple--Safari A use-after-free issue=
was addressed with improved memory management. This issue is fixed in Safa=
ri 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing mal= iciously crafted web content may lead to an unexpected process crash. 2026-= 06-29 not yet calculated CVE-2026-43742 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-43742 ] Apple--Safari An out-of-bounds write issue was addresse=
d with improved input validation. This issue is fixed in Safari 26.5.2, iOS=
26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously craft=
ed web content may lead to an unexpected Safari crash. 2026-06-29 not yet c= alculated CVE-2026-43745 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4374=
5 ] Apple--Safari A use-after-free issue was addressed with improved memory=
management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26= .5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may le=
ad to an unexpected Safari crash. 2026-06-29 not yet calculated CVE-2026-43= 746 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43746 ] ardupilot--Plane-= 4.6.3 ardupilot through Plane-4.6.3 was found to contain an out-of-bounds r= ead issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::h= andle_serial_control(). 2026-07-02 not yet calculated CVE-2026-38971 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-38971 ] ASUS--ASUS Business Manager=
External Control of File Name or Path vulnerability in ASUS Business Manag=
er allows a local user to execute arbitrary code with SYSTEM privileges via=
a tampered IPC message. Refer to the ' Security Update for ASUS Business M= anager=C2=A0' section on the ASUS Security Advisory for more information. 2= 026-07-03 not yet calculated CVE-2026-8921 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-8921 ] ASUS--Router app An Improper Export of Android Applica= tion Components vulnerability in ASUS Router App allows a third-party appli= cation on the same device to send a crafted Intent that causes ASUS Router = App to open an specified URL. Refer to the ' Security Update for ASUS Route=
r Android App=C2=A0' section on the ASUS Security Advisory for more informa= tion. 2026-07-03 not yet calculated CVE-2026-12960 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-12960 ] AVTECH Security Corporation--DGM3103SCT DGM31= 03SCT provided by AVTECH Security Corporation contains an OS command inject= ion vulnerability, which may lead to arbitrary command execution with the r= oot privilege by a user who can log in to the web management console of the=
affected product. 2026-06-30 not yet calculated CVE-2026-56808 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-56808 ] BIAFRA--Dancer2::Plugin::Auth::O= Auth::Provider Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 = for Perl do not support the OAuth 2.0 state parameter. The authentication_u=
rl method builds the provider authorization redirect without issuing a stat=
e value, and the callback method exchanges the callback code and registers = the resulting token into the session without verifying that the callback co= rresponds to an authorization request this session initiated. Any applicati=
on that uses this plugin for OAuth 2.0 login is exposed to login cross-site=
request forgery: because the callback is not bound to the session that beg=
an the flow, an attacker who starts an authorization with their own provide=
r account can deliver the resulting callback to a victim, causing the victi= m's session to complete the attacker's authorization and associating the at= tacker's provider identity and access token with that session. Where the ap= plication persists this as an account link, the attacker may retain access =
to the victim's account through their own provider credentials. 2026-07-04 = not yet calculated CVE-2026-12746 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-12746 ] BPS--HTML::Gumbo HTML::Gumbo versions before 0.19 for Perl dis= close heap memory via type confusion. Support for the <template> element wa=
s added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/= Gumbo.xs was not updated to support it. The element was treated as a text-n= ode, where strlen() over-reads the heap block that the pointer addresses. A=
ny caller that runs parse() with the default format =3D> 'string', or with = format =3D> 'tree', on input containing a <template> element serializes the=
over-read bytes into the returned result, disclosing bounded heap contents=
. format =3D> 'callback' reaches a croak on the unhandled node type and is = unaffected. 2026-07-01 not yet calculated CVE-2025-15646 [ https://www.cve.= org/CVERecord?id=3DCVE-2025-15646 ] bytecodealliance--wasmtime Wasmtime is =
a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 t= hrough those before 36.0.11; versions 37.0.0 through those before 44.0.3; a=
nd versions 45.0.0 and 45.0.1 contain a native implementation of WASIp1 whi=
ch suffers from a leak in the fd_renumber function where the file descripto=
r being renumbered to is not properly closed. Wasmtime's implementation err= oneously only updated the table of descriptors for WASIp1 and didn't update=
the underlying table of descriptors used by the host. This behavior means = that while fd_renumber works correctly from a guest's perspective it ends u=
p leaking resources in the host that aren't cleaned up until the correspond= ing Store is destroyed. In a loop, guests can use fd_renumber to cause host=
s to exhaust both resources and file descriptors. This bug only affects the=
native implementation of WASIp1, meaning that only runtimes which load cor=
e wasm modules and expose fd_renumber are affected. Runtimes are additional=
ly only affected if they expose the ability to acquire a file descriptor, s= uch as opening a file. For runtimes that deny access to files they are unaf= fected. This issue has been fixed in versions 24.0.10, 36.0.11, 44.0.3, and=
45.0.2. 2026-07-01 not yet calculated CVE-2026-54786 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-54786 ] Cato Networks--SDP Client Improper certifi= cate validation and a time-of-check time-of-use (TOCTOU) race condition in = the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macO=
S allows a local authenticated attacker to escalate privileges to root via =
a self-signed certificate that bypasses the XPC caller verification and a s= ymlink swap during package installation. 2026-07-01 not yet calculated CVE-= 2026-12374 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12374 ] Cloudflare= --Universal SSL Description: To issue and renew TLS certificates on behalf =
of customers, Cloudflare's Universal SSL feature automatically manages the = CAA RRset for the customer's zone. This auto-managed RRset is permissive by=
design (e.g. 'issue "letsencrypt.org"' without parameters). On Universal S=
SL zones, Cloudflare's authoritative DNS serves this auto-managed RRset at = query time, superseding any customer-configured CAA records on the zone. Wh=
en a customer publishes a stricter CAA record using the RFC 8657 accounturi=
or validationmethods parameters, the Certificate Authority does not observ=
e those parameters when evaluating the served RRset under RFC 8659. As a re= sult, the RFC 8657 account-binding and validation-method-binding protection=
s are not enforced end-to-end on Universal SSL zones. Successful exploitati=
on could result in issuance of a browser-trusted TLS certificate to an atta= cker, enabling MITM against the affected domain. Exploitation is non-trivia=
l in practice: an attacker would need to hold an ACME account at one of the=
Certificate Authorities in the served CAA RRset and to simultaneously sati= sfy domain control validation across the multiple geographically distinct N= etwork Perspectives the CA relies on for Multi-Perspective Issuance Corrobo= ration. Cloudflare prefixes are anycast-announced from hundreds of location=
s globally, raising the bar against single-vantage-point BGP hijacks. Any r= esulting misissuance of a browser-trusted certificate is subject to Certifi= cate Transparency logging required by major browsers, and would be visible =
to CT monitoring. Mitigation:=C2=A0 Customers requiring strict RFC 8657 enf= orcement need to disable Universal SSL on the affected zone. Universal SSL'=
s automatic CAA management and customer-set RFC 8657 accounturi and validat= ionmethods enforcement are mutually exclusive by the nature of the issue, s=
o there is no in-product workaround that preserves both.=C2=A0 Certificate = Transparency monitoring is recommended for all customers as a general detec= tion control. Credits: David Osipov (ORCID: https://orcid.org/0009-0005-271= 3-9242), independent researcher 2026-07-01 not yet calculated CVE-2026-1444=
0 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14440 ] containerd--contain= erd containerd is an open-source container runtime. In versions prior to 1.= 7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User direc= tive that cannot be parsed as a 32-bit integer are incorrectly treated as a=
username, leading to runAsNonRoot evasion. If a crafted image provides an = /etc/passwd file mapping this large numeric string to root, the container u= ltimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot res= triction to be bypassed, causing unexpected behavior for environments that = require containers to run as a non-root user. This issue has been fixed in = versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1. 2026-07-01 not yet calculated CVE-= 2026-46680 [ https://www.cve.org/CVERecord?id=3DCVE-2026-46680 ] containerd= --containerd containerd is an open-source container runtime. Versions prior=
to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that al= lows a maliciously crafted image to cause a Denial of Service (DoS) conditi= on. When creating a container from this image, memory exhaustion occurs, le= ading to an Out Of Memory (OOM) kill of the containerd process. This render=
s the container runtime API unavailable and can disrupt clients such as the=
Docker Engine or Kubernetes control-plane components. This issue has been = fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2. 2026-07-01 not ye=
t calculated CVE-2026-47262 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4= 7262 ] containerd--containerd containerd is an open-source container runtim=
e. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the = CRI checkpoint import process where it fails to validate the image referenc=
es specified within a checkpoint image's configuration. An attacker with pe= rmissions to create pods can use a crafted checkpoint image to force contai= nerd to pull a malicious image and assign it an arbitrary local tag, thereb=
y poisoning the node's local image cache. Subsequently, if other pods on th=
e same node attempt to use the poisoned tag with an IfNotPresent (or Never)=
pull policy, they will unknowingly execute the attacker's malicious image = instead of the legitimate one. This can lead to a compromise of the affecte=
d pods, allowing the attacker to execute arbitrary code under the victim po= d's identity. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.=
2026-07-01 not yet calculated CVE-2026-50195 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-50195 ] containerd--containerd containerd is an open-sourc=
e container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and = 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruc= tion in Dockerfile) to a container without validation. This may result in e= xecuting an arbitrary command on the host, via a plugin that consumes conta= iner labels for some operations. This issue has been fixed in versions 1.7.= 33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10. 2026-07-01 not yet calculated CVE-2026= -53488 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53488 ] containerd--co= ntainerd containerd is an open-source container runtime. Versions prior to = 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores containe= r.log from a checkpoint image without validating a symlinked path. This cou=
ld result in reading an arbitrary file on the host via kubectl logs. This i= ssue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9. 2026-07-01 not yet = calculated CVE-2026-53489 [ https://www.cve.org/CVERecord?id=3DCVE-2026-534=
89 ] containerd--containerd containerd is an open-source container runtime.=
In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improp= erly trusts Container Device Interface (CDI) annotations found within untru= sted checkpoint image metadata during container restoration. When restoring=
a container from a checkpoint, containerd preserves CDI-related annotation=
s from the checkpoint archive rather than relying solely on the pod's creat= e-time specification. This allows a user with pod creation permissions to b= ypass standard Kubernetes resource allocation and device plugin enforcement=
, injecting arbitrary CDI edits (such as device nodes and host mounts) into=
the restored container. Successful exploitation requires that the node has=
CDI enabled and contains a matching host CDI specification for the request=
ed device; environments where CDI is disabled or lacking sensitive device s= pecifications are not affected. This issue has been fixed in versions 2.3.2=
, 2.2.5 and 2.1.9. 2026-07-01 not yet calculated CVE-2026-53492 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-53492 ] CORNELIUS--Plack::Middleware::OA= uth Plack::Middleware::OAuth versions through 0.10 for Perl do not support = the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authoriza= tion redirect without issuing a state value, and AccessTokenV2 exchanges th=
e callback code and registers the resulting token into the session (registe= r_session) without verifying that the callback corresponds to an authorizat= ion request this session initiated. Any application that uses this middlewa=
re for OAuth 2.0 login is exposed to login cross-site request forgery: beca= use the callback is not bound to the session that began the flow, an attack=
er who starts an authorization with their own provider account can deliver = the resulting callback to a victim, causing the victim's session to complet=
e the attacker's authorization and associating the attacker's provider iden= tity and access token with that session. Where the application persists thi=
s as an account link, the attacker may retain access to the victim's accoun=
t through their own provider credentials. 2026-07-04 not yet calculated CVE= -2026-12740 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12740 ] craftcms-= -cms Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 = and above prior to 5.9.21, theEntriesController::actionSaveEntry() performs=
entry-edit permission checks before request-controlled author changes are = applied to the model, allowing for authorship spoofing. The subsequent auth=
or mutation path accepts attacker-supplied authors / author parameters and = allows the change when the current user is one of the old authors. Because = the controller does not re-run authorization after mutating the author list=
, a low-privileged user can reassign an entry's authorship to another user = without holding the dedicated peer-author-change permission. This issue has=
been fixed in version 5.9.21. 2026-07-01 not yet calculated CVE-2026-50279=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-50279 ] craftcms--cms Craft = CMS is a content management system (CMS). In versions 5.0.0-RC1 and above p= rior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates=
the destination section only by viewEntries:$section->uid rather than requ= iring saveEntries permission (the source entry is separately checked via En= try::canMove()). As a result, a low-privileged authenticated control-panel = user who can move an entry out of its current section can call moveEntryToS= ection() to rewrite the entry's sectionId and save it into a section where = they have read access but no write access. This breaks the section-level au= thorization model, letting a user with limited permissions inject content i= nto a protected section and interfere with editorial boundaries, approval w= orkflows, and section-specific business logic. This issue has been fixed in=
version 5.9.21. 2026-07-01 not yet calculated CVE-2026-50280 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-50280 ] craftcms--cms Craft CMS is a conte=
nt management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 conta=
in a mass-assignment flaw in the bulk-duplicate element action. An attacker=
who is only able to duplicate their own entires can submit an arbitrary id=
through the newAttributes request parameter. The duplication routine overr= ides its own id =3D null reset with that value and writes the attacker's at= tributes into the victim's existing entry row. ElementsController::beforeAc= tion() pulls the request body into $this->_attributes and rejects requests = that ship an id or canonicalId key at the top level, actionBulkDuplicate(),=
reads a separate newAttributes array and passes it straight through to the=
service layer. Elements::duplicateElement() clones the source element, set=
s id to null, and then hands the attacker's array to Craft::configure(), wh= ich overwrites the reset id with any numeric value inside $newAttributes. P=
HP Yii's saveElement() then performs an UPDATE against the row with that pr= imary key instead of an INSERT. The attackers's title, slug, authorId, post= Date, and UID land on the victim's entry. safeAttributes() on Entry include=
s id because the base element model exposes it, so the Collection::only() f= ilter does not strip it. This issue has been fixed in version 5.9.21. 2026-= 07-02 not yet calculated CVE-2026-50281 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-50281 ] craftcms--cms Craft CMS is a content management system = (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1=
and above prior to 4.17.14 contain an authorization issue where a forced f= older move can delete a conflicting destination folder without destination = delete permission. Function craft\controllers\AssetsController::actionMoveF= older() supports moving an asset folder into a destination parent folder. I=
f a folder with the same name already exists at the destination, the action=
can be called with force=3Dtrue to overwrite the destination. This issue h=
as been resolved in versions 5.9.21 and 4.17.14. 2026-07-02 not yet calcula= ted CVE-2026-50282 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50282 ] cr= aftcms--cms Craft CMS is a content management system (CMS). Versions 5.0.0-= RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization = issue in the AssetsController::actionReplaceFile that can delete a source a= sset without source delete permission by supplying both assetId and sourceA= ssetId. AssetsController::actionReplaceFile() supports replacing a target a= sset file using another existing asset as the source. The action loads: ass= etId -> $assetToReplace and sourceAssetId -> $sourceAsset, then enforces re= place permissions using ($assetToReplace ?: $sourceAsset). When both IDs ar=
e provided, this expression resolves to the target asset so no permission c= heck is performed against the source asset volume. When both assets are pre= sent, Craft copies the source file into the target and then deletes the sou= rce asset. There is no deletion check for for the source asset. An authenti= cated user who can replace files in one volume can delete assets in another=
volume where they do not have delete permission, as long as they can obtai=
n a sourceAssetId, leading to broken content references and data loss. This=
issue has been fixed in versions 4.17.14 and 5.9.21. 2026-07-01 not yet ca= lculated CVE-2026-50283 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50283=
] craftcms--cms Craft CMS is a content management system (CMS). In version=
s 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsControll= er::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permis= sion for the target folder. It never enforces deletePeerAssets:<volume-uid>=
, even though Assets::deleteFoldersByIds() cascades deletion to every desce= ndant folder and every asset inside, regardless of the uploader's assigned = privileges. A low-privilege user who has been granted folder-management rig= hts on a shared volume can therefore destroy assets uploaded by other users=
(peer assets), bypassing the per-asset peer-permission check that the sibl= ing actionDeleteAsset endpoint correctly applies. This issue has been fixed=
in versions 4.17.15 and 5.9.22. 2026-07-01 not yet calculated CVE-2026-502=
84 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50284 ] craftcms--cms Craf=
t CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5= .9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account=
can plant a JavaScript payload in a craftcms/cms issue title. When a Craft=
admin uses the CraftSupport widget's "Give feedback" screen and types a se= arch term that returns the poisoned issue, the payload executes in the admi= n's control panel session. No control panel account or elevated privileges = are required on the attacker's side. This issue has been fixed in versions = 4.17.16 and 5.9.23. 2026-07-01 not yet calculated CVE-2026-55790 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-55790 ] craftcms--cms Craft CMS is a co= ntent management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.=
0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side = Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /acti= ons/app/resource-js endpoint. By exploiting the default permissive trustedH= osts configuration, an attacker can poison the Host or X-Forwarded-Host hea= der to manipulate the application's $baseUrl. This bypasses the endpoint's = internal URL validation, forcing the backend Guzzle client to fetch a malic= ious payload from an attacker-controlled server and reflect it to the clien=
t with a Content-Type: application/javascript header. The vulnerability man= ifests when assetManager.cacheSourcePaths is set to false. This issue has b= een fixed in versions 4.18.0 and 5.10.0. 2026-07-01 not yet calculated CVE-= 2026-55791 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55791 ] craftcms--= cms Craft CMS is a content management system (CMS). In versions starting fr=
om 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0,=
the dataUrl() Twig function is included in Craft's Twig sandbox allowlist,=
allowing any control panel user granted the utility:system-messages permis= sion to embed a file-reading payload into system email templates. When thos=
e emails are sent, the server reads the target file and returns its content=
s as a base64-encoded data URL embedded in the email body. The .env file, w= hich typically contains the database password, CRAFT_SECURITY_KEY, and thir= d-party API keys, passes all of Craft's existing dataUrl() protection check=
s and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacke=
r to forge session tokens and escalate to full admin account takeover. This=
issue has been fixed in versions 4.18.0 and 5.10.0. 2026-07-01 not yet cal= culated CVE-2026-55792 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55792 =
] craftcms--cms Craft CMS is a content management system (CMS). In versions=
5.0.0-RC1 through 5.9.22, an author-level control panel user can store a m= alicious JavaScript payload in an entry title. When an admin, or any contro=
l panel user with saveEntries for the same Structure section, drags another=
entry under the poisoned entry in table view, the payload executes in the = victim's session. The issue is exploitable because the title is escaped int=
o data-title by the server, decoded again by the browser, read with jQuery = .data('title'), and then concatenated into a new HTML string without attrib= ute escaping. To exploit, an attacker must have an existing control panel a= ccount (Author role minimum), the victim must perform a drag operation (not=
just visit the page), and the victim's session needs to be elevated at tri= gger time. This issue has been fixed in version 5.9.23. 2026-07-01 not yet = calculated CVE-2026-55793 [ https://www.cve.org/CVERecord?id=3DCVE-2026-557=
93 ] craftcms--cms Craft CMS is a content management system (CMS). In versi= ons 5.9.0 and above prior to 5.10.0, control panel users with the ability t=
o edit entries can execute unsandboxed Twig code via the HTTP Referrer head= er, potentially leading to authenticated RCE. The issue happens when a user=
is saving entries. Strings for a signed redirect URL are being compiled as=
a Twig template via renderObjectTemplate(), and while a sandboxed alternat= ive already exists (renderSandboxedObjectTemplate()), it is not used in thi=
s case. This signed URL can be specified by users, as it is reflected in th=
e "Referer" HTTP request header, which is under attacker control. This issu=
e has been fixed in version 5.10.0. 2026-07-01 not yet calculated CVE-2026-= 55794 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55794 ] CubeSpace--CW00=
57 Reaction Wheel CubeSpace CW0057 Reaction Wheel firmware versions prior t=
o 5.0.20 are vulnerable to an Improper Verification of Cryptographic Signat= ure vulnerability. This could allow an attacker with physical access to the=
product to upload arbitrary malicious firmware to the device without authe= ntication. 2026-07-02 not yet calculated CVE-2026-13743 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-13743 ] curl--curl A use-after-free vulnerabilit=
y exists in libcurl when an application configures an HTTP/2 stream-depende= ncy tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subseq= uently invokes `curl_easy_reset()`, and finally terminates the handle with = `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to=
access and modify an internal structure that was already freed during the = reset operation. 2026-07-03 not yet calculated CVE-2026-10536 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-10536 ] curl--curl An issue in curl's QUIC=
UDP receive function allows a malicious HTTP/3 server to trigger a remote = denial of service against a curl or libcurl client. Because the helper func= tion discards zero-length UDP datagrams before counting them toward the per= -call packet budget, a connected QUIC peer can continuously stream empty da= tagrams to indefinitely stall the client. 2026-07-03 not yet calculated CVE= -2026-11352 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11352 ] curl--cur=
l libcurl keeps previously used connections in a connection pool for subseq= uent transfers to reuse if one of them matches the setup. An easy handle th=
at first uses default native CA trust can continue trusting the native plat= form store after the application switches that same handle to custom CA mat= erial for a later transfer. 2026-07-03 not yet calculated CVE-2026-11564 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-11564 ] curl--curl By default, = curl automatically responds to WebSocket PING frames. Because curl lacks an=
upper bound on memory allocation for unacknowledged frames, a malicious se= rver can exhaust all available memory by flooding curl with rapid, sequenti=
al PING messages. 2026-07-03 not yet calculated CVE-2026-11586 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-11586 ] curl--curl Successfully using lib= curl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** a= uthentication and then changing the origin to a different one (`hostB`) for=
a second transfer, reusing the same handle, makes libcurl wrongly pass on = the `Authorization:` header field meant for `hostA`, to `hostB`. 2026-07-03=
not yet calculated CVE-2026-11856 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-11856 ] curl--curl When a user invokes curl using a schemeless URL co= mbined with `--proto-default` sftp (or scp), a disconnect occurs between th=
e tool layer and libcurl. The tool layer incorrectly infers the URL scheme,=
which erroneously bypasses the initialization of critical SSH security opt= ions like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Co= nversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL = and establishes the connection via SFTP/SCP as specified. Because the tool = layer skipped the security configuration, these SSH host verification optio=
ns are silently omitted, causing curl to connect to an unverified SSH remot=
e host without throwing an error. 2026-07-03 not yet calculated CVE-2026-12= 064 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12064 ] curl--curl A vuln= erability exists where a new transfer that uses STARTTLS to upgrade the con= nection might reuse an existing live connection even though the TLS configu= ration mismatches so it should not. 2026-07-03 not yet calculated CVE-2026-= 8286 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8286 ] curl--curl libcur=
l might in some circumstances reuse the wrong connection when asked to do N= egotiate-authenticated ones, even when they are set to use different 'servi= ces'. libcurl features a pool of recent connections so that subsequent requ= ests can reuse an existing connection to avoid overhead. When reusing a con= nection a range of criteria must be met. Due to a logical error in the code=
, a request that was issued by an application could wrongfully reuse an exi= sting connection to the same server that was authenticated using different = services. 2026-07-03 not yet calculated CVE-2026-8458 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-8458 ] curl--curl A flaw in curl's cookie parsing = logic allows a malicious HTTP server to set 'super cookies' that bypass the=
Public Suffix List check. This enables an attacker-controlled origin to in= ject cookies that curl subsequently scopes and transmits to unrelated third= -party domains. 2026-07-03 not yet calculated CVE-2026-8924 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-8924 ] curl--curl The curl logic that works = with SASL authentication could end up cleaning up the GSASL context *twice*=
without clearing the pointer in between, making it `free()` the same point=
er twice. 2026-07-03 not yet calculated CVE-2026-8925 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-8925 ] curl--curl When asking curl to use a `.netr=
c` file to find credentials and at the same time specifying a URL with a us= ername(without a password), like `https://user@example.com/`, curl could wr= ongly get and use the password for *another* user set in the `.netrc` file = for that host if such a one exists and there is no match for the specified = user. 2026-07-03 not yet calculated CVE-2026-8926 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-8926 ] curl--curl When reusing a libcurl handle for se= quential transfers driven by environment-variable proxy configuration, libc= url fails to clear the proxy authentication state between requests. Specifi= cally, if the initial transfer authenticates against `proxyA` using Digest = auth, a subsequent transfer routed through `proxyB` erroneously leaks the `= Proxy-Authorization:` header intended solely for `proxyA`. 2026-07-03 not y=
et calculated CVE-2026-8927 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8= 927 ] curl--curl libcurl would reuse a previously created connection even w= hen some mTLS config related option had been changed that should have prohi= bited reuse. libcurl keeps previously used connections in a connection pool=
for subsequent transfers to reuse if one of them matches the setup. Howeve=
r, some TLS settings related to client certificates were left out from the = configuration match checks, making them match too easily. In particular opt= ions related to the private key. 2026-07-03 not yet calculated CVE-2026-893=
2 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8932 ] curl--curl libcurl h=
ad a flaw that when instructed to clear proxy authentication credentials wh= ich made it not do so, leaving the old credentials around to get used for s= ubsequent transfers that should not know nor use them. 2026-07-03 not yet c= alculated CVE-2026-9079 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9079 =
] curl--curl Calling `curl_easy_pause()` within the event-based `CURLMOPT_S= OCKETFUNCTION` callback triggers a use-after-free vulnerability, where libc= url attempts to store a flag using a dangling struct pointer immediately af= ter that pointer's memory has been freed. 2026-07-03 not yet calculated CVE= -2026-9080 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9080 ] curl--curl =
In this scenario, libcurl first uses a proper HTTP/3 server for the initial=
transfers, and when it makes a second transfer to the same site it has bee=
n replaced by the attacker's impostor machine - without a valid certificate=
. When libcurl returns to the hostname the second time with a cached SSL se= ssion (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enable=
d (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl=
might send off the second request's bytes on that new connection *before* = enforcing the certificate verification failure. Potentially leaking sensiti=
ve information. 2026-07-03 not yet calculated CVE-2026-9545 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-9545 ] curl--curl A vulnerability in libcurl=
caused the HTTP `Referer:` header to persist even when explicitly cleared.=
While the documentation states that passing NULL to `CURLOPT_REFERER` supp= resses the header, the option failed to clear the internal state. As a resu=
lt the previous referrer string was erroneously reused and sent in subseque=
nt requests, potentially leaking sensitive information to unintended server=
s. 2026-07-03 not yet calculated CVE-2026-9546 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-9546 ] curl--curl When a libcurl-based application perfor=
ms transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUN= CTION` callback, it may silently accept an untrusted server. This vulnerabi= lity occurs when a server presents a host key type that does not match the = specific key type already recorded for that host in the `known_hosts` file.=
Instead of rejecting the mismatch, the callback mechanism fails to properl=
y enforce the restriction, allowing the connection to succeed without warni=
ng and risking a potential man-in-the-middle attack. 2026-07-03 not yet cal= culated CVE-2026-9547 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9547 ] = cve-search--cve-search An unauthenticated improper input validation vulnera= bility in the POST /fetch_cve_data endpoint in cve-search. A remote attacke=
r can manipulate request parameters controlling the MongoDB collection, pro= jected fields, and regular-expression filters to read arbitrary application=
MongoDB collections. This can expose administrative usernames and password=
hashes from the mgmt_users collection, enabling offline password cracking = and potential administrative account compromise. 2026-07-05 not yet calcula= ted CVE-2026-59509 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59509 ] de= ltaww--DTMSoft The affected product is vulnerable to a deserialization of u= ntrusted data, which may allow an attacker to execute arbitrary code. 2026-= 06-30 not yet calculated CVE-2026-12578 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-12578 ] deltaww--DVP-12SE Delta Electronics DVP12SE PLCs are su= sceptible to a resource allocation vulnerability without limits or throttli=
ng (CWE-770) within their Modbus TCP service. 2026-06-30 not yet calculated=
CVE-2026-12818 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12818 ] delta= ww--DVP-12SE Delta Electronics DVP12SE PLC exposes a Modbus TCP service ove=
r a specified port without authentication or access control, permitting una= uthenticated interaction with security-sensitive PLC functions. 2026-06-30 = not yet calculated CVE-2026-12819 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-12819 ] deltaww--DVP80ES3 DVP80ES3 with Improperly Implemented Securit=
y Check for Standard vulnerability. 2026-07-01 not yet calculated CVE-2026-= 12577 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12577 ] Devolutions--Po= werShell Universal Insertion of sensitive information into sent data in the=
AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an au= thenticated user with AI Agent read access to obtain reusable, potentially = higher-privileged authentication tokens via App Tokens serialized in plaint= ext in job API responses. 2026-06-29 not yet calculated CVE-2026-13437 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-13437 ] DokuWiki--Librarian 56.2 =
An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker =
to create an account via the register function in inc/auth.php. NOTE: this =
is disputed by the Supplier because this is the intentional behavior when t=
he product is configured for self-registration (a non-default feature). 202= 6-06-30 not yet calculated CVE-2026-37106 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-37106 ] Eclipse Foundation--Eclipse CSI - PIA The /v1/upload/s= bom endpoint extracts the iss claim from the attacker-supplied JWT with sig= nature verification disabled, then interpolates that string into three log = statements before any validation gate. Because the configured log format ("= %(asctime)s - %(name)s - %(levelname)s - %(message)s") renders newlines lit= erally, an unauthenticated attacker can forge log records that are byte-for= -byte indistinguishable from PIA's genuine "Successfully authenticated proj= ect" message. PIA is an authentication broker whose logs are explicitly rel= ied upon for incident response (DESIGN.md =C3=82=C2=A75.4 lists "Token veri= fications" and "Errors" as events to log), so the ability to plant fake aut= h-success entries directly undermines the audit trail the service exists to=
produce. 2026-06-29 not yet calculated CVE-2026-12616 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-12616 ] Eclipse Foundation--Eclipse tinydtls Ecli= pse tinydtls before commit=C2=A0b3efd41ad111a4920f599f51ffa4f5e9f1e72221 co= ntains an out-of-bounds read vulnerability in the check_server_certificate(=
) function that allows unauthenticated attackers to trigger reads beyond va= lid buffer boundaries by crafting a Certificate handshake message with a sp= ecific fragment_length value. Attackers can exploit missing buffer length v= alidation before uint24 reads, memcmp, and memcpy operations during DTLS ep= och 0 on both client and server paths to cause denial of service on memory-= constrained devices. 2026-06-29 not yet calculated CVE-2026-9267 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-9267 ] EIPStackGroup--OpENer A buffer o= verflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 7= 6b95c allows attackers to cause a Denial of Service (DoS) via supplying a c= rafted Common Packet Format (CPF) packet. 2026-06-29 not yet calculated CVE= -2026-51221 [ https://www.cve.org/CVERecord?id=3DCVE-2026-51221 ] electron-= userland--electron-builder electron-updater allows for automatic updates fo=
r Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.pr= epareRedirectUrlOptions) only stripped a credential header whose key string=
matched exactly lowercase "authorization", exposing credentials. Other cre= dential-bearing headers - most notably PRIVATE-TOKEN (used by GitLab's pers= onal access token flow) and mixed-case Authorization (used by GitLab's Bear= er/OAuth flow) - were not stripped and could be forwarded to an attacker-co= ntrolled cross-origin redirect destination. This issue has been fixed in ve= rsion 9.7.0. 2026-06-30 not yet calculated CVE-2026-54673 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-54673 ] Erlang--OTP Observable Response Discre= pancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenti= cated SFTP user to enumerate the existence of files and directories outside=
the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd c= alls relate_file_name/3 with Canonicalize=3Dfalse, unlike every other SFTP = operation handler. This allows .. components in the requested path to bypas=
s the is_within_root/2 check without being resolved. The un-canonicalized p= ath then enters resolve_symlinks/2, which walks up the directory tree above=
the configured root and issues read_link() syscalls on arbitrary filesyste=
m paths. An authenticated SFTP client can exploit this by sending a REALPAT=
H request with a crafted traversal path. The server response differs depend= ing on whether the target path exists on the host filesystem (SSH_FXP_NAME = when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not).=
This creates a path-existence oracle that an attacker can use to enumerate=
the filesystem structure outside the configured root, including the existe= nce of sensitive files, directories, and mount points. The vulnerability le= aks only the existence of paths. No file contents, credentials, or write ac= cess are obtainable through this issue alone. The information gained may as= sist further attacks when combined with other vulnerabilities. This vulnera= bility is associated with program files lib/ssh/src/ssh_sftpd.erl and progr=
am routine ssh_sftpd:handle_op/4. This issue affects OTP from OTP 17.0 unti=
l OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until=
6.0.2, 5.5.2.2, and 5.2.11.9. 2026-07-02 not yet calculated CVE-2026-53422=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-53422 ] Erlang--OTP Loop wit=
h Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP = ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP = channel permanently unresponsive. The handle_data/4 function in ssh_sftpd c= ontains a catch-all clause that accepts channel data of any type. When chan= nel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives = with an empty pending buffer and a payload at or below the SFTP packet size=
limit, the clause tail-calls itself with identical arguments, creating an = infinite loop. The SFTP protocol operates exclusively on normal channel dat=
a (type 0). Extended data (non-zero type) is meaningless for SFTP and is ne= ver sent by conforming clients. However, the SSH protocol permits any chann=
el participant to send extended data on an open channel, so an authenticate=
d SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_EXTENDED_DATA=
with any data_type_code and any non-empty payload at or below the size lim= it. The targeted ssh_sftpd process enters an infinite tail-recursive loop. =
It never processes another message, its message queue grows without bound, = and it can only be stopped by killing the process. BEAM's reduction-based s= cheduler preemption continues to function, so other processes on the node a=
re not starved, but each stuck channel process consumes its full CPU time s= hare continuously and accumulates unbounded message queue memory. Opening m= any channels amplifies the CPU and memory impact. Erlang/OTP SSH configurat= ions using the default max_channels setting (infinity) allow an authenticat=
ed user to open unlimited channels per connection, amplifying the attack wi= thout requiring multiple TCP connections or authentications. No file conten= ts, credentials, or write access are obtainable through this issue. The imp= act is limited to denial of service on targeted SFTP channels, with seconda=
ry CPU degradation and memory growth. This vulnerability is associated with=
program file lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handl= e_data/4. This issue affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, = and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2= .11.9. 2026-07-02 not yet calculated CVE-2026-54886 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-54886 ] Erlang--OTP Use of Default Cryptographic Key=
vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cook=
ie computation during the startup window, enabling source address verificat= ion bypass. On DTLS server startup, dtls_server_connection:initial_hello/3 = initializes previous_cookie_secret to the empty binary (<<>>) instead of a = random value. Because HMAC with an empty key is deterministic, anyone who o= bserves the plaintext ClientHello can compute dtls_handshake:cookie(<<>>, I=
P, Port, Hello) and forge a valid DTLS cookie before the first rotation of = the cookie secret. The DTLS cookie (RFC 6347 =C3=82=C2=A74.2.1) is a denial= -of-service mitigation that prevents spoofed source IPs from forcing the se= rver to allocate state and perform expensive cryptographic operations; it i=
s not an authentication mechanism. During the window from server startup un= til the first secret rotation (0 to 15 seconds), an attacker who can observ=
e the plaintext ClientHello can bypass the source address verification, ena= bling DTLS handshake amplification with spoofed source addresses. This vuln= erability is associated with program file lib/ssl/src/dtls_server_connectio= n.erl and program routine dtls_server_connection:initial_hello/3. This issu=
e affects OTP from OTP 20.0 before 29.0.3, 28.5.0.3 and 27.3.4.14 correspon= ding to ssl from 8.2 before 11.7.3, 11.6.0.3 and 11.2.12.10. 2026-07-02 not=
yet calculated CVE-2026-54887 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-54887 ] Erlang--OTP Improper Enforcement of Message Integrity During Tran= smission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_ge= n_connection module) allows a network-positioned attacker to inject unauthe= nticated plaintext that the TLS client application later treats as authenti= cated server data. The function tls_gen_connection:handle_protocol_record/3=
rejects APPLICATION_DATA records that arrive in pre-handshake states when = the TLS endpoint acts as a server, but does not apply the same check when t=
he endpoint acts as a client. A network-positioned attacker can send plaint= ext APPLICATION_DATA records to the client during the handshake. The record=
s are buffered and, once the handshake completes successfully, delivered to=
the application as if they were authenticated post-handshake data. The att= acker cannot observe the client's response or steer the connection, so the = impact is limited to blind injection of unauthenticated bytes. The injectio=
n window is wider for TLS versions prior to TLS 1.3 than for TLS 1.3. This = vulnerability is associated with program file lib/ssl/src/tls_gen_connectio= n.erl. This issue affects OTP from OTP 17.0 before 29.0.3, 28.5.0.3 and 27.= 3.4.14 corresponding to ssl from 5.3.4 before 11.7.3, 11.6.0.3 and 11.2.12.= 10. TLS 1.3 is affected starting with OTP 22.0, when TLS 1.3 support was ad= ded. 2026-07-02 not yet calculated CVE-2026-54891 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-54891 ] Erlang--OTP Time-of-check Time-of-use (TOCTOU)=
race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) = allows an unauthenticated remote attacker to crash all active DTLS sessions=
on a listener. A DTLS server listener uses a single shared dtls_packet_dem=
ux gen_server process to route incoming UDP datagrams to the correct connec= tion handler. When a DTLS client reconnects rapidly from the same source ad= dress and port (sending multiple ClientHello messages in quick succession),=
a race condition in the demux's internal gb_trees key-value store causes a=
{key_exists, {old, Client}} crash, terminating the demux process. Because = the demux is shared across all DTLS associations on that listener, its cras=
h immediately kills every active DTLS session, not just the attacker's. The=
attack is pre-authentication: the attacker only needs to send UDP datagram=
s containing valid ClientHello messages from the same source IP and port be= fore the intermediate DOWN monitor message is processed by the gen_server. =
No credentials, no completed handshake, and no special configuration are re= quired, and the crash can be repeated indefinitely to create a persistent d= enial of service for all clients of that listener. This vulnerability is as= sociated with program file lib/ssl/src/dtls_packet_demux.erl. This issue af= fects OTP from OTP 25.3 before 29.0.3, 28.5.0.3, and 27.3.4.14 correspondin=
g to ssl from 10.9 before 11.7.3, 11.6.0.3, and 11.2.12.10. 2026-07-02 not = yet calculated CVE-2026-55950 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -55950 ] Erlang--OTP The Erlang/OTP ssl application does not validate that = the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-= shared key extension have equal length before passing them to the session t= icket handler. In tls_handshake_1_3:handle_pre_shared_key/3, an OfferedPreS= haredKeys record with a mismatched number of identities and binders is forw= arded directly to tls_server_session_ticket:use/4, which crashes the sessio=
n ticket handler process. An unauthenticated remote attacker can send a sin= gle crafted ClientHello to a TLS 1.3 server with session tickets enabled (s= tateful or stateless mode) and permanently disrupt session ticket handling =
on that listener. New TLS 1.3 handshakes complete but subsequently crash wh=
en the server attempts to issue a session ticket, effectively making TLS 1.=
3 unusable on the affected listener until the ssl application is restarted.=
TLS 1.2 connections are not affected. This issue affects OTP from 22.2 bef= ore 29.0.3, 28.5.0.3 and 27.3.4.14 corresponding to ssl from 9.5 before 11.= 7.3, 11.6.0.3 and 11.2.12.10. 2026-07-02 not yet calculated CVE-2026-55952 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-55952 ] EXODIST--DBIx::QuickO=
RM DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via=
unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subclas=
s, sets bindtype in its constructor but never quote_char, so SQL::Abstract = emits identifiers verbatim. Caller-supplied identifiers (order_by, where-cl= ause column keys, field and returning lists, upsert columns, and join alias= es) reach the SQL string raw, while values are placeholder-bound and unaffe= cted. A caller that forwards untrusted input to an affected identifier posi= tion, such as a user-controlled order_by value, enables SQL injection: the = row order can be made to depend on a sub-select over columns the query neve=
r selected, and the where and update identifier positions permit further da=
ta disclosure and tampering. 2026-06-30 not yet calculated CVE-2026-13766 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-13766 ] Flowise--Flowise Flowi=
se before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*=
) on its text-to-speech (TTS) generation endpoint (packages/server/src/cont= rollers/text-to-speech/index.ts), independent of the server's configured CO=
RS policy. This bypasses the server's otherwise restrictive default CORS co= nfiguration (getCorsOptions()) and allows any webpage to make cross-origin = requests that trigger TTS generation using stored credentials, enabling dri= ve-by cross-origin credential abuse. 2026-06-30 not yet calculated CVE-2026= -56277 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56277 ] fzf--fzf fzf i=
s vulnerable to=C2=A0Integer Overflow leading to crash in FuzzyMatchV2 func= tion. When input line length is=C2=A0approximately 2,200,000 bytes and patt= ern length is 999 bytes, the product=C2=A0overflows.=C2=A0The Go runtime de= tects the invalid slice bounds and terminates the=C2=A0process immediately = with a non-recoverable panic. This issue was fixed in version 0.73.1. 2026-= 06-30 not yet calculated CVE-2026-53432 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-53432 ] fzf--fzf fzf is vulnerable to a Denial of Service (DoS)=
due to inefficient HTTP body processing in the --listen mode due to ineffi= cient HTTP body processing using repeated string concatenation, resulting i=
n quadratic time complexity (O(n=C3=82=C2=B2)). A crafted POST request with=
many small segments can trigger excessive CPU usage during request handlin= g.This allows a single malicious request to monopolize the single-threaded = HTTP server, blocking all other clients and resulting in denial of service.=
This issue was fixed in version 0.73.1. 2026-06-30 not yet calculated CVE-= 2026-53433 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53433 ] gazebo--ga= zebo_plugins v3.9.0 An improper input validation in the gazebo_ros_diff_dri= ve.cpp component of gazebo_plugins v3.9.0 allows attackers to cause a Denia=
l of Service (DoS) via supplying a crafted geometry_msgs::Twist message. 20= 26-07-01 not yet calculated CVE-2026-38891 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-38891 ] Gigamon--GVOS v.5.16.1 Gigamon GVOS v5.16.1 and below=
is vulnerable to Directory Traversal in the GVOS H-VUE subsystem. 2026-06-=
29 not yet calculated CVE-2026-36848 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-36848 ] Gitea--Gitea Open Source Git Server Gitea versions up to an=
d including 1.26.1 allow repository archive downloads to bypass token scope=
checks on the web archive download endpoint. 2026-07-03 not yet calculated=
CVE-2026-20706 [ https://www.cve.org/CVERecord?id=3DCVE-2026-20706 ] Gitea= --Gitea Open Source Git Server Gitea versions before 1.25.5 have insufficie=
nt permission checks when listing tracked time entries. 2026-07-03 not yet = calculated CVE-2026-20909 [ https://www.cve.org/CVERecord?id=3DCVE-2026-209=
09 ] Gitea--Gitea Open Source Git Server Gitea versions before 1.25.5 lack = validation constraints for repository creation fields, including length-lim= ited template fields and trust model or object format values. 2026-07-03 no=
t yet calculated CVE-2026-22547 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-22547 ] Gitea--Gitea Open Source Git Server Gitea 1.26.2 allows fork syn= chronization to continue after a parent repository changes from public to p= rivate, exposing data to a fork that should no longer be authorized. 2026-0= 7-03 not yet calculated CVE-2026-24451 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-24451 ] Gitea--Gitea Open Source Git Server Gitea versions befo=
re 1.25.5 have insufficient permission checks for updating or rebasing pull=
request branches. 2026-07-03 not yet calculated CVE-2026-24690 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-24690 ] Gitea--Gitea Open Source Git Ser= ver Gitea 1.26.2 allows unauthorized users to access labels of private orga= nizations. 2026-07-03 not yet calculated CVE-2026-25038 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-25038 ] Gitea--Gitea Open Source Git Server Gite=
a versions before 1.25.5 have insufficient visibility checks in organizatio=
n permission APIs for hidden members and private organizations. 2026-07-03 = not yet calculated CVE-2026-25712 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-25712 ] Gitea--Gitea Open Source Git Server Gitea versions before 1.25=
.5 mishandle path resolution during template repository generation, allowin=
g template processing to read or write through symlinked or otherwise non-r= egular paths. 2026-07-03 not yet calculated CVE-2026-25718 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-25718 ] Gitea--Gitea Open Source Git Server G= itea versions up to and including 1.25.4 allow redirect bypasses through ra=
w or percent-encoded backslashes in redirect_to values. 2026-07-03 not yet = calculated CVE-2026-25779 [ https://www.cve.org/CVERecord?id=3DCVE-2026-257=
79 ] Gitea--Gitea Open Source Git Server Gitea versions before 1.25.5 look =
up tracked-time entries by time ID without scoping the lookup to the issue =
in the request URL, allowing deletion attempts to target entries from anoth=
er issue. 2026-07-03 not yet calculated CVE-2026-25782 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-25782 ] Gitea--Gitea Open Source Git Server Gitea=
versions before 1.25.5 do not consistently enforce OAuth2 authorization co=
de expiry and single-use behavior during token exchange. 2026-07-03 not yet=
calculated CVE-2026-26232 [ https://www.cve.org/CVERecord?id=3DCVE-2026-26= 232 ] Gitea--Gitea Open Source Git Server Gitea versions before 1.25.5 do n=
ot persist the OAuth2 PKCE S256 challenge method correctly during authoriza= tion, allowing token exchange without the expected verifier check. 2026-07-=
03 not yet calculated CVE-2026-26247 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-26247 ] Gitea--Gitea Open Source Git Server Gitea versions before 1= .25.5 do not use the migration HTTP transport for LFS push and sync mirror = operations, bypassing the configured migration transport protections for th= ose LFS requests. 2026-07-03 not yet calculated CVE-2026-26292 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-26292 ] Gitea--Gitea Open Source Git Serv=
er Gitea versions before 1.25.5 do not enforce a timeout on git grep search= es, allowing expensive searches to consume server resources. 2026-07-03 not=
yet calculated CVE-2026-26307 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-26307 ] Gitea--Gitea Open Source Git Server Gitea versions before 1.25.5 = allow a user to change another user's primary email address. 2026-07-03 not=
yet calculated CVE-2026-27657 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-27657 ] Gitea--Gitea Open Source Git Server Gitea versions before 1.25.5 = allow draft release data or attachments to be accessed without the required=
write permission. 2026-07-03 not yet calculated CVE-2026-27660 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-27660 ] Gitea--Gitea Open Source Git Ser= ver Gitea versions up to and including 1.26.1 have insufficient permission = checks for Composer package source links, which can expose private or inter= nal package source information. 2026-07-03 not yet calculated CVE-2026-2777=
1 [ https://www.cve.org/CVERecord?id=3DCVE-2026-27771 ] Gitea--Gitea Open S= ource Git Server Gitea 1.25.5 caches a branch-specific write-permission res= ult across multiple refs in one pre-receive hook session, allowing a per-br= anch maintainer-edit grant to be reused for other refs and escalate to full=
repository write access. 2026-07-03 not yet calculated CVE-2026-27775 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-27775 ] Gitea--Gitea Open Source = Git Server Gitea versions before 1.25.5 accept malformed or injected forwar= ded-proto values when detecting public URLs, allowing spoofed canonical URL=
generation. 2026-07-03 not yet calculated CVE-2026-27779 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-27779 ] Gitea--Gitea Open Source Git Server Gi= tea versions before 1.26.0 do not fail closed on bufio.Scanner errors while=
processing pre-receive hook input, allowing oversized input to bypass bran= ch-protection checks. 2026-07-03 not yet calculated CVE-2026-27780 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-27780 ] Gitea--Gitea Open Source Git = Server Gitea versions before 1.25.5 use release tag names and asset names a=
s filesystem path components when dumping release assets, allowing speciall=
y crafted names to affect dump output paths. 2026-07-03 not yet calculated = CVE-2026-28705 [ https://www.cve.org/CVERecord?id=3DCVE-2026-28705 ] Gitea-= -Gitea Open Source Git Server Notification API leaks private issue metadata=
after access revocation 2026-07-03 not yet calculated CVE-2026-58419 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-58419 ] Gitea--Gitea Open Source G=
it Server Unauthenticated ReDoS via CODEOWNERS pattern matching allows deni=
al of service 2026-07-03 not yet calculated CVE-2026-58421 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-58421 ] Gitea--Gitea Open Source Git Server I= mproper authorization on OAuth sign-in callback silently re-enables adminis= trator-disabled accounts 2026-07-03 not yet calculated CVE-2026-58422 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-58422 ] GitHub--Enterprise Server =
A stored cross-site scripting vulnerability was identified in GitHub Enterp= rise Server that allowed an authenticated attacker to execute arbitrary Jav= aScript in another user's browser by injecting a crafted payload into the t= itle of a Discussion in the Q&A category. The AnsweredQuestionStructuredDat= aComponent did not escape user-controlled Discussion titles before embeddin=
g them in a <script type=3D"application/ld+json"> block, allowing the title=
to break out of the script context. The injection was escalated to a full = cross-site scripting attack on GitHub Enterprise Server by leveraging JSONP=
callback support in the REST API to bypass the Content Security Policy. Th=
is vulnerability affected all versions of GitHub Enterprise Server prior to=
3.21 and was fixed in versions 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. = This vulnerability was reported via the GitHub Bug Bounty program. 2026-06-=
30 not yet calculated CVE-2026-10585 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-10585 ] GitHub--Enterprise Server An incorrect authorization vulner= ability was identified in GitHub Enterprise Server that allowed a user-to-s= erver token scoped to a GitHub App installation to perform certain write op= erations on public repositories outside the token's intended scope. This wa=
s possible because the authorization check only verified that the installat= ion had read permissions on the target repository rather than verifying tha=
t the token's installation was explicitly granted access to that repository=
. An attacker who obtained a victim's user-to-server token could create iss= ues, issue comments, commit comments, and private vulnerability reports on = any public repository, appearing as the victim user with no indication of t=
he app involvement. This vulnerability was fixed by adding a repository sco=
pe check for user-to-server tokens issued by global apps. This vulnerabilit=
y affected all versions of GitHub Enterprise Server prior to 3.22 and was f= ixed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vu= lnerability was reported via the GitHub Bug Bounty program. 2026-07-01 not = yet calculated CVE-2026-14340 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -14340 ] GitHub--Enterprise Server A UI misrepresentation vulnerability was=
identified in GitHub Enterprise Server that allowed an OAuth application t=
o gain unintended access to an organization's runner management. An attacke=
r could exploit this by creating an OAuth application requesting the manage= _runners:org scope and directing a victim user to authorize it, as the scop=
e was not displayed on the authorization consent screen. This vulnerability=
affected all versions of GitHub Enterprise Server prior to 3.22 and was fi= xed in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. This vul= nerability was reported via the GitHub Bug Bounty program. 2026-06-30 not y=
et calculated CVE-2026-9106 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9= 106 ] GitHub--Enterprise Server A missing authorization vulnerability was i= dentified in GitHub Enterprise Server that allowed an authenticated user to=
read source code from private repositories they did not have access to. Th=
e Copilot pull request description diff summary endpoint accepted a cross-r= epository comparison range and rendered the resulting diff without verifyin=
g that the requesting user was authorized to view the target repository. Ex= ploitation required an authenticated account on the instance with read acce=
ss to at least one repository to use as the comparison base. This vulnerabi= lity affected all versions of GitHub Enterprise Server prior to 3.21 and wa=
s fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. This vulnerabilit=
y was reported via the GitHub Bug Bounty program. 2026-06-30 not yet calcul= ated CVE-2026-9132 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9132 ] GNU= --gzip GNU gzip contains a vulnerability in the gzexe utility related to in= secure temporary file handling. When the mktemp utility is not available in=
the user's PATH, gzexe falls back to constructing a temporary file path ba= sed solely on the process ID (PID). This predictable filename is created wi= thout exclusive access or existence checks. A local attacker can pre-create=
the predicted temporary file path as a symbolic link pointing to an arbitr= ary file writable by the victim. When gzexe runs, it follows the symlink an=
d overwrites the target file, resulting in a time-of-check to time-of-use (= TOCTOU) condition that allows arbitrary file overwrite. This issue has been=
fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 2026-06-29 no=
t yet calculated CVE-2026-41991 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-41991 ] GNU--gzip GNU gzip contains a global buffer overflow vulnerabili=
ty in the LZH decompression logic caused by improper reuse of shared global=
state between different decompression formats within a single execution. G=
NU gzip maintains a global array that is shared across the LZ77, LZW, and L=
ZH decompression routines and is not reinitialized between files processed =
in the same invocation. By decompressing a specially crafted LZW file follo= wed by a specially crafted LZH file in a single gzip -d command, an attacke=
r can poison the shared global state and subsequently trigger an out-of-bou= nds read in the LZH decoder. The LZH decompression logic follows stale valu=
es left in the shared array, causing reads past the end of the allocated gl= obal buffer. This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a= 64e609b10e23969681 2026-06-29 not yet calculated CVE-2026-41992 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-41992 ] GoAdminGroup--GoAdmin SQL Inject= ion vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a r= emote attacker to execute arbitrary code and obtain sensitive information v=
ia the the __sort_type URL parameter on all /admin/info/{table} endpoints 2= 026-07-01 not yet calculated CVE-2026-51946 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-51946 ] Google--Chrome Use after free in Extensions in Googl=
e Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to=
install a malicious extension to execute arbitrary code via a crafted Chro=
me Extension. (Chromium security severity: Critical) 2026-06-30 not yet cal= culated CVE-2026-13774 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13774 =
] Google--Chrome Use after free in GPU in Google Chrome prior to 150.0.7871= .47 allowed a remote attacker who had compromised the renderer process to p= otentially perform a sandbox escape via a crafted HTML page. (Chromium secu= rity severity: Critical) 2026-06-30 not yet calculated CVE-2026-13775 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-13775 ] Google--Chrome Type Confus= ion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attack=
er who had compromised the renderer process to potentially perform a sandbo=
x escape via a crafted HTML page. (Chromium security severity: Critical) 20= 26-06-30 not yet calculated CVE-2026-13776 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-13776 ] Google--Chrome Insufficient validation of untrusted i= nput in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a rem= ote attacker to potentially exploit heap corruption via a crafted HTML page=
. (Chromium security severity: Critical) 2026-06-30 not yet calculated CVE-= 2026-13777 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13777 ] Google--Ch= rome Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.4=
7 allowed a local attacker to execute arbitrary code via a malicious periph= eral. (Chromium security severity: Critical) 2026-06-30 not yet calculated = CVE-2026-13778 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13778 ] Google= --Chrome Use after free in Chromoting in Google Chrome on ChromeOS prior to=
150.0.7871.47 allowed a remote attacker to execute arbitrary code via mali= cious network traffic. (Chromium security severity: Critical) 2026-06-30 no=
t yet calculated CVE-2026-13779 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-13779 ] Google--Chrome Insufficient validation of untrusted input in ANG=
LE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who ha=
d compromised the renderer process to potentially perform a sandbox escape = via a crafted HTML page. (Chromium security severity: Critical) 2026-06-30 = not yet calculated CVE-2026-13780 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-13780 ] Google--Chrome Insufficient validation of untrusted input in S= kia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who h=
ad compromised the renderer process to potentially perform a sandbox escape=
via a crafted HTML page. (Chromium security severity: Critical) 2026-06-30=
not yet calculated CVE-2026-13781 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-13781 ] Google--Chrome Use after free in Browser in Google Chrome pri=
or to 150.0.7871.47 allowed a remote attacker who had compromised the rende= rer process to potentially perform a sandbox escape via a crafted HTML page=
. (Chromium security severity: Critical) 2026-06-30 not yet calculated CVE-= 2026-13782 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13782 ] Google--Ch= rome Use after free in Views in Google Chrome prior to 150.0.7871.47 allowe=
d a remote attacker who convinced a user to engage in specific UI gestures =
to potentially exploit heap corruption via a crafted HTML page. (Chromium s= ecurity severity: Critical) 2026-06-30 not yet calculated CVE-2026-13783 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-13783 ] Google--Chrome Use afte=
r free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote at= tacker who convinced a user to engage in specific UI gestures to potentiall=
y exploit heap corruption via a crafted HTML page. (Chromium security sever= ity: Critical) 2026-06-30 not yet calculated CVE-2026-13784 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-13784 ] Google--Chrome Use after free in Blu= etooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote atta= cker who convinced a user to engage in specific UI gestures to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: Critical) 2026-06-30 not yet calculated CVE-2026-13785 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-13785 ] Google--Chrome Use after free in Ozon=
e in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to exec= ute arbitrary code via a crafted HTML page. (Chromium security severity: Cr= itical) 2026-06-30 not yet calculated CVE-2026-13786 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-13786 ] Google--Chrome Use after free in Chromoting=
in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attack=
er to execute arbitrary code via malicious network traffic. (Chromium secur= ity severity: Critical) 2026-06-30 not yet calculated CVE-2026-13787 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-13787 ] Google--Chrome Use after fr=
ee in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed=
a remote attacker to execute arbitrary code via a crafted HTML page. (Chro= mium security severity: Critical) 2026-06-30 not yet calculated CVE-2026-13= 788 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13788 ] Google--Chrome Us=
e after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remot=
e attacker who had compromised the renderer process to potentially perform =
a sandbox escape via a crafted HTML page. (Chromium security severity: High=
) 2026-06-30 not yet calculated CVE-2026-13789 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-13789 ] Google--Chrome Side-channel information leakage i=
n Scroll in Google Chrome prior to 150.0.7871.47 allowed a remote attacker =
to leak cross-origin data via a crafted HTML page. (Chromium security sever= ity: High) 2026-06-30 not yet calculated CVE-2026-13790 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-13790 ] Google--Chrome Insufficient validation o=
f untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allo= wed an attacker who convinced a user to install a malicious extension to ex= ecute arbitrary code via a crafted Chrome Extension. (Chromium security sev= erity: High) 2026-06-30 not yet calculated CVE-2026-13791 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-13791 ] Google--Chrome Use after free in Touch= bar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacke=
r to potentially perform a sandbox escape via a crafted HTML page. (Chromiu=
m security severity: High) 2026-06-30 not yet calculated CVE-2026-13792 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-13792 ] Google--Chrome Insuffici= ent policy enforcement in SVG in Google Chrome prior to 150.0.7871.47 allow=
ed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch= romium security severity: High) 2026-06-30 not yet calculated CVE-2026-1379=
3 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13793 ] Google--Chrome Insu= fficient validation of untrusted input in WebAppInstalls in Google Chrome o=
n Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a = user to engage in specific UI gestures to execute arbitrary code via a craf= ted HTML page. (Chromium security severity: High) 2026-06-30 not yet calcul= ated CVE-2026-13794 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13794 ] G= oogle--Chrome Insufficient policy enforcement in Chrome for iOS in Google C= hrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass nav= igation restrictions via a crafted HTML page. (Chromium security severity: = High) 2026-06-30 not yet calculated CVE-2026-13795 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-13795 ] Google--Chrome Integer overflow in Chromecast=
in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had = compromised the renderer process to potentially perform a sandbox escape vi=
a a crafted HTML page. (Chromium security severity: High) 2026-06-30 not ye=
t calculated CVE-2026-13796 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 3796 ] Google--Chrome Insufficient validation of untrusted input in Chromec= ast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who h=
ad compromised the renderer process to potentially perform a sandbox escape=
via a crafted HTML page. (Chromium security severity: High) 2026-06-30 not=
yet calculated CVE-2026-13797 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-13797 ] Google--Chrome Heap buffer overflow in Chromecast in Google Chrom=
e prior to 150.0.7871.47 allowed a remote attacker who had compromised the = renderer process to potentially perform a sandbox escape via a crafted HTML=
page. (Chromium security severity: High) 2026-06-30 not yet calculated CVE= -2026-13798 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13798 ] Google--C= hrome Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowe=
d a remote attacker to potentially exploit heap corruption via malicious ne= twork traffic. (Chromium security severity: High) 2026-06-30 not yet calcul= ated CVE-2026-13799 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13799 ] G= oogle--Chrome Inappropriate implementation in Updater in Google Chrome on W= indows prior to 150.0.7871.47 allowed a local attacker to perform OS-level = privilege escalation via a malicious file. (Chromium security severity: Hig=
h) 2026-06-30 not yet calculated CVE-2026-13800 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-13800 ] Google--Chrome Integer overflow in Chromecast in=
Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had com= promised the renderer process to potentially perform a sandbox escape via a=
crafted HTML page. (Chromium security severity: High) 2026-06-30 not yet c= alculated CVE-2026-13801 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1380=
1 ] Google--Chrome Use after free in Views in Google Chrome prior to 150.0.= 7871.47 allowed a remote attacker who convinced a user to engage in specifi=
c UI gestures to execute arbitrary code via a crafted HTML page. (Chromium = security severity: High) 2026-06-30 not yet calculated CVE-2026-13802 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-13802 ] Google--Chrome Type Confus= ion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 allowed a remote=
attacker who had compromised the renderer process to potentially perform a=
sandbox escape via a crafted HTML page. (Chromium security severity: High)=
2026-06-30 not yet calculated CVE-2026-13803 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-13803 ] Google--Chrome Use after free in Chromecast in Goo= gle Chrome prior to 150.0.7871.47 allowed a remote attacker who had comprom= ised the renderer process to potentially perform a sandbox escape via a cra= fted HTML page. (Chromium security severity: High) 2026-06-30 not yet calcu= lated CVE-2026-13804 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13804 ] = Google--Chrome Use after free in GFX in Google Chrome on Mac prior to 150.0= .7871.47 allowed a remote attacker to execute arbitrary code via a crafted = HTML page. (Chromium security severity: High) 2026-06-30 not yet calculated=
CVE-2026-13805 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13805 ] Googl= e--Chrome Insufficient validation of untrusted input in Accessibility in Go= ogle Chrome prior to 150.0.7871.47 allowed a remote attacker who had compro= mised the renderer process to bypass site isolation via a crafted HTML page=
. (Chromium security severity: High) 2026-06-30 not yet calculated CVE-2026= -13806 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13806 ] Google--Chrome=
Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 al= lowed a remote attacker who convinced a user to engage in specific UI gestu= res to execute arbitrary code via a malicious file. (Chromium security seve= rity: High) 2026-06-30 not yet calculated CVE-2026-13807 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-13807 ] Google--Chrome Insufficient data valida= tion in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allow=
ed a local attacker to obtain potentially sensitive information from proces=
s memory via physical access to the device. (Chromium security severity: Hi= gh) 2026-06-30 not yet calculated CVE-2026-13808 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-13808 ] Google--Chrome Side-channel information leakage=
in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a = remote attacker who had compromised the renderer process to leak cross-orig=
in data via a crafted HTML page. (Chromium security severity: High) 2026-06= -30 not yet calculated CVE-2026-13809 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-13809 ] Google--Chrome Inappropriate implementation in Input in Go= ogle Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to ob= tain potentially sensitive information from process memory via a crafted HT=
ML page. (Chromium security severity: High) 2026-06-30 not yet calculated C= VE-2026-13810 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13810 ] Google-= -Chrome Use after free in IME in Google Chrome prior to 150.0.7871.47 allow=
ed a remote attacker to execute arbitrary code inside a sandbox via a craft=
ed HTML page. (Chromium security severity: High) 2026-06-30 not yet calcula= ted CVE-2026-13811 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13811 ] Go= ogle--Chrome Insufficient validation of untrusted input in Chrome for iOS i=
n Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who=
convinced a user to engage in specific UI gestures to inject arbitrary scr= ipts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: H= igh) 2026-06-30 not yet calculated CVE-2026-13812 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-13812 ] Google--Chrome Insufficient policy enforcement=
in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a=
remote attacker who had compromised the renderer process to potentially pe= rform a sandbox escape via a crafted HTML page. (Chromium security severity=
: High) 2026-06-30 not yet calculated CVE-2026-13813 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-13813 ] Google--Chrome Use after free in Views in G= oogle Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced=
a user to engage in specific UI gestures to potentially exploit heap corru= ption via a crafted HTML page. (Chromium security severity: High) 2026-06-3=
0 not yet calculated CVE-2026-13814 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-13814 ] Google--Chrome Use after free in Blink in Google Chrome prio=
r to 150.0.7871.47 allowed a remote attacker to execute arbitrary code insi=
de a sandbox via a crafted HTML page. (Chromium security severity: High) 20= 26-06-30 not yet calculated CVE-2026-13815 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-13815 ] Google--Chrome Insufficient validation of untrusted i= nput in File Input in Google Chrome on Android prior to 150.0.7871.47 allow=
ed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch= romium security severity: High) 2026-06-30 not yet calculated CVE-2026-1381=
6 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13816 ] Google--Chrome Insu= fficient validation of untrusted input in Glic in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker to potentially perform a sandbox esca=
pe via a crafted HTML page. (Chromium security severity: High) 2026-06-30 n=
ot yet calculated CVE-2026-13817 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-13817 ] Google--Chrome Inappropriate implementation in Passwords in Goo= gle Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navig= ation restrictions via a crafted HTML page. (Chromium security severity: Hi= gh) 2026-06-30 not yet calculated CVE-2026-13818 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-13818 ] Google--Chrome Out of bounds read in ANGLE in G= oogle Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who ha=
d compromised the renderer process to perform an out of bounds memory read = via a crafted HTML page. (Chromium security severity: High) 2026-06-30 not = yet calculated CVE-2026-13819 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -13819 ] Google--Chrome Out of bounds read in Skia in Google Chrome on Mac = prior to 150.0.7871.47 allowed a remote attacker who had compromised the re= nderer process to leak cross-origin data via a crafted HTML page. (Chromium=
security severity: High) 2026-06-30 not yet calculated CVE-2026-13820 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-13820 ] Google--Chrome Use after = free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote att= acker to execute arbitrary code inside a sandbox via a crafted HTML page. (= Chromium security severity: High) 2026-06-30 not yet calculated CVE-2026-13= 821 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13821 ] Google--Chrome In= appropriate implementation in Extensions in Google Chrome on Android prior =
to 150.0.7871.47 allowed an attacker who convinced a user to install a mali= cious extension to bypass same origin policy via a crafted Chrome Extension=
. (Chromium security severity: High) 2026-06-30 not yet calculated CVE-2026= -13822 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13822 ] Google--Chrome=
Use after free in Glic in Google Chrome prior to 150.0.7871.47 allowed a r= emote attacker who had compromised the renderer process to potentially perf= orm a sandbox escape via a crafted HTML page. (Chromium security severity: = High) 2026-06-30 not yet calculated CVE-2026-13823 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-13823 ] Google--Chrome Insufficient policy enforcemen=
t in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote at= tacker who had compromised the renderer process to perform privilege escala= tion via a crafted HTML page. (Chromium security severity: High) 2026-06-30=
not yet calculated CVE-2026-13824 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-13824 ] Google--Chrome Uninitialized Use in Dawn in Google Chrome pri=
or to 150.0.7871.47 allowed a remote attacker to potentially exploit heap c= orruption via a crafted HTML page. (Chromium security severity: High) 2026-= 06-30 not yet calculated CVE-2026-13825 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13825 ] Google--Chrome Inappropriate implementation in Autofill=
in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attack=
er who had compromised the renderer process to leak cross-origin data via a=
crafted HTML page. (Chromium security severity: High) 2026-06-30 not yet c= alculated CVE-2026-13826 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1382=
6 ] Google--Chrome Use after free in Updater in Google Chrome on Mac prior =
to 150.0.7871.47 allowed a local attacker to perform privilege escalation v=
ia a malicious file. (Chromium security severity: High) 2026-06-30 not yet = calculated CVE-2026-13827 [ https://www.cve.org/CVERecord?id=3DCVE-2026-138=
27 ] Google--Chrome Inappropriate implementation in Enterprise in Google Ch= rome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially=
sensitive information from process memory via a crafted HTML page. (Chromi=
um security severity: High) 2026-06-30 not yet calculated CVE-2026-13828 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-13828 ] Google--Chrome Insuffic= ient validation of untrusted input in Settings in Google Chrome on Windows = prior to 150.0.7871.47 allowed a remote attacker who had compromised the re= nderer process to potentially perform a sandbox escape via a crafted HTML p= age. (Chromium security severity: High) 2026-06-30 not yet calculated CVE-2= 026-13829 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13829 ] Google--Chr= ome Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7= 871.47 allowed a remote attacker to execute arbitrary code via malicious ne= twork traffic. (Chromium security severity: High) 2026-06-30 not yet calcul= ated CVE-2026-13830 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13830 ] G= oogle--Chrome Out of bounds read and write in GPU in Google Chrome prior to=
150.0.7871.47 allowed a remote attacker who had compromised the renderer p= rocess to execute arbitrary code inside a sandbox via a crafted HTML page. = (Chromium security severity: High) 2026-06-30 not yet calculated CVE-2026-1= 3831 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13831 ] Google--Chrome U=
se after free in Headless in Google Chrome prior to 150.0.7871.47 allowed a=
remote attacker who had compromised the renderer process to potentially pe= rform a sandbox escape via a crafted HTML page. (Chromium security severity=
: High) 2026-06-30 not yet calculated CVE-2026-13832 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-13832 ] Google--Chrome Uninitialized Use in ANGLE i=
n Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to = leak cross-origin data via a crafted HTML page. (Chromium security severity=
: High) 2026-06-30 not yet calculated CVE-2026-13833 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-13833 ] Google--Chrome Insufficient validation of u= ntrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a r= emote attacker who had compromised the renderer process to potentially perf= orm a sandbox escape via a crafted HTML page. (Chromium security severity: = High) 2026-06-30 not yet calculated CVE-2026-13834 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-13834 ] Google--Chrome Inappropriate implementation i=
n XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to = potentially exploit heap corruption via a crafted HTML page. (Chromium secu= rity severity: High) 2026-06-30 not yet calculated CVE-2026-13835 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-13835 ] Google--Chrome Inappropriate i= mplementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remo=
te attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML p= age. (Chromium security severity: High) 2026-06-30 not yet calculated CVE-2= 026-13836 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13836 ] Google--Chr= ome Inappropriate implementation in CSS in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to perform UI spoofing via a crafted HTML pa= ge. (Chromium security severity: High) 2026-06-30 not yet calculated CVE-20= 26-13837 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13837 ] Google--Chro=
me Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871= .47 allowed a remote attacker to bypass same origin policy via a crafted HT=
ML page. (Chromium security severity: High) 2026-06-30 not yet calculated C= VE-2026-13838 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13838 ] Google-= -Chrome Inappropriate implementation in CSS in Google Chrome prior to 150.0= .7871.47 allowed a remote attacker to bypass same origin policy via a craft=
ed HTML page. (Chromium security severity: High) 2026-06-30 not yet calcula= ted CVE-2026-13839 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13839 ] Go= ogle--Chrome Insufficient policy enforcement in Canvas in Google Chrome pri=
or to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via=
a crafted HTML page. (Chromium security severity: High) 2026-06-30 not yet=
calculated CVE-2026-13840 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13= 840 ] Google--Chrome Integer overflow in Skia in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker who had compromised the renderer proce=
ss to potentially perform a sandbox escape via a crafted HTML page. (Chromi=
um security severity: High) 2026-06-30 not yet calculated CVE-2026-13841 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-13841 ] Google--Chrome Inapprop= riate implementation in Chrome for iOS in Google Chrome on iOS prior to 150= .0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (= URL bar) via a crafted HTML page. (Chromium security severity: High) 2026-0= 6-30 not yet calculated CVE-2026-13842 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13842 ] Google--Chrome Insufficient validation of untrusted inp=
ut in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: High) 2026-06-30 not yet calculated CVE-2026-13843 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-13843 ] Google--Chrome Use after free in Updater =
in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker=
to perform OS-level privilege escalation via a malicious file. (Chromium s= ecurity severity: High) 2026-06-30 not yet calculated CVE-2026-13844 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-13844 ] Google--Chrome Use after fr=
ee in DOM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker=
to execute arbitrary code inside a sandbox via a crafted HTML page. (Chrom= ium security severity: High) 2026-06-30 not yet calculated CVE-2026-13845 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-13845 ] Google--Chrome Use aft=
er free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a rem= ote attacker who had compromised the renderer process to potentially perfor=
m a sandbox escape via a crafted HTML page. (Chromium security severity: Hi= gh) 2026-06-30 not yet calculated CVE-2026-13846 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-13846 ] Google--Chrome Insufficient validation of untru= sted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47=
allowed a remote attacker to leak cross-origin data via a crafted HTML pag=
e. (Chromium security severity: High) 2026-06-30 not yet calculated CVE-202= 6-13847 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13847 ] Google--Chrom=
e Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a=
remote attacker to execute arbitrary code inside a sandbox via a crafted H= TML page. (Chromium security severity: High) 2026-06-30 not yet calculated = CVE-2026-13848 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13848 ] Google= --Chrome Insufficient validation of untrusted input in Chromoting in Google=
Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to poten= tially perform a sandbox escape via a malicious file. (Chromium security se= verity: High) 2026-06-30 not yet calculated CVE-2026-13849 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-13849 ] Google--Chrome Insufficient validatio=
n of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150= .0.7871.47 allowed a local attacker to execute arbitrary code inside a sand= box via a malicious file. (Chromium security severity: High) 2026-06-30 not=
yet calculated CVE-2026-13850 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-13850 ] Google--Chrome Insufficient validation of untrusted input in WebA= ppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a loc=
al attacker to bypass discretionary access control via a crafted HTML page.=
(Chromium security severity: High) 2026-06-30 not yet calculated CVE-2026-= 13851 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13851 ] Google--Chrome = Insufficient validation of untrusted input in WebAppInstalls in Google Chro=
me on Android prior to 150.0.7871.47 allowed a local attacker to bypass dis= cretionary access control via a crafted HTML page. (Chromium security sever= ity: High) 2026-06-30 not yet calculated CVE-2026-13852 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-13852 ] Google--Chrome Use after free in Journey=
s in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had=
compromised the renderer process to potentially perform a sandbox escape v=
ia a crafted HTML page. (Chromium security severity: High) 2026-06-30 not y=
et calculated CVE-2026-13853 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 13853 ] Google--Chrome Use after free in Ozone in Google Chrome on Linux pr= ior to 150.0.7871.47 allowed a remote attacker who had compromised the rend= erer process to potentially perform a sandbox escape via a crafted HTML pag=
e. (Chromium security severity: High) 2026-06-30 not yet calculated CVE-202= 6-13854 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13854 ] Google--Chrom=
e Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 = allowed a remote attacker who convinced a user to engage in specific UI ges= tures to execute arbitrary code via a crafted HTML page. (Chromium security=
severity: High) 2026-06-30 not yet calculated CVE-2026-13855 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-13855 ] Google--Chrome Insufficient valida= tion of untrusted input in Speech in Google Chrome on Android prior to 150.= 0.7871.47 allowed a remote attacker who had compromised the renderer proces=
s to perform privilege escalation via a crafted HTML page. (Chromium securi=
ty severity: Medium) 2026-06-30 not yet calculated CVE-2026-13856 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-13856 ] Google--Chrome Inappropriate i= mplementation in Geometry in Google Chrome prior to 150.0.7871.47 allowed a=
remote attacker who convinced a user to engage in specific UI gestures to = perform UI spoofing via a crafted HTML page. (Chromium security severity: M= edium) 2026-06-30 not yet calculated CVE-2026-13857 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-13857 ] Google--Chrome Out of bounds read in FFmpeg =
in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain=
potentially sensitive information from process memory via a crafted video = file. (Chromium security severity: Medium) 2026-06-30 not yet calculated CV= E-2026-13858 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13858 ] Google--= Chrome Inappropriate implementation in ANGLE in Google Chrome prior to 150.= 0.7871.47 allowed a remote attacker to potentially perform a sandbox escape=
via a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 n=
ot yet calculated CVE-2026-13859 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-13859 ] Google--Chrome Incorrect security UI in Autofill in Google Chro=
me on Windows prior to 150.0.7871.47 allowed a remote attacker who convince=
d a user to engage in specific UI gestures to perform UI spoofing via a cra= fted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet cal= culated CVE-2026-13860 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13860 =
] Google--Chrome Use after free in Core in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker who had compromised the renderer process to = potentially perform a sandbox escape via a crafted HTML page. (Chromium sec= urity severity: Medium) 2026-06-30 not yet calculated CVE-2026-13861 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-13861 ] Google--Chrome Insufficient=
policy enforcement in Web Authentication (Passkeys & Security Keys) in Goo= gle Chrome on iOS prior to 150.0.7871.47 allowed an attacker in a privilege=
d network position to leak cross-origin data via a crafted HTML page. (Chro= mium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-1386=
2 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13862 ] Google--Chrome Insu= fficient validation of untrusted input in CustomTabs in Google Chrome on An= droid prior to 150.0.7871.47 allowed a local attacker to perform privilege = escalation via a malicious file. (Chromium security severity: Medium) 2026-= 06-30 not yet calculated CVE-2026-13863 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13863 ] Google--Chrome Insufficient policy enforcement in WebHI=
D in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced=
a user to install a malicious extension to perform privilege escalation vi=
a a crafted Chrome Extension. (Chromium security severity: Medium) 2026-06-=
30 not yet calculated CVE-2026-13864 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-13864 ] Google--Chrome Insufficient validation of untrusted input i=
n Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attac= ker to perform UI spoofing via a crafted HTML page. (Chromium security seve= rity: Medium) 2026-06-30 not yet calculated CVE-2026-13865 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-13865 ] Google--Chrome Inappropriate implemen= tation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed =
a remote attacker who had compromised the renderer process to bypass site i= solation via a crafted HTML page. (Chromium security severity: Medium) 2026= -06-30 not yet calculated CVE-2026-13866 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13866 ] Google--Chrome Inappropriate implementation in Geolocat= ion in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to pe= rform UI spoofing via a crafted HTML page. (Chromium security severity: Med= ium) 2026-06-30 not yet calculated CVE-2026-13867 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-13867 ] Google--Chrome Inappropriate implementation in=
Network in Google Chrome on Android prior to 150.0.7871.47 allowed a remot=
e attacker who had compromised the renderer process to bypass site isolatio=
n via a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 = not yet calculated CVE-2026-13868 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-13868 ] Google--Chrome Use after free in Device in Google Chrome on Wi= ndows prior to 150.0.7871.47 allowed a remote attacker who had compromised = the renderer process to potentially perform a sandbox escape via a crafted = HTML page. (Chromium security severity: Medium) 2026-06-30 not yet calculat=
ed CVE-2026-13869 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13869 ] Goo= gle--Chrome Use after free in WebView in Google Chrome on Android prior to = 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a = sandbox via a crafted HTML page. (Chromium security severity: Medium) 2026-= 06-30 not yet calculated CVE-2026-13870 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13870 ] Google--Chrome Insufficient policy enforcement in Guest= View in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who = had compromised the renderer process to bypass site isolation via a crafted=
HTML page. (Chromium security severity: Medium) 2026-06-30 not yet calcula= ted CVE-2026-13871 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13871 ] Go= ogle--Chrome Insufficient validation of untrusted input in WebAppInstalls i=
n Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker =
to potentially perform a sandbox escape via a malicious file. (Chromium sec= urity severity: Medium) 2026-06-30 not yet calculated CVE-2026-13872 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-13872 ] Google--Chrome Out of bound=
s read in Layout in Google Chrome prior to 150.0.7871.47 allowed a remote a= ttacker to obtain potentially sensitive information from process memory via=
a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 not y=
et calculated CVE-2026-13873 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 13873 ] Google--Chrome Race in DataTransfer in Google Chrome prior to 150.0= .7871.47 allowed a remote attacker to obtain potentially sensitive informat= ion from process memory via a crafted HTML page. (Chromium security severit=
y: Medium) 2026-06-30 not yet calculated CVE-2026-13874 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-13874 ] Google--Chrome Insufficient validation o=
f untrusted input in GPU in Google Chrome on Windows prior to 150.0.7871.47=
allowed a remote attacker who had compromised the renderer process to obta=
in potentially sensitive information from process memory via a crafted HTML=
page. (Chromium security severity: Medium) 2026-06-30 not yet calculated C= VE-2026-13875 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13875 ] Google-= -Chrome Inappropriate implementation in Network in Google Chrome prior to 1= 50.0.7871.47 allowed an attacker in a privileged network position to bypass=
content security policy via malicious network traffic. (Chromium security = severity: Medium) 2026-06-30 not yet calculated CVE-2026-13876 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-13876 ] Google--Chrome Insufficient valid= ation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 a= llowed a remote attacker who had compromised the renderer process to obtain=
potentially sensitive information from process memory via a crafted HTML p= age. (Chromium security severity: Medium) 2026-06-30 not yet calculated CVE= -2026-13877 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13877 ] Google--C= hrome Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.78= 71.47 allowed a remote attacker who had compromised the renderer process to=
potentially perform a sandbox escape via a crafted HTML page. (Chromium se= curity severity: Medium) 2026-06-30 not yet calculated CVE-2026-13878 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-13878 ] Google--Chrome Use after f= ree in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed an attacke=
r on the local network segment to obtain potentially sensitive information = from process memory via a malicious peripheral. (Chromium security severity=
: Medium) 2026-06-30 not yet calculated CVE-2026-13879 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-13879 ] Google--Chrome Use after free in USB in G= oogle Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who ha=
d compromised the renderer process to potentially perform a sandbox escape = via a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 no=
t yet calculated CVE-2026-13880 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-13880 ] Google--Chrome Inappropriate implementation in WebAppInstalls in=
Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass s= ame origin policy via a crafted HTML page. (Chromium security severity: Med= ium) 2026-06-30 not yet calculated CVE-2026-13881 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-13881 ] Google--Chrome Race in USB in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker who had compromised the rend= erer process to potentially perform a sandbox escape via a crafted HTML pag=
e. (Chromium security severity: Medium) 2026-06-30 not yet calculated CVE-2= 026-13882 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13882 ] Google--Chr= ome Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed=
a remote attacker to potentially perform a sandbox escape via a crafted HT=
ML page. (Chromium security severity: Medium) 2026-06-30 not yet calculated=
CVE-2026-13883 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13883 ] Googl= e--Chrome Integer overflow in Chromecast in Google Chrome prior to 150.0.78= 71.47 allowed a local attacker to execute arbitrary code via malicious netw= ork traffic. (Chromium security severity: Medium) 2026-06-30 not yet calcul= ated CVE-2026-13884 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13884 ] G= oogle--Chrome Use after free in Skia in Google Chrome on Android prior to 1= 50.0.7871.47 allowed a remote attacker to execute arbitrary code inside a s= andbox via a crafted HTML page. (Chromium security severity: Medium) 2026-0= 6-30 not yet calculated CVE-2026-13885 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13885 ] Google--Chrome Insufficient policy enforcement in Isola= ted Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attac= ker to bypass content security policy via a crafted HTML page. (Chromium se= curity severity: Medium) 2026-06-30 not yet calculated CVE-2026-13886 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-13886 ] Google--Chrome Inappropria=
te implementation in NFC in Google Chrome on Android prior to 150.0.7871.47=
allowed a remote attacker who had compromised the renderer process to leak=
cross-origin data via a crafted HTML page. (Chromium security severity: Me= dium) 2026-06-30 not yet calculated CVE-2026-13887 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-13887 ] Google--Chrome Use after free in Extensions i=
n Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute=
arbitrary code inside a sandbox via a crafted HTML page. (Chromium securit=
y severity: Medium) 2026-06-30 not yet calculated CVE-2026-13888 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-13888 ] Google--Chrome Side-channel inf= ormation leakage in WebAuthentication in Google Chrome on iOS prior to 150.= 0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted=
HTML page. (Chromium security severity: Medium) 2026-06-30 not yet calcula= ted CVE-2026-13889 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13889 ] Go= ogle--Chrome Out of bounds read in Chromecast in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker who had compromised the renderer proce=
ss to obtain potentially sensitive information from process memory via a cr= afted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet ca= lculated CVE-2026-13890 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13890=
] Google--Chrome Insufficient validation of untrusted input in Extensions =
in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had c= ompromised the renderer process to perform privilege escalation via a craft=
ed HTML page. (Chromium security severity: Medium) 2026-06-30 not yet calcu= lated CVE-2026-13891 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13891 ] = Google--Chrome Inappropriate implementation in Chrome for iOS in Google Chr= ome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a=
user to engage in specific UI gestures to leak cross-origin data via a cra= fted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet cal= culated CVE-2026-13892 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13892 =
] Google--Chrome Insufficient validation of untrusted input in WebUI in Goo= gle Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-o= rigin data via malicious network traffic. (Chromium security severity: Medi= um) 2026-06-30 not yet calculated CVE-2026-13893 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-13893 ] Google--Chrome Insufficient policy enforcement =
in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a=
privileged network position to bypass navigation restrictions via a crafte=
d HTML page. (Chromium security severity: Medium) 2026-06-30 not yet calcul= ated CVE-2026-13894 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13894 ] G= oogle--Chrome Inappropriate implementation in Autofill in Google Chrome pri=
or to 150.0.7871.47 allowed a remote attacker who convinced a user to engag=
e in specific UI gestures to perform UI spoofing via a crafted HTML page. (= Chromium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-= 13895 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13895 ] Google--Chrome = Insufficient policy enforcement in Glic in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to bypass navigation restrictions via a craf= ted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet calc= ulated CVE-2026-13896 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13896 ]=
Google--Chrome Insufficient policy enforcement in Chromecast in Google Chr= ome prior to 150.0.7871.47 allowed a remote attacker to perform privilege e= scalation via a crafted HTML page. (Chromium security severity: Medium) 202= 6-06-30 not yet calculated CVE-2026-13897 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-13897 ] Google--Chrome Use after free in Cast Receiver in Goog=
le Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbit= rary code inside a sandbox via a crafted HTML page. (Chromium security seve= rity: Medium) 2026-06-30 not yet calculated CVE-2026-13898 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-13898 ] Google--Chrome Use after free in HTML=
in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execu=
te arbitrary code inside a sandbox via a crafted HTML page. (Chromium secur= ity severity: Medium) 2026-06-30 not yet calculated CVE-2026-13899 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-13899 ] Google--Chrome Inappropriate = implementation in Chromecast in Google Chrome prior to 150.0.7871.47 allowe=
d a remote attacker who had compromised the renderer process to bypass navi= gation restrictions via a crafted HTML page. (Chromium security severity: M= edium) 2026-06-30 not yet calculated CVE-2026-13900 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-13900 ] Google--Chrome Insufficient policy enforceme=
nt in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attac= ker who had compromised the renderer process to potentially perform a sandb=
ox escape via a crafted HTML page. (Chromium security severity: Medium) 202= 6-06-30 not yet calculated CVE-2026-13901 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-13901 ] Google--Chrome Inappropriate implementation in Chrome = for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote att= acker to perform UI spoofing via a crafted HTML page. (Chromium security se= verity: Medium) 2026-06-30 not yet calculated CVE-2026-13902 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-13902 ] Google--Chrome Insufficient policy = enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a = remote attacker to perform privilege escalation via a crafted HTML page. (C= hromium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-1= 3903 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13903 ] Google--Chrome I= nappropriate implementation in Safe Browsing in Google Chrome on iOS prior =
to 150.0.7871.47 allowed a remote attacker to bypass navigation restriction=
s via a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 = not yet calculated CVE-2026-13904 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-13904 ] Google--Chrome Race in Chrome for iOS in Google Chrome on iOS = prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensi= tive information from process memory via physical access to the device. (Ch= romium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-13= 905 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13905 ] Google--Chrome Ou=
t of bounds read in Codecs in Google Chrome prior to 150.0.7871.47 allowed =
a remote attacker to obtain potentially sensitive information from process = memory via a crafted HTML page. (Chromium security severity: Medium) 2026-0= 6-30 not yet calculated CVE-2026-13906 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13906 ] Google--Chrome Inappropriate implementation in iOSWeb i=
n Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who=
convinced a user to engage in specific UI gestures to perform UI spoofing = via a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 no=
t yet calculated CVE-2026-13907 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-13907 ] Google--Chrome Insufficient validation of untrusted input in Omn= ibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attack=
er who convinced a user to engage in specific UI gestures to bypass navigat= ion restrictions via malicious network traffic. (Chromium security severity=
: Medium) 2026-06-30 not yet calculated CVE-2026-13908 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-13908 ] Google--Chrome Insufficient policy enforc= ement in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote = attacker who had compromised the renderer process to potentially perform a = sandbox escape via a crafted HTML page. (Chromium security severity: Medium=
) 2026-06-30 not yet calculated CVE-2026-13909 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-13909 ] Google--Chrome Insufficient policy enforcement in=
WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote = attacker to leak cross-origin data via a crafted HTML page. (Chromium secur= ity severity: Medium) 2026-06-30 not yet calculated CVE-2026-13910 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-13910 ] Google--Chrome Insufficient p= olicy enforcement in Spellcheck in Google Chrome prior to 150.0.7871.47 all= owed a remote attacker who had compromised the renderer process to obtain p= otentially sensitive information from process memory via a crafted HTML pag=
e. (Chromium security severity: Medium) 2026-06-30 not yet calculated CVE-2= 026-13911 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13911 ] Google--Chr= ome Inappropriate implementation in Safe Browsing in Google Chrome on iOS p= rior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via =
a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 not ye=
t calculated CVE-2026-13912 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 3912 ] Google--Chrome Insufficient policy enforcement in Autofill in Google=
Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinc=
ed a user to engage in specific UI gestures to leak cross-origin data via a=
crafted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet=
calculated CVE-2026-13913 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13= 913 ] Google--Chrome Inappropriate implementation in Passwords in Google Ch= rome on Mac prior to 150.0.7871.47 allowed a local attacker to obtain poten= tially sensitive information from process memory via a malicious file. (Chr= omium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-139=
14 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13914 ] Google--Chrome Use=
after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.4=
7 allowed a remote attacker who convinced a user to engage in specific UI g= estures to potentially exploit heap corruption via a crafted HTML page. (Ch= romium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-13= 915 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13915 ] Google--Chrome In= appropriate implementation in Chrome for iOS in Google Chrome on iOS prior =
to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a cra= fted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet cal= culated CVE-2026-13916 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13916 =
] Google--Chrome Insufficient validation of untrusted input in Chrome for i=
OS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker=
who convinced a user to engage in specific UI gestures to bypass navigatio=
n restrictions via a crafted HTML page. (Chromium security severity: Medium=
) 2026-06-30 not yet calculated CVE-2026-13917 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-13917 ] Google--Chrome Use after free in Chrome for iOS i=
n Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to = potentially exploit heap corruption via a crafted HTML page. (Chromium secu= rity severity: Medium) 2026-06-30 not yet calculated CVE-2026-13918 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-13918 ] Google--Chrome Insufficient = policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 al= lowed a remote attacker who had compromised the renderer process to bypass = site isolation via a crafted HTML page. (Chromium security severity: Medium=
) 2026-06-30 not yet calculated CVE-2026-13919 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-13919 ] Google--Chrome Insufficient validation of untrust=
ed input in Media in Google Chrome on Windows prior to 150.0.7871.47 allowe=
d a remote attacker who had compromised the renderer process to potentially=
perform a sandbox escape via a crafted HTML page. (Chromium security sever= ity: Medium) 2026-06-30 not yet calculated CVE-2026-13920 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-13920 ] Google--Chrome Insufficient validation=
of untrusted input in DeviceBoundSessionCredentials in Google Chrome prior=
to 150.0.7871.47 allowed a remote attacker to bypass same origin policy vi=
a a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 not = yet calculated CVE-2026-13921 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -13921 ] Google--Chrome Side-channel information leakage in Paint in Google=
Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-orig=
in data via a crafted HTML page. (Chromium security severity: Medium) 2026-= 06-30 not yet calculated CVE-2026-13922 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13922 ] Google--Chrome Uninitialized Use in GPU in Google Chrom=
e on Android prior to 150.0.7871.47 allowed a remote attacker to obtain pot= entially sensitive information from process memory via a crafted HTML page.=
(Chromium security severity: Medium) 2026-06-30 not yet calculated CVE-202= 6-13923 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13923 ] Google--Chrom=
e Insufficient validation of untrusted input in WebView in Google Chrome on=
Android prior to 150.0.7871.47 allowed a remote attacker who had compromis=
ed the renderer process to bypass same origin policy via a crafted HTML pag=
e. (Chromium security severity: Medium) 2026-06-30 not yet calculated CVE-2= 026-13924 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13924 ] Google--Chr= ome Inappropriate implementation in Downloads in Google Chrome on Windows p= rior to 150.0.7871.47 allowed a remote attacker who convinced a user to eng= age in specific UI gestures to execute arbitrary code via a crafted HTML pa= ge. (Chromium security severity: Medium) 2026-06-30 not yet calculated CVE-= 2026-13925 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13925 ] Google--Ch= rome Insufficient validation of untrusted input in Network in Google Chrome=
prior to 150.0.7871.47 allowed a remote attacker who had compromised the r= enderer process to bypass navigation restrictions via a crafted HTML page. = (Chromium security severity: Medium) 2026-06-30 not yet calculated CVE-2026= -13926 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13926 ] Google--Chrome=
Insufficient validation of untrusted input in UI in Google Chrome on Andro=
id prior to 150.0.7871.47 allowed a local attacker to perform privilege esc= alation via a malicious file. (Chromium security severity: Medium) 2026-06-=
30 not yet calculated CVE-2026-13927 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-13927 ] Google--Chrome Insufficient validation of untrusted input i=
n Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attac= ker to perform privilege escalation via a crafted HTML page. (Chromium secu= rity severity: Medium) 2026-06-30 not yet calculated CVE-2026-13928 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-13928 ] Google--Chrome Insufficient = policy enforcement in DevTools in Google Chrome on Android prior to 150.0.7= 871.47 allowed a local attacker to bypass navigation restrictions via a mal= icious file. (Chromium security severity: Medium) 2026-06-30 not yet calcul= ated CVE-2026-13929 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13929 ] G= oogle--Chrome Insufficient policy enforcement in Actor in Google Chrome pri=
or to 150.0.7871.47 allowed a remote attacker to bypass navigation restrict= ions via a crafted HTML page. (Chromium security severity: Medium) 2026-06-=
30 not yet calculated CVE-2026-13930 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-13930 ] Google--Chrome Inappropriate implementation in Media in Goo= gle Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who = had compromised the renderer process to perform UI spoofing via a crafted H= TML page. (Chromium security severity: Medium) 2026-06-30 not yet calculate=
d CVE-2026-13931 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13931 ] Goog= le--Chrome Inappropriate implementation in Sharing in Google Chrome on Andr= oid prior to 150.0.7871.47 allowed a remote attacker who had compromised th=
e renderer process to leak cross-origin data via a crafted HTML page. (Chro= mium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-1393=
2 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13932 ] Google--Chrome Insu= fficient policy enforcement in Passwords in Google Chrome prior to 150.0.78= 71.47 allowed a remote attacker who had compromised the renderer process to=
obtain potentially sensitive information from process memory via a crafted=
HTML page. (Chromium security severity: Medium) 2026-06-30 not yet calcula= ted CVE-2026-13933 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13933 ] Go= ogle--Chrome Insufficient validation of untrusted input in Dawn in Google C= hrome on Android prior to 150.0.7871.47 allowed a remote attacker who had c= ompromised the renderer process to potentially perform a sandbox escape via=
a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 not y=
et calculated CVE-2026-13934 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 13934 ] Google--Chrome Side-channel information leakage in ComputePressure =
in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak c= ross-origin data via a crafted HTML page. (Chromium security severity: Medi= um) 2026-06-30 not yet calculated CVE-2026-13935 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-13935 ] Google--Chrome Inappropriate implementation in = Passwords in Google Chrome on Android prior to 150.0.7871.47 allowed a remo=
te attacker to obtain potentially sensitive information from process memory=
via a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 n=
ot yet calculated CVE-2026-13936 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-13936 ] Google--Chrome Insufficient policy enforcement in Passwords in = Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp= romised the renderer process to leak cross-origin data via a crafted HTML p= age. (Chromium security severity: Medium) 2026-06-30 not yet calculated CVE= -2026-13937 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13937 ] Google--C= hrome Integer overflow in Fonts in Google Chrome prior to 150.0.7871.47 all= owed a remote attacker to perform an out of bounds memory write via a craft=
ed HTML page. (Chromium security severity: Medium) 2026-06-30 not yet calcu= lated CVE-2026-13938 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13938 ] = Google--Chrome Insufficient validation of untrusted input in WebShare in Go= ogle Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who=
had compromised the renderer process to perform UI spoofing via a crafted = HTML page. (Chromium security severity: Medium) 2026-06-30 not yet calculat=
ed CVE-2026-13939 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13939 ] Goo= gle--Chrome Uninitialized Use in Cast in Google Chrome prior to 150.0.7871.=
47 allowed an attacker on the local network segment to obtain potentially s= ensitive information from process memory via malicious network traffic. (Ch= romium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-13= 940 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13940 ] Google--Chrome In= appropriate implementation in SiteSettings in Google Chrome on Android prio=
r to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a c= rafted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet c= alculated CVE-2026-13941 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1394=
1 ] Google--Chrome Inappropriate implementation in Video Capture in Google = Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perfo=
rm UI spoofing via a crafted HTML page. (Chromium security severity: Medium=
) 2026-06-30 not yet calculated CVE-2026-13942 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-13942 ] Google--Chrome Uninitialized Use in CSS in Google=
Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obta=
in potentially sensitive information from process memory via a crafted HTML=
page. (Chromium security severity: Medium) 2026-06-30 not yet calculated C= VE-2026-13943 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13943 ] Google-= -Chrome Inappropriate implementation in DataTransfer in Google Chrome on Ma=
c prior to 150.0.7871.47 allowed a remote attacker who convinced a user to = engage in specific UI gestures to leak cross-origin data via a crafted HTML=
page. (Chromium security severity: Medium) 2026-06-30 not yet calculated C= VE-2026-13944 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13944 ] Google-= -Chrome Insufficient policy enforcement in Extensions in Google Chrome on L= inux prior to 150.0.7871.47 allowed an attacker who convinced a user to ins= tall a malicious extension to perform UI spoofing via a crafted Chrome Exte= nsion. (Chromium security severity: Medium) 2026-06-30 not yet calculated C= VE-2026-13945 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13945 ] Google-= -Chrome Inappropriate implementation in ScriptInjections in Google Chrome o=
n iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin=
data via a crafted HTML page. (Chromium security severity: Medium) 2026-06= -30 not yet calculated CVE-2026-13946 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-13946 ] Google--Chrome Uninitialized Use in XR in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker who had compromised the rend= erer process to obtain potentially sensitive information from process memor=
y via a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 = not yet calculated CVE-2026-13947 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-13947 ] Google--Chrome Insufficient policy enforcement in Extensions i=
n Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a = user to install a malicious extension to perform UI spoofing via a crafted = Chrome Extension. (Chromium security severity: Medium) 2026-06-30 not yet c= alculated CVE-2026-13948 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1394=
8 ] Google--Chrome Insufficient policy enforcement in Payments in Google Ch= rome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain = potentially sensitive information from process memory via a crafted HTML pa= ge. (Chromium security severity: Medium) 2026-06-30 not yet calculated CVE-= 2026-13949 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13949 ] Google--Ch= rome Uninitialized Use in GPU in Google Chrome prior to 150.0.7871.47 allow=
ed a remote attacker who had compromised the renderer process to obtain pot= entially sensitive information from process memory via a crafted HTML page.=
(Chromium security severity: Medium) 2026-06-30 not yet calculated CVE-202= 6-13950 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13950 ] Google--Chrom=
e Insufficient policy enforcement in USB in Google Chrome prior to 150.0.78= 71.47 allowed a remote attacker who had compromised the renderer process to=
potentially perform a sandbox escape via a crafted HTML page. (Chromium se= curity severity: Medium) 2026-06-30 not yet calculated CVE-2026-13951 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-13951 ] Google--Chrome Inappropria=
te implementation in PerformanceAPIs in Google Chrome prior to 150.0.7871.4=
7 allowed a remote attacker to leak cross-origin data via a crafted HTML pa= ge. (Chromium security severity: Medium) 2026-06-30 not yet calculated CVE-= 2026-13952 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13952 ] Google--Ch= rome Inappropriate implementation in SplitView in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker who had compromised the renderer proc= ess to bypass navigation restrictions via a crafted HTML page. (Chromium se= curity severity: Medium) 2026-06-30 not yet calculated CVE-2026-13953 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-13953 ] Google--Chrome Insufficien=
t policy enforcement in XML in Google Chrome on Android prior to 150.0.7871= .47 allowed a remote attacker to obtain potentially sensitive information f= rom process memory via a crafted HTML page. (Chromium security severity: Me= dium) 2026-06-30 not yet calculated CVE-2026-13954 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-13954 ] Google--Chrome Insufficient validation of unt= rusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.=
47 allowed a local attacker to perform UI spoofing via a malicious file. (C= hromium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-1= 3955 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13955 ] Google--Chrome I= ncorrect security UI in PageInfo in Google Chrome prior to 150.0.7871.47 al= lowed a remote attacker who convinced a user to engage in specific UI gestu= res to perform UI spoofing via a crafted HTML page. (Chromium security seve= rity: Medium) 2026-06-30 not yet calculated CVE-2026-13956 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-13956 ] Google--Chrome Incorrect security UI =
in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker w=
ho convinced a user to install a malicious extension to inject arbitrary sc= ripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: = Medium) 2026-06-30 not yet calculated CVE-2026-13957 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-13957 ] Google--Chrome Uninitialized Use in Codecs =
in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacke=
r to obtain potentially sensitive information from process memory via a cra= fted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet cal= culated CVE-2026-13958 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13958 =
] Google--Chrome Insufficient validation of untrusted input in Blink in Goo= gle Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same = origin policy via a crafted HTML page. (Chromium security severity: Medium)=
2026-06-30 not yet calculated CVE-2026-13959 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-13959 ] Google--Chrome Inappropriate implementation in Pas= swords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to=
perform UI spoofing via a crafted HTML page. (Chromium security severity: = Medium) 2026-06-30 not yet calculated CVE-2026-13960 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-13960 ] Google--Chrome Insufficient validation of u= ntrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.=
47 allowed a remote attacker who convinced a user to engage in specific UI = gestures to obtain potentially sensitive information from process memory vi=
a a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 not = yet calculated CVE-2026-13961 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -13961 ] Google--Chrome Insufficient data validation in PDF in Google Chrom=
e prior to 150.0.7871.47 allowed a remote attacker who had compromised the = renderer process to bypass navigation restrictions via a crafted HTML page.=
(Chromium security severity: Medium) 2026-06-30 not yet calculated CVE-202= 6-13962 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13962 ] Google--Chrom=
e Inappropriate implementation in DevTools in Google Chrome prior to 150.0.= 7871.47 allowed a remote attacker who convinced a user to engage in specifi=
c UI gestures to leak cross-origin data via a crafted HTML page. (Chromium = security severity: Medium) 2026-06-30 not yet calculated CVE-2026-13963 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-13963 ] Google--Chrome Insuffici= ent policy enforcement in WebView in Google Chrome on Android prior to 150.= 0.7871.47 allowed a remote attacker to bypass navigation restrictions via a=
crafted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet=
calculated CVE-2026-13964 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13= 964 ] Google--Chrome Use after free in Oilpan in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker to execute arbitrary code inside a san= dbox via a crafted HTML page. (Chromium security severity: Medium) 2026-06-=
30 not yet calculated CVE-2026-13965 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-13965 ] Google--Chrome Inappropriate implementation in History in G= oogle Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI=
spoofing via a crafted HTML page. (Chromium security severity: Medium) 202= 6-06-30 not yet calculated CVE-2026-13966 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-13966 ] Google--Chrome Heap buffer overflow in V8 in Google Ch= rome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary = code inside a sandbox via a crafted HTML page. (Chromium security severity:=
Medium) 2026-06-30 not yet calculated CVE-2026-13967 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-13967 ] Google--Chrome Insufficient validation of = untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed=
a remote attacker who convinced a user to engage in specific UI gestures t=
o execute arbitrary code inside a sandbox via a malicious file. (Chromium s= ecurity severity: Medium) 2026-06-30 not yet calculated CVE-2026-13968 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-13968 ] Google--Chrome Uninitiali= zed Use in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a = remote attacker who had compromised the renderer process to obtain potentia= lly sensitive information from process memory via a crafted HTML page. (Chr= omium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-139=
69 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13969 ] Google--Chrome Uni= nitialized Use in Media in Google Chrome prior to 150.0.7871.47 allowed a r= emote attacker who had compromised the renderer process to obtain potential=
ly sensitive information from process memory via a crafted HTML page. (Chro= mium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-1397=
0 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13970 ] Google--Chrome Unin= itialized Use in Skia in Google Chrome prior to 150.0.7871.47 allowed a rem= ote attacker who had compromised the renderer process to obtain potentially=
sensitive information from process memory via a crafted HTML page. (Chromi=
um security severity: Medium) 2026-06-30 not yet calculated CVE-2026-13971 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-13971 ] Google--Chrome Inappr= opriate implementation in Paint in Google Chrome prior to 150.0.7871.47 all= owed a remote attacker to perform UI spoofing via a crafted HTML page. (Chr= omium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-139=
72 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13972 ] Google--Chrome Ina= ppropriate implementation in UI in Google Chrome prior to 150.0.7871.47 all= owed a remote attacker who convinced a user to engage in specific UI gestur=
es to perform UI spoofing via a crafted HTML page. (Chromium security sever= ity: Medium) 2026-06-30 not yet calculated CVE-2026-13973 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-13973 ] Google--Chrome Integer overflow in Saf=
e Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote = attacker to bypass navigation restrictions via a malicious file. (Chromium = security severity: Medium) 2026-06-30 not yet calculated CVE-2026-13974 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-13974 ] Google--Chrome Out of bo= unds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a=
remote attacker who had compromised the renderer process to obtain potenti= ally sensitive information from process memory via a crafted HTML page. (Ch= romium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-13= 975 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13975 ] Google--Chrome In= sufficient data validation in Storage in Google Chrome prior to 150.0.7871.=
47 allowed a remote attacker who had compromised the renderer process to po= tentially perform a sandbox escape via a crafted HTML page. (Chromium secur= ity severity: Medium) 2026-06-30 not yet calculated CVE-2026-13976 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-13976 ] Google--Chrome Inappropriate = implementation in HTMLParser in Google Chrome prior to 150.0.7871.47 allowe=
d a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafte=
d HTML page. (Chromium security severity: Medium) 2026-06-30 not yet calcul= ated CVE-2026-13977 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13977 ] G= oogle--Chrome Insufficient policy enforcement in PageInfo in Google Chrome = prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 not y=
et calculated CVE-2026-13978 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 13978 ] Google--Chrome Inappropriate implementation in Paint in Google Chro=
me prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing = via a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 no=
t yet calculated CVE-2026-13979 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-13979 ] Google--Chrome Inappropriate implementation in Chrome for iOS in=
Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to p= erform UI spoofing via a crafted HTML page. (Chromium security severity: Me= dium) 2026-06-30 not yet calculated CVE-2026-13980 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-13980 ] Google--Chrome Inappropriate implementation i=
n Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a r= emote attacker to perform UI spoofing via a crafted HTML page. (Chromium se= curity severity: Medium) 2026-06-30 not yet calculated CVE-2026-13981 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-13981 ] Google--Chrome Incorrect s= ecurity UI in Passwords in Google Chrome prior to 150.0.7871.47 allowed a r= emote attacker who had compromised the renderer process to perform UI spoof= ing via a crafted HTML page. (Chromium security severity: Medium) 2026-06-3=
0 not yet calculated CVE-2026-13982 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-13982 ] Google--Chrome Inappropriate implementation in Chrome for iO=
S in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker = who convinced a user to engage in specific UI gestures to spoof the content=
s of the Omnibox (URL bar) via a crafted HTML page. (Chromium security seve= rity: Medium) 2026-06-30 not yet calculated CVE-2026-13983 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-13983 ] Google--Chrome Incorrect security UI =
in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attack=
er to perform UI spoofing via a crafted HTML page. (Chromium security sever= ity: Medium) 2026-06-30 not yet calculated CVE-2026-13984 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-13984 ] Google--Chrome Inappropriate implement= ation in MediaCapture in Google Chrome prior to 150.0.7871.47 allowed a rem= ote attacker who had compromised the renderer process to perform UI spoofin=
g via a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 = not yet calculated CVE-2026-13985 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-13985 ] Google--Chrome Inappropriate implementation in Media UI in Goo= gle Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker who=
convinced a user to engage in specific UI gestures to perform UI spoofing = via a crafted HTML page. (Chromium security severity: Medium) 2026-06-30 no=
t yet calculated CVE-2026-13986 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-13986 ] Google--Chrome Incorrect security UI in Mobile in Google Chrome =
on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI s= poofing via a crafted HTML page. (Chromium security severity: Medium) 2026-= 06-30 not yet calculated CVE-2026-13987 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13987 ] Google--Chrome Inappropriate implementation in Paint in=
Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform =
UI spoofing via a crafted HTML page. (Chromium security severity: Medium) 2= 026-06-30 not yet calculated CVE-2026-13988 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-13988 ] Google--Chrome Inappropriate implementation in PageI= nfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who h=
ad compromised the renderer process to perform UI spoofing via a crafted HT=
ML page. (Chromium security severity: Medium) 2026-06-30 not yet calculated=
CVE-2026-13989 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13989 ] Googl= e--Chrome Insufficient validation of untrusted input in DataTransfer in Goo= gle Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who = had compromised the renderer process to perform UI spoofing via a crafted H= TML page. (Chromium security severity: Medium) 2026-06-30 not yet calculate=
d CVE-2026-13990 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13990 ] Goog= le--Chrome Insufficient validation of untrusted input in Chrome for iOS in = Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to pe= rform UI spoofing via a crafted HTML page. (Chromium security severity: Med= ium) 2026-06-30 not yet calculated CVE-2026-13991 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-13991 ] Google--Chrome Inappropriate implementation in=
UI in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacke=
r who convinced a user to engage in specific UI gestures to perform UI spoo= fing via a crafted HTML page. (Chromium security severity: Medium) 2026-06-=
30 not yet calculated CVE-2026-13992 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-13992 ] Google--Chrome Incorrect security UI in WebAppInstalls in G= oogle Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced=
a user to engage in specific UI gestures to perform domain spoofing via a = crafted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet = calculated CVE-2026-13993 [ https://www.cve.org/CVERecord?id=3DCVE-2026-139=
93 ] Google--Chrome Inappropriate implementation in Credential Management i=
n Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker=
to perform UI spoofing via a crafted HTML page. (Chromium security severit=
y: Medium) 2026-06-30 not yet calculated CVE-2026-13994 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-13994 ] Google--Chrome Insufficient validation o=
f untrusted input in Autofill in Google Chrome on Android prior to 150.0.78= 71.47 allowed a remote attacker to perform UI spoofing via a crafted HTML p= age. (Chromium security severity: Medium) 2026-06-30 not yet calculated CVE= -2026-13995 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13995 ] Google--C= hrome Inappropriate implementation in Permissions in Google Chrome prior to=
150.0.7871.47 allowed a remote attacker to perform UI spoofing via a craft=
ed HTML page. (Chromium security severity: Medium) 2026-06-30 not yet calcu= lated CVE-2026-13996 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13996 ] = Google--Chrome Incorrect security UI in Extensions in Google Chrome on Andr= oid prior to 150.0.7871.47 allowed a remote attacker who convinced a user t=
o engage in specific UI gestures to perform UI spoofing via a crafted HTML = page. (Chromium security severity: Medium) 2026-06-30 not yet calculated CV= E-2026-13997 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13997 ] Google--= Chrome Incorrect security UI in File Input in Google Chrome on Mac prior to=
150.0.7871.47 allowed a remote attacker who convinced a user to engage in = specific UI gestures to perform UI spoofing via a crafted HTML page. (Chrom= ium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-13998=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-13998 ] Google--Chrome Insuf= ficient validation of untrusted input in Extensions in Google Chrome prior =
to 150.0.7871.47 allowed an attacker who convinced a user to install a mali= cious extension to perform UI spoofing via a crafted Chrome Extension. (Chr= omium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-139=
99 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13999 ] Google--Chrome Ina= ppropriate implementation in XML in Google Chrome prior to 150.0.7871.47 al= lowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a cr= afted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet ca= lculated CVE-2026-14000 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14000=
] Google--Chrome Inappropriate implementation in Network in Google Chrome = prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary script=
s or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medi= um) 2026-06-30 not yet calculated CVE-2026-14001 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-14001 ] Google--Chrome Inappropriate implementation in = Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attack=
er who had compromised the renderer process to perform UI spoofing via a cr= afted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet ca= lculated CVE-2026-14002 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14002=
] Google--Chrome Insufficient policy enforcement in Extensions in Google C= hrome prior to 150.0.7871.47 allowed an attacker who convinced a user to in= stall a malicious extension to leak cross-origin data via a crafted Chrome = Extension. (Chromium security severity: Medium) 2026-06-30 not yet calculat=
ed CVE-2026-14003 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14003 ] Goo= gle--Chrome Inappropriate implementation in CSS in Google Chrome prior to 1= 50.0.7871.47 allowed a remote attacker to leak cross-origin data via a craf= ted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet calc= ulated CVE-2026-14004 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14004 ]=
Google--Chrome Use after free in Omnibox in Google Chrome on Android prior=
to 150.0.7871.47 allowed a remote attacker who convinced a user to engage =
in specific UI gestures to potentially exploit heap corruption via a crafte=
d HTML page. (Chromium security severity: Medium) 2026-06-30 not yet calcul= ated CVE-2026-14005 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14005 ] G= oogle--Chrome Use after free in Navigation in Google Chrome prior to 150.0.= 7871.47 allowed a remote attacker to execute arbitrary code via a crafted H= TML page. (Chromium security severity: Medium) 2026-06-30 not yet calculate=
d CVE-2026-14006 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14006 ] Goog= le--Chrome Insufficient policy enforcement in PermissionsPolicy in Google C= hrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation=
restrictions via a crafted HTML page. (Chromium security severity: Medium)=
2026-06-30 not yet calculated CVE-2026-14007 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-14007 ] Google--Chrome Uninitialized Use in WebXR in Googl=
e Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obt= ain potentially sensitive information from process memory via a crafted HTM=
L page. (Chromium security severity: Medium) 2026-06-30 not yet calculated = CVE-2026-14008 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14008 ] Google= --Chrome Inappropriate implementation in Passwords in Google Chrome prior t=
o 150.0.7871.47 allowed a remote attacker to potentially exploit heap corru= ption via a crafted HTML page. (Chromium security severity: Medium) 2026-06= -30 not yet calculated CVE-2026-14009 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-14009 ] Google--Chrome Uninitialized Use in Codecs in Google Chrom=
e on Windows prior to 150.0.7871.47 allowed a remote attacker to obtain pot= entially sensitive information from process memory via a crafted HTML page.=
(Chromium security severity: Medium) 2026-06-30 not yet calculated CVE-202= 6-14010 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14010 ] Google--Chrom=
e Out of bounds read in SurfaceCapture in Google Chrome prior to 150.0.7871= .47 allowed a remote attacker to perform an out of bounds memory read via a=
crafted HTML page. (Chromium security severity: Medium) 2026-06-30 not yet=
calculated CVE-2026-14011 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14= 011 ] Google--Chrome Side-channel information leakage in CSS in Google Chro=
me prior to 150.0.7871.47 allowed a remote attacker to obtain potentially s= ensitive information from process memory via a crafted HTML page. (Chromium=
security severity: Medium) 2026-06-30 not yet calculated CVE-2026-14012 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-14012 ] Google--Chrome Inapprop= riate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed=
a remote attacker to perform UI spoofing via a crafted HTML page. (Chromiu=
m security severity: Medium) 2026-06-30 not yet calculated CVE-2026-14013 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-14013 ] Google--Chrome Inappro= priate implementation in Paint in Google Chrome prior to 150.0.7871.47 allo= wed a remote attacker to perform UI spoofing via a crafted HTML page. (Chro= mium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-1401=
4 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14014 ] Google--Chrome Race=
in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a rem= ote attacker to leak cross-origin data via a crafted HTML page. (Chromium s= ecurity severity: Medium) 2026-06-30 not yet calculated CVE-2026-14015 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-14015 ] Google--Chrome Inappropri= ate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a=
remote attacker to leak cross-origin data via a crafted HTML page. (Chromi=
um security severity: Medium) 2026-06-30 not yet calculated CVE-2026-14016 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14016 ] Google--Chrome Inappr= opriate implementation in Navigation in Google Chrome prior to 150.0.7871.4=
7 allowed a remote attacker who had compromised the renderer process to pot= entially perform a sandbox escape via a crafted HTML page. (Chromium securi=
ty severity: Medium) 2026-06-30 not yet calculated CVE-2026-14017 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-14017 ] Google--Chrome Use after free =
in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a loc=
al attacker to perform OS-level privilege escalation via a malicious file. = (Chromium security severity: Medium) 2026-06-30 not yet calculated CVE-2026= -14018 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14018 ] Google--Chrome=
Inappropriate implementation in Passwords in Google Chrome prior to 150.0.= 7871.47 allowed a remote attacker to leak cross-origin data via a crafted H= TML page. (Chromium security severity: Medium) 2026-06-30 not yet calculate=
d CVE-2026-14019 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14019 ] Goog= le--Chrome Insufficient validation of untrusted input in WebXR in Google Ch= rome prior to 150.0.7871.47 allowed a remote attacker who had compromised t=
he renderer process to perform UI spoofing via a crafted HTML page. (Chromi=
um security severity: Medium) 2026-06-30 not yet calculated CVE-2026-14020 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14020 ] Google--Chrome Insuff= icient policy enforcement in StorageAccessAPI in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker who had compromised the renderer proce=
ss to leak cross-origin data via a crafted HTML page. (Chromium security se= verity: Medium) 2026-06-30 not yet calculated CVE-2026-14021 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-14021 ] Google--Chrome Insufficient validat= ion of untrusted input in Network in Google Chrome prior to 150.0.7871.47 a= llowed a remote attacker who had compromised the renderer process to leak c= ross-origin data via a crafted HTML page. (Chromium security severity: Medi= um) 2026-06-30 not yet calculated CVE-2026-14022 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-14022 ] Google--Chrome Insufficient validation of untru= sted input in SanitizerAPI in Google Chrome prior to 150.0.7871.47 allowed =
a remote attacker to bypass same origin policy via a crafted HTML page. (Ch= romium security severity: Medium) 2026-06-30 not yet calculated CVE-2026-14= 023 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14023 ] Google--Chrome Us=
e after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allo= wed a remote attacker who convinced a user to engage in specific UI gesture=
s to potentially exploit heap corruption via a crafted HTML page. (Chromium=
security severity: Medium) 2026-06-30 not yet calculated CVE-2026-14024 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-14024 ] Google--Chrome Use afte=
r free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a re= mote attacker who convinced a user to engage in specific UI gestures to pot= entially exploit heap corruption via a crafted HTML page. (Chromium securit=
y severity: Low) 2026-06-30 not yet calculated CVE-2026-14025 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-14025 ] Google--Chrome Incorrect security =
UI in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote at= tacker who convinced a user to engage in specific UI gestures to perform UI=
spoofing via a crafted HTML page. (Chromium security severity: Low) 2026-0= 6-30 not yet calculated CVE-2026-14026 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14026 ] Google--Chrome Use after free in SignIn in Google Chrom=
e prior to 150.0.7871.47 allowed a remote attacker who convinced a user to = engage in specific UI gestures to potentially exploit heap corruption via a=
crafted HTML page. (Chromium security severity: Low) 2026-06-30 not yet ca= lculated CVE-2026-14027 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14027=
] Google--Chrome Incorrect security UI in Chrome for iOS in Google Chrome =
on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a use=
r to engage in specific UI gestures to perform UI spoofing via a crafted HT=
ML page. (Chromium security severity: Low) 2026-06-30 not yet calculated CV= E-2026-14028 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14028 ] Google--= Chrome Inappropriate implementation in SplitView in Google Chrome on Linux = prior to 150.0.7871.47 allowed a remote attacker who convinced a user to en= gage in specific UI gestures to spoof the contents of the Omnibox (URL bar)=
via a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not = yet calculated CVE-2026-14030 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -14030 ] Google--Chrome Inappropriate implementation in File Input in Googl=
e Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spo= ofing via a crafted HTML page. (Chromium security severity: Low) 2026-06-30=
not yet calculated CVE-2026-14031 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-14031 ] Google--Chrome Use after free in Bluetooth in Google Chrome o=
n Mac prior to 150.0.7871.47 allowed an attacker who convinced a user to in= stall a malicious extension to execute arbitrary code via a crafted Chrome = Extension. (Chromium security severity: Low) 2026-06-30 not yet calculated = CVE-2026-14032 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14032 ] Google= --Chrome Insufficient policy enforcement in Media in Google Chrome on Windo=
ws prior to 150.0.7871.47 allowed a remote attacker to bypass site isolatio=
n via a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not=
yet calculated CVE-2026-14033 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-14033 ] Google--Chrome Inappropriate implementation in WebXR in Google Ch= rome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass = navigation restrictions via a crafted HTML page. (Chromium security severit=
y: Low) 2026-06-30 not yet calculated CVE-2026-14034 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-14034 ] Google--Chrome Insufficient policy enforcem= ent in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote a= ttacker to obtain potentially sensitive information from process memory via=
a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not yet = calculated CVE-2026-14035 [ https://www.cve.org/CVERecord?id=3DCVE-2026-140=
35 ] Google--Chrome Insufficient policy enforcement in Bluetooth in Google = Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privileg=
e escalation via a crafted HTML page. (Chromium security severity: Low) 202= 6-06-30 not yet calculated CVE-2026-14036 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-14036 ] Google--Chrome Insufficient policy enforcement in GPU =
in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had c= ompromised the renderer process to potentially perform a sandbox escape via=
a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not yet = calculated CVE-2026-14037 [ https://www.cve.org/CVERecord?id=3DCVE-2026-140=
37 ] Google--Chrome Insufficient validation of untrusted input in New Tab P= age in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who h=
ad compromised the renderer process to potentially perform a sandbox escape=
via a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not = yet calculated CVE-2026-14038 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -14038 ] Google--Chrome Insufficient policy enforcement in GetUserMedia in = Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass sa=
me origin policy via a crafted HTML page. (Chromium security severity: Low)=
2026-06-30 not yet calculated CVE-2026-14039 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-14039 ] Google--Chrome Use after free in BrowserTag in Goo= gle Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user =
to install a malicious extension to potentially exploit heap corruption via=
a crafted Chrome Extension. (Chromium security severity: Low) 2026-06-30 n=
ot yet calculated CVE-2026-14040 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-14040 ] Google--Chrome Insufficient policy enforcement in Serial in Goo= gle Chrome prior to 150.0.7871.47 allowed a remote attacker to perform priv= ilege escalation via a crafted HTML page. (Chromium security severity: Low)=
2026-06-30 not yet calculated CVE-2026-14041 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-14041 ] Google--Chrome Inappropriate implementation in Iso= lated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote att= acker to perform UI spoofing via a crafted HTML page. (Chromium security se= verity: Low) 2026-06-30 not yet calculated CVE-2026-14042 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-14042 ] Google--Chrome Use after free in GetUs= erMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker w=
ho had compromised the renderer process to potentially perform a sandbox es= cape via a crafted HTML page. (Chromium security severity: Low) 2026-06-30 = not yet calculated CVE-2026-14043 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-14043 ] Google--Chrome Use after free in ANGLE in Google Chrome prior =
to 150.0.7871.47 allowed a remote attacker who had compromised the renderer=
process to potentially perform a sandbox escape via a crafted HTML page. (= Chromium security severity: Low) 2026-06-30 not yet calculated CVE-2026-140=
44 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14044 ] Google--Chrome Ins= ufficient validation of untrusted input in Network in Google Chrome prior t=
o 150.0.7871.47 allowed a remote attacker who had compromised the renderer = process to leak cross-origin data via a crafted HTML page. (Chromium securi=
ty severity: Low) 2026-06-30 not yet calculated CVE-2026-14045 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-14045 ] Google--Chrome Inappropriate impl= ementation in CustomTabs in Google Chrome on Android prior to 150.0.7871.47=
allowed a remote attacker to bypass same origin policy via a crafted HTML = page. (Chromium security severity: Low) 2026-06-30 not yet calculated CVE-2= 026-14046 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14046 ] Google--Chr= ome Insufficient policy enforcement in Extensions in Google Chrome prior to=
150.0.7871.47 allowed an attacker who convinced a user to install a malici= ous extension to bypass content security policy via a crafted Chrome Extens= ion. (Chromium security severity: Low) 2026-06-30 not yet calculated CVE-20= 26-14047 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14047 ] Google--Chro=
me Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 all= owed an attacker on the local network segment to obtain potentially sensiti=
ve information from process memory via a malicious peripheral. (Chromium se= curity severity: Low) 2026-06-30 not yet calculated CVE-2026-14048 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-14048 ] Google--Chrome Inappropriate = implementation in GPU in Google Chrome prior to 150.0.7871.47 allowed a rem= ote attacker who had compromised the renderer process to obtain potentially=
sensitive information from process memory via a crafted HTML page. (Chromi=
um security severity: Low) 2026-06-30 not yet calculated CVE-2026-14049 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-14049 ] Google--Chrome Insuffici= ent policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47=
allowed a remote attacker to leak cross-origin data via a crafted HTML pag=
e. (Chromium security severity: Low) 2026-06-30 not yet calculated CVE-2026= -14050 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14050 ] Google--Chrome=
Uninitialized Use in GamepadAPI in Google Chrome prior to 150.0.7871.47 al= lowed a remote attacker who had compromised the renderer process to obtain = potentially sensitive information from process memory via a crafted HTML pa= ge. (Chromium security severity: Low) 2026-06-30 not yet calculated CVE-202= 6-14051 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14051 ] Google--Chrom=
e Insufficient policy enforcement in FileSystem in Google Chrome prior to 1= 50.0.7871.47 allowed a remote attacker to bypass discretionary access contr=
ol via a crafted HTML page. (Chromium security severity: Low) 2026-06-30 no=
t yet calculated CVE-2026-14052 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-14052 ] Google--Chrome Insufficient policy enforcement in Extensions in = Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp= romised the renderer process to leak cross-origin data via a crafted HTML p= age. (Chromium security severity: Low) 2026-06-30 not yet calculated CVE-20= 26-14053 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14053 ] Google--Chro=
me Insufficient policy enforcement in Network in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker to bypass navigation restrictions via =
a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not yet c= alculated CVE-2026-14054 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1405=
4 ] Google--Chrome Insufficient validation of untrusted input in Device Tru=
st in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote atta= cker who had compromised the renderer process to potentially perform a sand= box escape via a crafted HTML page. (Chromium security severity: Low) 2026-= 06-30 not yet calculated CVE-2026-14055 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14055 ] Google--Chrome Insufficient validation of untrusted inp=
ut in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attack=
er who had compromised the renderer process to potentially perform a sandbo=
x escape via a crafted video file. (Chromium security severity: Low) 2026-0= 6-30 not yet calculated CVE-2026-14056 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14056 ] Google--Chrome Inappropriate implementation in FedCM in=
Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass s= ame origin policy via a crafted HTML page. (Chromium security severity: Low=
) 2026-06-30 not yet calculated CVE-2026-14057 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-14057 ] Google--Chrome Insufficient policy enforcement in=
Parser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker t=
o bypass content security policy via a crafted HTML page. (Chromium securit=
y severity: Low) 2026-06-30 not yet calculated CVE-2026-14058 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-14058 ] Google--Chrome Insufficient policy=
enforcement in Related-Website-Sets in Google Chrome prior to 150.0.7871.4=
7 allowed a remote attacker to leak cross-origin data via a crafted HTML pa= ge. (Chromium security severity: Low) 2026-06-30 not yet calculated CVE-202= 6-14059 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14059 ] Google--Chrom=
e Insufficient validation of untrusted input in Chromoting in Google Chrome=
on Windows prior to 150.0.7871.47 allowed a local attacker to perform priv= ilege escalation via a malicious file. (Chromium security severity: Low) 20= 26-06-30 not yet calculated CVE-2026-14060 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-14060 ] Google--Chrome Inappropriate implementation in Dawn i=
n Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain = potentially sensitive information from process memory via a crafted HTML pa= ge. (Chromium security severity: Low) 2026-06-30 not yet calculated CVE-202= 6-14061 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14061 ] Google--Chrom=
e Inappropriate implementation in Views in Google Chrome on ChromeOS prior =
to 150.0.7871.47 allowed an attacker who convinced a user to install a mali= cious extension to obtain potentially sensitive information from process me= mory via a crafted Chrome Extension. (Chromium security severity: Low) 2026= -06-30 not yet calculated CVE-2026-14062 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14062 ] Google--Chrome Out of bounds read in Chromecast in Goog=
le Chrome prior to 150.0.7871.47 allowed a local attacker to obtain potenti= ally sensitive information from process memory via malicious network traffi=
c. (Chromium security severity: Low) 2026-06-30 not yet calculated CVE-2026= -14063 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14063 ] Google--Chrome=
Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871= .47 allowed a remote attacker who convinced a user to engage in specific UI=
gestures to execute arbitrary code via a crafted HTML page. (Chromium secu= rity severity: Low) 2026-06-30 not yet calculated CVE-2026-14064 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-14064 ] Google--Chrome Insufficient val= idation of untrusted input in PageInfo in Google Chrome prior to 150.0.7871= .47 allowed a remote attacker who had compromised the renderer process to b= ypass navigation restrictions via a crafted HTML page. (Chromium security s= everity: Low) 2026-06-30 not yet calculated CVE-2026-14065 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-14065 ] Google--Chrome Insufficient validatio=
n of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150= .0.7871.47 allowed a remote attacker to bypass navigation restrictions via =
a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not yet c= alculated CVE-2026-14066 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1406=
6 ] Google--Chrome Use after free in Chrome for iOS in Google Chrome on iOS=
prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code=
via a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not = yet calculated CVE-2026-14067 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -14067 ] Google--Chrome Inappropriate implementation in Omnibox in Google C= hrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced=
a user to engage in specific UI gestures to inject arbitrary scripts or HT=
ML (UXSS) via a crafted HTML page. (Chromium security severity: Low) 2026-0= 6-30 not yet calculated CVE-2026-14068 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14068 ] Google--Chrome Integer overflow in WebNN in Google Chro=
me prior to 150.0.7871.47 allowed a remote attacker to obtain potentially s= ensitive information from process memory via a crafted HTML page. (Chromium=
security severity: Low) 2026-06-30 not yet calculated CVE-2026-14069 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-14069 ] Google--Chrome Integer ove= rflow in WebNN in Google Chrome prior to 150.0.7871.47 allowed a remote att= acker to obtain potentially sensitive information from process memory via a=
crafted HTML page. (Chromium security severity: Low) 2026-06-30 not yet ca= lculated CVE-2026-14070 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14070=
] Google--Chrome Side-channel information leakage in WebAudio in Google Ch= rome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin = data via a crafted HTML page. (Chromium security severity: Low) 2026-06-30 = not yet calculated CVE-2026-14071 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-14071 ] Google--Chrome Inappropriate implementation in SplitView in Go= ogle Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI = spoofing via a crafted HTML page. (Chromium security severity: Low) 2026-06= -30 not yet calculated CVE-2026-14072 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-14072 ] Google--Chrome Insufficient validation of untrusted input =
in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker =
to bypass navigation restrictions via a crafted HTML page. (Chromium securi=
ty severity: Low) 2026-06-30 not yet calculated CVE-2026-14073 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-14073 ] Google--Chrome Side-channel infor= mation leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.= 7871.47 allowed a remote attacker to leak cross-origin data via a crafted H= TML page. (Chromium security severity: Low) 2026-06-30 not yet calculated C= VE-2026-14074 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14074 ] Google-= -Chrome Insufficient policy enforcement in Chrome for iOS in Google Chrome =
on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass no-referr=
er policy via a crafted HTML page. (Chromium security severity: Low) 2026-0= 6-30 not yet calculated CVE-2026-14075 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14075 ] Google--Chrome Insufficient policy enforcement in Netwo=
rk in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to byp= ass content security policy via a crafted HTML page. (Chromium security sev= erity: Low) 2026-06-30 not yet calculated CVE-2026-14076 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-14076 ] Google--Chrome Inappropriate implementa= tion in Select in Google Chrome on Mac prior to 150.0.7871.47 allowed a rem= ote attacker to spoof the contents of the Omnibox (URL bar) via a crafted H= TML page. (Chromium security severity: Low) 2026-06-30 not yet calculated C= VE-2026-14077 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14077 ] Google-= -Chrome Insufficient validation of untrusted input in WebRTC in Google Chro=
me prior to 150.0.7871.47 allowed a remote attacker to perform privilege es= calation via a crafted HTML page. (Chromium security severity: Low) 2026-06= -30 not yet calculated CVE-2026-14078 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-14078 ] Google--Chrome Insufficient policy enforcement in Network =
in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass=
same origin policy via a crafted HTML page. (Chromium security severity: L= ow) 2026-06-30 not yet calculated CVE-2026-14079 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-14079 ] Google--Chrome Insufficient validation of untru= sted input in TabSwitcher in Google Chrome on Android prior to 150.0.7871.4=
7 allowed a remote attacker to bypass navigation restrictions via malicious=
network traffic. (Chromium security severity: Low) 2026-06-30 not yet calc= ulated CVE-2026-14080 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14080 ]=
Google--Chrome Insufficient policy enforcement in DevTools in Google Chrom=
e prior to 150.0.7871.47 allowed an attacker who convinced a user to instal=
l a malicious extension to obtain potentially sensitive information from pr= ocess memory via a crafted Chrome Extension. (Chromium security severity: L= ow) 2026-06-30 not yet calculated CVE-2026-14081 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-14081 ] Google--Chrome Race in Storage in Google Chrome=
prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data=
via a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not = yet calculated CVE-2026-14082 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -14082 ] Google--Chrome Insufficient validation of untrusted input in HTML =
in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject=
arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium securi=
ty severity: Low) 2026-06-30 not yet calculated CVE-2026-14083 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-14083 ] Google--Chrome Insufficient valid= ation of untrusted input in Chromoting in Google Chrome prior to 150.0.7871= .47 allowed a remote attacker to potentially exploit heap corruption via ma= licious network traffic. (Chromium security severity: Low) 2026-06-30 not y=
et calculated CVE-2026-14084 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 14084 ] Google--Chrome Side-channel information leakage in CSS in Google Ch= rome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin = data via a crafted HTML page. (Chromium security severity: Low) 2026-06-30 = not yet calculated CVE-2026-14085 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-14085 ] Google--Chrome Insufficient policy enforcement in HID in Googl=
e Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitr= ary code via a crafted HTML page. (Chromium security severity: Low) 2026-06= -30 not yet calculated CVE-2026-14086 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-14086 ] Google--Chrome Heap buffer overflow in WebNN in Google Chr= ome on Windows prior to 150.0.7871.47 allowed a remote attacker who had com= promised the renderer process to potentially exploit heap corruption via a = crafted HTML page. (Chromium security severity: Low) 2026-06-30 not yet cal= culated CVE-2026-14087 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14087 =
] Google--Chrome Uninitialized Use in Canvas in Google Chrome on Android pr= ior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensit= ive information from process memory via a crafted HTML page. (Chromium secu= rity severity: Low) 2026-06-30 not yet calculated CVE-2026-14088 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-14088 ] Google--Chrome Insufficient val= idation of untrusted input in PopupBlocker in Google Chrome prior to 150.0.= 7871.47 allowed a remote attacker who had compromised the renderer process =
to perform UI spoofing via a crafted HTML page. (Chromium security severity=
: Low) 2026-06-30 not yet calculated CVE-2026-14089 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-14089 ] Google--Chrome Insufficient validation of un= trusted input in CameraCapture in Google Chrome on ChromeOS prior to 150.0.= 7871.47 allowed a remote attacker to perform an out of bounds memory read v=
ia a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not ye=
t calculated CVE-2026-14090 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 4090 ] Google--Chrome Use after free in DevTools in Google Chrome prior to = 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a = sandbox via a crafted HTML page. (Chromium security severity: Low) 2026-06-=
30 not yet calculated CVE-2026-14091 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-14091 ] Google--Chrome Insufficient policy enforcement in Privacy i=
n Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged = network position to leak cross-origin data via malicious network traffic. (= Chromium security severity: Low) 2026-06-30 not yet calculated CVE-2026-140=
92 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14092 ] Google--Chrome Use=
after free in Cast in Google Chrome prior to 150.0.7871.47 allowed a remot=
e attacker who had compromised the renderer process to potentially perform =
a sandbox escape via a crafted HTML page. (Chromium security severity: Low)=
2026-06-30 not yet calculated CVE-2026-14093 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-14093 ] Google--Chrome Use after free in Installer in Goog=
le Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to per= form OS-level privilege escalation via a malicious file. (Chromium security=
severity: Low) 2026-06-30 not yet calculated CVE-2026-14094 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-14094 ] Google--Chrome Insufficient policy = enforcement in Browser in Google Chrome prior to 150.0.7871.47 allowed a re= mote attacker who had compromised the renderer process to potentially perfo=
rm a sandbox escape via a crafted HTML page. (Chromium security severity: L= ow) 2026-06-30 not yet calculated CVE-2026-14095 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-14095 ] Google--Chrome Inappropriate implementation in = Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote a= ttacker who had compromised the renderer process to leak cross-origin data = via a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not y=
et calculated CVE-2026-14096 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 14096 ] Google--Chrome Inappropriate implementation in WebAppInstalls in Go= ogle Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had=
compromised the renderer process to potentially perform a sandbox escape v=
ia a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not ye=
t calculated CVE-2026-14097 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 4097 ] Google--Chrome Inappropriate implementation in CSS in Google Chrome = prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data = via a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not y=
et calculated CVE-2026-14098 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 14098 ] Google--Chrome Use after free in Chrome for iOS in Google Chrome on=
iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user =
to engage in specific UI gestures to potentially exploit heap corruption vi=
a a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not yet=
calculated CVE-2026-14099 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14= 099 ] Google--Chrome Insufficient data validation in NetworkCache in Google=
Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-orig=
in data via a crafted HTML page. (Chromium security severity: Low) 2026-06-=
30 not yet calculated CVE-2026-14100 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-14100 ] Google--Chrome Insufficient policy enforcement in Sandbox i=
n Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who=
had compromised the renderer process to potentially perform a sandbox esca=
pe via a crafted HTML page. (Chromium security severity: Low) 2026-06-30 no=
t yet calculated CVE-2026-14101 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-14101 ] Google--Chrome Use after free in Passwords in Google Chrome prio=
r to 150.0.7871.47 allowed a remote attacker to potentially exploit heap co= rruption via a crafted HTML page. (Chromium security severity: Low) 2026-06= -30 not yet calculated CVE-2026-14102 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-14102 ] Google--Chrome Use after free in SSL in Google Chrome on C= hromeOS prior to 150.0.7871.47 allowed a remote attacker to obtain potentia= lly sensitive information from process memory via a crafted HTML page. (Chr= omium security severity: Low) 2026-06-30 not yet calculated CVE-2026-14103 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14103 ] Google--Chrome Insuff= icient validation of untrusted input in WebAppInstalls in Google Chrome pri=
or to 150.0.7871.47 allowed a remote attacker to execute arbitrary code ins= ide a sandbox via a crafted HTML page. (Chromium security severity: Low) 20= 26-06-30 not yet calculated CVE-2026-14104 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-14104 ] Google--Chrome Insufficient policy enforcement in Spe= ech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to by= pass same origin policy via a crafted HTML page. (Chromium security severit=
y: Low) 2026-06-30 not yet calculated CVE-2026-14105 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-14105 ] Google--Chrome Insufficient validation of u= ntrusted input in Text in Google Chrome on Android prior to 150.0.7871.47 a= llowed a remote attacker who had compromised the renderer process to potent= ially perform a sandbox escape via a crafted HTML page. (Chromium security = severity: Low) 2026-06-30 not yet calculated CVE-2026-14106 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-14106 ] Google--Chrome Use after free in Sch= eduling in Google Chrome prior to 150.0.7871.47 allowed a remote attacker t=
o execute arbitrary code inside a sandbox via a crafted HTML page. (Chromiu=
m security severity: Low) 2026-06-30 not yet calculated CVE-2026-14107 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-14107 ] Google--Chrome Use after = free in PDFium in Google Chrome prior to 150.0.7871.47 allowed a remote att= acker to execute arbitrary code inside a sandbox via a crafted PDF file. (C= hromium security severity: Low) 2026-06-30 not yet calculated CVE-2026-1410=
8 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14108 ] Google--Chrome Insu= fficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47=
allowed a remote attacker who had compromised the renderer process to pote= ntially perform a sandbox escape via a crafted HTML page. (Chromium securit=
y severity: Low) 2026-06-30 not yet calculated CVE-2026-14109 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-14109 ] Google--Chrome Inappropriate imple= mentation in DarkMode in Google Chrome prior to 150.0.7871.47 allowed a rem= ote attacker to perform UI spoofing via a crafted HTML page. (Chromium secu= rity severity: Low) 2026-06-30 not yet calculated CVE-2026-14110 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-14110 ] Google--Chrome Use after free i=
n WebProtect in Google Chrome prior to 150.0.7871.47 allowed an attacker wh=
o convinced a user to install a malicious extension to execute arbitrary co=
de via a crafted Chrome Extension. (Chromium security severity: Low) 2026-0= 6-30 not yet calculated CVE-2026-14111 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14111 ] Google--Chrome Inappropriate implementation in Enterpri=
se in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who co= nvinced a user to engage in specific UI gestures to obtain potentially sens= itive information from process memory via a crafted HTML page. (Chromium se= curity severity: Low) 2026-06-30 not yet calculated CVE-2026-14112 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-14112 ] Google--Chrome Use after free=
in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a re= mote attacker who had compromised the renderer process to potentially perfo=
rm a sandbox escape via a crafted HTML page. (Chromium security severity: L= ow) 2026-06-30 not yet calculated CVE-2026-14113 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-14113 ] Google--Chrome Inappropriate implementation in = WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a=
local attacker to perform UI spoofing via a malicious file. (Chromium secu= rity severity: Low) 2026-06-30 not yet calculated CVE-2026-14114 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-14114 ] Google--Chrome Insufficient val= idation of untrusted input in Cast in Google Chrome prior to 150.0.7871.47 = allowed a remote attacker who had compromised the renderer process to perfo=
rm privilege escalation via a crafted HTML page. (Chromium security severit=
y: Low) 2026-06-30 not yet calculated CVE-2026-14115 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-14115 ] Google--Chrome Insufficient validation of u= ntrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed =
a remote attacker who convinced a user to engage in specific UI gestures to=
leak cross-origin data via a crafted HTML page. (Chromium security severit=
y: Low) 2026-06-30 not yet calculated CVE-2026-14116 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-14116 ] Google--Chrome Insufficient validation of u= ntrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.=
47 allowed a remote attacker who convinced a user to engage in specific UI = gestures to obtain potentially sensitive information from process memory vi=
a a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not yet=
calculated CVE-2026-14117 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14= 117 ] Google--Chrome Insufficient data validation in DevTools in Google Chr= ome prior to 150.0.7871.47 allowed a remote attacker who convinced a user t=
o engage in specific UI gestures to leak cross-origin data via a crafted HT=
ML page. (Chromium security severity: Low) 2026-06-30 not yet calculated CV= E-2026-14118 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14118 ] Google--= Chrome Type Confusion in Bluetooth in Google Chrome on Windows prior to 150= .0.7871.47 allowed an attacker on the local network segment to obtain poten= tially sensitive information from process memory via a malicious peripheral=
. (Chromium security severity: Low) 2026-06-30 not yet calculated CVE-2026-= 14119 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14119 ] Google--Chrome = Inappropriate implementation in DevTools in Google Chrome prior to 150.0.78= 71.47 allowed a remote attacker who had compromised the renderer process to=
potentially perform a sandbox escape via a crafted HTML page. (Chromium se= curity severity: Low) 2026-06-30 not yet calculated CVE-2026-14120 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-14120 ] Google--Chrome Use after free=
in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a r= emote attacker to execute arbitrary code via malicious network traffic. (Ch= romium security severity: Low) 2026-06-30 not yet calculated CVE-2026-14121=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14121 ] Google--Chrome Insuf= ficient validation of untrusted input in WebAppInstalls in Google Chrome on=
Windows prior to 150.0.7871.47 allowed a remote attacker to perform arbitr= ary read/write via a crafted HTML page. (Chromium security severity: Low) 2= 026-06-30 not yet calculated CVE-2026-14122 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-14122 ] Google--Chrome Incorrect security UI in Chrome for i=
OS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker=
to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (C= hromium security severity: Low) 2026-06-30 not yet calculated CVE-2026-1412=
3 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14123 ] Google--Chrome Inap= propriate implementation in CredentialProvider in Google Chrome on Windows = prior to 150.0.7871.47 allowed a local attacker to perform OS-level privile=
ge escalation via a malicious file. (Chromium security severity: Low) 2026-= 06-30 not yet calculated CVE-2026-14124 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14124 ] Google--Chrome Uninitialized Use in ANGLE in Google Chr= ome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially = sensitive information from process memory via a crafted HTML page. (Chromiu=
m security severity: Low) 2026-06-30 not yet calculated CVE-2026-14125 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-14125 ] Google--Chrome Incorrect = security UI in UI in Google Chrome on Android prior to 150.0.7871.47 allowe=
d a remote attacker to perform domain spoofing via a crafted HTML page. (Ch= romium security severity: Low) 2026-06-30 not yet calculated CVE-2026-14126=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14126 ] Google--Chrome Inapp= ropriate implementation in Printing in Google Chrome prior to 150.0.7871.47=
allowed a remote attacker who had compromised the renderer process to perf= orm UI spoofing via a crafted HTML page. (Chromium security severity: Low) = 2026-06-30 not yet calculated CVE-2026-14127 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-14127 ] Google--Chrome Inappropriate implementation in Chro=
me for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote = attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML = page. (Chromium security severity: Low) 2026-06-30 not yet calculated CVE-2= 026-14128 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14128 ] Google--Chr= ome Inappropriate implementation in PreviewTab in Google Chrome on Android = prior to 150.0.7871.47 allowed a remote attacker who convinced a user to en= gage in specific UI gestures to perform UI spoofing via a crafted HTML page=
. (Chromium security severity: Low) 2026-06-30 not yet calculated CVE-2026-= 14129 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14129 ] Google--Chrome = Incorrect security UI in Omnibox in Google Chrome prior to 150.0.7871.47 al= lowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch= romium security severity: Low) 2026-06-30 not yet calculated CVE-2026-14130=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14130 ] Google--Chrome Insuf= ficient validation of untrusted input in WebAppInstalls in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker who had compromised the rend= erer process to perform UI spoofing via a crafted HTML page. (Chromium secu= rity severity: Low) 2026-06-30 not yet calculated CVE-2026-14131 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-14131 ] Google--Chrome Inappropriate im= plementation in WebXR in Google Chrome prior to 150.0.7871.47 allowed a rem= ote attacker to perform UI spoofing via a crafted HTML page. (Chromium secu= rity severity: Low) 2026-06-30 not yet calculated CVE-2026-14132 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-14132 ] Google--Chrome Race in History = Embeddings in Google Chrome prior to 150.0.7871.47 allowed a remote attacke=
r to perform UI spoofing via a crafted HTML page. (Chromium security severi= ty: Low) 2026-06-30 not yet calculated CVE-2026-14133 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-14133 ] Google--Chrome Inappropriate implementatio=
n in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a = remote attacker to perform UI spoofing via a crafted HTML page. (Chromium s= ecurity severity: Low) 2026-06-30 not yet calculated CVE-2026-14134 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-14134 ] Google--Chrome Insufficient = validation of untrusted input in Network in Google Chrome prior to 150.0.78= 71.47 allowed a remote attacker who had compromised the renderer process to=
perform UI spoofing via a crafted HTML page. (Chromium security severity: = Low) 2026-06-30 not yet calculated CVE-2026-14135 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-14135 ] Google--Chrome Insufficient validation of untr= usted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.4=
7 allowed a remote attacker to perform UI spoofing via a crafted HTML page.=
(Chromium security severity: Low) 2026-06-30 not yet calculated CVE-2026-1= 4136 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14136 ] Google--Chrome I= nsufficient validation of untrusted input in Chrome for iOS in Google Chrom=
e on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a u= ser to engage in specific UI gestures to perform UI spoofing via a crafted = HTML page. (Chromium security severity: Low) 2026-06-30 not yet calculated = CVE-2026-14137 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14137 ] Google= --Chrome Inappropriate implementation in WebAppInstalls in Google Chrome on=
Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a u= ser to engage in specific UI gestures to perform UI spoofing via a crafted = HTML page. (Chromium security severity: Low) 2026-06-30 not yet calculated = CVE-2026-14138 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14138 ] Google= --Chrome Inappropriate implementation in TabStrip in Google Chrome prior to=
150.0.7871.47 allowed a remote attacker who convinced a user to engage in = specific UI gestures to perform UI spoofing via a crafted HTML page. (Chrom= ium security severity: Low) 2026-06-30 not yet calculated CVE-2026-14139 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-14139 ] Google--Chrome Insuffic= ient validation of untrusted input in Input in Google Chrome on Android pri=
or to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a = crafted HTML page. (Chromium security severity: Low) 2026-06-30 not yet cal= culated CVE-2026-14140 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14140 =
] Google--Chrome Incorrect security UI in Document Picture-in-Picture in Go= ogle Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to = perform domain spoofing via a crafted HTML page. (Chromium security severit=
y: Low) 2026-06-30 not yet calculated CVE-2026-14141 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-14141 ] Google--Chrome Inappropriate implementation=
in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote att= acker who had compromised the renderer process to perform UI spoofing via a=
crafted HTML page. (Chromium security severity: Low) 2026-06-30 not yet ca= lculated CVE-2026-14142 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14142=
] Google--Chrome Incorrect security UI in Passwords in Google Chrome on iO=
S prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing v=
ia a crafted HTML page. (Chromium security severity: Low) 2026-06-30 not ye=
t calculated CVE-2026-14143 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 4143 ] Google--Chrome Incorrect security UI in Views in Google Chrome prior=
to 150.0.7871.47 allowed a remote attacker who convinced a user to engage =
in specific UI gestures to perform UI spoofing via a crafted HTML page. (Ch= romium security severity: Low) 2026-06-30 not yet calculated CVE-2026-14144=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14144 ] Google--Chrome Inapp= ropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allo= wed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a craf= ted HTML page. (Chromium security severity: Low) 2026-06-30 not yet calcula= ted CVE-2026-14145 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14145 ] Go= ogle--Chrome Inappropriate implementation in CSS in Google Chrome prior to = 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a cra= fted HTML page. (Chromium security severity: Low) 2026-06-30 not yet calcul= ated CVE-2026-14146 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14146 ] G= oogle--Chrome Inappropriate implementation in CSS in Google Chrome prior to=
150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTM=
L (UXSS) via a crafted HTML page. (Chromium security severity: Low) 2026-06= -30 not yet calculated CVE-2026-14147 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-14147 ] Google--Chrome Type Confusion in CSS in Google Chrome prio=
r to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitiv=
e information from process memory via a crafted HTML page. (Chromium securi=
ty severity: Low) 2026-06-30 not yet calculated CVE-2026-14148 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-14148 ] Google--Chrome Use after free in = Audio in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote att= acker to execute arbitrary code via a crafted HTML page. (Chromium security=
severity: Low) 2026-06-30 not yet calculated CVE-2026-14149 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-14149 ] Google--Chrome Insufficient validat= ion of untrusted input in Speech in Google Chrome prior to 150.0.7871.47 al= lowed a remote attacker who had compromised the renderer process to perform=
UI spoofing via a crafted HTML page. (Chromium security severity: Low) 202= 6-06-30 not yet calculated CVE-2026-14150 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-14150 ] Google--Chrome Inappropriate implementation in AI in G= oogle Chrome prior to 150.0.7871.47 allowed a remote attacker who had compr= omised the renderer process to potentially perform a sandbox escape via a c= rafted HTML page. (Chromium security severity: Low) 2026-06-30 not yet calc= ulated CVE-2026-14151 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14151 ]=
Google--Chrome Out of bounds read and write in ANGLE in Google Chrome prio=
r to 150.0.7871.47 allowed a remote attacker who had compromised the render=
er process to potentially perform a sandbox escape via a crafted HTML page.=
(Chromium security severity: Low) 2026-06-30 not yet calculated CVE-2026-1= 4152 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14152 ] Google--Chrome I= nappropriate implementation in Glic in Google Chrome prior to 150.0.7871.47=
allowed a remote attacker who convinced a user to engage in specific UI ge= stures to perform UI spoofing via a crafted HTML page. (Chromium security s= everity: Low) 2026-06-30 not yet calculated CVE-2026-14153 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-14153 ] Google--Chrome Inappropriate implemen= tation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attac= ker who convinced a user to install a malicious extension to perform UI spo= ofing via a crafted Chrome Extension. (Chromium security severity: Low) 202= 6-06-30 not yet calculated CVE-2026-14154 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-14154 ] Google--Chrome Insufficient policy enforcement in Stor= ageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attac= ker to leak cross-origin data via a crafted HTML page. (Chromium security s= everity: Low) 2026-06-30 not yet calculated CVE-2026-14155 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-14155 ] Google--Chrome Insufficient policy en= forcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allow=
ed a remote attacker who had compromised the renderer process to bypass sam=
e origin policy via a crafted HTML page. (Chromium security severity: Low) = 2026-06-30 not yet calculated CVE-2026-14156 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-14156 ] Google--Chrome Incorrect security UI in WebAppInsta= lls in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to pe= rform UI spoofing via a crafted HTML page. (Chromium security severity: Med= ium) 2026-07-01 not yet calculated CVE-2026-14381 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-14381 ] Google--Chrome Insufficient validation of untr= usted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remo=
te attacker to potentially perform a sandbox escape via a crafted HTML page=
. (Chromium security severity: High) 2026-07-01 not yet calculated CVE-2026= -14382 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14382 ] Google--Chrome=
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46=
allowed a remote attacker to execute arbitrary code inside a sandbox via a=
crafted HTML page. (Chromium security severity: Medium) 2026-07-01 not yet=
calculated CVE-2026-14383 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14= 383 ] Google--Chrome Out of bounds read in ANGLE in Google Chrome on Window=
s prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin dat=
a via a crafted HTML page. (Chromium security severity: Medium) 2026-07-01 = not yet calculated CVE-2026-14384 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-14384 ] Google--Chrome Heap buffer overflow in ANGLE in Google Chrome =
on Mac prior to 150.0.7871.46 allowed a remote attacker to perform out of b= ounds memory access via a crafted HTML page. (Chromium security severity: H= igh) 2026-07-01 not yet calculated CVE-2026-14385 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-14385 ] Google--Chrome Out of bounds read in ANGLE in = Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain po= tentially sensitive information from process memory via a crafted HTML page=
. (Chromium security severity: High) 2026-07-01 not yet calculated CVE-2026= -14386 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14386 ] Google--Chrome=
Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a=
remote attacker to potentially perform a sandbox escape via a crafted HTML=
page. (Chromium security severity: Medium) 2026-07-01 not yet calculated C= VE-2026-14387 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14387 ] Google-= -Chrome Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46=
allowed a remote attacker to obtain potentially sensitive information from=
process memory via a crafted HTML page. (Chromium security severity: Mediu=
m) 2026-07-01 not yet calculated CVE-2026-14388 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-14388 ] Google--Chrome Integer overflow in Skia in Googl=
e Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromis=
ed the renderer process to potentially perform a sandbox escape via a craft=
ed HTML page. (Chromium security severity: Medium) 2026-07-01 not yet calcu= lated CVE-2026-14389 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14389 ] = Google--Chrome Use after free in ANGLE in Google Chrome prior to 150.0.7871= .46 allowed a remote attacker to potentially perform a sandbox escape via a=
crafted HTML page. (Chromium security severity: High) 2026-07-01 not yet c= alculated CVE-2026-14390 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1439=
0 ] Google--Chrome Integer overflow in ANGLE in Google Chrome on Windows pr= ior to 150.0.7871.46 allowed a remote attacker who had compromised the rend= erer process to obtain potentially sensitive information from process memor=
y via a crafted HTML page. (Chromium security severity: Medium) 2026-07-01 = not yet calculated CVE-2026-14391 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-14391 ] Google--Chrome Out of bounds write in Tint in Google Chrome pr= ior to 150.0.7871.46 allowed a remote attacker to potentially perform a san= dbox escape via a crafted HTML page. (Chromium security severity: High) 202= 6-07-01 not yet calculated CVE-2026-14392 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-14392 ] Google--Chrome Use after free in V8 in Google Chrome p= rior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code i= nside a sandbox via a crafted HTML page. (Chromium security severity: Mediu=
m) 2026-07-01 not yet calculated CVE-2026-14393 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-14393 ] Google--Chrome Use after free in V8 in Google Ch= rome prior to 150.0.7871.46 allowed a remote attacker to potentially exploi=
t heap corruption via a crafted HTML page. (Chromium security severity: Low=
) 2026-07-01 not yet calculated CVE-2026-14394 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-14394 ] Google--Chrome Out of bounds write in V8 in Googl=
e Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitr= ary code inside a sandbox via a crafted HTML page. (Chromium security sever= ity: Low) 2026-07-01 not yet calculated CVE-2026-14395 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-14395 ] Google--Chrome Out of bounds read in ANGL=
E in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak=
cross-origin data via a crafted HTML page. (Chromium security severity: Hi= gh) 2026-07-01 not yet calculated CVE-2026-14396 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-14396 ] Google--Chrome Out of bounds write in ANGLE in = Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to po= tentially perform a sandbox escape via a crafted HTML page. (Chromium secur= ity severity: Medium) 2026-07-01 not yet calculated CVE-2026-14397 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-14397 ] Google--Chrome Use after free=
in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker=
to potentially perform a sandbox escape via a crafted HTML page. (Chromium=
security severity: Critical) 2026-07-01 not yet calculated CVE-2026-14398 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14398 ] Google--Chrome Uninit= ialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remot=
e attacker to obtain potentially sensitive information from process memory = via a crafted HTML page. (Chromium security severity: Medium) 2026-07-01 no=
t yet calculated CVE-2026-14399 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-14399 ] Google--Chrome Out of bounds write in ANGLE in Google Chrome pri=
or to 150.0.7871.46 allowed a remote attacker who had compromised the rende= rer process to potentially perform a sandbox escape via a crafted HTML page=
. (Chromium security severity: High) 2026-07-01 not yet calculated CVE-2026= -14400 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14400 ] Google--Chrome=
Insufficient validation of untrusted input in ANGLE in Google Chrome on An= droid prior to 150.0.7871.46 allowed a remote attacker who had compromised = the renderer process to potentially perform a sandbox escape via a crafted = HTML page. (Chromium security severity: High) 2026-07-01 not yet calculated=
CVE-2026-14401 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14401 ] Googl= e--Chrome Uninitialized Use in ANGLE in Google Chrome on Windows prior to 1= 50.0.7871.46 allowed a remote attacker to obtain potentially sensitive info= rmation from process memory via a crafted HTML page. (Chromium security sev= erity: High) 2026-07-01 not yet calculated CVE-2026-14402 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-14402 ] Google--Chrome Use after free in V8 in=
Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute = arbitrary code inside a sandbox via a crafted HTML page. (Chromium security=
severity: Low) 2026-07-01 not yet calculated CVE-2026-14403 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-14403 ] Google--Chrome Inappropriate implem= entation in PDFium in Google Chrome prior to 150.0.7871.46 allowed a remote=
attacker to perform UI spoofing via a crafted PDF file. (Chromium security=
severity: Medium) 2026-07-01 not yet calculated CVE-2026-14404 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-14404 ] Google--Chrome Uninitialized Use=
in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to=
execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium=
security severity: Low) 2026-07-01 not yet calculated CVE-2026-14405 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-14405 ] Google--Chrome Out of boun=
ds read in V8 in Google Chrome prior to 150.0.7871.46 allowed an attacker w=
ho convinced a user to install a malicious extension to obtain potentially = sensitive information from process memory via a crafted Chrome Extension. (= Chromium security severity: Medium) 2026-07-01 not yet calculated CVE-2026-= 14406 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14406 ] Google--Chrome = Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 = allowed a remote attacker to execute arbitrary code inside a sandbox via a = crafted HTML page. (Chromium security severity: Medium) 2026-07-01 not yet = calculated CVE-2026-14407 [ https://www.cve.org/CVERecord?id=3DCVE-2026-144=
07 ] Google--Chrome Uninitialized Use in Dawn in Google Chrome prior to 150= .0.7871.46 allowed a remote attacker to obtain potentially sensitive inform= ation from process memory via a crafted HTML page. (Chromium security sever= ity: Medium) 2026-07-01 not yet calculated CVE-2026-14408 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-14408 ] Google--Chrome Inappropriate implement= ation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attack=
er who convinced a user to engage in specific UI gestures to execute arbitr= ary code inside a sandbox via a crafted HTML page. (Chromium security sever= ity: Low) 2026-07-01 not yet calculated CVE-2026-14409 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-14409 ] Google--Chrome Inappropriate implementati=
on in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacke=
r who had compromised the renderer process to perform UI spoofing via a cra= fted HTML page. (Chromium security severity: Low) 2026-07-01 not yet calcul= ated CVE-2026-14410 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14410 ] G= oogle--Chrome Insufficient validation of untrusted input in ANGLE in Google=
Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially per= form a sandbox escape via a crafted HTML page. (Chromium security severity:=
High) 2026-07-01 not yet calculated CVE-2026-14411 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-14411 ] Google--Chrome Insufficient validation of un= trusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a re= mote attacker who had compromised the renderer process to potentially perfo=
rm a sandbox escape via a crafted HTML page. (Chromium security severity: H= igh) 2026-07-01 not yet calculated CVE-2026-14412 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-14412 ] Google--Chrome Uninitialized Use in ANGLE in G= oogle Chrome prior to 150.0.7871.46 allowed a remote attacker who had compr= omised the renderer process to potentially perform a sandbox escape via a c= rafted HTML page. (Chromium security severity: High) 2026-07-01 not yet cal= culated CVE-2026-14413 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14413 =
] Google--Chrome Insufficient validation of untrusted input in Skia in Goog=
le Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromi= sed the renderer process to obtain potentially sensitive information from p= rocess memory via a crafted HTML page. (Chromium security severity: Medium)=
2026-07-01 not yet calculated CVE-2026-14414 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-14414 ] Google--Chrome Inappropriate implementation in V8 =
in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convi= nced a user to engage in specific UI gestures to potentially exploit heap c= orruption via a crafted HTML page. (Chromium security severity: Low) 2026-0= 7-01 not yet calculated CVE-2026-14415 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14415 ] Google--Chrome Out of bounds read in Dawn in Google Chr= ome prior to 150.0.7871.46 allowed a remote attacker to potentially perform=
a sandbox escape via a crafted HTML page. (Chromium security severity: Low=
) 2026-07-01 not yet calculated CVE-2026-14416 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-14416 ] Google--Chrome Use after free in Dawn in Google C= hrome prior to 150.0.7871.46 allowed a remote attacker to potentially perfo=
rm a sandbox escape via a crafted HTML page. (Chromium security severity: C= ritical) 2026-07-01 not yet calculated CVE-2026-14417 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-14417 ] Google--Chrome Uninitialized Use in ANGLE =
in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak c= ross-origin data via a crafted HTML page. (Chromium security severity: High=
) 2026-07-01 not yet calculated CVE-2026-14418 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-14418 ] Google--Chrome Use after free in Skia in Google C= hrome prior to 150.0.7871.46 allowed a remote attacker to potentially perfo=
rm a sandbox escape via a crafted HTML page. (Chromium security severity: C= ritical) 2026-07-01 not yet calculated CVE-2026-14419 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-14419 ] Google--Chrome Out of bounds read and writ=
e in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker=
to potentially perform a sandbox escape via a crafted HTML page. (Chromium=
security severity: Critical) 2026-07-01 not yet calculated CVE-2026-14420 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14420 ] Google--Chrome Uninit= ialized Use in Dawn in Google Chrome on ChromeOS prior to 150.0.7871.46 all= owed a remote attacker to obtain potentially sensitive information from pro= cess memory via a crafted HTML page. (Chromium security severity: Medium) 2= 026-07-01 not yet calculated CVE-2026-14421 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-14421 ] Google--Chrome Out of bounds read and write in Tint =
in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potent= ially perform out of bounds memory access via a crafted HTML page. (Chromiu=
m security severity: High) 2026-07-01 not yet calculated CVE-2026-14422 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-14422 ] Google--Chrome Type Conf= usion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote atta= cker to potentially perform a sandbox escape via a crafted HTML page. (Chro= mium security severity: High) 2026-07-01 not yet calculated CVE-2026-14423 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14423 ] Google--Chrome Use af= ter free in Dawn in Google Chrome on Mac prior to 150.0.7871.46 allowed a r= emote attacker to potentially perform a sandbox escape via a crafted HTML p= age. (Chromium security severity: High) 2026-07-01 not yet calculated CVE-2= 026-14424 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14424 ] Google--Chr= ome Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed=
a remote attacker to potentially perform a sandbox escape via a crafted HT=
ML page. (Chromium security severity: High) 2026-07-01 not yet calculated C= VE-2026-14425 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14425 ] Google-= -Chrome Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowe=
d a remote attacker who convinced a user to engage in specific UI gestures =
to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromi=
um security severity: High) 2026-07-01 not yet calculated CVE-2026-14426 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-14426 ] Google--Chrome Heap buf= fer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remo=
te attacker who had compromised the renderer process to potentially perform=
a sandbox escape via a crafted HTML page. (Chromium security severity: Cri= tical) 2026-07-01 not yet calculated CVE-2026-14427 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-14427 ] Google--Chrome Insufficient validation of un= trusted input in Dawn in Google Chrome on Android prior to 150.0.7871.46 al= lowed a remote attacker who had compromised the renderer process to potenti= ally perform a sandbox escape via a crafted HTML page. (Chromium security s= everity: High) 2026-07-01 not yet calculated CVE-2026-14428 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-14428 ] Google--Chrome Insufficient validati=
on of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allow=
ed a remote attacker who had compromised the renderer process to potentiall=
y perform a sandbox escape via a crafted HTML page. (Chromium security seve= rity: High) 2026-07-01 not yet calculated CVE-2026-14429 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-14429 ] Google--Chrome Integer overflow in V8 i=
n Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute=
arbitrary code inside a sandbox via a crafted HTML page. (Chromium securit=
y severity: High) 2026-07-01 not yet calculated CVE-2026-14430 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-14430 ] Google--Chrome Type Confusion in =
V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to exe= cute arbitrary code inside a sandbox via a crafted HTML page. (Chromium sec= urity severity: High) 2026-07-01 not yet calculated CVE-2026-14431 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-14431 ] Google--Chrome Use after free=
in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to=
execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium=
security severity: Medium) 2026-07-01 not yet calculated CVE-2026-14432 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-14432 ] Google--MCP Toolbox for=
Databases (googleapis/mcp-toolbox) A path traversal vulnerability exists i=
n the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing do= wnstream API requests, the URL builder substitutes user-controlled pathPara=
ms into the configured tool path and parses the resulting string as a relat= ive URL. While it checks that the input does not alter the scheme, host, or=
user info, it relies on ResolveReference for the final URL resolution. Bec= ause dot segments (../) are normalized during this resolution step, an atta= cker can supply path parameters containing directory traversal sequences to=
escape the operator-configured path scope. This allows the client to coerc=
e the toolbox into making requests to unintended endpoints on the same targ=
et host while forwarding the toolbox's configured credentials (e.g., bypass= ing a restricted path like /api/v1/users/{{.id}} to reach /admin/secrets). = 2026-06-29 not yet calculated CVE-2026-11720 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-11720 ] Gotcha Gotcha Games Inc.--RPG MAKER MV RPG MAKER MV=
and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injectio=
n vulnerability. If a user loads a specially crafted save-file, arbitrary O=
S command may be executed. 2026-06-30 not yet calculated CVE-2026-56137 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-56137 ] GTERMARS--CSS::Minifier:= :XS CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when=
the entire document is minified away. The minify function has a memory lea=
k when processing a document containing only characters to be removed, such=
as comments and whitespace. 2026-06-29 not yet calculated CVE-2026-13593 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-13593 ] GTERMARS--JavaScript::= Minifier::XS JavaScript::Minifier::XS versions before 0.16 for Perl crash w= ith a NULL pointer dereference when the first meaningful token of the input=
is a slash. The regexp versus division disambiguator in JsTokenizeString (= XS.xs) inspects the previous token's last byte to choose between a regexp l= iteral and a division operator. When a slash is the first meaningful token,=
with the start of input or only whitespace and comments before it, there i=
s no valid preceding token: the walk back over whitespace and comment nodes=
runs off the head of the node list to NULL, and the byte lookup reads thro= ugh a NULL contents pointer at an underflowed length index. The following i= dentifier check dereferences the same NULL pointer. The crash is reachable = through the public minify() API, so input as small as a single slash byte c= rashes the calling process. A service that minifies untrusted or third-part=
y JavaScript can be crashed by a remote request, causing denial of service.=
2026-06-29 not yet calculated CVE-2026-56017 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-56017 ] GTERMARS--JavaScript::Minifier::XS JavaScript::Min= ifier::XS versions before 0.16 for Perl leak memory on every call to minify= (), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees=
only the NodeSet structures and never the per-token contents buffers alloc= ated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing thei=
r contents. Each token's contents buffer is therefore leaked on every call,=
and the two early returns taken when the node list is empty leak the whole=
NodeSet. A long-lived process that minifies repeatedly, such as an asset p= ipeline or a server-side minifier endpoint, grows in memory without bound u= ntil it exhausts available memory and is killed, causing denial of service.=
2026-06-29 not yet calculated CVE-2026-56018 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-56018 ] hestiacp--hestiacp HestiaCP panel cronjob feature =
is affected by a broken access control vulnerability. Low privilege users c=
an modify the panel cronjob to execute scripts HestiaCP management scripts = with passwordless sudo. This could result in the takeover of administrator = users in the application and the underlying webserver. 2026-07-04 not yet c= alculated CVE-2026-12196 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1219=
6 ] Hitachi Energy--PROMOD V PROMOD V is using insecure HTTP communication = instead of HTTPS. The vulnerability is due to the lack of HTTPS support fro=
m 3rd party Digipede server. 2026-06-30 not yet calculated CVE-2026-10763 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-10763 ] Honeywell Technologies= --IQ MultiAccess Honeywell IQ MultiAccess, all versions prior to and includ= ing version 28, contain an improper digital signature verification vulnerab= ility. An attacker could potentially exploit this vulnerability, leading to=
the replacement of downloaded file with a malicious one. Honeywell also re= commends updating to the most recent version of this product, service, or o= ffering [V27 SP1, V28 SP1] 2026-06-29 not yet calculated CVE-2026-13742 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-13742 ] HP Inc--CCX The followin=
g Poly Voice IP devices, CCX, Trio, and Edge E, might be inoperable if they=
connect to a malicious SIP server and receive malformed data. HP is releas= ing updates to mitigate these potential vulnerabilities. 2026-07-01 not yet=
calculated CVE-2026-2891 [ https://www.cve.org/CVERecord?id=3DCVE-2026-289=
1 ] HP Inc.--HP Fan Control App The HP Fan Control App might allow local es= calation of privileges. An updated version of HP Fan Control App has been r= eleased to mitigate this potential vulnerability. 2026-06-30 not yet calcul= ated CVE-2026-8864 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8864 ] Int= ermark IT--WebControl CMS HTML injection vulnerability in Intermark IT's We= bControl CMS v3.5. This vulnerability allows an attacker to send an email c= ontaining malicious HTML code to a victim via the contact form. To exploit = this vulnerability, the attacker must send a request using the 'nombreApell= idos', 'direcci=C3=83=C2=B3n ', and 'comentarios ' parameters to '/processC= ontact.do'. 2026-06-30 not yet calculated CVE-2026-6953 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-6953 ] Intermark IT--WebControl CMS Cross-Site S= cripting (XSS) vulnerability in Intermark IT's WebControl CMS v3.5. This vu= lnerability allows an attacker to execute JavaScript code or inject a dynam=
ic iframe into the victim's browser by sending a malicious URL via the 'url= Destino' parameter in '/portal.do'. This vulnerability can be exploited to = steal sensitive user data, such as session cookies, display phishing interf= aces, or perform actions on the user's behalf. 2026-06-30 not yet calculate=
d CVE-2026-6954 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6954 ] joomla= ck.fr--JoomlaCK.fr Page Builder CK extension for Joomla The Joomla extensio=
n Page Builder CK is vulnerable to an unauthenticated arbitrary file upload=
that allows uploading executable files and leads to full RCE. 2026-06-29 n=
ot yet calculated CVE-2026-56290 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-56290 ] joomshaper.com--Helix3 extension for Joomla The Helix3 plugin f=
or Joomla exposes an ajax handler task, that allows unauthenticated attacke=
rs to delete arbitrary files, write arbitrary JSON files and update templat=
e parameters. 2026-06-29 not yet calculated CVE-2026-49049 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-49049 ] juliangruber--brace-expansion brace-e= xpansion through 5.0.6 is vulnerable to denial of service. The expand() fun= ction exhibits exponential-time complexity in the number of consecutive non= -expanding '{}' brace groups. An attacker who passes a crafted string to ex= pand(), directly or transitively, can cause significant CPU consumption and=
event-loop blocking. The max option does not mitigate this, as it bounds t=
he output size rather than the recursion work. 2026-06-30 not yet calculate=
d CVE-2026-13149 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13149 ] kera= s-team--keras-team/keras Keras versions up to and including 3.13.2 are vuln= erable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026= -1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `= file_editor.py` methods, which fail to check the `dataset.is_virtual` prope= rty of HDF5 datasets. This allows an attacker to craft a malicious `.keras`=
model archive or `.h5` weights file containing a Virtual Dataset (VDS) tha=
t references external HDF5 files on the victim's filesystem. When the victi=
m loads the model using `keras.models.load_model()` or `keras.saving.load_m= odel()`, the external file is transparently read, leading to potential info= rmation disclosure. Fixed in versions 3.12.2 and 3.14.1. 2026-07-01 not yet=
calculated CVE-2026-12480 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12= 480 ] keras-team--keras-team/keras A vulnerability in keras-team/keras vers= ion 3.14.0 allows for arbitrary code execution due to improper handling of = deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda= _deserialization()` function fails to enforce the safe-mode guard when `saf= e_mode` is set to `None`, which is the default value when `from_config()` i=
s called outside of a `SafeModeScope` context. This logic error conflates `= None` (unset/default-deny) with `False` (explicitly disabled), bypassing th=
e guard and allowing attacker-controlled `marshal` bytecode to be deseriali= zed. Affected call sites include `keras.layers.deserialize(config)`, `keras= .models.clone_model(model)`, and any direct invocation of `Lambda.from_conf= ig(config)` without an enclosing `SafeModeScope(True)`. This vulnerability = can be exploited to achieve arbitrary OS-level code execution in the contex=
t of the server or user process. 2026-07-03 not yet calculated CVE-2026-124=
81 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12481 ] Krajowa Izba Rozli= czeniowa--SzafirHost SzafirHost verifies the downloaded native library arch= ive with one JarFile parser (reading the Central Directory) but extracts na= tive libraries with JarInputStream parser (reading sequentially from local = file headers).=C2=A0An attacker who controls the served archive can insert =
a malicious DLL/SO/DYLIB as a local-file-header entry between the last legi= timate entry and the Central Directory, without adding it to the Central Di= rectory. The signature verifier never sees the injected entry and accepts t=
he archive as validly signed; the extractor reads it sequentially and write=
s the attacker library to the native temp directory with no hash check), wh= ile the archive-size check still passes. This=C2=A0can lead to remote code = execution. This issue was fixed in version 1.2.2. 2026-06-29 not yet calcul= ated CVE-2026-13165 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13165 ] K=
TM System--e-BOK KTM System e-BOK allows the session identifier to be set b=
y the client prior to authentication. If a cookie with a valid name is set,=
its value remains unchanged after successful login. This behaviour enables=
an attacker to fix a session ID for a victim and later hijack the authenti= cated session. This issue was fixed in the patch published in June 2026. 20= 26-06-30 not yet calculated CVE-2026-35095 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-35095 ] KTM System--e-BOK KTM System e-BOK is vulnerable to C= ross-Site Request Forgery (CSRF) in both the email-change and password-chan=
ge functionalities. An attacker can craft a malicious website=C2=A0that, wh=
en visited by an authenticated user, automatically sends a forged POST requ= est to the application. This allows the attacker to trigger an unauthorized=
email or password change on behalf of the victim without their knowledge o=
r interaction. This issue was fixed in the patch published in June 2026. 20= 26-06-30 not yet calculated CVE-2026-35096 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-35096 ] KTM System--e-BOK KTM System e-BOK enforces a maximum=
password length of six numeric digits and does not permit the use of any a= lphabetic, special, or extended characters. This issue was fixed in the pat=
ch published in June 2026. 2026-06-30 not yet calculated CVE-2026-35097 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-35097 ] KTM System--e-BOK KTM Sy= stem e-BOK does not implement any limit or timeout on consecutive login att= empts, allowing an attacker to perform unlimited authentication requests. T= his lack of rate-limiting enables efficient brute-force attacks against use=
r accounts. When combined with vulnerability CVE-2026-35097, where password=
s are restricted to a six-digit numeric format, this becomes a critical iss= ue, as such passwords can be brute-forced in a relatively short time. This = issue was fixed in the patch published in June 2026. 2026-06-30 not yet cal= culated CVE-2026-35098 [ https://www.cve.org/CVERecord?id=3DCVE-2026-35098 =
] leandrocp--mdex Allocation of Resources Without Limits or Throttling vuln= erability in leandrocp MDEx allows Excessive Allocation. MDEx.parse_documen= t/2 accepts a {:json, json} source. In lib/mdex.ex, the private json_to_nod= e/1 function passes the attacker-controlled node_type value to Module.conca= t/1, which calls String.to_atom/1 and interns a brand-new atom for every di= stinct value. Atoms are never garbage collected on the BEAM, so a crafted J= SON document carrying a unique node_type at each (deeply nested) node mints=
one permanent atom per node. A single document can intern hundreds of thou= sands of atoms, and a large enough document exhausts the default atom table=
(around 1,048,576 atoms) and aborts the entire Erlang VM, taking down ever=
y process on the node. Any application that passes untrusted input to the {= :json, ...} source of MDEx.parse_document is exposed to an unauthenticated = denial-of-service. This issue affects mdex from 0.4.3 before 0.13.2. 2026-0= 6-29 not yet calculated CVE-2026-53426 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-53426 ] leandrocp--mdex Improper Neutralization of Input During=
Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MD=
Ex allows stored or reflected cross-site scripting via attacker-controlled = Markdown. When syntax highlighting and full info-string forwarding (render:=
[full_info_string: true]) are enabled, the Lumis adapter copies the value =
of a code fence's highlight_lines_class info-string attribute, unescaped, i= nto the class attribute of every rendered line. comrak_nif::lumis_adapter::= LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapte= r.rs shlex-parses the info string and stores each key=3Dvalue pair verbatim=
, highlight_lines_config pulls highlight_lines_class into the per-line clas=
s value, and write_highlighted interpolates that value directly into the cl= ass attribute of the per-line <div>. A single-quoted shell token preserves =
an inner double quote through shlex parsing, so a value such as '"><script>= alert(1)</script>' terminates the class attribute early and the markup that=
follows is emitted as live HTML. An attacker who can submit Markdown (thro= ugh comments, posts, wiki pages, documentation, or any user-generated conte= nt) can inject arbitrary HTML and JavaScript that runs in the browser of ev= ery user who views the rendered output, enabling session theft, account tak= eover, and other client-side attacks. No authentication or special privileg=
es are required. The vulnerable native code originally shipped inside mdex = (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into th=
e separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs=
), where it remains unpatched. This issue affects mdex from 0.11.3 before 0= .12.3, and mdex_native from 0.1.0 before 0.2.3. 2026-06-29 not yet calculat=
ed CVE-2026-53427 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53427 ] lea= ndrocp--mdex Memory Allocation with Excessive Size Value vulnerability in l= eandrocp mdex allows an unauthenticated attacker to cause a denial of servi=
ce through unbounded memory allocation. comrak_nif::lumis_adapter::LumisAda= pter::parse_highlight_lines in native/comrak_nif/src/lumis_adapter.rs eager=
ly expands a user-controlled inclusive line range from a fenced code block'=
s highlight_lines decorator into a Vec<usize>, pushing one element per inte= ger in the range with no upper bound on the range size. An attacker who can=
supply Markdown that an application renders with MDEx.to_html/2 (for examp=
le a comment, chat message, or wiki page) can embed a code block whose info=
string is rust highlight_lines=3D"1-100000000", forcing the native adapter=
to allocate roughly 8 bytes per line in the range. A payload that differs =
by only a few bytes can therefore allocate hundreds of megabytes, and a suf= ficiently large range (for example 1-2000000000) exhausts host memory and a= borts the BEAM, denying service to every user of the rendering process. The=
per-line write loop additionally tests membership with a linear scan over = the same vector, degrading rendering to a quadratic cost even for ranges th=
at do not immediately exhaust memory. The vulnerable native code originally=
shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was la= ter extracted into the separate mdex_native package (native/mdex_native_nif= /src/lumis_adapter.rs), where it remains unpatched. This issue affects mdex=
from 0.11.0 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3. 2026-0= 6-29 not yet calculated CVE-2026-53428 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-53428 ] leandrocp--mdex Missing Release of Memory after Effecti=
ve Lifetime vulnerability in leandrocp mdex and mdex_native allows an attac= ker who controls a rendered document to cause a denial of service through u= nbounded native memory exhaustion. The native rendering code permanently le= aks memory when rendering a document that contains escaped-tag nodes. The c= onversion of each %MDEx.EscapedTag{} node into its native representation (F= rom<ExEscapedTag> for NodeValue in the Rust NIF) calls Box::leak on the cal= ler-supplied literal string, which surrenders the backing allocation so tha=
t it lives for the entire lifetime of the operating system process and is n= ever freed. Both the byte length of each literal and the number of escaped-= tag nodes in a document are attacker-controlled, and there is no size cap, = rate limit, or string interning on this path. Every render of a document co= ntaining escaped-tag nodes therefore leaks literal_size x node_count bytes = that can never be reclaimed, and repeated renders accumulate without bound.=
Rendering reaches this path through the public MDEx.to_html/1 entry point = and any other API that renders a supplied %MDEx.Document{}. Any application=
that uses mdex (or mdex_native directly) to render documents derived from = user-supplied content is affected. Because the leaked memory is never recla= imed for the life of the BEAM process, an attacker can drive resident memor=
y upward without limit until the node exhausts memory and crashes, taking d= own every process on it. The vulnerable native code originally shipped insi=
de mdex (in native/comrak_nif/src/types/document.rs) and was later extracte=
d into the separate mdex_native package (native/mdex_native_nif/src/types/d= ocument.rs), where it remains unpatched. This issue affects mdex from 0.11.=
0 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3. 2026-06-29 not ye=
t calculated CVE-2026-53429 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5= 3429 ] leandrocp--mdex Uncontrolled Recursion vulnerability in leandrocp md=
ex allows denial of service via deeply nested Markdown input. mdex converts=
between an Elixir %MDEx.Document{} struct and Comrak's internal AST using = two mutually recursive Rust functions, ex_document_to_comrak_ast and comrak= _ast_to_ex_document, in the NIF source file document.rs. Neither function e= nforces a maximum nesting depth, so the recursion depth is bounded only by = the structure of the input. An attacker who can get a Markdown document ren= dered (for example through MDEx.parse_document!/1 or MDEx.to_html/1) can su= pply a document with thousands of nested block quotes, which drives unbound=
ed recursion across the NIF boundary and exhausts the native C stack. Becau=
se the resulting stack overflow is an uncatchable SIGSEGV raised inside a N= IF, it cannot be contained by the Erlang runtime. It terminates the operati=
ng system process running the BEAM, killing every Elixir and Erlang process=
on the node, not just the caller that triggered the render. No authenticat= ion or special privileges are required. The vulnerable conversion code was = extracted from mdex into the separate mdex_native package starting in mdex = 0.12.3. This issue affects mdex from 0.3.0 before 0.12.3 and mdex_native fr=
om 0.1.0 before 0.2.3. 2026-06-29 not yet calculated CVE-2026-54888 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-54888 ] leandrocp--mdex Improper Neu= tralization of Input During Web Page Generation (XSS) vulnerability in lean= drocp mdex allows cross-site scripting via unsanitized URL schemes in Quill=
Delta output. 'Elixir.MDEx':to_delta/2 converts Markdown into a Quill Delt=
a. 'Elixir.MDEx.DeltaConverter':default_convert_node/3 in lib/mdex/delta_co= nverter.ex copies the URL of a link, wikilink, or image node directly from = the parsed Markdown into the Delta "link" or "image" attribute without appl= ying a scheme allowlist or any normalization. An attacker who controls the = Markdown text can supply a javascript: URL (for example [click](javascript:= alert(document.cookie))) that survives verbatim into the Delta attribute. W= hen the Delta is rendered to HTML by a downstream renderer (such as quill-d= elta-to-html or the Quill client), the attribute becomes an <a href> or <im=
g src>, and the javascript: scheme executes in the browser of anyone who vi= ews the rendered content. The link and wikilink cases are the strongest vec= tors because javascript: in an href executes on click; the image case is lo= wer impact because javascript: in <img src> generally does not execute in m= odern browsers. This issue affects mdex: from 0.8.3 before 0.13.2. 2026-06-=
29 not yet calculated CVE-2026-54889 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-54889 ] lib60870--lib60870 A heap buffer overflow in the HighPriori= tyASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 a= llows attackers to cause a Denial of Service (DoS) via a crafted payload. 2= 026-06-29 not yet calculated CVE-2026-51219 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-51219 ] Linux--Linux In the Linux kernel, the following vuln= erability has been resolved: agp/amd64: Fix broken error propagation in agp= _amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP dri= ver when running in a virtualized environment (e.g. qemu/kvm) without a phy= sical AMD northbridge. The crash occurs in amd64_fetch_size() when attempti=
ng to dereference the pointer returned by node_to_amd_nb(0). The root cause=
of this crash is broken error propagation in agp_amd64_probe(): When no AM=
D northbridges are found, cache_nbs() correctly returns -ENODEV. However, t=
he probe function erroneously checks the return value against exactly -1, r= ather than < 0. As a result, the hardware absence error is masked, allowing=
the driver to improperly proceed with initialization. It eventually calls = agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does=
not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection=
Fault (GPF) when accessing its ->misc member. Fix the issue by correcting = the error check in agp_amd64_probe() to abort properly when cache_nbs() ret= urns any negative error code. This prevents the driver from erroneously pro= ceeding without hardware, thereby avoiding the subsequent NULL pointer dere= ference at its source. 2026-06-29 not yet calculated CVE-2026-53325 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-53325 ] Linux--Linux In the Linux ke= rnel, the following vulnerability has been resolved: debugobjects: Don't ca=
ll fill_pool() in early boot hardirq context When booting a debug PREEMPT_R=
T kernel on an ARM64 system, a "inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-=
W} usage" lockdep warning message was reported to the console. During early=
boot, interrupts are enabled before the scheduler is enabled. In this wind=
ow (before SYSTEM_SCHEDULING is set) interrupts can fire and in the hard in= terrupt context handler attempt to fill the pool This can lead to a deadloc=
k when the interrupt occurred when the interrupt hits a region which holds =
a lock that is required to be taken in the allocation path. Add a new can_f= ill_pool() helper and reorder the exception rule and forbid this scenario b=
y excluding allocations from hard interrupt context. 2026-07-01 not yet cal= culated CVE-2026-53326 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53326 =
] Linux--Linux In the Linux kernel, the following vulnerability has been re= solved: debugobjects: Do not fill_pool() if pi_blocked_on On RT enabled ker= nels, fill_pool() ends up calling rtlock_lock(), which asserts if current::= pi_blocked_on is set, because a task can obviously only block on one lock a=
s otherwise the priority inheritenace chain gets corrupted. Prevent this by=
expanding the conditional to take current::pi_blocked_on into account. 202= 6-07-01 not yet calculated CVE-2026-53327 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-53327 ] Linux--Linux In the Linux kernel, the following vulner= ability has been resolved: sched_ext: Don't warn on NULL cgrp_moving_from i=
n scx_cgroup_move_task() A WARN fires when systemd's user manager writes "+= cpu +memory +pids" to its own subtree_control while a sched_ext scheduler i=
s loaded: WARNING: at kernel/sched/ext.c:3227 scx_cgroup_move_task+0xa8/0xb=
0 scx_cgroup_move_task+0xa8/0xb0 sched_move_task+0x134/0x290 cpu_cgroup_att= ach+0x39/0x70 cgroup_migrate_execute+0x37d/0x450 cgroup_update_dfl_csses+0x= 1e3/0x270 cgroup_subtree_control_write+0x3e7/0x440 scx_cgroup_can_attach() = arms cgrp_moving_from only when a task's cpu cgroup changes. It can still b=
e NULL when scx_cgroup_move_task() runs, through this sequence: Step Result=
--------------------------------- ---------------------------------- 1. cp=
u enabled on cgroup G cpu css =3D A 2. cpu toggled off then on for G A kill= ed, B created (same cgroup) 3. an exiting task keeps A alive migration skip=
s it, A now stale 4. +memory migrates G stale A vs current B pulls cpu in 5=
. cpu attach runs for all tasks hits a live, cpu-unchanged task 6. scx_cgro= up_move_task() on it cgrp_moving_from NULL -> WARN The mismatch is that scx= _cgroup_can_attach() keys on cgroup identity while migration drives the mov=
e on css identity, so a NULL cgrp_moving_from here is a legitimate css-only=
migration, not a missing prep. The call is already gated on cgrp_moving_fr= om, so just drop the warning. ops.cgroup_prep_move() and ops.cgroup_move() = stay paired. 2026-07-01 not yet calculated CVE-2026-53328 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-53328 ] Linux--Linux In the Linux kernel, the = following vulnerability has been resolved: drm/amd/display: Use krealloc_ar= ray() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the=
allocation size as "capacity * vector->struct_size" using uint32_t arithme= tic, which can silently wrap to a small value on overflow. This would cause=
krealloc to return a smaller buffer than expected, leading to heap overflo=
ws on subsequent vector appends. Replace krealloc() with krealloc_array() w= hich performs an internal overflow check and returns NULL on wrap, preventi=
ng the issue. (cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609= dd5707) 2026-07-01 not yet calculated CVE-2026-53329 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-53329 ] Linux--Linux In the Linux kernel, the follo= wing vulnerability has been resolved: drm/amd/display: Fix out-of-bounds re=
ad in dp_get_eq_aux_rd_interval() [Why & How] The aux_rd_interval array in = struct dc_lttpr_caps is declared with MAX_REPEATER_CNT - 1 (7) elements, in= dexed 0..6. However, the offset parameter passed to dp_get_eq_aux_rd_interv= al() can be as large as MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR re= peaters via DPCD. This leads to an out-of-bounds read of aux_rd_interval[7]=
when offset is 8. Fix this by growing aux_rd_interval to MAX_REPEATER_CNT = elements to accommodate the full range of valid repeater counts defined by = the DP spec. (cherry picked from commit a55a458a8df37a65ffda5cf721d554a8f74= f6b04) 2026-07-01 not yet calculated CVE-2026-53330 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-53330 ] Linux--Linux In the Linux kernel, the follow= ing vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Avoid ABBA on = tx_lock/ctrl->lock During the SSR/PDR down notification the tx_lock is take=
n with the intent to provide synchronization with active DMA transfers. But=
during this period qcom_slim_ngd_down() is invoked, which ends up in slim_= report_absent(), which takes the slim_controller lock. In multiple other co= depaths these two locks are taken in the opposite order (i.e. slim_controll=
er then tx_lock). The result is a lockdep splat, and a possible deadlock: r= procctl/449 is trying to acquire lock: ffff00009793e620 (&ctrl->lock){+.+.}= -{4:4}, at: slim_report_absent (drivers/slimbus/core.c:322) slimbus but tas=
k is already holding lock: ffff00009793fb50 (&ctrl->tx_lock){+.+.}-{4:4}, a=
t: qcom_slim_ngd_ssr_pdr_notify (drivers/slimbus/qcom-ngd-ctrl.c:1475) slim= _qcom_ngd_ctrl which lock already depends on the new lock. Possible unsafe = locking scenario: CPU0 CPU1 ---- ---- lock(&ctrl->tx_lock); lock(&ctrl->loc= k); lock(&ctrl->tx_lock); lock(&ctrl->lock); The assumption is that the com= ment refers to the desire to not call qcom_slim_ngd_exit_dma() while we hav=
e an ongoing DMA TX transaction. But any such transaction is initiated and = completed within a single qcom_slim_ngd_xfer_msg(). Prior to calling qcom_s= lim_ngd_exit_dma() the slim_controller is torn down, all child devices are = notified that the slimbus is gone and the child devices are removed. Stop t= aking the tx_lock in qcom_slim_ngd_ssr_pdr_notify() to avoid the deadlock. = 2026-07-01 not yet calculated CVE-2026-53331 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-53331 ] Linux--Linux In the Linux kernel, the following vul= nerability has been resolved: slimbus: qcom-ngd-ctrl: Register callbacks af= ter creating the ngd When the remoteproc starts in parallel with the NGD dr= iver being probed, or the remoteproc is already up when the PDR lookup is b= eing registered, or in the theoretical event that we get an interrupt from = the hardware, these callbacks will operate on uninitialized data. This resu=
lt in issues to boot the affected boards. One such example can be seen in t=
he following fault, where qcom_slim_ngd_ssr_pdr_notify() schedules work on = the NULL ngd_up_work. [ 21.858578] ------------[ cut here ]------------ [ 2= 1.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU= #2: kworker/2:2/116 ... [ 21.859251] Call trace: [ 21.859255] __queue_work+= 0x5e0/0x790 (P) [ 21.859265] queue_work_on+0x6c/0xf0 [ 21.859273] qcom_slim= _ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl] [ 21.859304] qcom_slim= _ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl] [ 21.859318] notifier_call_c= hain+0xa4/0x230 [ 21.859329] srcu_notifier_call_chain+0x64/0xb8 [ 21.859338=
] ssr_notify_start+0x40/0x78 [qcom_common] [ 21.859355] rproc_start+0x130/0= x230 [ 21.859367] rproc_boot+0x3d4/0x518 ... Move the enablement of interru= pts, and the registration of SSR and PDR until after the NGD device has bee=
n registered. This could be further refined by moving initialization to the=
control driver probe and by removing the platform driver model from the pi= cture. 2026-07-01 not yet calculated CVE-2026-53332 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-53332 ] Linux--Linux In the Linux kernel, the follow= ing vulnerability has been resolved: mm/mincore: handle non-swap entries be= fore !CONFIG_SWAP guard mincore_swap() also fields migration/hwpoison entri=
es (and shmem swapin-error entries), which can exist on !CONFIG_SWAP builds=
when CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE is enabled. The !IS_ENABLED= (CONFIG_SWAP) guard ran before the non-swap-entry early return, so mincore_= pte_range() can spuriously WARN and report these pages nonresident on !CONF= IG_SWAP kernels. Move the guard below the non-swap-entry check so only true=
swap entries trip the WARN, and migration/hwpoison entries take the existi=
ng "uptodate / non-shmem" path. 2026-07-01 not yet calculated CVE-2026-5333=
3 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53333 ] Linux--Linux In the=
Linux kernel, the following vulnerability has been resolved: mm/damon/recl= aim: handle ctx allocation failure Patch series "mm/damon/{reclaim,lru_sort=
}: handle ctx allocation failures". DAMON_RECLAIM and DAMON_LRU_SORT could = dereference NULL pointers if their damon_ctx object allocations fail. The b= ugs are expected to happen infrequently because the allocations are arguabl=
y too small to fail on common setups. But theoretically they are possible a=
nd the consequences are bad. Fix those. The issues were discovered [1] by S= ashiko. This patch (of 2): DAMON_RECLAIM allocates the damon_ctx object for=
its kdamond in its init function. damon_reclaim_enabled_store() wrongly as= sumes the allocation will always succeed once tried. If the damon_ctx alloc= ation was failed, therefore, code execution reaches to damon_commit_ctx() w= hile 'ctx' is NULL. As a result, it dereferences the NULL 'ctx' pointer. Av= oid the NULL dereference by returning -ENOMEM if 'ctx' is NULL. 2026-07-01 = not yet calculated CVE-2026-53334 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-53334 ] Linux--Linux In the Linux kernel, the following vulnerability = has been resolved: mm/damon/lru_sort: handle ctx allocation failure DAMON_L= RU_SORT allocates the damon_ctx object for its kdamond in its init function=
. damon_lru_sort_enabled_store() wrongly assumes the allocation will always=
succeed once tried. If the damon_ctx allocation was failed, therefore, cod=
e execution reaches to damon_commit_ctx() while 'ctx' is NULL. As a result,=
it dereferences the NULL 'ctx' pointer. Avoid the NULL dereference by retu= rning -ENOMEM if 'ctx' is NULL. 2026-07-01 not yet calculated CVE-2026-5333=
5 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53335 ] Linux--Linux In the=
Linux kernel, the following vulnerability has been resolved: nvmem: layout=
s: onie-tlv: fix hang on unknown types The EEPROM on my board has a vendor = specific entry of type 0x41. When stumbling upon that, this driver hangs in=
an endless loop. Fix it by keep incrementing the offset on unknown entries=
, so the loop will eventually stop. 2026-07-01 not yet calculated CVE-2026-= 53336 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53336 ] Linux--Linux In=
the Linux kernel, the following vulnerability has been resolved: net: bond= ing: fix NULL pointer dereference in bond_do_ioctl() In bond_do_ioctl(), sl= ave_dev is obtained via __dev_get_by_name() which can return NULL if the re= quested interface name does not exist. However, the subsequent slave_dbg() = call is placed before the NULL check: slave_dev =3D __dev_get_by_name(net, = ifr->ifr_slave); slave_dbg(bond_dev, slave_dev, "slave_dev=3D%p:\n", slave_= dev); //here if (!slave_dev) return -ENODEV; The slave_dbg() macro expands =
to netdev_dbg(bond_dev, "(slave %s): " fmt, (slave_dev)->name, ...) which u= nconditionally dereferences slave_dev->name before the NULL check is perfor= med. This results in a NULL pointer dereference kernel oops when a user cal=
ls bonding ioctl (e.g. SIOCBONDENSLAVE, SIOCBONDRELEASE, etc.) with a non-e= xistent slave interface name. This is reachable from userspace via the bond= ing ioctl interface with CAP_NET_ADMIN capability, making it a potential lo= cal denial-of-service vector. Fix by moving the slave_dbg() call after the = NULL check. 2026-07-01 not yet calculated CVE-2026-53337 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-53337 ] Linux--Linux In the Linux kernel, the f= ollowing vulnerability has been resolved: net: airoha: Add NULL check for o= f_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues() of_reserved_mem_l= ookup() may return NULL if the reserved memory region referenced by the "me= mory-region" phandle is not found in the reserved memory table (e.g. due to=
a misconfigured DTS or a removed memory-region node). The current code der= eferences the returned pointer without checking for NULL, leading to a kern=
el NULL pointer dereference at the following lines: dma_addr =3D rmem->base=
; // line 1156 num_desc =3D div_u64(rmem->size, buf_size); // line 1160 Add=
a NULL check after of_reserved_mem_lookup() and return -ENODEV if the look=
up fails, which is consistent with the existing error handling for of_parse= _phandle() failure in the same code block. 2026-07-01 not yet calculated CV= E-2026-53338 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53338 ] Linux--L= inux In the Linux kernel, the following vulnerability has been resolved: i2=
c: qcom-cci: Fix NULL pointer dereference in cci_remove() On all modern pla= tforms Qualcomm CCI controller provides two I2C masters, and on particular = boards only one I2C master may be initialized, and in such cases the device=
unbinding or driver removal causes a NULL pointer dereference, because cci= _halt() is called for all two I2C masters, but a completion is initialized = only for the single enabled master: % rmmod i2c-qcom-cci Unable to handle k= ernel NULL pointer dereference at virtual address 0000000000000000 <snip> C= all trace: __wait_for_common+0x194/0x1a8 (P) wait_for_completion_timeout+0x= 20/0x2c cci_remove+0xc4/0x138 [i2c_qcom_cci] platform_remove+0x20/0x30 devi= ce_remove+0x4c/0x80 device_release_driver_internal+0x1c8/0x224 driver_detac= h+0x50/0x98 bus_remove_driver+0x6c/0xbc driver_unregister+0x30/0x60 platfor= m_driver_unregister+0x14/0x20 qcom_cci_driver_exit+0x18/0x1008 [i2c_qcom_cc=
i] .... 2026-07-01 not yet calculated CVE-2026-53339 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-53339 ] Linux--Linux In the Linux kernel, the follo= wing vulnerability has been resolved: i2c: imx: fix clock and pinctrl state=
inconsistency in runtime PM In i2c_imx_runtime_suspend(), the clock is dis= abled before switching the pinctrl state to sleep. If pinctrl_pm_select_sle= ep_state() fails, the runtime suspend is aborted but the clock remains disa= bled, causing a system crash when the hardware is subsequently accessed. Fi=
x this by switching the pinctrl state before disabling the clock so that a = pinctrl failure leaves the clock enabled and the hardware accessible. In i2= c_imx_runtime_resume(), restore the pinctrl state back to sleep if clk_enab= le() fails to keep the consistent. 2026-07-01 not yet calculated CVE-2026-5= 3340 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53340 ] Linux--Linux In = the Linux kernel, the following vulnerability has been resolved: fhandle: f=
ix UAF due to unlocked ->mnt_ns read in may_decode_fh() may_decode_fh() acc= esses mount::mnt_ns without holding any locks; that means the mount can con= currently be unmounted, and the mnt_namespace can concurrently be freed aft=
er an RCU grace period. This race can happens as follows, assuming that the=
mount point was created by open_tree(..., OPEN_TREE_CLONE): thread 1 threa=
d 2 RCU __do_sys_open_by_handle_at do_handle_open handle_to_path may_decode= _fh is_mounted [mount::mnt_ns access] [mount::mnt_ns access] __do_sys_close=
fput_close_sync __fput dissolve_on_fput umount_tree class_namespace_excl_d= estructor namespace_unlock free_mnt_ns mnt_ns_tree_remove call_rcu(mnt_ns_r= elease_rcu) mnt_ns_release_rcu mnt_ns_release kfree [mnt_namespace::user_ns=
access] **UAF** Fix it by taking rcu_read_lock() around the mount::mnt_ns = access, like in __prepend_path(). Additionally, document the semantics of m= ount::mnt_ns, and use WRITE_ONCE() for writers that can race with lockless = readers. This bug is unreachable unless one of the following is set: - CONF= IG_PREEMPTION - CONFIG_RCU_STRICT_GRACE_PERIOD because it requires an RCU g= race period to happen during a syscall without an explicit preemption. This=
doesn't seem to have interesting security impact; worst-case, it could lea=
k the result of an integer comparison to userspace (from the level check in=
cap_capable()), cause an endless loop, or crash the kernel by dereferencin=
g an invalid address. 2026-07-01 not yet calculated CVE-2026-53341 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-53341 ] Linux--Linux In the Linux ker= nel, the following vulnerability has been resolved: arm64: mm: call pagetab=
le dtor when freeing hot-removed page tables Since 5e8eb9aeeda3 ("arm64: mm=
: always call PTE/PMD ctor in __create_pgd_mapping()") page-table allocatio=
n on ARM64 always calls pagetable_{pte,pmd,pud,p4d}_ctor(). This sets the p= age_type to PGTY_table, increments NR_PAGETABLE and possible allocates a PT=
L. However the matching pagetable_dtor() calls were never added. With DEBUG= _VM enabled on kernel versions prior to v6.17 without 2dfcd1608f3a9 ("mm/pa= ge_alloc: let page freeing clear any set page type") this leads to the foll= owing warning when freeing these pages due to page->page_type sharing page-= >_mapcount: BUG: Bad page state in process ... pfn:284fbb page: refcount:0 = mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x284fbb flags: 0x17fffc0= 00000000(node=3D0|zone=3D2|lastcpupid=3D0x1ffff) page_type: f2(table) page = dumped because: nonzero mapcount Call trace: bad_page+0x13c/0x160 __free_fr= ozen_pages+0x6cc/0x860 ___free_pages+0xf4/0x180 free_pages+0x54/0x80 free_h= otplug_page_range.part.0+0x58/0x90 free_empty_tables+0x438/0x500 __remove_p= gd_mapping.constprop.0+0x60/0xa8 arch_remove_memory+0x48/0x80 try_remove_me= mory+0x158/0x1d8 offline_and_remove_memory+0x138/0x180 It can also lead to = leaking the ptl allocation if ALLOC_SPLIT_PTLOCKS is defined and incorrect = NR_PAGETABLE stats. Fix this by calling pagetable_dtor() in free_hotplug_pg= table_page() prior to freeing the page to undo the effects of calling paget= able_*_ctor(). 2026-07-01 not yet calculated CVE-2026-53342 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-53342 ] Linux--Linux In the Linux kernel, th=
e following vulnerability has been resolved: ARM: 9475/1: entry: use byte l= oad for KASAN VMAP stack shadow Commit 44e9a3bb76e5 ("ARM: 9430/1: entry: D=
o a dummy read from VMAP shadow") added a dummy read from the KASAN VMAP st= ack shadow in __switch_to(). The read uses ldr, but the KASAN shadow addres=
s is byte-granular and is not guaranteed to be word aligned. ARMv5 faults u= naligned word loads. With CONFIG_KASAN_VMALLOC and CONFIG_VMAP_STACK enable=
d, ARM926/VersatilePB crashes in __switch_to() with an alignment exception = before reaching init. Use ldrb for the dummy shadow access. The code only n= eeds to fault in the shadow mapping if the stack shadow is missing, so a by=
te load is sufficient and matches the granularity of KASAN shadow memory. 2= 026-07-01 not yet calculated CVE-2026-53343 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-53343 ] Linux--Linux In the Linux kernel, the following vuln= erability has been resolved: pinctrl: mcp23s08: Initialize mcp->dev and mcp= ->addr before regmap init Regmap initialization triggers regcache_maple_pop= ulate() which attempts SPI read to populate cache. SPI read requires mcp->d=
ev and mcp->addr to be set, without them, NULL pointer dereference occurs d= uring probe. Move initialization before mcp23s08_spi_regmap_init() call. 20= 26-07-01 not yet calculated CVE-2026-53344 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-53344 ] Linux--Linux In the Linux kernel, the following vulne= rability has been resolved: KVM: Don't WARN if memory is dirtied without a = vCPU when the VM is dying When marking a page dirty, complain about not hav= ing a running/loaded vCPU if and only if the VM is still alive, i.e. its re= fcount is non-zero. This will allow fixing a memory leak for x86 SEV-ES gue= sts without hitting what is effectively a false positive on the WARN. For s= ome SEV-ES VM-Exits, KVM keeps a writable mapping of a guest page across an=
exit to userspace, and typically unmaps the page on the next KVM_RUN. But =
if userspace never calls KVM_RUN after such an exit, then KVM needs to unma=
p the page when the vCPU is destroyed, which in turn triggers the WARN abou=
t not having a running vCPU. Alternatively, SEV-ES could temporarily load t=
he vCPU to suppress the WARN, as is done in nested_vmx_free_vcpu() (but for=
completely unrelated reasons; suppressing WARN from nested_put_vmcs12_page= s() is pure happenstance). But loading a vCPU during destruction is gross (= ideally nVMX code would be cleaned up), risks complicating the SEV-ES code = (KVM would need to ensure the temporarily load()+put() only runs when the v= CPU isn't already loaded), and is ultimately pointless. The motivation for = the WARN is to guard against KVM dirtying guest memory without pushing the = corresponding GFN to the active vCPU's dirty ring, e.g. to ensure userspace=
doesn't miss a dirty page. But for the VM's refcount to reach zero, there = can't be _any_ userspace mappings to the dirty ring, as mapping the dirty r= ing requires doing mmap() on the vCPU FD. I.e. if userspace had a valid map= ping for the dirty ring, then the vCPU file and thus the owning VM would st= ill be alive. And so since userspace can't possibly reach the dirty ring, w= hether or not KVM technically "misses" a push to the dirty ring is irreleva= nt. 2026-07-01 not yet calculated CVE-2026-53345 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-53345 ] Linux--Linux In the Linux kernel, the following=
vulnerability has been resolved: rust: arm64: set uwtable llvm module flag=
for CONFIG_UNWIND_TABLES Due to a rustc bug [1] the -Cforce-unwind-tables= =3Dy flag only emits the uwtable annotation for functions, but not for the = module. This means that compiler-generated functions such as 'asan.module_c= tor' do not receive the uwtable annotation. When CONFIG_UNWIND_PATCH_PAC_IN= TO_SCS is enabled, this leads to boot failures because the dwarf informatio=
n emitted for the kasan constructors is wrong, which causes the SCS boot pa= tching code to patch the constructor in an illegal manner. Specifically, th=
e paciasp instruction is patched, but the autiasp instruction is not. This = mismatch leads to a crash when the constructor is called during boot. =3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: global-out-of-bou= nds in do_basic_setup+0x4c/0x90 Read of size 8 at addr ffffffe3cc7eb488 by = task swapper/0/1 Specifically the faulting instruction is the (*fn)() to in= voke the constructor in do_ctors() of the init/main.c file. Once the fix la= nds in rustc, this flag can be made conditional on the rustc version. Note = that passing the flag on a rustc with the fix present has no effect. [ The = fix [1] has landed for Rust 1.98.0 (expected release on 2026-08-20). Thus a=
dd a version check as discussed. - Miguel ] [ Adjusted link and comment. - = Miguel ] 2026-07-01 not yet calculated CVE-2026-53346 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-53346 ] Linux--Linux In the Linux kernel, the foll= owing vulnerability has been resolved: drm/virtio: Fix driver removal with = disabled KMS DRM atomic and modesetting aren't initialized if virtio-gpu dr= iver built with disabled KMS, leading to access of uninitialized data on dr= iver removal/unbinding and crashing kernel. Fix it by skipping shutting dow=
n atomic core with unavailable KMS. 2026-07-01 not yet calculated CVE-2026-= 53347 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53347 ] Linux--Linux In=
the Linux kernel, the following vulnerability has been resolved: ASoC: SDC=
A: fix NULL pointer dereference in sdca_dev_unregister_functions sdca_dev_u= nregister_functions() iterates over all SDCA function descriptors and calls=
sdca_dev_unregister() on each func_dev without checking for NULL. When a f= unction registration has failed partway through, or the device cleanup race=
s with probe deferral, func_dev entries may be NULL, leading to a kernel oo= ps: BUG: kernel NULL pointer dereference, address: 0000000000000040 RIP: 00= 10:device_del+0x1e/0x3e0 Call Trace: sdca_dev_unregister_functions+0x37/0x6=
0 [snd_soc_sdca] release_nodes+0x35/0xb0 devres_release_all+0x90/0x100 devi= ce_unbind_cleanup+0xe/0x80 device_release_driver_internal+0x1c1/0x200 bus_r= emove_device+0xc6/0x130 device_del+0x161/0x3e0 device_unregister+0x17/0x60 = sdw_delete_slave+0xb6/0xd0 [soundwire_bus] sdw_bus_master_delete+0x1e/0x50 = [soundwire_bus] ... sof_probe_work+0x19/0x30 [snd_sof] This was observed on=
a Lenovo ThinkPad X1 Carbon G14 (Panther Lake) with the SOF audio driver p= robe failing due to missing Panther Lake firmware, causing the subsequent c= leanup of SoundWire devices to trigger the crash. Fix this with three chang= es: 1) Add a NULL guard in sdca_dev_unregister() so that callers do not nee=
d to pre-validate the pointer (defense in depth). 2) In sdca_dev_unregister= _functions(), skip NULL func_dev entries and clear func_dev to NULL after u= nregistration, making the function idempotent and safe against double-invoc= ation. 3) In sdca_dev_register_functions(), roll back all previously regist= ered functions when a later one fails, so the function array is never left =
in a partially-populated state. 2026-07-01 not yet calculated CVE-2026-5334=
8 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53348 ] Linux--Linux In the=
Linux kernel, the following vulnerability has been resolved: netfilter: nf= _conntrack: destroy stale expectfn expectations on unregister NAT helpers s= uch as nf_nat_h323 store a raw pointer to module text in exp->expectfn (e.g=
. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister() only unlinks the = callback descriptor and never walks the expectation table, so an expectatio=
n pending at module removal survives with a dangling exp->expectfn into fre=
ed module text. When the expected connection arrives, init_conntrack() invo= kes exp->expectfn(), now a stale pointer into the unloaded module. Reproduc=
ed on a KASAN build by loading the H.323 helpers, creating a Q.931 expectat= ion, unloading nf_nat_h323, then connecting to the expected port: Oops: int=
3: 0000 [#1] SMP KASAN NOPTI RIP: 0010:0xffffffffa06102d1 init_conntrack.is= ra.0 (net/netfilter/nf_conntrack_core.c:1862) nf_conntrack_in (net/netfilte= r/nf_conntrack_core.c:2049) ipv4_conntrack_local (net/netfilter/nf_conntrac= k_proto.c:223) nf_hook_slow (net/netfilter/core.c:619) __ip_local_out (net/= ipv4/ip_output.c:120) __tcp_transmit_skb (net/ipv4/tcp_output.c:1715) tcp_c= onnect (net/ipv4/tcp_output.c:4374) tcp_v4_connect (net/ipv4/tcp_ipv4.c:345=
) __sys_connect (net/socket.c:2167) Modules linked in: nf_conntrack_h323 [l= ast unloaded: nf_nat_h323] Reaching the dangling state requires CAP_SYS_MOD= ULE in the initial user namespace to remove a NAT helper that still has liv=
e expectations, so this is a robustness fix; leaving an expectation pointin=
g at freed text is wrong regardless. Add nf_ct_helper_expectfn_destroy(), w= hich walks the expectation table and drops every expectation whose ->expect=
fn matches the descriptor being torn down. Call it from each NAT helper's e= xit path after the existing RCU grace period, so no expectation outlives th=
e code it points at and no extra synchronize_rcu() is introduced. With the = fix, the same reproducer runs to completion without the Oops. 2026-07-01 no=
t yet calculated CVE-2026-53349 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-53349 ] Linux--Linux In the Linux kernel, the following vulnerability ha=
s been resolved: ASoC: wm_adsp: Fix NULL dereference when removing firmware=
controls In wm_adsp_control_remove() check that the priv pointer is not NU=
LL before attempting to cleanup what it points to. When cs_dsp creates a co= ntrol it calls wm_adsp_control_add_cb() so that wm_adsp can create its own = private control data. There are two cases where private data is not created=
: 1. The control is a SYSTEM control, so an ALSA control is not created. 2.=
The codec driver has registered a control_add() callback that hides the co= ntrol, so wm_adsp_control_add() is not called. When cs_dsp_remove destroys = its control list it calls wm_adsp_control_remove() for each control. But wm= _adsp_control_remove() was attempting to cleanup the private data pointed t=
o by cs_ctl->priv without checking the pointer for NULL. 2026-07-01 not yet=
calculated CVE-2026-53350 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53= 350 ] Linux--Linux In the Linux kernel, the following vulnerability has bee=
n resolved: riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI Fixes a = warning while dumping core: [54983.546369][ C7] WARNING: [!note_name] fs/bi= nfmt_elf.c:1771 at elf_core_dump+0x910/0xf68, CPU#7: abort01/31982 2026-07-=
01 not yet calculated CVE-2026-53351 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-53351 ] Linux--Linux In the Linux kernel, the following vulnerabili=
ty has been resolved: signal: clear JOBCTL_PENDING_MASK for caller in zap_o= ther_threads() When a multi-threaded process receives a stop signal (e.g., = SIGSTOP), do_signal_stop() sets JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME=
on all threads and sets signal->group_stop_count to the number of threads.=
If one of the threads concurrently calls execve(), de_thread() invokes zap= _other_threads() to kill all other threads. zap_other_threads() aborts the = pending group stop by resetting signal->group_stop_count to 0 and clears th=
e JOBCTL_PENDING_MASK for all other threads. However, it fails to clear the=
job control flags for the calling thread. When execve() completes, the cal= ling thread returns to user mode and checks for pending signals. Seeing the=
stale JOBCTL_STOP_PENDING flag, it calls do_signal_stop(), which invokes t= ask_participate_group_stop(). Since JOBCTL_STOP_CONSUME is still set, it at= tempts to decrement the already-zero signal->group_stop_count, triggering a=
warning: sig->group_stop_count =3D=3D 0 WARNING: CPU: 1 PID: 6475 at kerne= l/signal.c:373 task_participate_group_stop+0x215/0x2d0 Call Trace: <TASK> d= o_signal_stop+0x3be/0x5c0 kernel/signal.c:2619 get_signal+0xa8c/0x1330 kern= el/signal.c:2884 arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signa= l.c:337 exit_to_user_mode_loop+0x8c/0x4d0 kernel/entry/common.c:98 do_sysca= ll_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hw= frame+0x77/0x7f </TASK> Fix this race condition by clearing the JOBCTL_PEND= ING_MASK for the calling thread in zap_other_threads(), ensuring it does no=
t retain any stale job control state after the thread group is destroyed. T= his aligns with other functions that tear down a thread group and abort gro=
up stops, such as zap_process() and complete_signal(), which correctly clea=
r these flags for all threads including the current one. 2026-07-01 not yet=
calculated CVE-2026-53352 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53= 352 ] Linux--Linux In the Linux kernel, the following vulnerability has bee=
n resolved: hsr: Remove WARN_ONCE() in hsr_addr_is_self(). syzbot reported = the warning [0] in hsr_addr_is_self(), whose assumption is simply wrong. hs= r->self_node is cleared in hsr_del_self_node(), which is called from hsr_de= llink(). Since dev->rtnl_link_ops->dellink() is called before unregister_ne= tdevice_many(), there is a window when user can find the device but without=
hsr->self_node. Let's remove WARN_ONCE() in hsr_addr_is_self(). [0]: HSR: =
No self node WARNING: net/hsr/hsr_framereg.c:39 at hsr_addr_is_self+0x211/0= x3f0 net/hsr/hsr_framereg.c:39, CPU#0: syz.4.16848/17220 Modules linked in:=
CPU: 0 UID: 0 PID: 17220 Comm: syz.4.16848 Tainted: G L syzkaller #0 PREEM= PT_{RT,(full)} Tainted: [L]=3DSOFTLOCKUP Hardware name: Google Google Compu=
te Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:hsr_addr_= is_self+0x211/0x3f0 net/hsr/hsr_framereg.c:39 Code: 33 2f 41 0f b7 dd 89 ee=
09 de 31 ff e8 c8 b4 c6 f6 09 dd 74 54 e8 0f b0 c6 f6 31 ed eb 53 e8 06 b0=
c6 f6 48 8d 3d 2f 50 9c 04 <67> 48 0f b9 3a 31 ed eb 42 e8 c1 13 1f 00 89 =
c5 31 ff 89 c6 e8 96 RSP: 0018:ffffc900041c70e0 EFLAGS: 00010283 RAX: fffff= fff8afdc6ca RBX: ffffffff8afdc4e6 RCX: 0000000000080000 RDX: ffffc900104930=
00 RSI: 0000000000000948 RDI: ffffffff8f9a1700 RBP: 0000000000000001 R08: 0= 000000000000000 R09: 0000000000000000 R10: ffffc900041c71e8 R11: fffff52000= 838e3f R12: dffffc0000000000 R13: ffff888041f9e3c0 R14: ffff888086ee3802 R1=
5: 0000000000000000 FS: 00007f6fe985d6c0(0000) GS:ffff888126176000(0000) kn= lGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: = 00007f80bd437dac CR3: 0000000025096000 CR4: 00000000003526f0 DR0: fffffffff= fffffff DR1: 00000000000001f8 DR2: 0000000000000002 DR3: ffffffffefffff15 D= R6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: <TASK> check_local_d= est net/hsr/hsr_forward.c:592 [inline] fill_frame_info net/hsr/hsr_forward.= c:728 [inline] hsr_forward_skb+0xa11/0x2a80 net/hsr/hsr_forward.c:739 hsr_d= ev_xmit+0x253/0x370 net/hsr/hsr_device.c:236 __netdev_start_xmit include/li= nux/netdevice.h:5368 [inline] netdev_start_xmit include/linux/netdevice.h:5= 377 [inline] xmit_one net/core/dev.c:3888 [inline] dev_hard_start_xmit+0x2d= f/0x860 net/core/dev.c:3904 __dev_queue_xmit+0x1428/0x3900 net/core/dev.c:4= 870 neigh_output include/net/neighbour.h:556 [inline] ip_finish_output2+0xc= ec/0x10b0 net/ipv4/ip_output.c:237 ip_send_skb net/ipv4/ip_output.c:1510 [i= nline] ip_push_pending_frames+0x8b/0x110 net/ipv4/ip_output.c:1530 raw_send= msg+0x1547/0x1a50 net/ipv4/raw.c:659 sock_sendmsg_nosec net/socket.c:787 [i= nline] __sock_sendmsg net/socket.c:802 [inline] ____sys_sendmsg+0x7da/0x9c0=
net/socket.c:2698 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2752 __sys_sendm=
sg net/socket.c:2784 [inline] __do_sys_sendmsg net/socket.c:2789 [inline] _= _se_sys_sendmsg net/socket.c:2787 [inline] __x64_sys_sendmsg+0x1c3/0x2a0 ne= t/socket.c:2787 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_s= yscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after= _hwframe+0x77/0x7f RIP: 0033:0x7f6feb62ce59 Code: ff c3 66 2e 0f 1f 84 00 0=
0 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 8=
9 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff=
f7 d8 64 89 01 48 RSP: 002b:00007f6fe985d028 EFLAGS: 00000246 ORIG_RAX: 00= 0000000000002e RAX: ffffffffffffffda RBX: 00007f6feb8a6090 RCX: 00007f6feb6= 2ce59 RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 RBP=
: 00007f6feb6c2d6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000= 000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6feb8a6128=
R14: 00007f6feb8a6090 R15: 00007ffcf01cc488 </TASK> 2026-07-01 not yet cal= culated CVE-2026-53353 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53353 =
] Linux--Linux In the Linux kernel, the following vulnerability has been re= solved: arm64: errata: Mitigate TLBI errata on various Arm CPUs A number of=
CPUs developed by Arm suffer from errata whereby a broadcast TLBI;DSB sequ= ence may complete before the global observation of writes which are transla= ted by an affected TLB entry. These errata ONLY affect the completion of me= mory accesses which have been translated by an invalidated TLB entry, and t= hese errata DO NOT affect the actual invalidation of TLB entries. TLB entri=
es are removed correctly. This issue has been assigned CVE ID CVE-2025-1026=
3. To mitigate this issue, Arm recommends that software follows any affecte=
d TLBI;DSB sequence with an additional TLBI;DSB, which will ensure that all=
memory write effects affected by the first TLBI have been globally observe=
d. The additional TLBI can use any operation that is broadcast to affected = CPUs, and the additional DSB can use any option that is sufficient to compl= ete the additional TLBI. The ARM64_WORKAROUND_REPEAT_TLBI workaround is suf= ficient to mitigate the issue. Enable this workaround for affected CPUs, an=
d update the silicon errata documentation accordingly. Note that due to the=
manner in which Arm develops IP and tracks errata, some CPUs share a commo=
n erratum number. 2026-07-01 not yet calculated CVE-2026-53354 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-53354 ] Linux--Linux In the Linux kernel,=
the following vulnerability has been resolved: net: rds: clear i_sends on = setup unwind The RDS IB connection teardown path is written so it can run d= uring partial startup and on repeated shutdown attempts. It uses NULL point= ers to distinguish resources that are still owned from resources that have = already been released. When rds_ib_setup_qp() fails after allocating i_send=
s but before allocating i_recvs, the sends_out path frees i_sends without c= learing the pointer. A later shutdown pass can still treat that stale point=
er as a live send ring allocation. Clear i_sends after vfree() in the error=
unwind path so the existing shutdown logic continues to use the correct ow= nership state. 2026-07-01 not yet calculated CVE-2026-53355 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-53355 ] Linux--Linux In the Linux kernel, th=
e following vulnerability has been resolved: drm/i915/gem: Fix phys BO prea= d/pwrite with offset sg_page() returns struct page pointer not (void *) so = the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO woul=
d be accessed if non-zero offset is used. Last impacted platform with overl=
ay or cursor planes using phys mapping was Gen3/945G/Lakeport. (cherry pick=
ed from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6) 2026-07-01 not yet=
calculated CVE-2026-53356 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53= 356 ] Linux--Linux In the Linux kernel, the following vulnerability has bee=
n resolved: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn= _del() bt_accept_dequeue() unlinks a not-yet-accepted child from the parent=
accept queue and release_sock()s it before returning, so the returned sk h=
as no caller reference and is unlocked. l2cap_sock_cleanup_listen() walks t= hese children on listening-socket close. A concurrent HCI disconnect drives=
hci_rx_work -> l2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_k= ill() and frees the child sk and its l2cap_chan; cleanup_listen() then uses=
both: BUG: KASAN: slab-use-after-free in l2cap_sock_kill l2cap_sock_kill /=
l2cap_sock_cleanup_listen / __x64_sys_close Freed by: l2cap_conn_del -> l2= cap_sock_close_cb -> l2cap_sock_kill This is distinct from the two fixes al= ready in this area: commit e83f5e24da741 ("Bluetooth: serialize accept_q ac= cess") serialises the accept_q list/poll and takes temporary refs inside bt= _accept_dequeue(), and CVE-2025-39860 serialises the userspace close()/acce= pt() race by calling cleanup_listen() under lock_sock() in l2cap_sock_relea= se(). Neither covers l2cap_conn_del() running from hci_rx_work, so this UAF=
still reproduces on current bluetooth/master. Take the reference at the so= urce: bt_accept_dequeue() does sock_hold() while sk is still locked, before=
release_sock(); callers sock_put(). cleanup_listen() pins the chan with l2= cap_chan_hold_unless_zero() under a brief child sk lock (serialising vs l2c= ap_sock_teardown_cb()), drops it before l2cap_chan_lock(), and skips a dupl= icate l2cap_sock_kill() on SOCK_DEAD. conn->lock is not taken here: cleanup= _listen() runs under the parent sk lock and that would invert conn->lock ->=
chan->lock -> sk_lock (lockdep). KASAN/SMP: an unprivileged listen/close v=
s HCI-disconnect race produced 12 use-after-free reports per run before thi=
s change; 0, and no lockdep report, over 1600+ raced iterations after it on=
bluetooth/master. 2026-07-02 not yet calculated CVE-2026-53357 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-53357 ] Linux--Linux In the Linux kernel=
, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan=
timer to close channels in cleanup_listen() l2cap_chan_close() removes the=
channel from conn->chan_l, which must be done under conn->lock. cleanup_li= sten() runs under the parent sk_lock, so acquiring conn->lock would invert = the established conn->lock -> chan->lock -> sk_lock order. Instead of calli=
ng l2cap_chan_close() directly, schedule l2cap_chan_timeout with delay 0 to=
close the channel asynchronously. The timeout handler already acquires con= n->lock and chan->lock in the correct order. The timer is only armed when c= han->conn is still set: if it is already NULL, l2cap_conn_del() has already=
processed this channel (l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_so= ck_close_cb), so there is nothing left to do. If l2cap_conn_del() races in = after the timer is armed, __clear_chan_timer() inside l2cap_chan_del() canc= els it; if the timer has already fired, the handler returns harmlessly beca= use chan->conn was cleared. 2026-07-02 not yet calculated CVE-2026-53358 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-53358 ] Linux--Linux In the Lin=
ux kernel, the following vulnerability has been resolved: KVM: x86: Fix sha= dow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM=
: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a sha= dow paging mismatch between stored and computed GFNs; the bug could be trig= gered by changing a PDE mapping from outside the guest, and then deleting a=
memslot. The rmap_remove() call would miss entries created after the PDE c= hange because the GFN of the leaf SPTE does not match the GFN of the struct=
kvm_mmu_page. A similar hole however remains if the modified PDE points to=
a non-leaf page. In this case the gfn can be made to match, but the role d= oes not match: the original large 2MB page creates a kvm_mmu_page with dire= ct=3D1, while the new 4KB needs a kvm_mmu_page with direct=3D0. However, kv= m_mmu_get_child_sp() does not compare the role, and therefore reuses the pa= ge. The next step is installing a leaf (4KB) SPTE on the new path which rec= ords an rmap entry under the gfn resolved by the walk. But when that child =
is zapped its parent kvm_mmu_page has direct=3D1 and kvm_mmu_page_get_gfn()=
computes the gfn for the 4KB page as sp->gfn + index instead of using sp->= shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails=
to remove the recorded entry. When the memslot is dropped the shadow page =
is freed but the rmap entry survives, as in the scenario that was already f= ixed. Code that later walks that gfn (dirty logging, MMU notifier invalidat= ion, and so on) dereferences an sptep that lies in the freed page, causing = the use-after-free. 2026-07-04 not yet calculated CVE-2026-53359 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-53359 ] Linux--Linux In the Linux kerne=
l, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB=
scratch area if GHCB v2+ is in use As per the GHCB spec, when using GHCB v=
2+ require the software scratch area to reside in the GHCB's shared buffer.=
Note, things like Page State Change (PSC) requests _rely_ on this behavior=
, as the guest can't provide a length when making the request, i.e. the siz=
e of the guest payload is bounded by the size of the shared buffer. Failure=
to force usage of the GHCB, and a slew of other flaws, lets a malicious SN=
P guest corrupt host kernel heap memory, and leak host heap layout informat= ion. setup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2), = where exit_info_2 is guest-controlled. With exit_info_2=3D24, this yields a=
24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer hol=
ds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only entries[=
0] and entries[1] are in-bounds. snp_begin_psc() validates end_entry agains=
t VMGEXIT_PSC_MAX_COUNT (253) but NOT against the actual buffer size: idx_e=
nd =3D hdr->end_entry; if (idx_end >=3D VMGEXIT_PSC_MAX_COUNT) { // checks = 253, not buffer snp_complete_psc(svm, ...); return 1; } for (idx =3D idx_st= art; idx <=3D idx_end; idx++) { entry_start =3D entries[idx]; // OOB when i=
dx >=3D 2 The guest sets end_entry=3D10+, causing the host to iterate entri= es[2+] which are OOB into adjacent slab objects. For each OOB entry: - The = host reads 8 bytes (OOB READ / info leak oracle) - If the data passes PSC v= alidation, __snp_complete_one_psc() writes cur_page =3D 1 or 512 into the e= ntry (OOB WRITE, sev.c:3806) - If validation fails, the error response reve= als whether adjacent memory is zero vs non-zero (information disclosure to = guest) The guest controls allocation size (exit_info_2), entry range (cur_e= ntry/end_entry), and can fire unlimited VMGEXITs to repeatedly hit differen=
t slab positions. By exploiting the variety of bugs, a malicious SEV-SNP gu= est can: - OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure)=
- OOB write cur_page bits into adjacent objects (heap corruption) - Trigge=
r use-after-free conditions across VMGEXITs E.g. with KASAN enabled, a sing=
le insmod of the PoC guest module produces 73 KASAN reports: BUG: KASAN: sl= ab-out-of-bounds in snp_begin_psc+0x126/0x890 Read of size 8 at addr ffff88= 8219ffb5e0 by task qemu-system-x86/2199 BUG: KASAN: slab-out-of-bounds in s= np_begin_psc+0x468/0x890 Write of size 8 at addr ffff888351566648 by task q= emu-system-x86/2199 The buggy address belongs to the object at ffff888XXXXX= XXXX which belongs to the cache kmalloc-cg-32 of size 32 The buggy address =
is located N bytes to the right of allocated 32-byte region [ffff888XXXXXXX= XX, ffff888XXXXXXXXX) Breakdown: 62 slab-out-of-bounds (reads + writes past=
allocation) 7 slab-use-after-free 4 use-after-free All credit to Stan for = the wonderful description and reproducer! [sean: write changelog] 2026-07-0=
4 not yet calculated CVE-2026-53360 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-53360 ] Linux--Linux In the Linux kernel, the following vulnerabilit=
y has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor=
Ushakov reported that unix_gc() could run with gc_in_progress being false =
if the work is scheduled while running: Thread 1 Thread 2 Thread 3 --------=
-------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_prog= ress) `- if (!gc_in_progress) |- gc_in_progress =3D true | `- queue_work() =
| unix_gc() <----------------/ | | |- gc_in_progress =3D true ... `- queue_= work() | | `- gc_in_progress =3D false | | unix_gc() <---------------------= ------------------------' | ... /* gc_in_progress =3D=3D false */ | `- gc_i= n_progress =3D false unix_peek_fpl() relies on gc_in_progress not to confus=
e GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc(). 2026-07-04=
not yet calculated CVE-2026-53361 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-53361 ] Linux--Linux In the Linux kernel, the following vulnerability=
has been resolved: ipv6: account for fraggap on the paged allocation path =
In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE=
/ NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloc= len =3D fragheaderlen + transhdrlen; pagedlen =3D datalen - transhdrlen; da= talen already includes fraggap (datalen =3D length + fraggap). When fraggap=
is non-zero, this is not the first skb and transhdrlen is zero. The fragga=
p bytes carried over from the previous skb are copied just past the fragmen=
t headers in the new skb's linear area. The linear area is therefore unders= ized by fraggap bytes while pagedlen is overstated by the same amount, and = the copy writes past skb->end into the trailing skb_shared_info. An unprivi= leged user can trigger this via a UDPv6 socket using MSG_MORE together with=
MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104=
("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fi=
x __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy v= alue caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PA= GES to proceed in this case, making the corruption triggerable. The non-pag=
ed branch sets alloclen to fraglen, which already accounts for fraggap beca= use datalen does. Bring the paged branch in line by adding fraggap to alloc= len and subtracting it from pagedlen. After this adjustment, copy no longer=
collapses to -fraggap on the paged path, so remove the stale comment descr= ibing that old arithmetic. Since a negative copy is no longer expected for =
a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from t=
he negative copy check. 2026-07-04 not yet calculated CVE-2026-53362 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-53362 ] Little Orbit--GameFirst Ant= i-Cheat A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.s= ys` in Little Orbit GFAC allows a local attacker to cause a denial of servi=
ce via crafted requests that trigger a system crash. 2026-07-02 not yet cal= culated CVE-2026-12166 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12166 =
] Little Orbit--GameFirst Anti-Cheat The Minifilter communication port for = driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to a= ccess privileged driver functionality via a communication interface that la= cks appropriate access restrictions. 2026-07-02 not yet calculated CVE-2026= -12167 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12167 ] Little Orbit--= GameFirst Anti-Cheat An improper validation vulnerability for driver `GFAC_= Sys_x64.sys` in Little Orbit GFAC allows a local attacker to escalate privi= leges to SYSTEM and execute arbitrary code in kernel mode via crafted messa= ges sent through a Minifilter communication port. 2026-07-02 not yet calcul= ated CVE-2026-12168 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12168 ] M= ARKSTOS--CGI::Session::ID::md5 CGI::Session::ID::md5 versions before 4.49 f=
or Perl generate predictable session ids from low-entropy sources. The gene= rate_id method builds the session id from a MD5 digest of the process id, t=
he epoch time, and the built-in rand() function. All three are predictable,=
low-entropy sources: the PID is drawn from a small range, the epoch time c=
an be guessed or read from the HTTP Date header, and Perl's rand() is unsui= table for security purposes because it is predictable and reversible. An at= tacker who predicts a session id can impersonate the corresponding session = and bypass authentication. 2026-07-01 not yet calculated CVE-2026-56016 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-56016 ] MediaTek, Inc.--MediaTek=
chipset In Modem, there is a possible system crash due to improper input v= alidation. This could lead to remote denial of service, if a UE has connect=
ed to a rogue base station controlled by the attacker, with no additional e= xecution privileges needed. User interaction is not needed for exploitation=
. Patch ID: MOLY01826924; Issue ID: MSV-7301. 2026-07-01 not yet calculated=
CVE-2026-20457 [ https://www.cve.org/CVERecord?id=3DCVE-2026-20457 ] Media= Tek, Inc.--MediaTek chipset In Modem, there is a possible memory corruption=
due to a missing bounds check. This could lead to remote escalation of pri= vilege, if a UE has connected to a rogue base station controlled by the att= acker, with no additional execution privileges needed. User interaction is = not needed for exploitation. Patch ID: MOLY01402160; Issue ID: MSV-7298. 20= 26-07-01 not yet calculated CVE-2026-20458 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-20458 ] MediaTek, Inc.--MediaTek chipset In Modem, there is a=
possible system crash due to improper input validation. This could lead to=
remote denial of service, if a UE has connected to a rogue base station co= ntrolled by the attacker, with no additional execution privileges needed. U= ser interaction is not needed for exploitation. Patch ID: MOLY01816800; Iss=
ue ID: MSV-6842. 2026-07-01 not yet calculated CVE-2026-20459 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-20459 ] MediaTek, Inc.--MediaTek chipset I=
n Modem, there is a possible information disclosure due to improper input v= alidation. This could lead to remote information disclosure, if a UE has co= nnected to a rogue base station controlled by the attacker, with no additio= nal execution privileges needed. User interaction is not needed for exploit= ation. Patch ID: MOLY01811421; Issue ID: MSV-6788. 2026-07-01 not yet calcu= lated CVE-2026-20460 [ https://www.cve.org/CVERecord?id=3DCVE-2026-20460 ] = MediaTek, Inc.--MediaTek chipset In Modem, there is a possible out of bound=
s write due to a missing bounds check. This could lead to remote denial of = service, if a UE has connected to a rogue base station controlled by the at= tacker, with no additional execution privileges needed. User interaction is=
not needed for exploitation. Patch ID: MOLY01267281 / MOLY01318201; Issue = ID: MSV-6486. 2026-07-01 not yet calculated CVE-2026-20461 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-20461 ] MediaTek, Inc.--MediaTek chipset In T= elephony, there is a possible memory corruption due to a heap buffer overfl= ow. This could lead to local escalation of privilege if a malicious actor h=
as already obtained the System privilege. User interaction is not needed fo=
r exploitation. Patch ID: ALPS11006447; Issue ID: MSV-7871. 2026-07-01 not = yet calculated CVE-2026-20462 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -20462 ] MediaTek, Inc.--MediaTek chipset In Modem, there is a possible esc= alation of privilege due to a permissions bypass. This could lead to local = escalation of privilege if a malicious actor has already obtained the Syste=
m privilege. User interaction is not needed for exploitation. Patch ID: MOL= Y01716533; Issue ID: MSV-6309. 2026-07-01 not yet calculated CVE-2026-20463=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-20463 ] MIK--CryptX CryptX v= ersions before 0.088_001 for Perl compare AEAD authentication tags in non-c= onstant time in the streaming decrypt_done path. The decrypt_done($tag) for=
m compares it against the computed tag with memNE (memcmp() !=3D 0), which = short-circuits on the first differing byte, so its run time depends on the = number of matching leading bytes. This affects all five AEAD modes: GCM, CC=
M, ChaCha20Poly1305, EAX and OCB. The one-shot *_decrypt_verify helpers are=
unaffected; they verify the tag inside libtomcrypt with a constant-time co= mparison. The timing difference is a tag-verification oracle. An attacker w=
ho can submit many candidate tags for the same nonce, ciphertext and associ= ated data while measuring the timing precisely enough may recover the expec= ted tag byte by byte and forge a message that verifies. 2026-06-29 not yet = calculated CVE-2026-13758 [ https://www.cve.org/CVERecord?id=3DCVE-2026-137=
58 ] mlflow--mlflow/mlflow In MLflow versions prior to 3.14.0, when running=
with authentication enabled, the trace API endpoints lack proper authoriza= tion validators. This allows any authenticated user to bypass experiment-le= vel authorization controls on all trace operations, including reading, dele= ting, and modifying traces on experiments they do not have permission to ac= cess. The issue arises from the `_before_request` handler, which does not r= egister authorization validators for trace endpoints, resulting in requests=
proceeding without validation. This vulnerability can expose sensitive dat=
a, destroy audit logs, and allow unauthorized modifications. 2026-07-02 not=
yet calculated CVE-2026-8147 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -8147 ] Mozilla--Firefox Memory safety bugs present in Firefox 152.0.3. Som=
e of these bugs showed evidence of memory corruption and we presume that wi=
th enough effort some of these could have been exploited to run arbitrary c= ode. This vulnerability was fixed in Firefox 152.0.4. 2026-06-30 not yet ca= lculated CVE-2026-14241 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14241=
] Mozilla--Thunderbird A malicious LDAP server, which a Thunderbird user i=
s configured to query for address-book autocomplete, can stash arbitrarily = large amounts of attacker-supplied data into the Thunderbird LDAP client un= til it crashes due to memory exhaustion. This vulnerability was fixed in Th= underbird 152.0.1 and Thunderbird 140.12.1. 2026-07-01 not yet calculated C= VE-2026-57962 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57962 ] Mozilla= --Thunderbird An attacker who can send HTML chat messages (via Matrix or XM= PP) can inject arbitrary styled content, phishing links, and CSS that manip= ulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and=
Thunderbird 140.12.1. 2026-07-01 not yet calculated CVE-2026-57963 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-57963 ] MyComplianceOffice--MCO MCO = does not properly enforce authorization checks in the /customer/servlet/mco= /webapi/profile-sections/group-membership endpoint. An authenticated user c=
an modify their group membership without proper authorization checks, allow= ing privilege escalation. An attacker can add themselves to arbitrary group=
s by supplying a valid group ID, which can be obtained via other applicatio=
n functionalities (e.g.=C2=A0/customer/servlet/mco/webapi/group/picker/grou= ps), provided he has necessary permissions, or potentially inferred through=
brute-force techniques. Because vendor contact attempts were unsuccessful,=
the vulnerability has only been confirmed in version 25.3.3.1=C2=A0but may=
also affect other versions. 2026-07-01 not yet calculated CVE-2026-53902 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-53902 ] MyComplianceOffice--MC=
O MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerabi= lity in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement=
endpoint. The application does not properly validate whether an authentica= ted user is authorized to access a requested document, allowing direct retr= ieval based on a user-supplied identifier. An attacker can access trading d= ocuments belonging to other users by providing a valid document ID. Althoug=
h exploitation requires guessing the identifier, predictable ID patterns en= able feasible enumeration, leading to unauthorized disclosure of sensitive = information. Because vendor contact attempts were unsuccessful, the vulnera= bility has only been confirmed in version 25.3.3.1=C2=A0but may also affect=
other versions. 2026-07-01 not yet calculated CVE-2026-53903 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-53903 ] MyComplianceOffice--MCO MCO is vul= nerable to Account Denial of Service due to improper implementation of pass= word reset functionality. Each password reset request invalidates previousl=
y set password as well as previously issued temporary passwords, furthermor=
e, password resets are not limited in any way. An attacker who provides vic= tim's email and answer to their security question, can successfully initiat=
e the reset process and continuously invalidate credentials, effectively lo= cking the victim out of their account. Answering security questions has a l= imited number of tries which lowers the risk of this vulnerability. Because=
vendor contact attempts were unsuccessful, the vulnerability has only been=
confirmed in version 25.3.3.1=C2=A0but may also affect other versions. 202= 6-07-01 not yet calculated CVE-2026-53904 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-53904 ] MyComplianceOffice--MCO MCO does not properly enforce = authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarc= hy/get-acl-tree-structure endpoint. An authenticated, low-privileged user c=
an retrieve administrator access control structures without proper authoriz= ation checks. This may expose sensitive permission mappings and internal co= nfiguration details. Because vendor contact attempts were unsuccessful, the=
vulnerability has only been confirmed in version 25.3.3.1=C2=A0but may als=
o affect other versions. 2026-07-01 not yet calculated CVE-2026-53905 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-53905 ] MyComplianceOffice--MCO MC=
O is vulnerable to Path Disclosure and Path Traversal in file handling func= tionality related to data export and upload. Improper validation of the fil= ename parameter allows writing files to arbitrary locations as well as indi= rect disclosure of absolute server paths through error messages. Because ve= ndor contact attempts were unsuccessful, the vulnerability has only been co= nfirmed in version 25.3.3.1=C2=A0but may also affect other versions. 2026-0= 7-01 not yet calculated CVE-2026-53906 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-53906 ] MyComplianceOffice--MCO MCO is vulnerable to Stored Cro= ss-Site Scripting (XSS) via the application logo upload functionality. An a= ttacker with the ability to change the application logo can upload a crafte=
d SVG file containing malicious JavaScript code that is executed when the l= ogo is rendered or opened. Because vendor contact attempts were unsuccessfu=
l, the vulnerability has only been confirmed in version 25.3.3.1=C2=A0but m=
ay also affect other versions. 2026-07-01 not yet calculated CVE-2026-53907=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-53907 ] MyComplianceOffice--= MCO MCO is vulnerable to User Enumeration through authentication-related fu= nctionalities. The application returns distinguishable responses for valid = and invalid users during username reminder and password reset operations. A=
n attacker can leverage these differences to enumerate valid usernames and = email addresses. Because vendor contact attempts were unsuccessful, the vul= nerability has only been confirmed in version 25.3.3.1=C2=A0but may also af= fect other versions. 2026-07-01 not yet calculated CVE-2026-53908 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-53908 ] MyComplianceOffice--MCO MCO do=
es not correctly validate types of uploaded files. File upload validation f= unctionality relies only on client-side checks, which can be bypassed. An a= uthorized, low-privileged attacker can upload files with arbitrary types to=
the server. Because vendor contact attempts were unsuccessful, the vulnera= bility has only been confirmed in version 25.3.3.1=C2=A0but may also affect=
other versions. 2026-07-01 not yet calculated CVE-2026-53909 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-53909 ] myvesta--vesta myVesta is affected=
by an authenticated remote code execution vulnerability. Low privileged us= ers can insert arbitrary commands as a part of the v_ftp_user parameter whe=
n deleting FTP usernames. This could result in the execution of commands as=
the admin user or takevoer of the admin user in myVesta. 2026-07-04 not ye=
t calculated CVE-2026-12195 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 2195 ] NetScaler--ADC Arbitrary File Read (Unauthenticated) in=C2=A0NetScal=
er ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP o=
r SNIP with management access is enabled 2026-06-30 not yet calculated CVE-= 2026-10816 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10816 ] NetScaler-= -ADC Insufficient input validation leading to memory overread in=C2=A0NetSc= aler ADC and NetScaler Gateway if the=C2=A0TCP TimeStamp is enabled in TCP = Profile and is associated with the virtual server (of type LB, CS, VPN) or = the service configured on NetScaler 2026-06-30 not yet calculated CVE-2026-= 10817 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10817 ] NetScaler--ADC = Denial of service via malformed HTTP/2 requests in=C2=A0NetScaler ADC and N= etScaler Gateway=C2=A0if=C2=A0HTTP/2 is enabled in HTTP Profile and associa= ted with the virtual server (of type LB, CS, VPN) or the service configured=
on NetScaler 2026-06-30 not yet calculated CVE-2026-13474 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-13474 ] NetScaler--ADC Insufficient input val= idation in=C2=A0NetScaler ADC and NetScaler Gateway=C2=A0leading to memory = overread if=C2=A0NetScaler ADC or NetScaler Gateway is configured as a SAML=
IDP 2026-06-30 not yet calculated CVE-2026-8451 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-8451 ] NetScaler--ADC Memory overflow vulnerability=C2= =A0NetScaler ADC and NetScaler Gateway=C2=A0leading to unpredictable or err= oneous behavior and Denial of Service if the appliance is configured as a= =C2=A0Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server 2= 026-06-30 not yet calculated CVE-2026-8452 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-8452 ] NetScaler--ADC Multiple Memory overflow vulnerabilitie=
s in=C2=A0NetScaler ADC and NetScaler Gateway=C2=A0leading to unpredictable=
or erroneous behavior and Denial of Service if=C2=A0NetScaler ADC is confi= gured as an LB of type Oracle=C2=A0OR=C2=A0NetScaler ADC is configured as a=
DNS Proxy=C2=A0OR=C2=A0NetScaler ADC is configured as a DNS recursive reso= lver deployment 2026-06-30 not yet calculated CVE-2026-8655 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-8655 ] nltk--nltk/nltk NLTK version 3.9.4 is=
vulnerable to a path traversal attack due to an incomplete fix for GitHub = Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` checks fo=
r literal `../` sequences but fails to account for percent-encoded traversa=
l sequences such as `..%2f`. The `url2pathname()` function decodes these se= quences after the validation step, allowing an attacker to bypass the prote= ction. This vulnerability enables an attacker to read arbitrary files acces= sible to the Python process by controlling the resource name parameter pass=
ed to `nltk.data.load()` or `nltk.data.find()`. The issue affects applicati= ons that rely on NLTK for resource loading, including NLP web applications,=
Jupyter notebooks, and CLI tools. The default `pathsec.ENFORCE=3DFalse` se= tting exacerbates the impact by not blocking the file read at the `open()` = stage. 2026-06-30 not yet calculated CVE-2026-12243 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-12243 ] nltk--nltk/nltk In nltk/nltk versions 3.9.3 = and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNE= RTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDepend= encyParser) are vulnerable to untrusted JAR code execution. These classes a= ccept user-controllable JAR paths and execute them via the `java()` functio=
n, which invokes `subprocess.Popen()` without integrity verification. This = vulnerability is identical to CVE-2026-0848, which was fixed for StanfordSe= gmenter by adding SHA256 verification. However, the fix was not applied to = these additional classes, leaving them susceptible to arbitrary code execut= ion when loading untrusted JAR files. 2026-07-04 not yet calculated CVE-202= 6-12252 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12252 ] Nokia--MantaR=
ay NM Nokia MantaRay NM is subject to an unrestricted file upload vulnerabi= lity due to insufficient file type validation. Successful exploitation coul=
d allow an authenticated attacker to upload malicious files onto the system=
. 2026-06-30 not yet calculated CVE-2025-24815 [ https://www.cve.org/CVERec= ord?id=3DCVE-2025-24815 ] Nokia--MantaRay NM Nokia MantaRay is subject to a=
n Improper Access Control vulnerability due to insufficient authorization w= ithin the API. Successful exploitation could allow an authenticated attacke=
r to retrieve confidential information beyond their assigned privileges. 20= 26-06-30 not yet calculated CVE-2025-24816 [ https://www.cve.org/CVERecord?= id=3DCVE-2025-24816 ] Nokia--MantaRay NM Nokia MantaRay NM is vulnerable to=
a sudo privilege escalation vulnerability where a local attacker possessin=
g administrative (local admin) privileges can escalate to full root privile= ges on the host. Successful exploitation results in root-level access to th=
e filesystem and the ability to execute actions as root. The risk can be te= mporarily mitigated by restricting the set of commands permitted via sudo f=
or the affected accounts. 2026-06-30 not yet calculated CVE-2025-7406 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2025-7406 ] Notepad3--Notepad3 Notepad3=
through 6.25.822.1 contains a DLL search-order hijacking vulnerability in = the About-dialog code path in src/Notepad3.c. The application calls LoadLib= rary(L"MSFTEDIT.DLL") with a bare DLL name, which allows a local attacker t=
o place a malicious MSFTEDIT.DLL in the application directory or another pr= eferred DLL search location and achieve arbitrary code execution in the con= text of the user when the About dialog is opened. 2026-07-02 not yet calcul= ated CVE-2026-38972 [ https://www.cve.org/CVERecord?id=3DCVE-2026-38972 ] n= topng--ntopng ntopng through 6.6 is vulnerable to Predictable Session Ident= ifier which can lead to Session Hijacking. HTTP session identifiers in src/= HTTPserver.cpp use weak time-seeded pseudo-randomness during session creati= on. As a result, fresh authenticated logins can receive deterministic or co= lliding session cookies under attacker-controlled timing. 2026-07-02 not ye=
t calculated CVE-2026-38968 [ https://www.cve.org/CVERecord?id=3DCVE-2026-3= 8968 ] ohler55--oj Oj (Optimized JSON) is a JSON parser and Object marshall=
er packaged as a Ruby gem. In versions prior to 3.17.2, Oj.dump is vulnerab=
le to a stack-based buffer overflow when a large :indent value is provided =
by the developer. fill_indent in dump.h calls memset(indent_str, ' ', (size= _t)opts->indent) without validating the size. When opts->indent is set to I= NT_MAX (2,147,483,647), the (size_t) cast preserves the large value and mem= set writes 2 GB into the stack-allocated out buffer (4,184 bytes), corrupti=
ng the stack and crashing the process. This issue has been fixed in version=
3.17.2. 2026-06-30 not yet calculated CVE-2026-54502 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-54502 ] ohler55--oj Oj (Optimized JSON) is a JSON = parser and Object marshaller packaged as a Ruby gem. In versions prior to 3= .17.2, when in object mode, Oj.dump is vulnerable to a heap buffer overflow=
when serializing Exception objects with a large :indent value. The seriali= zer allocates a buffer sized for the object's attributes but does not accou=
nt for the indent bytes added on each write. With indent: 5000, the accumul= ation of 5,000-byte indent strings overflows the 13,150-byte heap allocatio=
n, corrupting adjacent heap memory. This issue has been fixed in version 3.= 17.2. 2026-06-30 not yet calculated CVE-2026-54896 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-54896 ] ohler55--oj Oj (Optimized JSON) is a JSON par= ser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc = iterators (each_value, each_child, each_leaf) were vulnerable to a heap use= -after-free. When a Ruby block yielded during iteration calls doc.close or = d.close, the document's heap memory is freed while the C iterator is still = running. When control returns from the block, the iterator reads from the f= reed region, producing a use-after-free accessible from pure Ruby. This iss=
ue has been fixed in version 3.17.2. 2026-06-30 not yet calculated CVE-2026= -54897 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54897 ] ohler55--oj Oj=
(Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby=
gem. In versions prior to 3.17.2,Oj::Parser#parse is vulnerable to a heap = use-after-free when a SAJ/SAJ2 callback mutates the input JSON string durin=
g parsing. The C engine holds a raw const byte * pointer into the Ruby stri= ng's internal buffer. If a callback (e.g. hash_start) resizes the string - = for example by calling String#replace with a longer value - Ruby reallocate=
s the string buffer and frees the old one. The C parser's pointer is left d= angling; the next character read at parser.c:607 is a use-after-free. This = issue has been fixed in version 3.17.2. 2026-06-30 not yet calculated CVE-2= 026-54898 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54898 ] ohler55--oj=
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a R= uby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Par= ser instance triggers a heap use-after-free. When symbol_keys is toggled fr=
om true to false, opt_symbol_keys_set frees the internal key cache (cache_f= ree) but does not clear the pointer. The next parse call reads from the fre=
ed cache via cache_intern, producing a use-after-free. This issue has been = fixed in version 3.17.2. 2026-06-30 not yet calculated CVE-2026-54899 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-54899 ] ohler55--oj Oj (Optimized = JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In ver= sions prior to 3.17.2, when in usual mode with create_id enabled, Oj::Parse= r#parse is vulnerable to heap corruption via a negative-size memcpy. When a=
JSON object key is exactly 65,535 bytes long, an integer truncation in for= m_attr (usual.c:63) converts the length to -1 before passing it to memcpy. = This causes memcpy to copy SIZE_MAX bytes (interpreted as a huge size_t), c= orrupting heap memory and crashing the process. The issue has been fixed in=
version 3.17.2. 2026-06-30 not yet calculated CVE-2026-54900 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-54900 ] ohler55--oj Oj (Optimized JSON) is=
a JSON parser and Object marshaller packaged as a Ruby gem. In versions pr= ior to 3.17.2, Oj::Parser in usual mode does not mark array_class and hash_= class references during garbage collection, leading to Use-After-Free. If G=
C runs after the class is assigned but before a parse, the class object is = reclaimed, leaving the parser holding a dangling VALUE. The subsequent pars=
e call dereferences the freed object, producing a segfault. This issue has = been fixed in version 3.17.2. 2026-06-30 not yet calculated CVE-2026-54901 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-54901 ] ohler55--oj Oj (Optim= ized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. P= rior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. T=
he Oj::Parser does not protect cached object keys (=C3=A2=E2=80=B0=C2=A5 35=
bytes) from garbage collection, and a Ruby callback that triggers GC insid=
e hash_end can cause the key string to be reclaimed while the C parser stil=
l holds a pointer to it. The subsequent access to the freed string VALUE re= sults in a segfault, confirmed by an RIP pointing to address 0x4242 (a cana= ry-style pattern suggesting control over the freed memory's content). This = issue has been fixed in version 3.17.2. 2026-06-30 not yet calculated CVE-2= 026-54902 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54902 ] ohler55--oj=
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a R= uby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corrupt= ion when parsing a JSON string longer than 2 GB. An integer overflow in buf= _append_string (buf.h:61) converts the string length to a large negative si= ze_t, causing memcpy to copy an astronomically large amount of data out of = bounds. This crashes the process and can corrupt adjacent heap memory. The = issue has been fixed in version 3.17.2. 2026-06-30 not yet calculated CVE-2= 026-54903 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54903 ] OpenIDC--li= boauth2 liboauth2 is vulnerable to Server-Side Request Forgery in=C2=A0oaut= h2_jose_jwks_aws_alb_resolve() function.=C2=A0The AWS ALB verifier reads bo=
th signer and kid from the unverified JWT header. If signer matches the con= figured ARN, kid is appended to alb_base_url without URL encoding or path s= anitization, and the HTTP GET is issued before signature verification. This=
allows an attacker to force the server to send a GET request to an attacke= r-chosen internal path. This issue was fixed in version 2.3.0 2026-07-02 no=
t yet calculated CVE-2026-54430 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-54430 ] OpenIDC--liboauth2 In liboauth2 the Demonstrating Proof-of-Posse= ssion (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header conta= ins private key=C2=A0material. RFC 9449 section 4.3 step 7 requires the ver= ifier to reject=C2=A0such a proof but=C2=A0oauth2_token_verify() function r= eturns success for a malformed DPoP=C2=A0proof that embeds the private Elli= ptic Curve (EC) key in the header. This issue was fixed in version 2.3.0 20= 26-07-02 not yet calculated CVE-2026-54431 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-54431 ] pdfcpu--pdfcpu pdfcpu through v0.11.1 contains an unc= ontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. T=
he parser descends recursively through nested PDF objects, including arrays=
, via ParseObjectContext() and parseArray() without enforcing a maximum nes= ting depth. 2026-07-02 not yet calculated CVE-2026-38970 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-38970 ] Perforce--Puppet Core Puppet resource_a=
pi (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) d= oes not preserve the sensitive flag on parameters defined via the resource-= api, causing values such as passwords to be stored in cleartext in the agen= t's local transaction state cache. Affected versions of the resource_api mo= dule include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fix=
ed in puppet resource_api=C2=A01.9.2 and 2.0.1 released with Puppet Core 8.= 20.0 and PE 2023.8.10 & PE 2025.11.0. 2026-07-03 not yet calculated CVE-202= 6-8804 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8804 ] phpipam--phpipa=
m PHPIPAM is affected by an authenticated local file inclusion vulnerabilit=
y that allows users with access to the API to execute/include arbitrary PHP=
files on the web server's file system. The API is not enabled by default o=
n installations. 2026-07-04 not yet calculated CVE-2026-12194 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-12194 ] Picklescan--Picklescan Picklescan = before 0.0.25 fails to detect unsafe global functions in the Numpy library,=
allowing attackers to bypass static analysis and execute arbitrary code du= ring deserialization. Attackers can craft malicious pickle files using nump= y.testing._private.utils.runstring within the reduce method to import dange= rous libraries like os and execute arbitrary OS commands when the pickle fi=
le is loaded. 2026-06-30 not yet calculated CVE-2025-71355 [ https://www.cv= e.org/CVERecord?id=3DCVE-2025-71355 ] pion--dtls Pion DTLS is a Go implemen= tation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vu= lnerable to Remote Denial of Service via panic while parsing a crafted ECDH= E_PSK ServerKeyExchange message. This issue has been fixed in version 3.1.4=
. 2026-07-01 not yet calculated CVE-2026-54908 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-54908 ] Pivotal --CRM 6.6.4.08 An issue in Pivotal CRM 6.= 6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Piv= otal CRM 6.6.5.10 and Patch_CWE502_20260316.zip) allows a remote attacker t=
o execute arbitrary code via the Pivotal.Engine.Client.Services.Conversion.= dll component. NOTE: this issue exists because of an incomplete fix for CVE= -2026-39253. 2026-07-01 not yet calculated CVE-2026-51947 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-51947 ] pretix--pretix We found a chain of com= bining multiple weaknesses in the product that could allow an attacker to b= ecome any user in the backend and access any data: * The payment integratio=
n plugins Stripe (included in the core system), pretix-mollie, pretix-oppwa=
, pretix-bitpay, pretix-payone, pretix-secuconnect, pretix-sofort, and pret= ix-saferpay contain a code path that is intended for the transport of sessi=
on parameters from a tab with isolated cookies (e.g. in the pretix widget) =
to a new tab. For this purpose, a set of session parameters is cryptographi= cally signed and then passed to the new tab as a URL parameter. The plugins=
perform no further validation of the session parameters, other than the cr= yptographic signature being valid. This is fixed with the releases issued t= oday by strictly validating that no session parameters outside of the scope=
of the respective plugin may be set. * An unrelated feature in the core sy= stem is used to generate redirect links that obfuscate any Referer headers = for outgoing links to prevent leakage of secrets in URLs. This redirect pag=
e also requires cryptographically signed parameters. Unfortunately, it uses=
the same key and salt for the signature as the previously mentioned featur=
e in the payment integration plugins. A motivated attacker with access to a=
t least one event in the backend can trick the system into cryptographicall=
y signing arbitrary content using specially crafted links. In combination w= ith the previous issue, the attacker could use this to set and modify arbit= rary parameters on their user session by injecting the signed parameters in=
to the feature of the payment providers. This is fixed with the releases is= sued today by using different salts for the signature for each plugin and f= eature. * A third, unrelated feature in the core system is used for admin u= sers to act on behalf of another user, mostly for debugging purposes. With = being able to insert arbitrary parameters into a session, an attacker can a= buse this feature to change their session from their actual user to any use=
r in the system by guessing a valid user ID. This is fixed with the release=
today by requiring unguessable information to be contained in the session =
of the user to switch to. 2026-07-01 not yet calculated CVE-2026-13602 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-13602 ] pretix--pretix-oppwa The = payment integration pretix-oppwa provides support for the payment providers=
VR Payment, Hobex, and potentially others based on Oppwa's technology. The=
integration of Oppwa, following their official documentation, includes a s= tep where the user is redirected from the payment provider back to our syst=
em with a query parameter like ?resourcePath=3D/v1/checkouts/{checkoutId}/p= ayment in the URL. Our system is then supposed to fetch the status of the t= ransaction from the URL given by baseUrl + resourcePath. Our plugin pretix-= oppwa did so insecurely by concatenating the parameter form the URL to the = base domain of the API without further validation and, critically, without =
a / at the end of the baseUrl. Therefore, an attacker could inject a resour= cePath argument in a way that causes pretix to call a different server inst= ead. Since the request includes the access token (API key) of the Oppwa acc= ount, this would leak the access token, giving access to data contained in = the payment provider's system. This is fixed with the release today by stri= ctly validating the given API URL. After installing the update, we recommen=
d asking your payment provider for a new access token and updating it in pr= etix. 2026-07-01 not yet calculated CVE-2026-13603 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-13603 ] Progress Software--Flowmon In Progress Flowmo=
n versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an a= uthenticated low-privileged user may craft a request during the PDF generat= ion process that results in operations being performed with the privileges =
of another user, potentially leading to unauthorized access to sensitive da=
ta and unintended modifications to system configuration. 2026-07-02 not yet=
calculated CVE-2026-8079 [ https://www.cve.org/CVERecord?id=3DCVE-2026-807=
9 ] Progress Software--Flowmon ADS In Progress Flowmon ADS versions prior t=
o 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is aut= henticated as a low-privileged user in the Anomaly Detection System (ADS) m=
ay send specially crafted requests that could result in unauthorized access=
to application data and its modification. 2026-07-02 not yet calculated CV= E-2026-9272 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9272 ] py-pdf--py= pdf pypdf is a free and open-source pure-python PDF library. Prior to 6.13.=
3, a maliciously crafted PDF can cause DoS. An attacker who uses this vulne= rability can craft a PDF which leads to large memory usage, as MAX_DECLARED= _STREAM_LENGTH is sometimes ignored. This requires parsing a content stream=
without a /Length value. This issue has been fixed in version 6.13.3. 2026= -06-30 not yet calculated CVE-2026-57204 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-57204 ] Python Software Foundation--CPython In the Tarfile.extr= act() function, the filter parameter is not passed properly when extracting=
hardlinks. An affected system that extracts content from untrusted tar fil=
es could end up writing files with an unexpected uid/gid despite the user p= assing filter=3D'data' to the extract() function. 2026-06-30 not yet calcul= ated CVE-2026-4360 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4360 ] Ray= tha--Raytha Raytha CMS is vulnerable to SQL Injection within the OData filt=
er parsing pipeline.=C2=A0 The vulnerability allows a remote, unauthenticat=
ed attacker to execute arbitrary SQL statements against the underlying Post= greSQL database, leading to full database compromise, including credential = extraction. Because vendor contact attempts were unsuccessful, the vulnerab= ility has only been confirmed in version=C2=A01.5.2 but may also affect oth=
er versions. 2026-06-30 not yet calculated CVE-2026-12076 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-12076 ] Redeight--Redeight CMS An SQL Injectio=
n vulnerability exists in Redeight CMS version 1.0 via the "userEmail" para= meter in the POST "/admin/index.php" login endpoint. The application fails =
to sanitize user input and directly interpolates it into SQL queries withou=
t using prepared statements, which allows unauthenticated remote attackers =
to execute arbitrary SQL commands and extract sensitive database informatio=
n. 2026-06-30 not yet calculated CVE-2026-53690 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-53690 ] Redeight--Redeight CMS An Unrestricted File Uplo=
ad vulnerability in Redeight CMS version 1.0 allows authenticated attackers=
to achieve Remote Code Execution via the POST "/admin/index.php?module=3Dp= ages&mode=3DFileAdd" endpoint. The application fails to validate file exten= sions and MIME types, permitting the upload of arbitrary PHP scripts to the=
publicly accessible "/uploads/files/" directory where they can be executed=
directly by the web server. 2026-06-30 not yet calculated CVE-2026-53691 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-53691 ] Redeight--Redeight CMS=
Redeight CMS version 1.0 uses the MD5 algorithm without a salt to store us=
er passwords. Because MD5 is a cryptographically broken algorithm and lacks=
salting, attackers who obtain the password hashes can trivially reverse th=
em using rainbow tables, leading to the exposure of plaintext credentials. = 2026-06-30 not yet calculated CVE-2026-53692 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-53692 ] Ricoh Company, Ltd.--Multiple laser printers and MF=
Ps which implement Ricoh Web Image Monitor Multiple laser printers and MFPs=
(multifunction printers) which implement Ricoh Web Image Monitor contain a=
reflected cross-site scripting vulnerability. An arbitrary script may be e= xecuted on the web browser of the user who accesses Web Image Monitor. 2026= -06-30 not yet calculated CVE-2026-56809 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-56809 ] Roskus--Prospero Flow CRM Authorization Bypass Through = User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Co= ntrollers/Calendar/CalendarDeleteEventController.php), exposed at GET /cale= ndar/event/delete/{id}, in Prospero Flow CRM before 5.5.3 allows a remote, = authenticated attacker to delete arbitrary calendar events belonging to oth=
er users by manipulating the {id} path parameter, because the delete handle=
r resolves the record with Calendar::find($id)->delete() and performs no ow= nership check (no user_id/company_id scoping) before deletion. This results=
in unauthorized destruction of other users' calendar events across the pla= tform. 2026-07-03 not yet calculated CVE-2026-59234 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-59234 ] ruby--webrick ruby webrick through v1.9.2 WE= Brick reparses trailer Content-Length into canonical request state, enablin=
g request smuggling. 2026-07-02 not yet calculated CVE-2026-38969 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-38969 ] SamVerschueren--decode-uri-com= ponent decode-uri-component through 0.4.1 is vulnerable to denial of servic=
e. The decode() function splits input on '%' producing N tokens and calls d= ecodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens t= akes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens appro= ximately 33s. An attacker can cause significant CPU consumption and event-l= oop blocking via crafted input. 2026-06-30 not yet calculated CVE-2026-4582=
2 [ https://www.cve.org/CVERecord?id=3DCVE-2026-45822 ] SANKO--Net::BitTorr= ent Net::BitTorrent versions through 2.0.1 for Perl write files outside the=
download directory via path traversal in peer-supplied metadata. Net::BitT= orrent validates file path components only on the .torrent-file ingest path=
. The peer and magnet metadata path (_on_metadata_received, reached from th=
e BEP09 ut_metadata extension) passes attacker-supplied file names straight=
to Storage::add_file and Storage::_parse_file_tree, where Path::Tiny's chi= ld() does not collapse "..". A v2 file tree key, a v1 files[].path element,=
or a single-file name containing ".." segments therefore resolves outside = the download directory. Because the peer also controls the piece hashes and=
the served bytes, content verification passes, so a malicious magnet or pe=
er writes attacker-chosen content to an attacker-chosen path on the downloa= ding host. 2026-06-30 not yet calculated CVE-2026-57079 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-57079 ] SANKO--Net::BitTorrent Net::BitTorrent v= ersions through 2.0.1 for Perl allow remote memory exhaustion via an uncapp=
ed peer-wire message-length prefix. The peer-wire framing in _process_messa= ges trusts the 4-byte length prefix sent by a connected peer with no upper = bound, while receive_data appends every inbound byte to the input buffer. A=
peer announces a length prefix of up to about 4 GiB and then streams bytes=
; the decoder waits until the buffer holds the full message before processi=
ng it, so the buffer grows without limit. Peer connections are unauthentica= ted, so any peer in the swarm exhausts the downloading process's memory. Th=
e largest legitimate message is a 16 KiB piece block, so any announced leng=
th far above that is anomalous. 2026-06-30 not yet calculated CVE-2026-5708=
0 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57080 ] SANKO--Net::BitTorr= ent Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exh= austion via deeply nested bencoded input. bdecode recurses once per nested = list or dictionary level with no depth cap, and each recursive call receive=
s the remaining buffer by value while the list and dictionary branches capt= ure the whole remainder, so every live recursion frame keeps its own copy o=
f the shrinking buffer (O(N^2) bytes for an N-deep input). The decoder runs=
on every untrusted bencode source: .torrent files, BEP09 metadata fetched = from peers, DHT messages, and tracker responses. A bencoded input of roughl=
y 150,000 nested lists (about 150 KB on the wire) drives multi-gigabyte pea=
k memory, so one short message from any peer, or one crafted .torrent file =
or magnet link, terminates the client. 2026-06-30 not yet calculated CVE-20= 26-57081 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57081 ] SANKO--Net::= BitTorrent Net::BitTorrent versions through 2.0.1 for Perl generate the MSE=
Diffie-Hellman private key with a non-cryptographic PRNG. The MSE (Message=
Stream Encryption) handshake derives its 160-bit Diffie-Hellman private ke=
y from Perl's rand(), a non-cryptographic drand48-class generator seeded on=
ce per process, in KeyExchange.pm. The shared secret and the RC4 keys deriv=
ed from it (the SHA-1 of "keyA" or "keyB", the shared secret, and the infoh= ash) therefore depend entirely on a predictable PRNG. The same handshake se= nds, in cleartext, random padding drawn from the same rand() sequence in _r= andom_pad, immediately after the public key and the private-key draw. A pas= sive observer of the handshake recovers the PRNG state from the cleartext p= adding, reconstructs the private key, computes the shared secret from the p= eer's public key on the wire, derives the RC4 keys, and decrypts the connec= tion, defeating the passive-observation obfuscation MSE provides. 2026-06-3=
0 not yet calculated CVE-2026-57082 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-57082 ] Seiko Solutions Inc.--SkyBridge MB-A100/MB-A110 Improper neu= tralization of special elements used in an OS command ('OS Command Injectio= n') issue exists in SkyBridge MB-A100/MB-A110. If this vulnerability is exp= loited, an arbitrary OS command may be executed by an attacker who can log =
in to the product with an administrative privilege. 2026-07-01 not yet calc= ulated CVE-2026-50043 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50043 ]=
Squidex--CMS v.7.21.0 Cross Site Request Forgery vulnerability in Squidex.=
io Squidex CMS v.7.21.0 and before allows a remote attacker to escalate pri= vileges via the IdentityServer account profile endpoint 2026-06-29 not yet = calculated CVE-2026-31016 [ https://www.cve.org/CVERecord?id=3DCVE-2026-310=
16 ] SUSE--Rancher Improper privilege handling could be used by users with= =C2=A0Project Owner role to escalate privileges, in Rancher versions=C2=A02= .14 before 2.14.2,=C2=A02.13 before 2.13.6, and=C2=A02.12 before 2.12.10. 2= 026-06-29 not yet calculated CVE-2026-41052 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-41052 ] SUSE--Rancher A SAML authentication replay vulnerabi= lity in Rancher's Assertion Consumer Service (ACS) handler did not enforce = one-time use of SAML assertion, potentially allowing person in the middle a= ttacks against Rancher, affecting Rancher 2.14.0 before 2.14.3, 2026-06-30 = not yet calculated CVE-2026-44946 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-44946 ] SUSE--Rancher A missing clean-up in the legacy Project Role Te= mplate Binding (PRTB) reconciler in Rancher versions 2.13.0 up to 2.13.7 an=
d 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security Adm= ission (PSA) permissions after an administrator removes those permissions f= rom a RoleTemplate. 2026-06-30 not yet calculated CVE-2026-44947 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-44947 ] SUSE--Rancher A path traversal = vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.1= 2.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up =
to 0.15.3 could be used to traverse outside of the intended directory, caus= ing a denial of service. 2026-06-30 not yet calculated CVE-2026-44948 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-44948 ] SUSE--Rancher A Rancher Fl= eetWorkspace admission path allowed side effects to occur in the Rancher we= bhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0 up =
to 0.9.6 and 0.10.0 up to 0.10.7. An unauthenticated attacker with network = access to the in-cluster rancher-webhook service could submit a crafted adm= ission payload and cause workspace-related Kubernetes objects to be created=
with attacker-chosen identity data. 2026-06-30 not yet calculated CVE-2026= -44949 [ https://www.cve.org/CVERecord?id=3DCVE-2026-44949 ] swaldman--c3p0=
c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3=
p0 in combination with other libraries, can compose to a "sink" for deseria= lization gadgets. The JDBC spec's DataSource.getConnection() and Connection= PoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean l= ibraries treat them as "properties" assumed safe while they actually call i= nto JDBC drivers. Attackers can thus craft malicious DataSource objects who=
se property lookups invoke vulnerable drivers, then smuggle them in seriali= zed form to where an application deserializes and auto-resolves bean proper= ties - triggering the attack. This requires a susceptible DataSource/Connec= tionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that au= to-looks-up JavaBean properties on =3D deserialization, most commonly a col= lection paired with an Apache commons-beanutils Comparator that sorts by be=
an properties. c3p0 supplied that susceptible DataSource/ConnectionPoolData= Source, which was an essential component of the trigger. This issue has bee=
n fixed in version 0.14.0. 2026-06-30 not yet calculated CVE-2026-55223 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-55223 ] Tenda--AC18 v15.03.05.05=
An unauthenticated command injection vulnerability in the /goform/fast_set= ting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attackers to e= xecute arbitrary commands via a crafted payload injected into the mac param= eter. 2026-07-01 not yet calculated CVE-2026-38142 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-38142 ] The Wikimedia Foundation--Mediawiki - Cargo E= xtension Improper neutralization of special elements used in an SQL command=
('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Ca= rgo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Ex= tension: from * before 1.43.9,1.44.6,1.45.4. 2026-07-01 not yet calculated = CVE-2026-14363 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14363 ] The Wi= kimedia Foundation--Mediawiki - Cargo Extension Improper neutralization of = input during web page generation ('cross-site scripting') vulnerability in = The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. Thi=
s issue affects Mediawiki - Cargo Extension: from * before 3.9.1. 2026-07-0=
1 not yet calculated CVE-2026-58519 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-58519 ] The Wikimedia Foundation--Mediawiki - Cargo Extension Improp=
er neutralization of special elements used in an SQL command ('SQL injectio= n') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension a= llows SQL Injection. This issue affects Mediawiki - Cargo Extension: from *=
before 1.43.9,1.44.6,1.45.4. 2026-07-01 not yet calculated CVE-2026-58521 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-58521 ] The Wikimedia Foundat= ion--Mediawiki - Charts Extension Improper neutralization of input during w=
eb page generation ('cross-site scripting') vulnerability in The Wikimedia = Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). = This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.= 6,1.45.4. 2026-07-01 not yet calculated CVE-2026-14358 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-14358 ] The Wikimedia Foundation--Mediawiki - Red= irectManager Extension Cross-Site request forgery (CSRF) vulnerability in T=
he Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross = Site Request Forgery. This issue affects Mediawiki - RedirectManager Extens= ion: from * before 1.3.3. 2026-07-01 not yet calculated CVE-2026-58518 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-58518 ] The Wikimedia Foundation-= -Mediawiki - UrlShortener Extension URL redirection to untrusted site ('ope=
n redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShort= ener Extension allows Cross-Site Flashing. This issue affects Mediawiki - U= rlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4. 2026-07-01 not=
yet calculated CVE-2026-58520 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-58520 ] The Wikimedia Foundation--Mediawiki - WikiLambda Extension Improp=
er neutralization of input terminators vulnerability in The Wikimedia Found= ation Mediawiki - WikiLambda Extension allows Authentication Bypass. This i= ssue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,= 1.45.4. 2026-07-01 not yet calculated CVE-2026-58517 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-58517 ] TIMLEGGE--Crypt::DSA Crypt::DSA versions be= fore 1.22 for Perl draw the DSA signing nonce and private key from a biased=
random generator, leading to private-key recovery. "Crypt::DSA::Util::make= random forces the high bit of every value it returns to obtain an exactly N= -bit integer for prime search. The signing nonce and the private key are dr= awn from makerandom. Because the high bit is always set, the result is not = uniform: its top bit is fixed, producing insecure values." An attacker who = collects a modest number of signatures under an affected key, together with=
the public key, can recover the private key with a lattice attack. Keys us=
ed to sign with an affected version should be considered compromised and ne=
w keys should be generated. 2026-07-05 not yet calculated CVE-2026-14570 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-14570 ] tinacms--tinacms Tina i=
s a headless content management system. In versions prior to @tinacms/app 2= .5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text U= RL-sanitization bypass enable stored XSS and session takeover. The library = registers window message listeners - the useTina overlay handler, the OAuth=
authentication popup handler, and the admin=C3=A2=E2=80=A0=E2=80=9Dpreview=
iframe GraphQL reducer - that act on event.data without verifying event.or= igin or event.source and post messages using non-specific target origins, w= hile insufficient URL sanitization in rich-text content allows malicious UR=
Ls to persist and execute. A page the victim visits (or a window in an open= er/iframe relationship with a Tina admin) can forge messages to drive the e= ditor, inject preview content, or observe/forge the OAuth popup channel to = take over an authenticated editing session. This issue has been fixed in ve= rsions @tinacms/app 2.5.6 and tinacms 3.9.3. 2026-07-01 not yet calculated = CVE-2026-55660 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55660 ] tinacm= s--tinacms Tina is a headless content management system. In versions prior =
to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default = link/image renderers did not sanitize the url field on Slate link/image nod= es. Content containing javascript: or data:text/html URLs - including case-= variant, whitespace-padded, and control-character-obfuscated forms - is ren= dered into href/src and executes when the content is viewed. Any actor able=
to author rich-text content (for example a lower-privileged editor, or imp= orted/external content) can achieve stored XSS against editors and site vie= wers. This issue is fixed in versions @tinacms/mdx 2.1.7 and tinacms 3.9.3.=
2026-07-01 not yet calculated CVE-2026-55661 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-55661 ] TP-Link Systems Inc.--Archer AX20 V2.0 An unauthen= ticated URL redirection vulnerability has been identified in Archer AX20 V2=
due to improper validation of user-supplied URL input within the web inter= face.=C2=A0 An unauthenticated attacker can craft URLs containing URL-encod=
ed path traversal sequences. When processed by the embedded web server, the=
se inputs may cause the device to respond with HTTP 3xx redirects to attack= er-controlled external domains. This issue affects Archer AX20 V2.0: throug=
h 2.1.9 Build 20230829. 2026-06-30 not yet calculated CVE-2026-10562 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-10562 ] TP-Link Systems Inc.--Arche=
r C5 v6.8 A stored Cross-Site Scripting (XSS) vulnerability has been identi= fied in the web-based management interface of Archer C5 v6.8 routers, due t=
o insufficient server-side validation and lack of proper output encoding of=
user-controlled input in a certain field.=C2=A0 An attacker with administr= ative privileges can inject crafted HTML or JS payloads into the affected f= ield. The payload is stored and later executed when the affected page is re= ndered in an administrator's browser.Successful exploitation allows executi=
on of arbitrary JavaScript in an admin's browser, potentially leading to se= ssion hijacking and unauthorized access to router configuration, possibly r= esulting in exposure of sensitive data and modification of device settings.=
The vulnerability affects ISP-managed firmware variants of the product. Re= mediation is coordinated through service providers. 2026-07-02 not yet calc= ulated CVE-2026-8699 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8699 ] T= P-Link Systems Inc.--TL-WR841N v14 An authenticated stack-based buffer over= flow vulnerability exists in the web management interface of TP-Link TL-WR8= 41N v14. A remote authenticated attacker can send crafted HTTP requests to = cause the embedded web server to overflow a stack buffer, resulting in a cr= ash of the affected process. Successful exploitation results in a denial-of= -service condition, causing the device to crash and automatically reboot. 2= 026-06-29 not yet calculated CVE-2026-9105 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-9105 ] TPODER--Net::IP::LPM Net::IP::LPM versions through 1.1=
0 for Perl allow a heap out-of-bounds read via an unbounded prefix length. = add() passes the prefix string to the trie builder addPrefixToTrie() withou=
t checking it against the address width. addPrefixToTrie() then walks the p= refix buffer by prefix_length bits, reading prefix[byte] for byte up to pre= fix_len/8, where prefix is the 4-byte (IPv4) or 16-byte (IPv6) packed addre= ss. A prefix length greater than 32 for IPv4 or 128 for IPv6, for example a= dd("1.2.3.4/255", $v) or add("2001:db8::/255", $v), reads past the end of t=
he packed address. The out-of-bounds read happens during trie construction = and is bounded: the prefix length is stored as an unsigned char, so the bit=
walk reads at most 32 bytes from the start of the packed address, a short = distance past the end of the 4-byte or 16-byte buffer. It is detectable und=
er AddressSanitizer, valgrind, or a hardened allocator, where it can abort = the process. Lookups and dump() format only the valid address width, so the=
out-of-bounds bytes are not exposed through the module's API. 2026-07-03 n=
ot yet calculated CVE-2026-56015 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-56015 ] TS7Worker--TS7Worker A heap buffer overflow in the TS7Worker::P= erformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 allows=
attackers to cause a Denial of Service (DoS) via a crafted packet. 2026-06= -29 not yet calculated CVE-2026-51218 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-51218 ] u5CMS--u5CMS u5CMS=C2=A0through=C2=A0v12.8.8 is vulnerable=
to reflected XSS via the 'thanks' parameter in multiple form components 20= 26-07-02 not yet calculated CVE-2026-14449 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-14449 ] Unknown--Adminify The Adminify WordPress plugin befor=
e 4.2.10 does not perform per-user read-capability checks on the results re= turned by one of its administration search features, allowing users with a = low-privilege role (Contributor) to disclose non-public content that WordPr= ess would not otherwise expose to them, such as other authors' unpublished = post titles, pending comment content, the site's Adminify WordPress plugin = before 4.2.10 inventory, and user account names. 2026-07-02 not yet calcula= ted CVE-2026-11781 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11781 ] Un= known--Advanced Form Integration Connect Forms to 200+ Apps The Advanced Fo=
rm Integration - Connect Forms to 200+ Apps WordPress plugin before 2.1.1 d= oes not restrict the WordPress role assigned when it creates a user from a = public form submission, allowing unauthenticated visitors to create an admi= nistrator account when an active integration maps the user role to a public=
form field. This requires a specific, non-default multi-Advanced Form Inte= gration - Connect Forms to 200+ Apps WordPress plugin before 2.1.1 configur= ation. 2026-07-01 not yet calculated CVE-2026-11794 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-11794 ] Unknown--APCu Manager The APCu Manager WordP= ress plugin before 4.5.0 does not escape APCu object-cache keys before rend= ering them in an admin-area page, leading to a Stored Cross-Site Scripting = vulnerability. When a persistent object cache is enabled, cache keys derive=
d from unsanitised user input (e.g. a transient name created by another APC=
u Manager WordPress plugin before 4.5.0 from an unauthenticated request) ar=
e output without escaping and execute arbitrary JavaScript in the session o=
f an administrator viewing the page. 2026-06-29 not yet calculated CVE-2026= -10083 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10083 ] Unknown--F4 Po=
st Tree The F4 Post Tree WordPress plugin before 2.0.5 does not perform cap= ability checks or CSRF/nonce verification on one of its AJAX actions, allow= ing authenticated users with Subscriber-level access and above to modify th=
e parent and menu order of arbitrary posts. 2026-06-29 not yet calculated C= VE-2026-9676 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9676 ] Unknown--= Fluent Booking The Fluent Booking WordPress plugin before 2.1.2 does not ve= rify ownership of the requested group_id before exporting attendee data via=
the export endpoint, allowing users with at least the Calendar Manager rol=
e to retrieve attendees' PII (name, email, phone, address, payment informat= ion) from calendar groups they do not own. 2026-06-30 not yet calculated CV= E-2026-9576 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9576 ] Unknown--F= luent Forms The Fluent Forms WordPress plugin before 6.2.5 does not properl=
y restrict the deletion of form submission entries to the forms a restricte=
d Manager is authorized to manage, allowing a Manager limited to specific f= orms to permanently delete submission entries belonging to other forms. Thi=
s requires a non-default configuration in which an administrator has create=
d at least one Manager restricted to specific forms. 2026-07-02 not yet cal= culated CVE-2026-11578 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11578 =
] Unknown--Fluent Forms The Fluent Forms WordPress plugin before 6.2.1 does=
not properly verify ownership before processing a subscription cancellatio=
n request, allowing authenticated users with a low-privilege account to can= cel subscriptions belonging to other users. 2026-07-01 not yet calculated C= VE-2026-11880 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11880 ] Unknown= --Kali Forms Contact Form & Drag-and-Drop Builder The Kali Forms - Contact = Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not saniti=
se a form field's caption before outputting it as a column header on the ad= ministrator form-entries screen, allowing users with Contributor-level acce=
ss or above to store JavaScript that executes in an administrator's session=
. A missing capability check in the Kali Forms - Contact Form & Drag-and-Dr=
op Builder WordPress plugin before 2.4.13's post-duplication action additio= nally lets the Contributor publish the malicious form so an administrator r= enders it. 2026-06-30 not yet calculated CVE-2026-11581 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-11581 ] Unknown--Product Configurator for WooCom= merce The Product Configurator for WooCommerce WordPress plugin before 1.7.=
3 does not perform any authorisation or post-status check before returning = WooCommerce product data through a public AJAX action, allowing unauthentic= ated users to retrieve the data (title, price, weight, stock status, and co= nfigurator option pricing/SKUs) of private and draft, non-public products b=
y supplying the product ID. WordPress post-visibility controls are bypassed=
. 2026-07-01 not yet calculated CVE-2026-11568 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-11568 ] Unknown--Royal MCP The Royal MCP WordPress plugin=
before 1.4.26 does not perform capability checks on the majority of its MC=
P tools after token authentication, allowing authenticated users with a low= -privileged role such as Subscriber to read private content, enumerate all = users and their roles, and create, modify, or delete content owned by other=
users. 2026-07-01 not yet calculated CVE-2026-10750 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-10750 ] Unknown--Salon Booking System The Salon Boo= king System WordPress plugin before 10.30.20 does not have proper authorisa= tion checks on one of its AJAX actions, allowing any authenticated user, su=
ch as a subscriber, to modify a Salon Booking System WordPress plugin befor=
e 10.30.20 setting and bypass the manual approval of new bookings. 2026-07-=
01 not yet calculated CVE-2026-11887 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-11887 ] Unknown--User Registration & Membership The User Registrati=
on & Membership WordPress plugin before 5.2.0 does not enforce payment comp= letion before activating a paid membership subscription, allowing unauthent= icated users (after self-registering an account through the open registrati=
on flow) to obtain an active subscription on any paid plan without paying a=
nd access the gated content. 2026-07-02 not yet calculated CVE-2026-11965 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-11965 ] Unknown--User Submitte=
d Posts The User Submitted Posts WordPress plugin before 20260608 does not = escape a submitted value before outputting it in an admin-configured displa=
y template, leading to a Stored Cross-Site Scripting that can be triggered =
by unauthenticated users when a non-default display option is enabled. 2026= -07-01 not yet calculated CVE-2026-11570 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-11570 ] Unknown--WebAuthn Provider for Two Factor The WebAuthn = Provider for Two Factor WordPress plugin before 2.5.6 does not correctly va= lidate the second-factor authentication response, allowing an attacker who = already knows a user's password to bypass the two-factor authentication req= uirement by submitting a malformed request. 2026-07-01 not yet calculated C= VE-2026-11883 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11883 ] Unknown= --WP Support Plus Responsive Ticket System The WP Support Plus Responsive T= icket System WordPress plugin through 9.1.2 does not properly validate uplo= aded files, allowing unauthenticated users to upload files containing malic= ious JavaScript (such as HTML or SVG) to a publicly accessible location, le= ading to Stored Cross-Site Scripting attacks against site users and adminis= trators. 2026-06-30 not yet calculated CVE-2026-11589 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-11589 ] Unknown--WP Support Plus Responsive Ticket=
System The WP Support Plus Responsive Ticket System WordPress plugin throu=
gh 9.1.2 does not sanitize user-supplied array keys before using them in a = SQL statement, allowing unauthenticated users to perform SQL injection atta= cks. 2026-06-30 not yet calculated CVE-2026-11590 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-11590 ] Unknown--WS Form LITE The WS Form LITE WordPre=
ss plugin before 1.11.8 does not have a capability check on one of its sett= ings-update actions, allowing authenticated users with subscriber-level acc= ess and above to modify the WS Form LITE WordPress plugin before 1.11.8's s= ettings. 2026-07-01 not yet calculated CVE-2026-11562 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-11562 ] Unknown--yootheme The yootheme WordPress t= heme before 5.0.35 does not prevent its bundled front-end framework from tr= eating certain HTML attributes, which are permitted by wp_kses_post(), as m= arkup, allowing users with the Author role to perform Stored Cross-Site Scr= ipting attacks that execute in the browser of any user who views the affect=
ed post. 2026-07-02 not yet calculated CVE-2026-10077 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-10077 ] UTT--nv518G SQL Injection vulnerability in=
UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execut=
e arbitrary code via the gohead/sub_463bbc component 2026-07-01 not yet cal= culated CVE-2026-52186 [ https://www.cve.org/CVERecord?id=3DCVE-2026-52186 =
] UTT--nv518G Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-21= 0919-161313 allows a remote attacker to cause a denial of service via the g= ohead/sub_483ba0 component 2026-07-02 not yet calculated CVE-2026-52187 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-52187 ] UTT--nv518G Buffer Overf= low vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remot=
e attacker to cause a denial of service via the gohead//sub_497498 componen=
t 2026-07-02 not yet calculated CVE-2026-52188 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-52188 ] UTT--nv518G Buffer Overflow vulnerability in UTT = nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a den= ial of service via the gohead/sub_487330 component 2026-07-02 not yet calcu= lated CVE-2026-52189 [ https://www.cve.org/CVERecord?id=3DCVE-2026-52189 ] = UTT--nv518G Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-2109= 19-161313 allows a remote attacker to cause a denial of service via the goh= ead/sub_448384 component 2026-07-01 not yet calculated CVE-2026-52190 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-52190 ] UTT--nv518G Buffer Overflo=
w vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote = attacker to cause a denial of service via the gohead/sub_444C8C component 2= 026-07-02 not yet calculated CVE-2026-52191 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-52191 ] UTT--nv518G An issue in UTT nv518G nv518GV3v3.2.7-21= 0919-161313 allows a remote attacker to cause a denial of service via the g= ohead/sub_445C5C component 2026-07-02 not yet calculated CVE-2026-52192 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-52192 ] UTT--nv518G Buffer Overf= low vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remot=
e attacker to cause a denial of service via the gohead/sub_447CAC component=
2026-06-30 not yet calculated CVE-2026-52193 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-52193 ] UTT--nv518G Buffer Overflow vulnerability in UTT n= v518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a deni=
al of service via the gohead/sub_472f08 component 2026-06-30 not yet calcul= ated CVE-2026-52195 [ https://www.cve.org/CVERecord?id=3DCVE-2026-52195 ] U= TT--nv518G Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-21091= 9-161313 allows a remote attacker to cause a denial of service via the gohe= ad/sub_416f28 component 2026-06-30 not yet calculated CVE-2026-52196 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-52196 ] UTT--nv518G An issue in UTT=
nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a de= nial of service via the gohead/sub_44af70 component 2026-06-30 not yet calc= ulated CVE-2026-52197 [ https://www.cve.org/CVERecord?id=3DCVE-2026-52197 ]=
UTT--nv518G Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210= 919-161313 allows a remote attacker to cause a denial of service via the go= head/sub_425994 component 2026-06-30 not yet calculated CVE-2026-52198 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-52198 ] WatchGuard--Fireware OS A=
n Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd proc= ess could allow an authenticated privileged user to execute arbitrary code = via a specially crafted requests to the Management Web UI.This vulnerabilit=
y affects Fireware OS 11.8 up to and including=C2=A011.12.4_Update1, 12.0 u=
p to and including 12.12 and 2025.1 up to and including 2026.2. 2026-07-02 = not yet calculated CVE-2026-13050 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-13050 ] WatchGuard--Fireware OS An Out-of-bounds Write vulnerability i=
n WatchGuard Fireware OS's CLI could allow an authenticated privileged user=
to execute arbitrary code via a specially crafted CLI command. This vulner= ability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 =
up to and including 12.12 and 2025.1 up to and including 2026.2. 2026-07-02=
not yet calculated CVE-2026-13053 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-13053 ] WatchGuard--Fireware OS A path traversal vulnerability in the=
WatchGuard Fireware OS Management Web UI allows a privileged authenticated=
attacker to write arbitrary files on the Firebox's filesystem. This vulner= ability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 =
up to and including 12.12 and 2025.1 up to and including 2026.2. 2026-07-02=
not yet calculated CVE-2026-13054 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-13054 ] WatchGuard--Fireware OS A local privilege escalation vulnerab= ility in the WatchGuard Mobile VPN with SSL client for Windows allows a loc=
al attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the mach= ine where the client is installed. This issue affects the Mobile VPN with S=
SL client for Windows up to and including 2026.2. 2026-07-02 not yet calcul= ated CVE-2026-13079 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13079 ] W= atchGuard--Fireware OS A null pointer dereference vulnerability in WatchGua=
rd Fireware OS may allow a remote unauthenticated attacker to create a deni= al-of-service (DoS) condition by sending specially crafted IKEv2 messages.= =C2=A0This vulnerability affects both the Mobile User VPN with IKEv2 and th=
e Branch Office VPN using IKEv2 when configured with a dynamic gateway peer=
. This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.= 4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 20= 26.2 2026-07-02 not yet calculated CVE-2026-13084 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-13084 ] WatchGuard--Fireware OS WatchGuard Fireware OS=
contains a race condition leading to a use-after-free vulnerability in LDA=
P authentication for the Mobile User VPN with IKEv2. A remote unauthenticat=
ed attacker could exploit this vulnerability to execute arbitrary code in t=
he context of the iked process on Fireboxes that have a Mobile VPN with IKE=
v2 configured to use an external LDAP authentication server. This vulnerabi= lity affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up =
to and including 12.12 and 2025.1 up to and including 2026.2. 2026-07-02 no=
t yet calculated CVE-2026-13368 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-13368 ] WatchGuard--Fireware OS An authenticated administrator can trigg=
er a denial-of-service condition in the Fireware Management Web UI by sendi=
ng malformed or crafted data to the put_data endpoint, which performs unsaf=
e deserialization of the attacker-supplied input. 2026-07-02 not yet calcul= ated CVE-2026-13371 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13371 ] W= atchGuard--Fireware OS Improper Neutralization of Input During Web Page Gen= eration (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Firewar=
e OS (Tigerpaw Technology Integration module) allows Stored XSS. This vulne= rability is an additional unmitigated attack path for CVE-2025-13936. This = issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up to and in= cluding 12.5.18, and 2025.1 up to and including 2026.2. 2026-07-02 not yet = calculated CVE-2026-13373 [ https://www.cve.org/CVERecord?id=3DCVE-2026-133=
73 ] WatchGuard--Fireware OS Improper Neutralization of Input During Web Pa=
ge Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard F= ireware OS (ConnectWise Technology Integration module) allows Stored XSS. T= his vulnerability is an additional unmitigated attack path for CVE-2025-139= 37. This issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up =
to and including 12.5.18, and 2025.1 up to and including 2026.2. 2026-07-02=
not yet calculated CVE-2026-13374 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-13374 ] WatchGuard--Fireware OS Improper Neutralization of Input Duri=
ng Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wat= chGuard Fireware OS (Autotask Technology Integration module) allows Stored = XSS. This vulnerability is an additional unmitigated attack path for CVE-20= 25-13938. This issue affects Fireware OS 12.4 up to and including 12.12, 12=
.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2. 2026= -07-02 not yet calculated CVE-2026-13375 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13375 ] WatchGuard--Fireware OS Improper Neutralization of Inpu=
t During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability =
in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulner= ability is an additional unmitigated attack path for CVE-2025-1071. This is= sue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and incl= uding 12.5.18, and 2025.1 up to and including 2026.2. 2026-07-02 not yet ca= lculated CVE-2026-13376 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13376=
] WatchGuard--Fireware OS Improper Neutralization of Input During Web Page=
Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fir= eware OS SIP Proxy module allows Stored XSS. This vulnerability is an addit= ional unmitigated attack path for CVE-2025-6947. This issue affects Firewar=
e OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and = 2025.1 up to and including 2026.2. 2026-07-02 not yet calculated CVE-2026-1= 3377 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13377 ] WatchGuard--Fire= ware OS An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikes= tubd process could allow an authenticated privileged user to execute arbitr= ary code via a specially crafted requests to the Management Web UI.This vul= nerability affects Fireware OS 12.1 up to and including 12.12 and 2025.1 up=
to and including 2026.2. 2026-07-02 not yet calculated CVE-2026-13383 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-13383 ] WatchGuard--Fireware OS A=
n Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent proce=
ss could allow an authenticated privileged user to execute arbitrary code v=
ia a specially crafted requests to the Management Web UI.This vulnerability=
affects Fireware OS 12.1 up to and including 12.12 and 2025.1 up to and in= cluding 2026.2. 2026-07-02 not yet calculated CVE-2026-13384 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-13384 ] WatchGuard--Fireware OS WatchGuard = Fireware OS contains a firmware validation bypass when processing a backup = image via the backup/restore feature. An authenticated administrator can ex= ploit this vulnerability to install a tampered firmware image.This vulnerab= ility affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up=
to and including 12.12 and 2025.1 up to and including 2025.6.2. 2026-07-02=
not yet calculated CVE-2026-13722 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-13722 ] WatchGuard--Fireware OS In exception circumstances, WatchGuar=
d Fireware OS on a FireCluster may use a hard-coded encryption key to encry=
pt saved credentials for Access Portal resources. This vulnerability affect=
s Fireware OS 12.1 up to and including 12.12 and 2025.1 up to and including=
2026.2. This vulnerability does not affect devices that do not support the=
Access Portal feature or standalone Fireboxes not deployed in a FireCluste=
r. 2026-07-02 not yet calculated CVE-2026-13728 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-13728 ] WatchGuard--Fireware OS An Out-of-bounds Write v= ulnerability in WatchGuard Fireware OS may allow an unauthenticated attacke=
r on the same local network segment to execute arbitrary code. This vulnera= bility affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 u=
p to and including 12.12 and 2025.1 up to and including 2026.2. 2026-07-02 = not yet calculated CVE-2026-8247 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-8247 ] Wikimedia Foundation--AbuseFilter Exposure of Sensitive Informat= ion to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFil= ter. This vulnerability is associated with program files includes/Api/Query= AbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.4= 5.4, 1.44.6, 1.43.9. 2026-07-01 not yet calculated CVE-2026-58027 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-58027 ] Wikimedia Foundation--CheckUse=
r Improper Neutralization of Input During Web Page Generation (XSS or 'Cros= s-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vu= lnerability is associated with program files modules/ext.CheckUser.TempAcco= unts/components/blockConnectedTempAccountsField.Vue. This issue affects Che= ckUser: from 1.46.0-rc.0 before 1.46.0. 2026-07-01 not yet calculated CVE-2= 026-58034 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58034 ] Wikimedia F= oundation--MediaWiki Exposure of Sensitive Information to an Unauthorized A= ctor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is=
associated with program files includes/Api/ApiUserrights.Php. This issue a= ffects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. 2026-07-01 = not yet calculated CVE-2026-58024 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-58024 ] Wikimedia Foundation--MediaWiki Deserialization of untrusted d= ata vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is = associated with program files includes/Import/WikiImporter.Php, includes/Im= port/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affect=
s MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. 2026-07-01 not y=
et calculated CVE-2026-58025 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 58025 ] Wikimedia Foundation--MediaWiki Exposure of Sensitive Information t=
o an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. Th=
is vulnerability is associated with program files includes/Parser/Parser.Ph=
p. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43= .9. 2026-07-01 not yet calculated CVE-2026-58026 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-58026 ] Wikimedia Foundation--MediaWiki Improper Neutra= lization of Input During Web Page Generation (XSS or 'Cross-site Scripting'=
) vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cen= tralAuth. This vulnerability is associated with program files includes/Api/= ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module= .Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogForma= tter/PermissionChangeLogFormatter.Php. This issue affects MediaWiki: from *=
before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, = 1.45.4, 1.44.6, 1.43.9. 2026-07-01 not yet calculated CVE-2026-58028 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-58028 ] Wikimedia Foundation--Media= Wiki Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is=
associated with program files includes/Api/ApiChangeAuthenticationData.Php=
, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData= .Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialU= nlinkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45= .4, 1.44.6, 1.43.9. 2026-07-01 not yet calculated CVE-2026-58029 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-58029 ] Wikimedia Foundation--MediaWiki=
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross= -site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vul= nerability is associated with program files resources/src/mediawiki.Special= .Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46.0-= rc.0 before 1.46.0. 2026-07-01 not yet calculated CVE-2026-58031 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-58031 ] Wikimedia Foundation--MediaWiki=
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross= -site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vul= nerability is associated with program files resources/src/mediawiki.Api/ind= ex.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, = 1.43.9. 2026-07-01 not yet calculated CVE-2026-58032 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-58032 ] Wikimedia Foundation--MediaWiki Exposure of=
Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia = Foundation MediaWiki. This vulnerability is associated with program files i= ncludes/Actions/InfoAction.Php. This issue affects MediaWiki: from * before=
1.46.0, 1.45.4, 1.44.6, 1.43.9. 2026-07-01 not yet calculated CVE-2026-580=
33 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58033 ] Wikimedia Foundati= on--MediaWiki Improper Neutralization of Input During Web Page Generation (= XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaW= iki. This vulnerability is associated with program files resources/src/medi= awiki.Special.Block/SpecialBlock.Vue. 2026-07-01 not yet calculated CVE-202= 6-58035 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58035 ] Wikimedia Fou= ndation--MediaWiki Exposure of Sensitive Information to an Unauthorized Act=
or vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is a= ssociated with program files includes/Api/ApiQueryAllUsers.Php, includes/Ap= i/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/U= ser/UserGroupManager.Php. 2026-07-01 not yet calculated CVE-2026-58036 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-58036 ] Wikimedia Foundation--Med= iaWiki Improper Neutralization of Input During Web Page Generation (XSS or = 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. Th=
is vulnerability is associated with program files includes/Language/Languag= e.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatte= r.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/Renameuser= LogFormatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/S= pecialVersion.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45= .4, 1.44.6, 1.43.9. 2026-07-01 not yet calculated CVE-2026-58037 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-58037 ] Wikimedia Foundation--OAuth Ses= sion fixation vulnerability in Wikimedia Foundation OAuth. This vulnerabili=
ty is associated with program files src/Backend/MWOAuthServer.Php. This iss=
ue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9. 2026-07-01=
not yet calculated CVE-2026-13707 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-13707 ] Wikimedia Foundation--SyntaxHighlight_GeSHi Improper Neutrali= zation of Input During Web Page Generation (XSS or 'Cross-site Scripting') = vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This vulnerabi= lity is associated with program files includes/SyntaxHighlight.Php. This is= sue affects SyntaxHighlight_GeSHi: from * before 1.46.0, 1.45.4, 1.44.6, 1.= 43.9. 2026-07-01 not yet calculated CVE-2026-58030 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-58030 ] Wikimedia Foundation--timeline Improper Neutr= alization of Input During Web Page Generation (XSS or 'Cross-site Scripting=
') vulnerability in Wikimedia Foundation timeline. This vulnerability is as= sociated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl.=
This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.=
2026-07-01 not yet calculated CVE-2026-58038 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-58038 ] Wikimedia Foundation--timeline A vulnerability in = Wikimedia Foundation timeline. This vulnerability is associated with progra=
m files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects = timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. 2026-07-01 not yet = calculated CVE-2026-8857 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8857=
] Wikimedia Foundation--UrlShortener Improper input validation vulnerabili=
ty in Wikimedia Foundation UrlShortener. This vulnerability is associated w= ith program files includes/UrlShortenerUtils.Php. 2026-07-01 not yet calcul= ated CVE-2026-13706 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13706 ] x= dan--jodit Jodit Editor is a WYSIWYG editor with written in pure TypeScript=
file and image editing capabilities. In versions prior to 4.12.18, Jodit.c= onfigure(options) - and the internal ConfigMerge / ConfigProto helpers - me= rged user-supplied options into the editor configuration without filtering = prototype-mutating keys, potentially causing a Prototype Pollution vulnerab= ility. A payload nested under an existing plain-object option such as contr= ols could reach and mutate Object.prototype. Applications that pass user-co= ntrolled or partially user-controlled configuration into Jodit.configure() = may be vulnerable. This issue was fixed in version 4.12.18. 2026-07-01 not = yet calculated CVE-2026-54756 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -54756 ] xdan--jodit Jodit Editor is a WYSIWYG editor with written in pure = TypeScript file and image editing capabilities. Versions prior to 4.12.26 a=
re vulnerable to Prototype Pollution through Jodit.modules.Helpers.set(chai=
n, value, obj), which walks the dot-separated chain, creating and following=
each path segment without filtering prototype-mutating keys. A chain that = begins with (or contains) __proto__, constructor, or prototype lets the fin=
al assignment reach and mutate Object.prototype. Applications that pass a u= ser-controlled or partially user-controlled key path into Jodit.modules.Hel= pers.set() could be vulnerable, causing unexpected property injection, logi=
c bypass, denial of service, or secondary security issues. This issue has b= een fixed in version 4.12.26. 2026-07-01 not yet calculated CVE-2026-55886 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-55886 ] xmlsoft--libxml2 libx= ml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalo=
g utility when running in --shell mode. The usershell() function processes = user input using fixed-size stack buffers without proper bounds checking. B=
y supplying an overly long input line, an attacker can overflow internal bu= ffers (command, arg, and argv) during input parsing. This results in memory=
corruption within the stack frame. Successful exploitation may cause a cra=
sh or potentially allow arbitrary code execution in the context of the xmlc= atalog process. This issue has been fixed in the commit c2e233fc. NOTE: The=
maintainers of this project did not agree that this issue is a vulnerabili=
ty and considered it a bug. 2026-06-29 not yet calculated CVE-2026-11979 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-11979 ]=20

Back to top [ #top ]

body { font-size: 1em; font-family: Arial, Verdana, sans-serif; font-weight=
: normal; font-style: normal; color: #333333; }=20

Having trouble viewing this message?=C2=A0View it as a webpage [ https://co= ntent.govdelivery.com/accounts/USDHSCISA/bulletins/41f3c56 ].=C2=A0 [ https= ://content.govdelivery.com/accounts/USDHS/bulletins/292141e ]

You are subscribed to updates from the Cybersecurity and Infrastructure Sec= urity Agency [ https://www.cisa.gov ] (CISA)
Manage Subscriptions [ https://public.govdelivery.com/accounts/USDHSCISA/su= bscriber/edit?preferences=3Dtrue#tab1 ]=C2=A0=C2=A0|=C2=A0=C2=A0Privacy Pol= icy [ https://www.cisa.gov/privacy-policy ]=C2=A0=C2=A0|=C2=A0 Help [ https= ://subscriberhelp.granicus.com/s/article/Subscriber-Help-Center ] [ https:/= /insights.govdelivery.com/Communications/Subscriber_Help_Center ]

Connect with CISA:=20
Facebook [ https://www.facebook.com/CISA ]=C2=A0 |=C2=A0 Twitter [ https://= twitter.com/CISAgov ]=C2=A0 |=C2=A0 Instagram [ https://Instagram.com/cisag=
ov ]=C2=A0 |=C2=A0 LinkedIn [ https://www.linkedin.com/company/cybersecurit= y-and-infrastructure-security-agency ]=C2=A0 |=C2=A0=C2=A0 YouTube [ https:= //www.youtube.com/channel/UCxyq9roe-npgzrVwbpoAy0A ]

________________________________________________________________________

This email was sent to cisa@toolazy.synchro.net using Granicus Communicatio=
ns Cloud, on behalf of: Cybersecurity and Infrastructure Security Agency = =C2=B7 707 17th St, Suite 4000 =C2=B7 Denver, CO 80202 GovDelivery logo [ h= ttps://subscriberhelp.granicus.com/ ]=20
body .abe-column-block { min-height: 5px; } table.gd_combo_table img {margi= n-left:10px; margin-right:10px;} table.gd_combo_table div.govd_image_displa=
y img, table.gd_combo_table td.gd_combo_image_cell img {margin-left:0px; ma= rgin-right:0px;}

--===============7983194463610718321==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns=3D"http://www.w3.org/1999/xhtml" xml:lang=3D"en" lang=3D"en"> <head>
<title> Vulnerability Summary for the Week of June 29, 2026
</title>


</head>
<body style=3D"">

<table width=3D"700" border=3D"0" cellspacing=3D"0" cellpadding=3D"0"=
align=3D"center">
<tr>
<td>

<!--[if (gte mso 9)|(IE)]>
<table style=3D"display:none"><tr><td><a name=3D"gd_top" id=3D"gd_top"></= a></td></tr></table>
<![endif]-->
<a name=3D"gd_top" id=3D"gd_top"></a>

=20



<p><img src=3D"https://content.govdelivery.com/attachments/fancy_images/U= SDHSCISA/2020/06/3486054/05152023-gov-delivery-banner-copy_original.png" al= t=3D"Cybersecurity and Infrastructure Security Agency (CISA)" title=3D"" wi= dth=3D"600" height=3D"100"></p>
<p>You are subscribed to Vulnerability Bulletins for Cybersecurity and In= frastructure Security Agency. This information has recently been updated an=
d is now available.</p>
<p>The CISA Vulnerability Bulletin provides a summary of new vulnerabilitie=
s that have been recorded in the past week. In some cases, the vulnerabilit= ies in the bulletin may not yet have assigned CVSS scores.</p> <p>Vulnerabilities are based on the=C2=A0<a href=3D"https://www.cve.org/" t= arget=3D"_blank" class=3D"ext" data-extlink=3D"" rel=3D"noopener">Common Vu= lnerabilities and Exposures</a>=C2=A0(CVE) vulnerability naming standard an=
d are organized according to severity, determined by the=C2=A0<a href=3D"ht= tps://www.cve.org/about/relatedefforts" target=3D"_blank" rel=3D"noopener">= Common Vulnerability Scoring System</a>=C2=A0(CVSS) standard. The division =
of high, medium, and low severities correspond to the following scores:</p>


<strong>High</strong>: vulnerabilities with a CVSS base score of 7.0=E2=80= =9310.0</li>

<strong>Medium</strong>: vulnerabilities with a CVSS base score of 4.0=E2= =80=936.9</li>

<strong>Low</strong>: vulnerabilities with a CVSS base score of 0.0=E2=80= =933.9</li>
</ul>
<p>Entries may include additional information provided by organizations and=
efforts sponsored by CISA. This information may include identifying inform= ation, values, definitions, and related links. Patch information is provide=
d when available. Please note that some of the information in the bulletin =
is compiled from external, open-source reports and is not a direct result o=
f CISA analysis.</p>
<p>=C2=A0</p>
<div class=3D"rss_item" style=3D"margin-bottom: 2em;">
<div class=3D"rss_title" style=3D"font-weight: bold; font-size: 120%; margi=
n: 0 0 0.3em; padding: 0;"><a href=3D"https://www.cisa.gov/news-events/bull= etins/sb26-187" target=3D"_blank" title=3D"Vulnerability Summary for the We=
ek of June 29, 2026" rel=3D"noopener">Vulnerability Summary for the Week of=
June 29, 2026</a></div>
<div class=3D"rss_pub_date" style=3D"font-size: 90%; font-style: italic; co= lor: #666666; margin: 0 0 0.3em; padding: 0;">07/06/2026 11:00 AM EDT</div>

<div class=3D"rss_description" style=3D"margin: 0 0 0.3em; padding: 0;">
<div id=3D"high_v">
<h2 id=3D"high_v_title">High Vulnerabilities</h2>
<table class=3D"table no-tablesaw" style=3D"table-layout: fixed; width: 100= %;" border=3D"1" summary=3D"High Vulnerabilities">
<thead>

<th class=3D"vendor-product" style=3D"width: 24%;" scope=3D"col">
<span class=3D"primary-vendor">Primary</span><br><span class=3D"primary-ven= dor">Vendor</span> -- Product</th>
<th style=3D"width: 44%;" scope=3D"col">Description</th>
<th style=3D"width: 10%;" scope=3D"col">Published</th>
<th style=3D"width: 8%;" scope=3D"col">CVSS Score</th>
<th style=3D"width: 7%;" scope=3D"col">Source Info</th>
</tr>
</thead>
<tbody>

<td class=3D"vendor-product">@fastify/express--@fastify/express</td> <td>@fastify/express versions 4.0.6 and earlier only rewrite the plugin pre= fix for middleware mount paths when the path argument is a string. Non-stri=
ng mount paths (arrays of paths and regular expressions) are left unprefixe=
d inside prefixed plugin scopes, so middleware registered with those forms = does not match the actual prefixed request path. Applications that use path= -scoped middleware for authentication, authorization, rate limiting, or aud= iting on routes inside a prefixed scope can be bypassed by sending a reques=
t to the prefixed route, because Fastify still matches the route but the mi= ddleware is skipped. Patches: upgrade to @fastify/express 4.0.7. Workaround=
s: use string mount paths instead of arrays or regular expressions in prefi= xed plugins, or register one use call per path.</td>
<td>2026-06-30</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6556" target=3D"= _blank" rel=3D"noopener">CVE-2026-6556</a></td>
</tr>

<td class=3D"vendor-product">@fastify/middie--@fastify/middie</td> <td>@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %=
2F inside path parameter values before matching middleware paths, while Fas= tify's underlying router preserves the encoding during route lookup. The tw=
o layers disagree on the canonical request path, so the middleware fails to=
match a URL that the route handler does match. When middleware is used for=
authentication, authorization, rate limiting, or auditing on parameterized=
paths, an attacker can reach the protected handler by sending a single cra= fted URL with an encoded slash in the parameter position. The bypass is HTT=
P method agnostic and requires no authentication or special preconditions. = Patches: upgrade to @fastify/middie 9.3.3. Workarounds: avoid parameterized=
middleware paths for security decisions, or enforce authentication at the = route handler or via a Fastify hook that runs after the router has resolved=
the request.</td>
<td>2026-07-01</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14198" target=3D= "_blank" rel=3D"noopener">CVE-2026-14198</a></td>
</tr>

<td class=3D"vendor-product">@fastify/middie--@fastify/middie</td> <td>@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL norm= alization step used by the standalone engine when incoming request paths co= ntain malformed percent-encoded sequences. Inputs such as an incomplete per= cent escape or a truncated multibyte sequence cause the underlying decoder =
to throw synchronously, and the exception escapes the middie normalize step=
and terminates the Node.js process. The bypass affects applications that c= all middie.run directly on the standalone engine API, causing an immediate = denial of service for all connected clients until restart. Applications usi=
ng the Fastify plugin path are not affected because Fastifys error handler = catches the exception. Patches: upgrade to @fastify/middie 9.3.3. Workaroun= ds: migrate from the standalone engine API to the Fastify plugin path, wher=
e the framework error handler catches the exception.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14181" target=3D= "_blank" rel=3D"noopener">CVE-2026-14181</a></td>
</tr>

<td class=3D"vendor-product">a--nicen-localize-image</td>
<td>Contributor SQL Injection in nicen-localize-image &lt;=3D 1.4.9 version= s.</td>
<td>2026-07-02</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57756" target=3D= "_blank" rel=3D"noopener">CVE-2026-57756</a></td>
</tr>

<td class=3D"vendor-product">acl project--acl</td>
<td>acl before version 2.4.0 contains a symlink traversal vulnerability in = the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_ext= ended_file(), and acl_delete_def_file() that allows local attackers to esca= late privileges by replacing any pathname component with a symbolic link. A= ttackers who control any component of a pathname processed by a privileged = caller can redirect ACL read or write operations to arbitrary files or dire= ctories, enabling unauthorized manipulation of access control lists and loc=
al privilege escalation.</td>
<td>2026-06-29</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54369" target=3D= "_blank" rel=3D"noopener">CVE-2026-54369</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Adobe Campaign Classic (ACC)</td>
<td>Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are = affected by an Incorrect Authorization vulnerability that could result in a= rbitrary code execution in the context of the current user. Exploitation of=
this issue does not require user interaction. Scope is changed.</td> <td>2026-06-30</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48286" target=3D= "_blank" rel=3D"noopener">CVE-2026-48286</a></td>
</tr>

<td class=3D"vendor-product">Adobe--ColdFusion</td>
<td>ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unre= stricted Upload of File with Dangerous Type vulnerability that could result=
in arbitrary code execution in the context of the current user. Exploitati=
on of this issue does not require user interaction. Scope is changed.</td> <td>2026-06-30</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48276" target=3D= "_blank" rel=3D"noopener">CVE-2026-48276</a></td>
</tr>

<td class=3D"vendor-product">Adobe--ColdFusion</td>
<td>ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Impr= oper Input Validation vulnerability that could result in arbitrary code exe= cution in the context of the current user. Exploitation of this issue does = not require user interaction. Scope is changed.</td>
<td>2026-06-30</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48277" target=3D= "_blank" rel=3D"noopener">CVE-2026-48277</a></td>
</tr>

<td class=3D"vendor-product">Adobe--ColdFusion</td>
<td>ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Impr= oper Input Validation vulnerability that could result in arbitrary code exe= cution in the context of the current user. Exploitation of this issue does = not require user interaction. Scope is changed.</td>
<td>2026-06-30</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48281" target=3D= "_blank" rel=3D"noopener">CVE-2026-48281</a></td>
</tr>

<td class=3D"vendor-product">Adobe--ColdFusion</td>
<td>ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Impr= oper Limitation of a Pathname to a Restricted Directory ('Path Traversal') = vulnerability that could lead to arbitrary code execution in the context of=
the current user. Exploitation of this issue does not require user interac= tion. Scope is changed.</td>
<td>2026-06-30</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48282" target=3D= "_blank" rel=3D"noopener">CVE-2026-48282</a></td>
</tr>

<td class=3D"vendor-product">Adobe--ColdFusion</td>
<td>ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unre= stricted Upload of File with Dangerous Type vulnerability that could result=
in arbitrary code execution in the context of the current user. Exploitati=
on of this issue does not require user interaction. Scope is changed.</td> <td>2026-06-30</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48283" target=3D= "_blank" rel=3D"noopener">CVE-2026-48283</a></td>
</tr>

<td class=3D"vendor-product">Adobe--ColdFusion</td>
<td>ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Impr= oper Limitation of a Pathname to a Restricted Directory ('Path Traversal') = vulnerability that could lead to arbitrary file system read and limited wri=
te access. An attacker could exploit this vulnerability to access sensitive=
files and directories outside the intended access scope. Exploitation of t= his issue does not require user interaction. Scope is changed.</td> <td>2026-06-30</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48313" target=3D= "_blank" rel=3D"noopener">CVE-2026-48313</a></td>
</tr>

<td class=3D"vendor-product">Adobe--ColdFusion</td>
<td>ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Impr= oper Input Validation vulnerability that could result in arbitrary code exe= cution in the context of the current user. An attacker could exploit this v= ulnerability to inject malicious scripts into a web page, potentially gaini=
ng elevated access or control over the victim's account or session. Exploit= ation of this issue requires user interaction in that a victim must open a = malicious file. Scope is changed.</td>
<td>2026-06-30</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48315" target=3D= "_blank" rel=3D"noopener">CVE-2026-48315</a></td>
</tr>

<td class=3D"vendor-product">Adobe--ColdFusion</td>
<td>ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Serve= r-Side Request Forgery (SSRF) vulnerability that could result in a Security=
feature bypass. An attacker could leverage this vulnerability to bypass se= curity measures and gain unauthorized read access. Exploitation of this iss=
ue does not require user interaction. Scope is changed.</td> <td>2026-06-30</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48285" target=3D= "_blank" rel=3D"noopener">CVE-2026-48285</a></td>
</tr>

<td class=3D"vendor-product">Adobe--ColdFusion</td>
<td>ColdFusion versions 2025.9, 2023.20 and earlier are affected by a refle= cted Cross-Site Scripting (XSS) vulnerability. An attacker could exploit th=
is vulnerability to inject malicious scripts into a web page, potentially r= esulting in arbitrary code execution in the context of the current user. Ex= ploitation of this issue requires user interaction in that a victim must op=
en a malicious link. Scope is changed.</td>
<td>2026-06-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48307" target=3D= "_blank" rel=3D"noopener">CVE-2026-48307</a></td>
</tr>

<td class=3D"vendor-product">advancedcoding--Comments wpDiscuz</td>
<td>The Comments - wpDiscuz plugin for WordPress is vulnerable to Stored Cr= oss-Site Scripting via the guest commenter 'Website' field in versions up t=
o, and including, 7.6.56 This is due to insufficient output escaping in the=
getCommentAuthor() function, which interpolates the stored comment_author_= url value directly into single-quoted HTML attributes without applying esc_= url() or esc_attr(). This makes it possible for unauthenticated attackers t=
o inject arbitrary web scripts in pages that will execute whenever a user a= ccesses an injected page.</td>
<td>2026-07-03</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9148" target=3D"= _blank" rel=3D"noopener">CVE-2026-9148</a></td>
</tr>

<td class=3D"vendor-product">Advantech--Hospital Quering Management</td> <td>Hospital Queuing Management developed by Advantech has a Sensitive Data=
Exposure vulnerability, allowing unauthenticated remote attackers to acces=
s a specific URL to obtain API documentation.</td>
<td>2026-06-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14162" target=3D= "_blank" rel=3D"noopener">CVE-2026-14162</a></td>
</tr>

<td class=3D"vendor-product">Advantech--Hospital Queuing Management</td> <td>Hospital Quening Management developed by Advantech has a Sensitive Data=
Exposure vulnerability, allowing unauthenticated remote attackers to acces=
s a specific URL to obtain API documentation.</td>
<td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14161" target=3D= "_blank" rel=3D"noopener">CVE-2026-14161</a></td>
</tr>

<td class=3D"vendor-product">Ahmadgb--GeekyBot</td>
<td>Unauthenticated SQL Injection in GeekyBot &lt;=3D 1.2.5 versions.</td> <td>2026-07-02</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57679" target=3D= "_blank" rel=3D"noopener">CVE-2026-57679</a></td>
</tr>

<td class=3D"vendor-product">ajith-ab--react-native-receive-sharing-intent<=

<td>react-native-receive-sharing-intent contains a path traversal vulnerabi= lity that allows a co-resident malicious application to write files outside=
the intended cache directory by supplying a crafted _display_name value co= ntaining dot-dot path components through a malicious ContentProvider. Attac= kers can fire an explicit ACTION_SEND intent at the consuming app's exporte=
d share-receiver activity to overwrite arbitrary files in the consuming app=
's private data directory, including databases, shared preferences, and cac= hed configuration, with attacker-controlled content.</td>
<td>2026-07-02</td>
<td>7.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58460" target=3D= "_blank" rel=3D"noopener">CVE-2026-58460</a></td>
</tr>

<td class=3D"vendor-product">AncoraThemes--Lighthouse</td>
<td>Unauthenticated Local File Inclusion in Lighthouse &lt;=3D 1.2.12 versi= ons.</td>
<td>2026-07-02</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-58902" target=3D= "_blank" rel=3D"noopener">CVE-2025-58902</a></td>
</tr>

<td class=3D"vendor-product">Andy Fragen--WP Debugging</td>
<td>Unauthenticated Cross Site Scripting (XSS) in WP Debugging &lt;=3D 2.12=
.2 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57350" target=3D= "_blank" rel=3D"noopener">CVE-2026-57350</a></td>
</tr>

<td class=3D"vendor-product">Anyscale, Inc--Ray</td>
<td>Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in=
the WebDataset reader that allows attackers to achieve remote code executi=
on by supplying a malicious tar archive to the read_webdataset() function. = The _default_decoder() function in webdataset_datasource.py unconditionally=
calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch= .load() with weights_only=3DFalse on .pt/.pth entries, executing arbitrary = code inside Ray remote workers on every worker that processes the malicious=
archive.</td>
<td>2026-07-01</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57516" target=3D= "_blank" rel=3D"noopener">CVE-2026-57516</a></td>
</tr>

<td class=3D"vendor-product">apereo--cas</td>
<td>Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerabilit=
y that allows remote unauthenticated attackers to recover plaintext convers= ation state by exploiting AES-GCM initialization vector reuse across the se= rver lifetime. Attackers can collect multiple client-side webflow execution=
tokens from the unauthenticated login page and perform known-plaintext ana= lysis to decrypt the webflow conversation state due to keystream reuse caus=
ed by a fixed all-zero IV paired with the same encryption key.</td> <td>2026-07-02</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59099" target=3D= "_blank" rel=3D"noopener">CVE-2026-59099</a></td>
</tr>

<td class=3D"vendor-product">Arraytics--Booktics</td>
<td>Unauthenticated PHP Object Injection in Booktics &lt;=3D 1.0.21 version= s.</td>
<td>2026-07-02</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57621" target=3D= "_blank" rel=3D"noopener">CVE-2026-57621</a></td>
</tr>

<td class=3D"vendor-product">Arraytics--Timetics</td>
<td>Unauthenticated Cross Site Scripting (XSS) in Timetics &lt;=3D 1.0.58 v= ersions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57674" target=3D= "_blank" rel=3D"noopener">CVE-2026-57674</a></td>
</tr>

<td class=3D"vendor-product">ASE--Admin and Site Enhancements (ASE) Pro</td=

<td>Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancemen=
ts (ASE) Pro &lt;=3D 8.8.5 versions.</td>
<td>2026-07-02</td>
<td>9.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57625" target=3D= "_blank" rel=3D"noopener">CVE-2026-57625</a></td>
</tr>

<td class=3D"vendor-product">Astoundify--Jobify</td>
<td>Unauthenticated Cross Site Scripting (XSS) in Jobify &lt;=3D 4.3.2 vers= ions.</td>
<td>2026-06-29</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57336" target=3D= "_blank" rel=3D"noopener">CVE-2026-57336</a></td>
</tr>

<td class=3D"vendor-product">attr project--attr</td>
<td>attr before version 2.6.0 contains a symlink traversal vulnerability in=
the getfattr and setfattr utilities that allows local attackers to escalat=
e privileges by replacing a pathname component with a symbolic link during = directory hierarchy traversal. Attackers who control a pathname component c=
an redirect getfattr and setfattr operations to arbitrary files by substitu= ting a symlink, leading to local privilege escalation when getfattr or setf= attr is invoked by a privileged process over an attacker-controlled path.</=

<td>2026-06-29</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54371" target=3D= "_blank" rel=3D"noopener">CVE-2026-54371</a></td>
</tr>

<td class=3D"vendor-product">AWS--Amazon CloudFront</td>
<td>Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront wit=
h AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule = body inspection via crafted HTTP/2 requests that fragment the request body = across frames so that only a partial body is inspected. This issue was reme= diated server-side. No customer action is required.</td>
<td>2026-06-29</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13762" target=3D= "_blank" rel=3D"noopener">CVE-2026-13762</a></td>
</tr>

<td class=3D"vendor-product">AWS--AWS Advanced JDBC Wrapper</td> <td>Deserialization of untrusted data in the RemoteQueryCachePlugin in Amaz=
on Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow a=
n actor with write access to the shared cache infrastructure to execute arb= itrary code on application servers that read cached query results via a cra= fted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStr= eam without class filtering when deserializing cached query results from Re= dis or Valkey, enabling gadget chain execution when cache entries are poiso= ned. We recommend upgrading to AWS Advanced JDBC Wrapper version 4.0.1 or l= ater.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14265" target=3D= "_blank" rel=3D"noopener">CVE-2026-14265</a></td>
</tr>

<td class=3D"vendor-product">AWS--AWS Application Load Balancer</td> <td>Inconsistent interpretation of HTTP/2 requests in AWS Application Load = Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF m= anaged rule body inspection via crafted HTTP/2 requests that fragment the r= equest body across frames so that only a partial body is inspected. This is= sue only impacts HTTP/2 ALB target groups. To remediate this issue, custome=
rs should enable the "Inspect after sufficient data" target group configura= tion associated to an ALB load balancer. Refer to: ( https://docs.aws.amazo= n.com/elasticloadbalancing/latest/application/edit-target-group-attributes.= html#waf-http2-inspection )</td>
<td>2026-06-29</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13763" target=3D= "_blank" rel=3D"noopener">CVE-2026-13763</a></td>
</tr>

<td class=3D"vendor-product">AWS--AWS CDK</td>
<td>OS command injection in the NodejsFunction Docker bundling pipeline (Os= Command helper) in AWS aws-cdk-lib on all platforms might allow a actor who=
controls dependency version strings in a project's package.json file to ex= ecute arbitrary commands on the host running the CDK toolchain via injected=
shell metacharacters in the OsCommand helper. This issue requires the acto=
r to control the content of a package.json dependency version string that i=
s processed during Docker-based bundling with nodeModules specified. To rem= ediate this issue, users should upgrade to=C2=A0v2.260.0.</td> <td>2026-07-01</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13760" target=3D= "_blank" rel=3D"noopener">CVE-2026-13760</a></td>
</tr>

<td class=3D"vendor-product">Ays Pro--Survey Maker</td>
<td>Unauthenticated Cross Site Scripting (XSS) in Survey Maker &lt;=3D 5.2.= 2.5 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57361" target=3D= "_blank" rel=3D"noopener">CVE-2026-57361</a></td>
</tr>

<td class=3D"vendor-product">BeRocket--Permalink Manager for WooCommerce</t=

<td>Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager = for WooCommerce &lt;=3D 1.0.8.2 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57758" target=3D= "_blank" rel=3D"noopener">CVE-2026-57758</a></td>
</tr>

<td class=3D"vendor-product">BlueAstralThemes--SEOWP</td>
<td>Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP &lt;=3D 3.12=
.2 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57761" target=3D= "_blank" rel=3D"noopener">CVE-2026-57761</a></td>
</tr>

<td class=3D"vendor-product">BMC--Control-M/Enterprise Manager</td> <td>Messaging consumer functionality allows deserialization of user-control= led data without sufficient restriction of allowed object types in the out =
of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.2= 0.x and potentially earlier. This issue may allow an authenticated attacker=
to trigger unintended server-side behavior through crafted serialized cont= ent.</td>
<td>2026-07-01</td>
<td>8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10538" target=3D= "_blank" rel=3D"noopener">CVE-2026-10538</a></td>
</tr>

<td class=3D"vendor-product">BMC--Control-M/Server</td>
<td>A Control-M/Server communication command does not sufficiently filter o=
r sanitize user-supplied input. Under certain conditions, this issue may al= low an unauthenticated attacker to execute unauthorized commands on the aff= ected server, potentially leading to compromise of the server.=C2=A0 This v= ulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (incl= uded) and potentially earlier unsupported versions.</td>
<td>2026-07-01</td>
<td>9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10539" target=3D= "_blank" rel=3D"noopener">CVE-2026-10539</a></td>
</tr>

<td class=3D"vendor-product">BoldGrid--W3 Total Cache</td>
<td>Unauthenticated Arbitrary Code Execution in W3 Total Cache &lt;=3D 2.9.=
4 versions.</td>
<td>2026-07-02</td>
<td>9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57623" target=3D= "_blank" rel=3D"noopener">CVE-2026-57623</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 contains a broken object level authorization vuln= erability in middlewareKey() that accepts the client-controlled x-limited-k= ey-id header without validating ownership, allowing authenticated users to = adopt cross-tenant limited keys. Attackers can supply another tenant's limi= ted key ID to bypass authorization checks and access unauthorized cross-ten= ant resources across multiple API endpoints.</td>
<td>2026-06-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56230" target=3D= "_blank" rel=3D"noopener">CVE-2026-56230</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 contains a path traversal vulnerability in the bu= ilder upload proxy that allows authenticated users with build permissions t=
o bypass upload restrictions. Attackers can append traversal sequences to t=
he upload path, which are normalized by the WHATWG URL parser, enabling acc= ess to internal administrative endpoints with the privileged BUILDER_API_KE=
Y header and resulting in server-side privilege escalation.</td> <td>2026-06-30</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56233" target=3D= "_blank" rel=3D"noopener">CVE-2026-56233</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles=
at app scope without validating role scope compatibility, including to pen= ding invitees. Attackers can pre-seed malformed high-privilege bindings tha=
t survive invite acceptance, enabling accepted low-privilege users to perfo=
rm unauthorized privileged app actions.</td>
<td>2026-06-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56247" target=3D= "_blank" rel=3D"noopener">CVE-2026-56247</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 contains an authentication bypass vulnerability i=
n the account deletion endpoint that allows deletion without password re-au= thentication or secondary verification. Attackers can delete user accounts = via session hijacking, CSRF attacks, or parameter tampering, resulting in u= nauthorized account deletion, data loss, and denial-of-service.</td> <td>2026-06-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56286" target=3D= "_blank" rel=3D"noopener">CVE-2026-56286</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the = public.get_org_user_access_rbac function that allows unauthenticated attack= ers to retrieve RBAC role bindings and member email addresses. Attackers ca=
n exploit improper NULL comparison in the authorization gate to disclose or= ganization membership, roles, and email addresses via the PostgREST RPC end= point using only a public API key.</td>
<td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56219" target=3D= "_blank" rel=3D"noopener">CVE-2026-56219</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 contains an authorization bypass vulnerability in=
the channel creation endpoint that allows authenticated users to overwrite=
existing channels by reusing their names. Attackers with app.create_channe=
l permission can exploit a logic mismatch between existence validation and = upsert operations to reassign channel ownership and modify critical product= ion channel configurations.</td>
<td>2026-06-30</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56249" target=3D= "_blank" rel=3D"noopener">CVE-2026-56249</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 contains unauthenticated security definer RPC fun= ctions get_user_id and get_org_perm_for_apikey that expose API key validity=
oracles and user UUID disclosure. Unauthenticated attackers using the publ=
ic API key can validate leaked keys, enumerate users and apps, and determin=
e permission levels, significantly increasing the actionability of compromi= sed credentials.</td>
<td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56300" target=3D= "_blank" rel=3D"noopener">CVE-2026-56300</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 contains an authorization flaw in POST /private/c= reate_device that accepts a caller-supplied org_id parameter without valida= ting it matches the target app's owner organization. Authenticated attacker=
s can create device records for an application using a foreign organization=
identifier, bypassing the intended org/app authorization boundary.</td> <td>2026-06-30</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56320" target=3D= "_blank" rel=3D"noopener">CVE-2026-56320</a></td>
</tr>

<td class=3D"vendor-product">ChaN--FatFs</td>
<td>In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mou= nt_volume() where fasize *=3D fs-&gt;n_fats can wrap, leading to attacker-c= ontrolled file-size metadata and unsafe read lengths in downstream callers.=
This maps to CWE-190 (Integer Overflow or Wraparound). Estimated CVSS v3.1=
vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). Remote d= elivery is also possible in OTA/update pipelines. The estimated CISA SSVC v= ectors are Exploitation: PoC, Technical Impact: Total.</td>
<td>2026-07-01</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6682" target=3D"= _blank" rel=3D"noopener">CVE-2026-6682</a></td>
</tr>

<td class=3D"vendor-product">ChaN--FatFs</td>
<td>FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() b= ecause exFAT label length (XDIR_NumLabel) is trusted without enforcing spec=
maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CV=
SS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). T=
he estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Tot= al.</td>
<td>2026-07-01</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6687" target=3D"= _blank" rel=3D"noopener">CVE-2026-6687</a></td>
</tr>

<td class=3D"vendor-product">ChaN--FatFs</td>
<td>FatFs R0.16 and earlier contains a downstream-caller vulnerability patt= ern associated with FatFs long filename handling. With LFN enabled, fno.fna=
me can be up to 255 characters; many callers copy it into short fixed buffe=
rs without bounds checks, causing overflow. This maps to CWE-120 (Buffer Co=
py without Checking Size of Input). Estimated CVSS v3.1 vector: CVSS:3.1/AV= :P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vect= ors are Exploitation: PoC, Technical Impact: Total.</td>
<td>2026-07-01</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6688" target=3D"= _blank" rel=3D"noopener">CVE-2026-6688</a></td>
</tr>

<td class=3D"vendor-product">Chill Media Labs S.R.L.--Modula - PRO</td> <td>Unauthenticated Cross Site Scripting (XSS) in Modula - PRO &lt;=3D 2.10=
.8 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57426" target=3D= "_blank" rel=3D"noopener">CVE-2026-57426</a></td>
</tr>

<td class=3D"vendor-product">Cisco--Cisco Catalyst Center</td>
<td>A vulnerability in Cisco Catalyst Center could allow an unauthenticated=
, remote attacker to read arbitrary files from a restricted container.&amp;= nbsp; This vulnerability is due to insufficient validation of user-supplied=
input. An attacker could exploit this vulnerability by sending a crafted H= TTP request to an affected device. A successful exploit could allow the att= acker to read arbitrary files from a restricted container of the affected d= evice.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20191" target=3D= "_blank" rel=3D"noopener">CVE-2026-20191</a></td>
</tr>

<td class=3D"vendor-product">Cisco--Cisco Secure Endpoint</td>
<td>A vulnerability in the PE file format parser of ClamAV could allow an u= nauthenticated, remote attacker to cause a DoS condition, or possibly other=
expanded impacts, resulting from memory corruption on an affected device. = This vulnerability is due to improper boundary checks for content in PE fil=
es during scanning, which may result in an out-of-bounds buffer write. An a= ttacker could exploit this vulnerability by submitting a crafted file that = contains PE content to be scanned by ClamAV on an affected device. A succes= sful exploit could allow the attacker to cause the ClamAV scanning process =
to terminate, resulting in a DoS condition on the affected software.</td> <td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20213" target=3D= "_blank" rel=3D"noopener">CVE-2026-20213</a></td>
</tr>

<td class=3D"vendor-product">Cisco--Cisco Secure Endpoint</td>
<td>A vulnerability in the FSG file format parser of ClamAV could allow an = unauthenticated, remote attacker to cause a DoS condition, or possibly othe=
r expanded impacts, resulting from memory corruption on an affected device.=
This vulnerability is due to improper boundary checks for content in FSG f= iles during scanning, which may result in an out-of-bounds buffer write. An=
attacker could exploit this vulnerability by submitting a crafted file tha=
t contains portable executable content compressed with FSG to be scanned by=
ClamAV on an affected device. A successful exploit could allow the attacke=
r to cause the ClamAV scanning process to terminate, resulting in a DoS con= dition on the affected software.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20214" target=3D= "_blank" rel=3D"noopener">CVE-2026-20214</a></td>
</tr>

<td class=3D"vendor-product">Cisco--Cisco Secure Endpoint</td>
<td>A vulnerability in the 7z file format parser of ClamAV could allow an u= nauthenticated, remote attacker to cause a DoS condition, or possibly other=
expanded impacts, resulting from memory corruption on an affected device. = This vulnerability is due to improper boundary checks for content in 7z fil=
es during scanning, which may result in an out-of-bounds buffer write. An a= ttacker could exploit this vulnerability by submitting a crafted file that = contains 7z&amp;nbsp;content to be scanned by ClamAV on an affected device.=
A successful exploit could allow the attacker to cause the ClamAV scanning=
process to terminate, resulting in a DoS condition on the affected softwar= e.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20215" target=3D= "_blank" rel=3D"noopener">CVE-2026-20215</a></td>
</tr>

<td class=3D"vendor-product">Cisco--Cisco Secure Endpoint</td>
<td>A vulnerability in the InstallShield file format parser of ClamAV could=
allow an unauthenticated, remote attacker to cause a DoS condition on an a= ffected device. This vulnerability is due to improper handling of temporary=
resources during file scanning. An attacker could exploit this vulnerabili=
ty by submitting a crafted InstallShield file to be scanned by ClamAV on an=
affected device. A successful exploit could allow the attacker to terminat=
e the ClamAV scanning process and temporarily consume available system reso= urces, resulting in a DoS condition on the affected software.</td> <td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20216" target=3D= "_blank" rel=3D"noopener">CVE-2026-20216</a></td>
</tr>

<td class=3D"vendor-product">Cisco--Cisco Secure Endpoint</td>
<td>A vulnerability in the PESpin file format parser of ClamAV could allow =
an unauthenticated, remote attacker to cause a DoS condition, or possibly o= ther expanded impacts, resulting from memory corruption on an affected devi= ce. This vulnerability is due to improper boundary checks for content in PE= Spin files during scanning, which may result in an out-of-bounds buffer wri= te. An attacker could exploit this vulnerability by submitting a crafted fi=
le that contains PESpin content to be scanned by ClamAV on an affected devi= ce. A successful exploit could allow the attacker to cause the ClamAV scann= ing process to terminate, resulting in a DoS condition on the affected soft= ware.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20217" target=3D= "_blank" rel=3D"noopener">CVE-2026-20217</a></td>
</tr>

<td class=3D"vendor-product">Cisco--Cisco Secure Endpoint</td>
<td>A vulnerability in the ALZ file format parser of ClamAV could allow an = unauthenticated, remote attacker to cause a DoS condition, or possibly othe=
r expanded impacts, resulting from memory corruption on an affected device.=
This vulnerability is due to improper boundary checks for content in ALZ f= iles during scanning, which may result in an out-of-bounds buffer write. An=
attacker could exploit this vulnerability by submitting a crafted file tha=
t contains ALZ content to be scanned by ClamAV on an affected device. A suc= cessful exploit could allow the attacker to cause the ClamAV scanning proce=
ss to terminate, resulting in a DoS condition on the affected software.</td=

<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20243" target=3D= "_blank" rel=3D"noopener">CVE-2026-20243</a></td>
</tr>

<td class=3D"vendor-product">Cisco--Cisco Secure Endpoint</td>
<td>A vulnerability in the DMG file format parser of ClamAV could allow an = unauthenticated, remote attacker to cause a DoS condition, or possibly othe=
r expanded impacts, resulting from memory corruption on an affected device.=
This vulnerability is due to improper boundary checks for content in DMG f= iles during scanning, which may result in an integer overflow on 32-bit pla= tforms only. An attacker could exploit this vulnerability by submitting a c= rafted file that contains DMG content to be scanned by ClamAV on an affecte=
d device. A successful exploit could allow the attacker to cause the ClamAV=
scanning process to terminate, resulting in a DoS condition on the affecte=
d software.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20244" target=3D= "_blank" rel=3D"noopener">CVE-2026-20244</a></td>
</tr>

<td class=3D"vendor-product">cmsjunkie--WP-BusinessDirectory Business direc= tory plugin for WordPress</td>
<td>The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthen= ticated Arbitrary File Deletion in versions up to and including 4.0.1. This=
is due to insufficient path validation in the remove() method of the JBusi= nessDirectoryControllerUpload class. The task=3Dupload.remove endpoint is a= ccessible without authentication via the plugin's frontend routing system. = The _filename parameter is accepted with RAW filter (no sanitization), and = the helper function makePathFile() only normalizes directory separator char= acters without stripping path traversal sequences (../). When combined with=
the _path_type=3D2 parameter, which sets the base directory to the plugin'=
s site folder, an attacker can supply a _filename value containing ../ sequ= ences to traverse outside the plugin directory and call PHP's unlink() on a= rbitrary files - including wp-config.php, wp-config-backup.php, or other cr= itical server files accessible to the web server process. This makes it pos= sible for unauthenticated attackers to delete arbitrary files on the server= .</td>
<td>2026-07-01</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6070" target=3D"= _blank" rel=3D"noopener">CVE-2026-6070</a></td>
</tr>

<td class=3D"vendor-product">cockpit-project--cockpit</td>
<td>Cockpit CMS before release 364 contains a path traversal and local file=
inclusion vulnerability that allows unauthenticated attackers to read arbi= trary files or execute PHP files by including unvalidated PATH_INFO derived=
from REQUEST_URI in filesystem path construction without containment check=
s. Attackers can inject dot-dot sequences into the URL to traverse outside = the designated spaces directory, and when the resolved path ends with a .ph=
p extension, the application passes it to include(), enabling local file in= clusion on deployments using the PHP built-in server or certain non-default=
Nginx configurations.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58467" target=3D= "_blank" rel=3D"noopener">CVE-2026-58467</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Hotel and Tourism Reservation</=

<td>A flaw has been found in code-projects Hotel and Tourism Reservation 1.=
0. Affected is an unknown function of the file /admin/add_room.php. Executi=
ng a manipulation of the argument delete_image/edit/description/number/pric= e/rooms/type can lead to sql injection. The attack can be launched remotely=
. The exploit has been published and may be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14754" target=3D= "_blank" rel=3D"noopener">CVE-2026-14754</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Hotel and Tourism Reservation</=

<td>A vulnerability has been found in code-projects Hotel and Tourism Reser= vation 1.0. Affected by this vulnerability is an unknown functionality of t=
he file /admin/reservations.php of the component Reservations Management Pa= ge. The manipulation of the argument delete leads to sql injection. The att= ack may be initiated remotely. The exploit has been disclosed to the public=
and may be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14755" target=3D= "_blank" rel=3D"noopener">CVE-2026-14755</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Hotel and Tourism Reservation</=

<td>A vulnerability was found in code-projects Hotel and Tourism Reservatio=
n 1.0. Affected by this issue is some unknown functionality of the file /ad= min/add_tour.php of the component Tour Management Page. The manipulation of=
the argument delete_image results in sql injection. The attack may be laun= ched remotely. The exploit has been made public and could be used.</td> <td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14756" target=3D= "_blank" rel=3D"noopener">CVE-2026-14756</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Hotel and Tourism Reservation</=

<td>A vulnerability was detected in code-projects Hotel and Tourism Reserva= tion 1.0. The impacted element is an unknown function of the file /admin/ro= oms.php of the component Room Management Page. The manipulation of the argu= ment delete results in sql injection. It is possible to launch the attack r= emotely. The exploit is now public and may be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14762" target=3D= "_blank" rel=3D"noopener">CVE-2026-14762</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Hotel and Tourism Reservation</=

<td>A flaw has been found in code-projects Hotel and Tourism Reservation 1.=
0. This affects an unknown function of the file /admin/tour_reserves.php of=
the component Tour Reservations Page. This manipulation of the argument to=
ur causes sql injection. The attack can be initiated remotely. The exploit = has been published and may be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14763" target=3D= "_blank" rel=3D"noopener">CVE-2026-14763</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Hotel and Tourism Reservation</=

<td>A vulnerability has been found in code-projects Hotel and Tourism Reser= vation 1.0. This impacts an unknown function of the file /admin/add_event.p=
hp of the component Event Management Page. Such manipulation of the argumen=
t fdetails leads to sql injection. The attack can be launched remotely. The=
exploit has been disclosed to the public and may be used.</td> <td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14764" target=3D= "_blank" rel=3D"noopener">CVE-2026-14764</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Internship Management System</t=

<td>A security vulnerability has been detected in code-projects Internship = Management System 1.0. The impacted element is an unknown function of the f= ile employer/login.php of the component Employer Login Endpoint. The manipu= lation of the argument email/password leads to sql injection. Remote exploi= tation of the attack is possible. The exploit has been disclosed publicly a=
nd may be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14700" target=3D= "_blank" rel=3D"noopener">CVE-2026-14700</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Online Examination</td>
<td>A vulnerability was determined in code-projects Online Examination 1.0.=
Affected by this issue is some unknown functionality of the file head.php.=
Executing a manipulation of the argument uname/password can lead to sql in= jection. It is possible to launch the attack remotely. The exploit has been=
publicly disclosed and may be utilized.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14705" target=3D= "_blank" rel=3D"noopener">CVE-2026-14705</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Online Job Portal</td>
<td>A vulnerability was found in code-projects Online Job Portal 1.0. The a= ffected element is an unknown function of the file login.php. Performing a = manipulation of the argument txtUser/txtPass results in sql injection. The = attack may be initiated remotely. The exploit has been made public and coul=
d be used.</td>
<td>2026-07-04</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14660" target=3D= "_blank" rel=3D"noopener">CVE-2026-14660</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Online Voting System</td>
<td>A security vulnerability has been detected in code-projects Online Voti=
ng System up to 0.x/1.0. This issue affects the function test_input of the = file /authentication.php of the component Login. Such manipulation of the a= rgument adminUserName/adminPassword leads to sql injection. It is possible =
to launch the attack remotely. The exploit has been disclosed publicly and = may be used.</td>
<td>2026-07-04</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14648" target=3D= "_blank" rel=3D"noopener">CVE-2026-14648</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Online Voting System</td>
<td>A vulnerability was detected in code-projects Online Voting System 1.0.=
Impacted is the function test_input of the file /saveVote.php. Performing =
a manipulation of the argument voterName/voterEmail/voterID/selectedCandida=
te results in sql injection. The attack can be initiated remotely.</td> <td>2026-07-04</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14649" target=3D= "_blank" rel=3D"noopener">CVE-2026-14649</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Real State Services</td>
<td>A weakness has been identified in code-projects Real State Services 1.0=
. Impacted is an unknown function of the file /single-list_sale.php?action= =3Dadd. Executing a manipulation of the argument ID can lead to sql injecti= on. The attack can be executed remotely. The exploit has been made availabl=
e to the public and could be used for attacks.</td>
<td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13559" target=3D= "_blank" rel=3D"noopener">CVE-2026-13559</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Real State Services</td>
<td>A vulnerability was identified in code-projects Real State Services 1.0=
. The impacted element is an unknown function of the file /normalHomeSale.p= hp. Such manipulation of the argument loc leads to sql injection. The attac=
k may be performed from remote. The exploit is publicly available and might=
be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14743" target=3D= "_blank" rel=3D"noopener">CVE-2026-14743</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Real State Services</td>
<td>A security flaw has been discovered in code-projects Real State Service=
s 1.0. This affects an unknown function of the file /normalHomeRent.php. Pe= rforming a manipulation of the argument loc results in sql injection. It is=
possible to initiate the attack remotely. The exploit has been released to=
the public and may be used for attacks.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14744" target=3D= "_blank" rel=3D"noopener">CVE-2026-14744</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Real State Services</td>
<td>A weakness has been identified in code-projects Real State Services 1.0=
. This impacts an unknown function of the file /single-list_rent.php. Execu= ting a manipulation of the argument ID can lead to sql injection. It is pos= sible to launch the attack remotely. The exploit has been made available to=
the public and could be used for attacks.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14745" target=3D= "_blank" rel=3D"noopener">CVE-2026-14745</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Real State Services</td>
<td>A security vulnerability has been detected in code-projects Real State = Services 1.0. Affected is an unknown function of the file /addprojectrent.p= hp. The manipulation of the argument amen leads to sql injection. The attac=
k can be initiated remotely. The exploit has been disclosed publicly and ma=
y be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14746" target=3D= "_blank" rel=3D"noopener">CVE-2026-14746</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Real State Services</td>
<td>A vulnerability was detected in code-projects Real State Services 1.0. = Affected by this vulnerability is an unknown functionality of the file /add= projectsale.php. The manipulation of the argument amen results in sql injec= tion. The attack can be launched remotely.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14747" target=3D= "_blank" rel=3D"noopener">CVE-2026-14747</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Real State Services</td>
<td>A weakness has been identified in code-projects Real State Services 1.0=
. This vulnerability affects unknown code of the file /builderHome.php. Thi=
s manipulation of the argument loc causes sql injection. The attack is poss= ible to be carried out remotely. The exploit has been made available to the=
public and could be used for attacks.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14768" target=3D= "_blank" rel=3D"noopener">CVE-2026-14768</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Real State Services</td>
<td>A security vulnerability has been detected in code-projects Real State = Services 1.0. This issue affects some unknown processing of the file /pay.p= hp. Such manipulation of the argument Bankname leads to sql injection. The = attack may be performed from remote. The exploit has been disclosed publicl=
y and may be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14769" target=3D= "_blank" rel=3D"noopener">CVE-2026-14769</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Smart Parking System</td>
<td>A vulnerability has been found in code-projects Smart Parking System 1.=
0. The affected element is an unknown function of the file /parkings/parkin= gs.php. Such manipulation of the argument street/city/status leads to sql i= njection. The attack can be executed remotely. The exploit has been disclos=
ed to the public and may be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14735" target=3D= "_blank" rel=3D"noopener">CVE-2026-14735</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Apartment Visitor Management System= </td>
<td>A vulnerability was found in CodeAstro Apartment Visitor Management Sys= tem 1.0. Affected is an unknown function of the file /index.php of the comp= onent Login. Performing a manipulation of the argument Username results in = sql injection. Remote exploitation of the attack is possible. The exploit h=
as been made public and could be used.</td>
<td>2026-07-04</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14640" target=3D= "_blank" rel=3D"noopener">CVE-2026-14640</a></td>
</tr>

<td class=3D"vendor-product">Codepeople--Google Maps CP</td> <td>Unauthenticated Cross Site Scripting (XSS) in Google Maps CP &lt;=3D 1.= 2.5 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57670" target=3D= "_blank" rel=3D"noopener">CVE-2026-57670</a></td>
</tr>

<td class=3D"vendor-product">CoderPress--NOWPayments for WooCommerce</td> <td>Unauthenticated Broken Access Control in NOWPayments for WooCommerce &l= t;=3D 1.4.0 versions.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-39448" target=3D= "_blank" rel=3D"noopener">CVE-2026-39448</a></td>
</tr>

<td class=3D"vendor-product">conductor-oss--conductor</td>
<td>Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remot=
e code execution vulnerability that allows remote attackers to execute arbi= trary OS commands by submitting inline workflow definitions containing mali= cious JavaScript or Python expressions to the workflow API endpoint prior t=
o authentication. Attackers can exploit unsandboxed GraalVM evaluators conf= igured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, = DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Jav=
a reflection or direct subprocess calls.</td>
<td>2026-06-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58138" target=3D= "_blank" rel=3D"noopener">CVE-2026-58138</a></td>
</tr>

<td class=3D"vendor-product">Connekt Media--Ajax Load More - Filters</td> <td>The Ajax Load More - Filters plugin for WordPress is vulnerable to Stor=
ed Cross-Site Scripting via the 'taxonomy_include_children' parameter in al=
l versions up to, and including, 3.4.1 due to insufficient input sanitizati=
on and output escaping. This makes it possible for unauthenticated attacker=
s to inject arbitrary web scripts in pages that will execute whenever a use=
r accesses an injected page.</td>
<td>2026-06-30</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8141" target=3D"= _blank" rel=3D"noopener">CVE-2026-8141</a></td>
</tr>

<td class=3D"vendor-product">Contempoinc--Real Estate 7</td> <td>Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 &lt;=3D 3.5=
.9 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57343" target=3D= "_blank" rel=3D"noopener">CVE-2026-57343</a></td>
</tr>

<td class=3D"vendor-product">Control Web Panel--Control Web Panel</td> <td>Control Web Panel before 0.9.8.1225 contains a blind SQL injection vuln= erability that allows unauthenticated remote attackers to execute arbitrary=
SQL queries by submitting unsanitized input through the userRes POST param= eter at the user endpoint. Attackers can exploit MySQL root privileges obta= ined via the injection to write arbitrary files using INTO DUMPFILE, enabli=
ng deployment of a PHP webshell to the web-accessible roundcube logs direct= ory and achieving remote code execution as the cwpsvc account.</td> <td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57517" target=3D= "_blank" rel=3D"noopener">CVE-2026-57517</a></td>
</tr>

<td class=3D"vendor-product">coollabsio--coolify</td>
<td>Coolify is an open-source and self-hostable tool for managing servers, = applications, and databases. Prior to 4.0.0-beta.474, Coolify's API control= lers consistently validate server ownership with Server::whereTeamId($teamI=
d) before any operation. However, multiple Livewire web UI components accep=
t server_id and destination_uuid from URL query parameters without any team=
ownership validation, allowing cross-team resource deployment. This vulner= ability is fixed in 4.0.0-beta.474.</td>
<td>2026-06-29</td>
<td>9.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57498" target=3D= "_blank" rel=3D"noopener">CVE-2026-57498</a></td>
</tr>

<td class=3D"vendor-product">coollabsio--coolify</td>
<td>Coolify is an open-source and self-hostable tool for managing servers, = applications, and databases. Prior to 4.0.0-beta.464, an authenticated comm= and injection vulnerability in the CA Certificate management feature allows=
any authenticated user to execute arbitrary commands as the configured SSH=
user on the managed server host. As the SSH user typically would have to e= ither be root or part of the docker group for Coolify to function as intend= ed, this provides complete compromise of the managed server and associated = docker containers. This vulnerability is fixed in 4.0.0-beta.464.</td> <td>2026-06-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27957" target=3D= "_blank" rel=3D"noopener">CVE-2026-27957</a></td>
</tr>

<td class=3D"vendor-product">coollabsio--coolify</td>
<td>Coolify is an open-source and self-hostable tool for managing servers, = applications, and databases. Prior to 4.0.0-beta.471, an authenticated comm= and injection vulnerability in the Destination Network Management functiona= lity allows users with destination management permissions to execute arbitr= ary commands as root on managed servers. The "network" parameter is passed = directly to shell commands without proper sanitization, enabling full remot=
e code execution on the host system. This vulnerability is fixed in 4.0.0-b= eta.471.</td>
<td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34594" target=3D= "_blank" rel=3D"noopener">CVE-2026-34594</a></td>
</tr>

<td class=3D"vendor-product">coollabsio--coolify</td>
<td>Coolify is an open-source and self-hostable tool for managing servers, = applications, and databases. Prior to 4.0.0-beta.470, a critical Authentica= ted Host Remote Code Execution (RCE) vulnerability was discovered in Coolif=
y. The flaw resides in the handling of user-defined build parameters for th=
e Nixpacks build pack. Specifically, the install_command provided by a user=
is directly concatenated into a shell command string that is executed on t=
he deployment host during the building phase. An attacker can leverage this=
to escape the intended build context and execute arbitrary commands with h= ost-level privileges. This vulnerability is fixed in 4.0.0-beta.470.</td> <td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34597" target=3D= "_blank" rel=3D"noopener">CVE-2026-34597</a></td>
</tr>

<td class=3D"vendor-product">coollabsio--coolify</td>
<td>Coolify is an open-source and self-hostable tool for managing servers, = applications, and databases. Prior to 4.0.0-beta.471, Coolify server and pr= oject lookups are not scoped to the current team, allowing any authenticate=
d user to access servers and projects belonging to other teams by specifyin=
g their IDs directly. This vulnerability is fixed in 4.0.0-beta.471.</td> <td>2026-06-29</td>
<td>7.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34592" target=3D= "_blank" rel=3D"noopener">CVE-2026-34592</a></td>
</tr>

<td class=3D"vendor-product">coollabsio--coolify</td>
<td>Coolify is an open-source and self-hostable tool for managing servers, = applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the a= pplication's manual_webhook_secret_github field, which is used by Coolify's=
webhook endpoints to validate incoming requests, is nullable with no defau=
lt - meaning newly created applications have a null webhook secret. PHP's h= ash_hmac() function silently coerces a null key to an empty string ''. So w= hen the secret is null, the server computes hash_hmac('sha256', $payload, '=
') - a deterministic value that any attacker can calculate independently. B=
y sending X-Hub-Signature-256: sha256=3D&lt;hash_hmac('sha256', payload, ''= )&gt;, an unauthenticated attacker can forge a valid signature and trigger = deployments. This vulnerability is fixed in 4.0.0-beta.474.</td> <td>2026-06-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41896" target=3D= "_blank" rel=3D"noopener">CVE-2026-41896</a></td>
</tr>

<td class=3D"vendor-product">Cozmoslabs--Paid Member Subscriptions</td> <td>Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subsc= riptions &lt;=3D 3.0.4 versions.</td>
<td>2026-07-02</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57348" target=3D= "_blank" rel=3D"noopener">CVE-2026-57348</a></td>
</tr>

<td class=3D"vendor-product">cozyvision1--SMS Alert SMS &amp; OTP for WooCo= mmerce, Order Notifications &amp; Abandoned Cart Recovery</td>
<td>The SMS Alert - SMS &amp; OTP for WooCommerce, Order Notifications &amp=
; Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege e= scalation via account takeover in all versions up to, and including, 3.9.5.=
This is due to the plugin not properly validating a user's identity prior =
to updating their details like reset the password of any user account, incl= uding administrators, and gain full access to those accounts. This makes it=
possible for unauthenticated attackers to change arbitrary user's email ad= dresses, including administrators, and leverage that to reset the user's pa= ssword and gain access to their account. This is only vulnerable on sites w= ith OTP verification for password resets enabled, and where the administrat=
or (or other user) has set a phone number for OTP verification.</td> <td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11387" target=3D= "_blank" rel=3D"noopener">CVE-2026-11387</a></td>
</tr>

<td class=3D"vendor-product">Crawl4AI--Crawl4AI</td>
<td>Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulner= ability in the Docker API server's /execute_js endpoint, which accepts and = executes arbitrary user-supplied JavaScript in the server's browser context=
with --disable-web-security enabled. An attacker can execute arbitrary Jav= aScript and, combined with the browser's relaxed security settings, perform=
server-side request forgery against internal services.</td> <td>2026-06-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56264" target=3D= "_blank" rel=3D"noopener">CVE-2026-56264</a></td>
</tr>

<td class=3D"vendor-product">Creative Themes--Blocksy Companion Pro</td> <td>Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro &l= t;=3D 2.1.46 versions.</td>
<td>2026-07-02</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57624" target=3D= "_blank" rel=3D"noopener">CVE-2026-57624</a></td>
</tr>

<td class=3D"vendor-product">D-Link--DCS-935L</td>
<td>A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects=
the function sub_400E40 of the file setconf.cgi of the component POST Para= meter Handler. Such manipulation of the argument UID leads to os command in= jection. The attack can be launched remotely. The exploit has been disclose=
d to the public and may be used.</td>
<td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13545" target=3D= "_blank" rel=3D"noopener">CVE-2026-13545</a></td>
</tr>

<td class=3D"vendor-product">dapr--dapr</td>
<td>Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri o=
f the /.well-known/openid-configuration document from the request Host, hon= oring an attacker-controlled X-Forwarded-Host header without validation whe=
n no allowed-hosts list is configured (the default), and serves the documen=
t with a one-hour public cache lifetime. A remote unauthenticated attacker = can poison the discovery document so relying parties performing dynamic (un= pinned) discovery fetch the JWKS from an attacker-controlled server, causin=
g attacker-signed JWTs to be accepted. Exploitation requires the OIDC serve=
r enabled without a configured jwt-issuer or oidc-allowed-hosts.</td> <td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59096" target=3D= "_blank" rel=3D"noopener">CVE-2026-59096</a></td>
</tr>

<td class=3D"vendor-product">Dassault Systmes--BIOVIA Workbook</td>
<td>A Race Condition vulnerability affecting BIOVIA Workbook from Release 2= 021 through Release 2026 could allow a user to access unauthorized data fro=
m another user.</td>
<td>2026-07-01</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5120" target=3D"= _blank" rel=3D"noopener">CVE-2026-5120</a></td>
</tr>

<td class=3D"vendor-product">databasebackup--WP Database Backup Unlimited D= atabase &amp; Files Backup by Backup for WP</td>
<td>The WP Database Backup - Unlimited Database &amp; Files Backup by Backu=
p for WP plugin for WordPress is vulnerable to OS Command Injection in all = versions up to and including 7.11 via the `wp_db_exclude_table` parameter. = This is due to the direct concatenation of user-supplied `$_POST['wp_db_exc= lude_table']` values into the `mysqldump` shell command string in the `mysq= ldump()` function of `includes/admin/class-wpdb-admin.php` without wrapping=
them in `escapeshellarg()`-every other argument in the same command (DB_US= ER, DB_PASSWORD, host, filename, DB_NAME) is properly escaped, making the e= xclude-table values the sole exception-and because the only applied filteri= ng, `sanitize_text_field()` via `recursive_sanitize_text_field()`, strips H= TML tags but leaves shell metacharacters such as `;`, `|`, `` ` ``, and `$(=
)` intact. This makes it possible for authenticated attackers, with adminis= trator-level access and above, to execute arbitrary operating system comman=
ds on the server, potentially enabling full remote code execution. The inje= ction is stored: malicious values submitted through the plugin settings for=
m are persisted to the WordPress options table via `update_option('wp_db_ex= clude_table')` and later retrieved with `get_option()` and passed unsanitiz=
ed to `shell_exec()` whenever a backup operation runs.</td>
<td>2026-07-02</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9834" target=3D"= _blank" rel=3D"noopener">CVE-2026-9834</a></td>
</tr>

<td class=3D"vendor-product">Dell--Device Management Agent</td>
<td>Dell Device Management Agent, versions prior to DDMA 26.05, contain an = Improper Link Resolution Before File Access ('Link Following') vulnerabilit=
y. A low privileged attacker with local access could=C2=A0potentially explo=
it this vulnerability, leading to Elevation of Privileges.</td> <td>2026-07-01</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41121" target=3D= "_blank" rel=3D"noopener">CVE-2026-41121</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an Improper Neutralization of Special Elements used in an OS Command ('OS C= ommand Injection') vulnerability. A high privileged attacker with remote ac= cess could potentially exploit this vulnerability, leading to arbitrary com= mand execution.</td>
<td>2026-07-03</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49814" target=3D= "_blank" rel=3D"noopener">CVE-2026-49814</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an improper neutralization of special Elements used in an OS command ('OS c= ommand Injection') vulnerability. A high privileged attacker with remote ac= cess could potentially exploit this vulnerability, leading to execution of = arbitrary OS commands.</td>
<td>2026-07-03</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49815" target=3D= "_blank" rel=3D"noopener">CVE-2026-49815</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an improper neutralization of special elements used in an OS command ('OS c= ommand Injection') vulnerability. A high privileged attacker with remote ac= cess could potentially exploit this vulnerability, leading to command execu= tion.</td>
<td>2026-07-03</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53478" target=3D= "_blank" rel=3D"noopener">CVE-2026-53478</a></td>
</tr>

<td class=3D"vendor-product">deltaww--AS228T</td>
<td>AS228T with Authentication Bypass Vulnerability</td>
<td>2026-07-01</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12579" target=3D= "_blank" rel=3D"noopener">CVE-2026-12579</a></td>
</tr>

<td class=3D"vendor-product">deltaww--DVP80ES3</td>
<td>DVP80ES3 with=C2=A0 Improper Resource Shutdown or Release vulnerability= .</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12575" target=3D= "_blank" rel=3D"noopener">CVE-2026-12575</a></td>
</tr>

<td class=3D"vendor-product">deltaww--DVP80ES3</td>
<td>DVP80ES3 with Improper Enforcement of Message Integrity During Transmis= sion in a Communication Channel vulnerability.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12576" target=3D= "_blank" rel=3D"noopener">CVE-2026-12576</a></td>
</tr>

<td class=3D"vendor-product">deltaww--DVP80ES300T</td>
<td>DVP80ES300T with Improper Validation of Array Index Vulnerability</td> <td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14193" target=3D= "_blank" rel=3D"noopener">CVE-2026-14193</a></td>
</tr>

<td class=3D"vendor-product">Design themes--Kids Zone - Children WordPress = Theme</td>
<td>Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children Word= Press Theme &lt;=3D 5.4 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69156" target=3D= "_blank" rel=3D"noopener">CVE-2025-69156</a></td>
</tr>

<td class=3D"vendor-product">Designthemes--Fitness Zone WordPress Theme</td=

<td>Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Th= eme &lt;=3D 5.7 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69155" target=3D= "_blank" rel=3D"noopener">CVE-2025-69155</a></td>
</tr>

<td class=3D"vendor-product">Designthemes--Kids Life | Children School Word= Press</td>
<td>Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children Scho=
ol WordPress &lt;=3D 5.2 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27402" target=3D= "_blank" rel=3D"noopener">CVE-2026-27402</a></td>
</tr>

<td class=3D"vendor-product">Designthemes--LMS</td>
<td>Unauthenticated Cross Site Scripting (XSS) in LMS &lt;=3D 9.7 versions.= </td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27404" target=3D= "_blank" rel=3D"noopener">CVE-2026-27404</a></td>
</tr>

<td class=3D"vendor-product">designthemes--SpaLab | Beauty Salon WordPress = Theme</td>
<td>Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon Wor= dPress Theme &lt;=3D 6.7 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69154" target=3D= "_blank" rel=3D"noopener">CVE-2025-69154</a></td>
</tr>

<td class=3D"vendor-product">designthemes--Trendy Travel</td> <td>Unauthenticated Cross Site Scripting (XSS) in Trendy Travel &lt;=3D 6.7=
versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69153" target=3D= "_blank" rel=3D"noopener">CVE-2025-69153</a></td>
</tr>

<td class=3D"vendor-product">dhruvin--Custom Payment Gateways for WooCommer= ce</td>
<td>The Custom Payment Gateways for WooCommerce plugin for WordPress is vul= nerable to Stored Cross-Site Scripting via the 'alg_wc_cpg_input_fields' pa= rameter in all versions up to, and including, 2.1.0 due to insufficient inp=
ut sanitization and output escaping. This makes it possible for unauthentic= ated attackers to inject arbitrary web scripts in pages that will execute w= henever a user accesses an injected page. This vulnerability is exploitable=
by unauthenticated guest users submitting a crafted checkout POST request,=
requiring no custom input fields to be configured in the plugin.</td> <td>2026-07-01</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7517" target=3D"= _blank" rel=3D"noopener">CVE-2026-7517</a></td>
</tr>

<td class=3D"vendor-product">Divi Engine--Divi Form Builder</td>
<td>The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary F= ile Upload leading to Remote Code Execution in all versions up to and inclu= ding 5.1.8. This is due to insufficient file extension validation in the do= _image_upload() function where user-supplied input from the acceptFileTypes=
POST parameter is directly interpolated into a regular expression used to = validate uploaded files. Attackers can specify PHP-executable extensions su=
ch as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess prote= ction which only blocks .php files specifically. Additionally, on Nginx-bas=
ed servers, the .htaccess protection is completely ineffective as Nginx doe=
s not process .htaccess files. This makes it possible for unauthenticated a= ttackers (who can obtain a nonce from any public page containing a form) to=
upload executable PHP files to the publicly accessible /wp-content/uploads= /de_fb_uploads/ directory and achieve Remote Code Execution by accessing th=
e uploaded file via HTTP. The vulnerability was partially patched in versio=
n 5.1.3.</td>
<td>2026-07-02</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5524" target=3D"= _blank" rel=3D"noopener">CVE-2026-5524</a></td>
</tr>

<td class=3D"vendor-product">Dolibarr--dolibarr</td>
<td>Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql inject= ion vulnerability that allows authenticated API users to exfiltrate arbitra=
ry database contents by supplying malicious values to the sqlfilters query = parameter in the setup dictionary and multicurrencies REST API endpoints. T=
he affected endpoints in api_setup.class.php and api_multicurrencies.class.= php validate sqlfilters only for balanced parentheses and rewrite matched t= riplets, allowing text placed outside the expected shape such as an appende=
d UNION SELECT to be concatenated into the SQL WHERE clause unmodified, ena= bling retrieval of sensitive data including password hashes and API keys.</=

<td>2026-06-30</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58376" target=3D= "_blank" rel=3D"noopener">CVE-2026-58376</a></td>
</tr>

<td class=3D"vendor-product">e4jvikwp--VikBooking Hotel Booking Engine &amp=
; PMS</td>
<td>Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking = Hotel Booking Engine &amp; PMS allows Path Traversal. This issue affects Vi= kBooking Hotel Booking Engine &amp; PMS: from n/a through 1.8.12.</td> <td>2026-07-01</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57723" target=3D= "_blank" rel=3D"noopener">CVE-2026-57723</a></td>
</tr>

<td class=3D"vendor-product">Eclipse Foundation--Eclipse CSI - PIA</td> <td>PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefi=
x check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, = pia/models.py:139) instead of validating the issuer as a properly host-boun= ded URL. An attacker can craft an issuer such as https://ci.eclipse.org@evi= l.host (userinfo trick) or https://ci.eclipse.org.evil.host (suffix trick) = that satisfies the prefix check while pointing the OIDC discovery and JWKS = fetches at a server the attacker controls. An unauthenticated caller of POS=
T /v1/upload/sbom can use this to force PIA to make outbound HTTP(S) reques=
ts to an arbitrary attacker-chosen host, and to have oidc.verify_token acce=
pt a JWT signed with the attacker's own key.</td>
<td>2026-07-02</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14336" target=3D= "_blank" rel=3D"noopener">CVE-2026-14336</a></td>
</tr>

<td class=3D"vendor-product">Eclipse Foundation--Eclipse Parsson</td>
<td>In Eclipse Parsson published Maven Central artifacts before version 1.1= .8, the JSON parser did not enforce a default maximum on the number of char= acters consumed while parsing a single JSON document. Applications that par=
se attacker- controlled JSON can be forced to consume excessive CPU and mem= ory by processing very large documents, including large arrays, objects, st= rings, numbers, whitespace, or nested structures, resulting in a denial of = service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing li= mit with a default limit of 15 million parser-consumed characters.</td> <td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9563" target=3D"= _blank" rel=3D"noopener">CVE-2026-9563</a></td>
</tr>

<td class=3D"vendor-product">Eclipse Foundation--Eclipse Theia</td>
<td>In affected versions of Eclipse Theia (1.8.1 and later), the browser ba= ckend exposes privileged terminal RPC over WebSocket (/services/shell-termi= nal, /services/terminals/:id) without service-level authentication. WebSock=
et origin validation in @theia/core is fail-open: connections are accepted = when the Origin header is missing or when no THEIA_HOSTS allowlist is confi= gured (the default). The Socket.IO integration additionally replaces the re=
al Origin header with a client-supplied fix-origin header that an attacker = can control or omit. As a result, a foreign-origin web page visited by a us=
er with a running Theia instance can open the /services WebSocket namespace=
, invoke terminal creation, attach to the resulting terminal data channel, = execute arbitrary OS commands, and read their output. This affects both loc=
al developer setups (drive-by attack) and hosted or tunneled deployments wi= thout strong external authentication. A fix is in development that enforces=
same-origin validation by default, removes trust in the fix-origin header,=
gates HTTP and WebSocket access on a SameSite=3DStrict; HttpOnly connectio= n-token cookie, and sanitizes shell terminal creation options.</td> <td>2026-07-03</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10054" target=3D= "_blank" rel=3D"noopener">CVE-2026-10054</a></td>
</tr>

<td class=3D"vendor-product">Eclipse Foundation--Eclipse Theia</td>
<td>In Eclipse Theia since version 1.26.0, the backend /services/request-se= rvice RPC accepts an attacker-controlled URL from any client connected to t=
he standard /services messaging endpoint, performs the HTTP request server-= side, and returns the full response body to the caller. Because the destina= tion URL is neither validated nor allowlisted, a remote attacker with acces=
s to the Theia service connection can issue server-side HTTP requests to lo= calhost or other backend-reachable hosts and read their responses, exposing=
internal administrative endpoints, cloud instance metadata services, and o= ther resources that are intentionally outside the browser network boundary.=
The vulnerability affects deployments where the Theia service connection i=
s reachable by untrusted users (for example, multi-tenant or publicly-reach= able Theia deployments).</td>
<td>2026-07-03</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10055" target=3D= "_blank" rel=3D"noopener">CVE-2026-10055</a></td>
</tr>

<td class=3D"vendor-product">eclipse-wakaama--wakaama</td>
<td>Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory=
allocation vulnerability in the CoAP Block1 handler within coap/block.c th=
at allows unauthenticated remote attackers to exhaust server memory by send= ing a sequence of Block1 PUT requests with incrementing block numbers. Atta= ckers can target the registration endpoint over UDP without authentication,=
causing the server to repeatedly reallocate a growing accumulation buffer =
by appending each block payload without enforcing any maximum total size li= mit, resulting in denial of service through memory exhaustion.</td> <td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58465" target=3D= "_blank" rel=3D"noopener">CVE-2026-58465</a></td>
</tr>

<td class=3D"vendor-product">Edimax--EW-7478APC</td>
<td>A flaw has been found in Edimax EW-7478APC 1.04. This affects the funct= ion formiNICSiteSurvey of the file /goform/formiNICSiteSurvey of the compon= ent POST Request Handler. This manipulation of the argument selSSID causes = buffer overflow. It is possible to initiate the attack remotely. The exploi=
t has been published and may be used. The vendor was contacted early about = this disclosure but did not respond in any way.</td>
<td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13562" target=3D= "_blank" rel=3D"noopener">CVE-2026-13562</a></td>
</tr>

<td class=3D"vendor-product">Edimax--EW-7478APC</td>
<td>A vulnerability has been found in Edimax EW-7478APC 1.04. This impacts = the function formL2TPSetup of the file /goform/formL2TPSetup of the compone=
nt POST Request Handler. Such manipulation of the argument L2TPUserName lea=
ds to stack-based buffer overflow. It is possible to launch the attack remo= tely. The exploit has been disclosed to the public and may be used. The ven= dor was contacted early about this disclosure but did not respond in any wa= y.</td>
<td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13563" target=3D= "_blank" rel=3D"noopener">CVE-2026-13563</a></td>
</tr>

<td class=3D"vendor-product">Edimax--EW-7478APC</td>
<td>A vulnerability was found in Edimax EW-7478APC 1.04. Affected is the fu= nction formPPPoESetup of the file /goform/formPPPoESetup of the component P= OST Request Handler. Performing a manipulation of the argument pppUserName = results in stack-based buffer overflow. The attack can be initiated remotel=
y. The exploit has been made public and could be used. The vendor was conta= cted early about this disclosure but did not respond in any way.</td> <td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13564" target=3D= "_blank" rel=3D"noopener">CVE-2026-13564</a></td>
</tr>

<td class=3D"vendor-product">Edimax--EW-7478APC</td>
<td>A security vulnerability has been detected in Edimax EW-7478APC 1.04. T= his affects the function formQoS of the file /goform/formQoS of the compone=
nt POST Request Handler. The manipulation of the argument selSSID leads to = buffer overflow. Remote exploitation of the attack is possible. The exploit=
has been disclosed publicly and may be used. The vendor was contacted earl=
y about this disclosure but did not respond in any way.</td> <td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13580" target=3D= "_blank" rel=3D"noopener">CVE-2026-13580</a></td>
</tr>

<td class=3D"vendor-product">Edimax--EW-7478APC</td>
<td>A flaw has been found in Edimax EW-7478APC 1.04. This issue affects the=
function formUSBAccount of the file /goform/formUSBAccount of the componen=
t POST Request Handler. This manipulation of the argument UserName/Password=
causes buffer overflow. The attack is possible to be carried out remotely.=
The exploit has been published and may be used. The vendor was contacted e= arly about this disclosure but did not respond in any way.</td> <td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13582" target=3D= "_blank" rel=3D"noopener">CVE-2026-13582</a></td>
</tr>

<td class=3D"vendor-product">Edimax--EW-7478APC</td>
<td>A vulnerability has been found in Edimax EW-7478APC 1.04. Impacted is t=
he function formUSBFolder of the file /goform/formUSBFolder of the componen=
t POST Request Handler. Such manipulation of the argument ShareName/SelectN= ame leads to buffer overflow. The attack may be performed from remote. The = exploit has been disclosed to the public and may be used. The vendor was co= ntacted early about this disclosure but did not respond in any way.</td> <td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13583" target=3D= "_blank" rel=3D"noopener">CVE-2026-13583</a></td>
</tr>

<td class=3D"vendor-product">Eksagate Electronic Engineering and Computer I= ndustry Trade Inc.--SYSGUARD 6001</td>
<td>Improper neutralization of special elements used in an SQL command ('SQ=
L injection') vulnerability in Eksagate Electronic Engineering and Computer=
Industry Trade Inc. SYSGUARD 6001 allows Blind SQL Injection. This issue a= ffects SYSGUARD 6001: from 2.0.2 before 6.1.16.0.=C2=A0 NOTE: The vendor wa=
s contacted and it was learned that the product is not supported.</td> <td>2026-06-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8402" target=3D"= _blank" rel=3D"noopener">CVE-2026-8402</a></td>
</tr>

<td class=3D"vendor-product">Elastic--Kibana</td>
<td>Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to=
log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker = can supply specially crafted input that is written to log files without pro= per neutralization. When the log files are subsequently viewed in a termina=
l that interprets control sequences, the injected content may alter the dis= played log data.</td>
<td>2026-07-01</td>
<td>8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49091" target=3D= "_blank" rel=3D"noopener">CVE-2026-49091</a></td>
</tr>

<td class=3D"vendor-product">Elated-Themes--Audrey</td>
<td>Unauthenticated Local File Inclusion in Audrey &lt;=3D 1.5 versions.</t=

<td>2026-07-02</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-42382" target=3D= "_blank" rel=3D"noopener">CVE-2026-42382</a></td>
</tr>

<td class=3D"vendor-product">electron-userland--electron-builder</td> <td>electron-updater allows for automatic updates for Electron apps. Prior =
to 26.15.0, AppImage targets built by app-builder-lib could use an empty pa=
th component when setting the LD_LIBRARY_PATH environment variable at runti= me. This causes the current working directory to be added to the dynamic li= nker search path, which may allow an attacker to execute arbitrary code by = placing a malicious shared library in the directory from which the AppImage=
is launched. This issue has been fixed in version 26.15.0.</td> <td>2026-06-30</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54672" target=3D= "_blank" rel=3D"noopener">CVE-2026-54672</a></td>
</tr>

<td class=3D"vendor-product">elemntor--Image Optimizer Optimize Images and = Convert to WebP or AVIF</td>
<td>The Image Optimizer plugin for WordPress is vulnerable to arbitrary fil=
e deletion in versions up to and including 1.7.4. This is due to insufficie=
nt path validation in the Image_Backup::remove() function where backup file=
paths stored in post meta are used directly in file deletion operations wi= thout verifying they are within the uploads directory. The plugin stores ba= ckup file paths in the image_optimizer_metadata post meta field and trusts = these paths completely when deleting backups on the delete_attachment hook.=
An authenticated attacker with Author-level access can edit the image_opti= mizer_metadata post meta on their own attachments via WordPress's Custom Fi= elds interface, injecting arbitrary absolute file paths into the backups ar= ray. When the attacker subsequently deletes the attachment, the plugin call=
s File_System::delete() on each path without validation. This makes it poss= ible for authenticated attackers, with Author-level access and above, to de= lete arbitrary files on the server within the web server's filesystem permi= ssions, potentially leading to denial of service, data loss, or security de= gradation.</td>
<td>2026-07-02</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5821" target=3D"= _blank" rel=3D"noopener">CVE-2026-5821</a></td>
</tr>

<td class=3D"vendor-product">emarket-design--Request a Quote Quote Forms fo=
r Any WordPress Site</td>
<td>The Request a Quote plugin for WordPress is vulnerable to Code Injectio=
n in versions up to, and including, 2.5.5 via the emd_delete_file AJAX acti= on. This is due to the emd_delete_file() handler deriving a PHP function na=
me from the attacker-controlled $_POST['path'] parameter and invoking it dy= namically via the variable-function call $sess_name(), and the handler bein=
g registered for wp_ajax_nopriv with its only protection being a nonce that=
the plugin prints into the public quote-form page via wp_localize_script. = This makes it possible for unauthenticated attackers to invoke arbitrary ze= ro-argument PHP functions on the server, such as phpinfo(), potentially exp= osing sensitive server configuration and credentials, or executing other de= structive built-in PHP functions.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14249" target=3D= "_blank" rel=3D"noopener">CVE-2026-14249</a></td>
</tr>

<td class=3D"vendor-product">emarket-design--Video Gallery YouTube Gallery,=
Playlist &amp; Video Grid</td>
<td>The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Fu= nction Call in versions up to and including 4.0.3. This is due to insuffici= ent validation of the 'path' parameter in the emd_delete_file() AJAX handle=
r in includes/common-functions.php. The user-supplied value is passed throu=
gh sanitize_text_field(), has its trailing '_PLUGIN_DIR' substring stripped=
, and is then invoked as a PHP function name with no arguments via `$sess_n= ame()`. The handler is gated only by a nonce - no current_user_can() check =
is present - and the nonce is emitted on any front-end page that renders a = form shortcode containing file fields. This makes it possible for authentic= ated attackers, with Subscriber-level access and above, to invoke arbitrary=
zero-argument PHP functions (such as phpinfo, phpversion, get_defined_vars=
, error_get_last), resulting in sensitive information disclosure and potent= ial further compromise depending on the functions available in the environm= ent.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12923" target=3D= "_blank" rel=3D"noopener">CVE-2026-12923</a></td>
</tr>

<td class=3D"vendor-product">Empirum--Matrix42</td>
<td>PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 cre= ates a named pipe (\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ=
and GENERIC_WRITE permissions to all authenticated users. A low-privileged=
local attacker can connect to this pipe and send crafted IPC messages to t= rigger execution of arbitrary commands with SYSTEM privileges via an untrus= ted search path. This allows privilege escalation by placing a malicious sh= adow.exe in a controlled working directory.</td>
<td>2026-06-29</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57919" target=3D= "_blank" rel=3D"noopener">CVE-2026-57919</a></td>
</tr>

<td class=3D"vendor-product">Epiphyt--Embed Privacy</td>
<td>Improper Limitation of a Pathname to a Restricted Directory ('Path Trav= ersal') vulnerability in Epiphyt Embed Privacy allows Path Traversal. This = issue affects Embed Privacy: from n/a through 1.12.3.</td>
<td>2026-06-29</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57346" target=3D= "_blank" rel=3D"noopener">CVE-2026-57346</a></td>
</tr>

<td class=3D"vendor-product">Epsiloncool--WP Fast Total Search</td> <td>Unauthenticated SQL Injection in WP Fast Total Search &lt;=3D 1.80.280 = versions.</td>
<td>2026-07-02</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57683" target=3D= "_blank" rel=3D"noopener">CVE-2026-57683</a></td>
</tr>

<td class=3D"vendor-product">EstrellaXD--Auto_Bangumi</td>
<td>AutoBangumi before 3.2.8 contains a hard-coded default credentials vuln= erability that allows unauthenticated attackers to authenticate as the admi= nistrator by using the publicly known default credentials seeded at startup=
via add_default_user() in the database user module when the users table is=
empty. Attackers can submit the default credentials to the authentication = login endpoint to gain full control of the application, including RSS feed = configuration, downloader configuration, and all authenticated API endpoint= s.</td>
<td>2026-07-02</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58466" target=3D= "_blank" rel=3D"noopener">CVE-2026-58466</a></td>
</tr>

<td class=3D"vendor-product">etruel--WPeMatico RSS Feed Fetcher</td> <td>Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetche=
r &lt;=3D 2.8.17 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57349" target=3D= "_blank" rel=3D"noopener">CVE-2026-57349</a></td>
</tr>

<td class=3D"vendor-product">EventON--EventON (Pro) - WordPress Virtual Eve=
nt Calendar Plugin</td>
<td>The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPr= ess (full) is vulnerable to SQL Injection via the WordPress 'search' parame= ter in versions up to, and including, 5.0.11 due to insufficient escaping o=
n the user supplied parameter and lack of preparation on the existing SQL q= uery. This makes it possible for unauthenticated attackers to append additi= onal SQL queries into already existing queries that can be used to extract = sensitive information from the database, granted the "Enable additional sea= rch queries" setting is enabled and at least one published event exists.</t=

<td>2026-06-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9711" target=3D"= _blank" rel=3D"noopener">CVE-2026-9711</a></td>
</tr>

<td class=3D"vendor-product">fast-uri--fast-uri</td>
<td>fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Un= icode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a=
helper that does not exist on the global URL constructor, silently leaving=
the host in its original Unicode form while normalize() and equal() still = return values that differ from a WHATWG-compatible URL parser. Applications=
that use fast-uri to enforce host-based policy (denylists, loopback filter= ing, redirect validation, outbound proxy routing) before passing the same U=
RL to Node's URL or fetch can be bypassed when the two implementations reso= lve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 f=
or the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy=
using the same URL parser used for the actual request, or reject non-ASCII=
hosts before policy checks.</td>
<td>2026-06-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13676" target=3D= "_blank" rel=3D"noopener">CVE-2026-13676</a></td>
</tr>

<td class=3D"vendor-product">Feast--Feast Feature Server</td>
<td>A vulnerability has been identified in the Feast Feature Server's `/sav= e-document` endpoint that allows an unauthenticated remote attacker to writ=
e arbitrary JSON files to the server's filesystem. Although the system atte= mpts to restrict file locations, these protections can be bypassed, enablin=
g an attacker to overwrite vital application configurations or startup scri= pts. Because this flaw requires no credentials or special privileges, any a= ttacker with network access to the server can potentially compromise the in= tegrity of the system. This could lead to unauthorized system modifications=
, denial of service through disk exhaustion, or potential remote code execu= tion.</td>
<td>2026-07-01</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-23537" target=3D= "_blank" rel=3D"noopener">CVE-2026-23537</a></td>
</tr>

<td class=3D"vendor-product">Feehi--CMS</td>
<td>A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability = affects unknown code of the file /api/articles of the component REST API En= dpoint. Performing a manipulation results in missing authentication. The at= tack may be initiated remotely. The exploit has been made public and could =
be used. The project was informed of the problem early through an issue rep= ort but has not responded yet.</td>
<td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13546" target=3D= "_blank" rel=3D"noopener">CVE-2026-13546</a></td>
</tr>

<td class=3D"vendor-product">Flowise--Flowise</td>
<td>Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak=
hardcoded default secret ('flowise') for the express-session middleware wh=
en the EXPRESS_SESSION_SECRET environment variable is not set (packages/ser= ver/src/enterprise/middleware/passport/index.ts). Because this default secr=
et is publicly visible in the source code, an attacker can forge valid sign=
ed session cookies to impersonate any user and bypass authentication.</td> <td>2026-06-30</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56278" target=3D= "_blank" rel=3D"noopener">CVE-2026-56278</a></td>
</tr>

<td class=3D"vendor-product">Frangoteam--FUXA SCADA/HMI</td>
<td>FUXA versions 1.3.1 and prior contain an authentication bypass vulnerab= ility via dot-segment path normalization in the REST API. The API router fa= ils to normalize dot-segment sequences before applying authentication middl= eware, allowing unauthenticated requests to access protected endpoints by p= refixing paths with dot-segments such as /api/./users, /api/./roles, and /a= pi/project/../users. These requests bypass authentication checks and return=
sensitive user and role data without credentials.</td>
<td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13207" target=3D= "_blank" rel=3D"noopener">CVE-2026-13207</a></td>
</tr>

<td class=3D"vendor-product">FrontAccounting--FrontAccounting</td> <td>FrontAccounting before 2.4.20 contains a path traversal vulnerability i=
n the attachment upload handler that allows authenticated attackers to exec= ute arbitrary code by uploading files with traversal sequences in the uniqu= e_name parameter. Attackers can supply path traversal sequences ../../../sh= ell.php to write files outside the intended attachments directory into the = web root, and by uploading PHP files without extension validation, achieve = remote code execution as the web server user.</td>
<td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-40521" target=3D= "_blank" rel=3D"noopener">CVE-2026-40521</a></td>
</tr>

<td class=3D"vendor-product">FrontAccounting--FrontAccounting</td> <td>FrontAccounting before 2.4.20 contains a SQL injection vulnerability in=
the Audit Trail report handler that allows authenticated attackers with SA= _GLANALYTIC permission to execute arbitrary SQL queries by injecting malici= ous code into the PARAM_2 and PARAM_3 POST parameters. Attackers can exploi=
t time-based blind SQL injection through SLEEP() functions that are amplifi=
ed across JOIN result sets to cause denial of service by exhausting databas=
e connections, or extract arbitrary database content through UNION-based in= jection techniques.</td>
<td>2026-06-29</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-40523" target=3D= "_blank" rel=3D"noopener">CVE-2026-40523</a></td>
</tr>

<td class=3D"vendor-product">FrontAccounting--FrontAccounting</td> <td>FrontAccounting before 2.4.20 contains a SQL injection vulnerability in=
the get_gl_transactions() function where the filter_type parameter is conc= atenated directly into a SQL IN() clause without parameterization. Attacker=
s with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a clo= sing parenthesis followed by malicious conditions to extract sensitive jour= nal entry data through boolean-based blind SQL injection with reliable resp= onse size differentials.</td>
<td>2026-06-29</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-40524" target=3D= "_blank" rel=3D"noopener">CVE-2026-40524</a></td>
</tr>

<td class=3D"vendor-product">FrontAccounting--FrontAccounting</td> <td>FrontAccounting before 2.4.20 contains a SQL injection vulnerability in=
the Bank Statement report handler that allows authenticated attackers to e= xtract arbitrary database data by injecting UNION SELECT payloads into the = PARAM_0 POST parameter. Attackers can supply malicious SQL syntax through t=
he unparameterized WHERE clause to retrieve sensitive information including=
usernames, password hashes, and email addresses from the users table, rend= ered into PDF report output.</td>
<td>2026-06-29</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-40522" target=3D= "_blank" rel=3D"noopener">CVE-2026-40522</a></td>
</tr>

<td class=3D"vendor-product">Fuelthemes--Werkstatt</td>
<td>Contributor PHP Object Injection in Werkstatt &lt;=3D 4.8.3 versions.</=

<td>2026-07-02</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27414" target=3D= "_blank" rel=3D"noopener">CVE-2026-27414</a></td>
</tr>

<td class=3D"vendor-product">Gardyn--Gardyn Home Firmware</td>
<td>Gardyn devices expose a privileged iothubowner key. Access to this key = will allow a malicious user to invoke an IoTHub Registry Manager function w= hich returns connection information for all Gardyn Home Kit and Studio devi= ces. Access to this key also allows a malicious user to execute arbitrary c= ommands on a specific connected device and may allow the malicious user to = pivot to other devices on the user's network.</td>
<td>2026-07-02</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13768" target=3D= "_blank" rel=3D"noopener">CVE-2026-13768</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. In or= der to access the websocket server, no authentication is required. As such,=
any malicious website can attempt to open a connection to the server and p= otentially access sensitive APIs. In particular, it's possible to call a co= mbination of the `create` method and `getScreenCapture` to retrieve the con= tent of the user's screen.</td>
<td>2026-07-02</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13125" target=3D= "_blank" rel=3D"noopener">CVE-2026-13125</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. Many of = the commands will take an `index` value that is then used to access various=
arrays to enter critical sections, perform various actions via function ca= lls, etc. However the `index` value is usually not checked for valid range,=
and as such it can be used to access multiple arrays out-of-bound. #### co= nnectInfo command index-out-of-bound</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13131" target=3D= "_blank" rel=3D"noopener">CVE-2026-13131</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. Many of = the commands will take an `index` value that is then used to access various=
arrays to enter critical sections, perform various actions via function ca= lls, etc. However the `index` value is usually not checked for valid range,=
and as such it can be used to access multiple arrays out-of-bound. #### se= tStream command index-out-of-bound</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13132" target=3D= "_blank" rel=3D"noopener">CVE-2026-13132</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. Many of = the commands will take an `index` value that is then used to access various=
arrays to enter critical sections, perform various actions via function ca= lls, etc. However the `index` value is usually not checked for valid range,=
and as such it can be used to access multiple arrays out-of-bound. #### se= tPIP command index-out-of-bound</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57264" target=3D= "_blank" rel=3D"noopener">CVE-2026-57264</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. Many of = the commands will take an `index` value that is then used to access various=
arrays to enter critical sections, perform various actions via function ca= lls, etc. However the `index` value is usually not checked for valid range,=
and as such it can be used to access multiple arrays out-of-bound. #### au= dio command index-out-of-bound</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57265" target=3D= "_blank" rel=3D"noopener">CVE-2026-57265</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. Many of = the commands will take an `index` value that is then used to access various=
arrays to enter critical sections, perform various actions via function ca= lls, etc. However the `index` value is usually not checked for valid range,=
and as such it can be used to access multiple arrays out-of-bound. #### 2w= ayAudio command index-out-of-bound</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57266" target=3D= "_blank" rel=3D"noopener">CVE-2026-57266</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. Many of = the commands will take an `index` value that is then used to access various=
arrays to enter critical sections, perform various actions via function ca= lls, etc. However the `index` value is usually not checked for valid range,=
and as such it can be used to access multiple arrays out-of-bound. #### sn= apshot command index-out-of-bound</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57267" target=3D= "_blank" rel=3D"noopener">CVE-2026-57267</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. Many of = the commands will take an `index` value that is then used to access various=
arrays to enter critical sections, perform various actions via function ca= lls, etc. However the `index` value is usually not checked for valid range,=
and as such it can be used to access multiple arrays out-of-bound. ### sav= eVideo command index-out-of-bound When sending the `saveVideo` command, the=
`index` field is extracted from the websocket message [1]. Then without ch= ecking the range of the index, it is used to trigger a CriticalSection ([2]=
) and releases it [3]. The release function call ([3]) is executed using a = function pointer which will be read out of bounds potentially leading to co=
de execution: v6 =3D get_entry(a2, "index"); result =3D json_is_value_int(v= 6); if ( (_BYTE)result ) { v8 =3D get_entry(a2, "index"); index =3D json_va= lue_to_int(&amp;v8-&gt;value); // [1] result =3D CCriticalSection::EnterCri= tSection(&amp;this-&gt;crit_sections[index]); //[2] if ( result ) { if ( th= is-&gt;array_of_IPCams[index] ) { if ( this-&gt;array_of_IPCams[index]-&gt;= field_20 ) do_PostMessageA((CViewer *)this-&gt;array_of_IPCams[index], 0x11= 1u, 0x139Fu, v11); } return (*(int (__thiscall **)(CCriticalSection *))(thi= s-&gt;crit_sections[index].vtbl + 20))(&amp;this-&gt;crit_sections[index]);=
//[3] } }</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57268" target=3D= "_blank" rel=3D"noopener">CVE-2026-57268</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. Many of = the commands will take an `index` value that is then used to access various=
arrays to enter critical sections, perform various actions via function ca= lls, etc. However the `index` value is usually not checked for valid range,=
and as such it can be used to access multiple arrays out-of-bound. #### di= sconnect command index-out-of-bound</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57269" target=3D= "_blank" rel=3D"noopener">CVE-2026-57269</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. Many of = the commands will take an `index` value that is then used to access various=
arrays to enter critical sections, perform various actions via function ca= lls, etc. However the `index` value is usually not checked for valid range,=
and as such it can be used to access multiple arrays out-of-bound. #### pl=
ay command index-out-of-bound</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57270" target=3D= "_blank" rel=3D"noopener">CVE-2026-57270</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. #### = pause command index-out-of-bound</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57271" target=3D= "_blank" rel=3D"noopener">CVE-2026-57271</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. Many of = the commands will take an `index` value that is then used to access various=
arrays to enter critical sections, perform various actions via function ca= lls, etc. However the `index` value is usually not checked for valid range,=
and as such it can be used to access multiple arrays out-of-bound. #### by= Pass command index-out-of-bound</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57272" target=3D= "_blank" rel=3D"noopener">CVE-2026-57272</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. One of t= hem, `connectionInfo` is meant to provide the necessary details to connect =
to a camera. The handler associated with this command that we call`handle_c= onnection_info` contains multiple instances of string copy that can overflo=
w. The function `handle_connect_info` copies attacker-controlled JSON strin=
gs into fixed-size buffers using manual byte-by-byte loops that do not enfo= rce length limits. #### Buffer Overflow in username field (no key present)<=

<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57273" target=3D= "_blank" rel=3D"noopener">CVE-2026-57273</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. One of t= hem, `connectionInfo` is meant to provide the necessary details to connect =
to a camera. The handler associated with this command that we call`handle_c= onnection_info` contains multiple instances of string copy that can overflo=
w. The function `handle_connect_info` copies attacker-controlled JSON strin=
gs into fixed-size buffers using manual byte-by-byte loops that do not enfo= rce length limits. #### Buffer Overflow in password field (no key present)<=

<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57274" target=3D= "_blank" rel=3D"noopener">CVE-2026-57274</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. One of t= hem, `connectionInfo` is meant to provide the necessary details to connect =
to a camera. The handler associated with this command that we call`handle_c= onnection_info` contains multiple instances of string copy that can overflo=
w. The function `handle_connect_info` copies attacker-controlled JSON strin=
gs into fixed-size buffers using manual byte-by-byte loops that do not enfo= rce length limits. #### Buffer Overflow in username field (key present)</td=

<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57275" target=3D= "_blank" rel=3D"noopener">CVE-2026-57275</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. One of t= hem, `connectionInfo` is meant to provide the necessary details to connect =
to a camera. The handler associated with this command that we call`handle_c= onnection_info` contains multiple instances of string copy that can overflo=
w. The function `handle_connect_info` copies attacker-controlled JSON strin=
gs into fixed-size buffers using manual byte-by-byte loops that do not enfo= rce length limits. #### Buffer Overflow in password field (key present)</td=

<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57276" target=3D= "_blank" rel=3D"noopener">CVE-2026-57276</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. One of t= hem, `connectionInfo` is meant to provide the necessary details to connect =
to a camera. The handler associated with this command that we call`handle_c= onnection_info` contains multiple instances of string copy that can overflo=
w. The function `handle_connect_info` copies attacker-controlled JSON strin=
gs into fixed-size buffers using manual byte-by-byte loops that do not enfo= rce length limits. #### Buffer Overflow in key field</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57277" target=3D= "_blank" rel=3D"noopener">CVE-2026-57277</a></td>
</tr>

<td class=3D"vendor-product">GeoVision Inc.--GeoWebPlayer</td>
<td>GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and = "WS Player" for VMS-Cloud) is an addon that can be installed with various G= eoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server th=
at expands the capabilities of the various web-interfaces provided by the G= eoVision software and may be necessary for them to function properly. The W= ebsocket server can accept various commands coming from localhost. One of t= hem, `connectionInfo` is meant to provide the necessary details to connect =
to a camera. The handler associated with this command that we call`handle_c= onnection_info` contains multiple instances of string copy that can overflo=
w. The function `handle_connect_info` copies attacker-controlled JSON strin=
gs into fixed-size buffers using manual byte-by-byte loops that do not enfo= rce length limits. #### Buffer Overflow in ip field</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57278" target=3D= "_blank" rel=3D"noopener">CVE-2026-57278</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROX= Y_TRUSTED_PROXIES=3D* by default, allowing any source IP to impersonate a u= ser when reverse-proxy authentication headers such as X-WEBAUTH-USER are en= abled.</td>
<td>2026-07-03</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20896" target=3D= "_blank" rel=3D"noopener">CVE-2026-20896</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions up to and including 1.26.2 have incomplete SSRF protecti=
on in webhook and migration allow-list filtering.</td>
<td>2026-07-03</td>
<td>9.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-22874" target=3D= "_blank" rel=3D"noopener">CVE-2026-22874</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repos= itory artifact read and cross-task upload-state write</td>
<td>2026-07-03</td>
<td>9.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58426" target=3D= "_blank" rel=3D"noopener">CVE-2026-58426</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.26.0 allow API users to fork a repository into =
an organization without first passing the CanCreateOrgRepo check, which can=
expose organization secrets.</td>
<td>2026-07-03</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-22555" target=3D= "_blank" rel=3D"noopener">CVE-2026-22555</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions up to and including 1.26.1 allow the Allow edits from ma= intainers permission path to authorize commits to repositories that the use=
r can read but should not be able to write.</td>
<td>2026-07-03</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-26231" target=3D= "_blank" rel=3D"noopener">CVE-2026-26231</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions up to and including 1.26.1 allow OAuth2 access token sco=
pe enforcement to be bypassed through HTTP Basic authentication.</td> <td>2026-07-03</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28699" target=3D= "_blank" rel=3D"noopener">CVE-2026-28699</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site script= ing through the extensionsRequired field in glTF files rendered by the 3D f= ile viewer.</td>
<td>2026-07-03</td>
<td>8.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28737" target=3D= "_blank" rel=3D"noopener">CVE-2026-28737</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions up to and including 1.26.1 allow Git smart HTTP requests=
authenticated with bearer tokens to bypass repository token scope checks.<=

<td>2026-07-03</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28744" target=3D= "_blank" rel=3D"noopener">CVE-2026-28744</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td> <td>Permanent Fork PR Workflow Approval Gate Bypass</td>
<td>2026-07-03</td>
<td>8.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58424" target=3D= "_blank" rel=3D"noopener">CVE-2026-58424</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcem= ent defect that allows a valid TOTP code to be accepted more than once acro=
ss web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.= </td>
<td>2026-07-03</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20779" target=3D= "_blank" rel=3D"noopener">CVE-2026-20779</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions up to and including 1.26.2 allow Git LFS object reuse to=
authorize private source objects for users who have repository access but = lack Code-unit access.</td>
<td>2026-07-03</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28740" target=3D= "_blank" rel=3D"noopener">CVE-2026-28740</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>LFS authentication bypass via malformed SSH sub-verb allows unauthorize=
d read access to private repositories</td>
<td>2026-07-03</td>
<td>7.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58423" target=3D= "_blank" rel=3D"noopener">CVE-2026-58423</a></td>
</tr>

<td class=3D"vendor-product">GNOME--GLib</td>
<td>A flaw was found in GLib. An off-by-one error can occur in the g_key_fi= le_get_locale_string_list function in the gkeyfile.c file when loading a ke=
y file with an empty value. This flaw can cause an out-of-bounds access of =
1 byte or a denial of service when the out-of-bounds access crosses a page = boundary.</td>
<td>2026-06-30</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58014" target=3D= "_blank" rel=3D"noopener">CVE-2026-58014</a></td>
</tr>

<td class=3D"vendor-product">GNOME--GLib</td>
<td>A flaw was found in GLib. A state confusion issue exists in g_dbus_node= _info_new_for_xml() in the gio/gdbusintrospection.c file when processing ma= lformed D-Bus introspection XML, specifically with a &lt;node&gt; element n= ested within other elements like &lt;method&gt;, &lt;signal&gt;, &lt;proper= ty&gt; or &lt;arg&gt;. This issue can cause an unsigned integer overflow an=
d lead to an out-of-bounds read, resulting in a denial of service.</td> <td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58016" target=3D= "_blank" rel=3D"noopener">CVE-2026-58016</a></td>
</tr>

<td class=3D"vendor-product">GoodLayers--Tourmaster</td>
<td>Subscriber Local File Inclusion in Tourmaster &lt;=3D 5.4.5 versions.</=

<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69133" target=3D= "_blank" rel=3D"noopener">CVE-2025-69133</a></td>
</tr>

<td class=3D"vendor-product">gorse-io--gorse</td>
<td>Gorse before 0.5.10 contains an authentication bypass vulnerability in = the /api/dump and /api/restore endpoints that allows unauthenticated attack= ers to access protected functionality when admin_api_key is empty, which is=
the default configuration. Remote attackers can exfiltrate the entire data= base including user records, items, and feedback data containing personally=
identifiable information, or completely overwrite the dataset without auth= entication.</td>
<td>2026-06-29</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56782" target=3D= "_blank" rel=3D"noopener">CVE-2026-56782</a></td>
</tr>

<td class=3D"vendor-product">gradio-app--gradio</td>
<td>Gradio before 6.16.0 contain a path traversal vulnerability in the File= Explorer component's preprocess() method that allows unauthenticated attack= ers to escape the configured root directory by supplying path segments cont= aining directory traversal sequences or absolute paths. Attackers can provi=
de crafted path segments that cause os.path.join to discard the root_dir pr= efix entirely, resulting in arbitrary file read or exposure of sensitive fi= les outside the intended directory.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49119" target=3D= "_blank" rel=3D"noopener">CVE-2026-49119</a></td>
</tr>

<td class=3D"vendor-product">Grav--Grav</td>
<td>Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabi= lities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework= \Cache\Adapter\FileCache, and Session - deserialize untrusted data without = restricting allowed classes, enabling PHP object injection and, via a gadge=
t chain, arbitrary code execution where an attacker controls the serialized=
input. Additionally, InstallCommand's git clone operation passes the branc=
h, url, and path parameters into a shell command without escaping, allowing=
OS command injection via plugin/theme installation (which requires admin a= ccess). A Twig security blocklist bypass (server-side template injection) i=
s also present. The issues are fixed in 2.0.0-beta.2.</td>
<td>2026-06-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56700" target=3D= "_blank" rel=3D"noopener">CVE-2026-56700</a></td>
</tr>

<td class=3D"vendor-product">Greg Winiarski--WPAdverts</td>
<td>Unauthenticated Cross Site Scripting (XSS) in WPAdverts &lt;=3D 2.3.1 v= ersions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57366" target=3D= "_blank" rel=3D"noopener">CVE-2026-57366</a></td>
</tr>

<td class=3D"vendor-product">Guangzhou Red Sea Cloud Computing Co., Ltd.--R=
ed Sea Cloud eHR</td>
<td>Redsea Cloud eHR contains an arbitrary file upload vulnerability that a= llows unauthenticated attackers to achieve remote code execution by uploadi=
ng malicious files through the PtFjk.mob servlet endpoint. Attackers can su= bmit a multipart POST request with a JSP webshell disguised using a spoofed=
image/jpeg Content-Type to bypass the absence of extension and MIME type v= alidation, with the uploaded file stored at a predictable path under the up= loadfile directory and executed directly by the web server. Exploitation ev= idence was first observed by the Shadowserver Foundation on 2024-11-03 (UTC= ).</td>
<td>2026-07-02</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2024-14037" target=3D= "_blank" rel=3D"noopener">CVE-2024-14037</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into an u= nsanitized SQL query in job_info.php (line 16): SELECT * FROM jobs where id=
=3D '\".$_GET['id'].\"'. No authentication is required. An unauthenticated=
attacker can perform error-based SQL injection to extract the database ver= sion, current user, schema names, and table contents.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34099" target=3D= "_blank" rel=3D"noopener">CVE-2026-34099</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into an u= nsanitized SQL query in media.php (line 17): SELECT id, filename, extension=
, type, duration, owner, private FROM files where id =3D '\".$_GET['id'].\"=
'. An authenticated attacker can perform error-based SQL injection to extra=
ct database contents.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34100" target=3D= "_blank" rel=3D"noopener">CVE-2026-34100</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into an u= nsanitized SQL query in text_file.php (line 17): SELECT id, filename, exten= sion, type, duration, owner, private FROM files where id =3D '\".$_GET['id'= ].\"'. An authenticated attacker can perform error-based SQL injection to e= xtract database contents.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34101" target=3D= "_blank" rel=3D"noopener">CVE-2026-34101</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into an u= nsanitized SQL query in job_info_get.php (line 16): SELECT * FROM jobs wher=
e input1 =3D '\".$_GET['id'].\"'. An authenticated attacker can perform err= or-based SQL injection to extract database contents.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34102" target=3D= "_blank" rel=3D"noopener">CVE-2026-34102</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into an u= nsanitized SQL query in subtitles.php (line 16): SELECT id, filename, exten= sion, type FROM files where id =3D '\".$_GET['id'].\"'. An authenticated at= tacker can perform error-based SQL injection to extract database contents.<=

<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34103" target=3D= "_blank" rel=3D"noopener">CVE-2026-34103</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the name GET parameter directly into an=
unsanitized SQL query in designer.php (line 124): SELECT * FROM complex WH= ERE name=3D'\".$_GET['name'].\"'. An authenticated attacker can perform err= or-based SQL injection to extract database contents.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34104" target=3D= "_blank" rel=3D"noopener">CVE-2026-34104</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into an u= nsanitized SQL query in translate_text.php (line 15): SELECT id, filename, = extension, type FROM files where id =3D '\".$_GET['id'].\"'. An authenticat=
ed attacker can perform error-based SQL injection to extract database conte= nts.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34105" target=3D= "_blank" rel=3D"noopener">CVE-2026-34105</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into a PH=
P exec() call in subtitles.php (line 19) without sanitization: exec(\"php j= obs/subtitle_rendering.php \".$login_session.\" \".$_GET['id'].\" ...\"). N=
o authentication is required. An unauthenticated remote attacker can append=
shell metacharacters to the id parameter to execute arbitrary OS commands =
on the server.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34106" target=3D= "_blank" rel=3D"noopener">CVE-2026-34106</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into a PH=
P exec() call in translate.php (line 14) without sanitization: exec(\"php j= obs/translate.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authent= ication is required. An unauthenticated remote attacker can append shell me= tacharacters to execute arbitrary OS commands on the server.</td> <td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34107" target=3D= "_blank" rel=3D"noopener">CVE-2026-34107</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into a PH=
P exec() call in text.php (line 15) without sanitization: exec(\"php jobs/t= ext.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is=
required. An unauthenticated remote attacker can append shell metacharacte=
rs to execute arbitrary OS commands on the server.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34108" target=3D= "_blank" rel=3D"noopener">CVE-2026-34108</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into a PH=
P exec() call in speech.php (line 18) without sanitization: exec(\"php jobs= /speech_audio.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authent= ication is required. An unauthenticated remote attacker can append shell me= tacharacters to execute arbitrary OS commands on the server.</td> <td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34109" target=3D= "_blank" rel=3D"noopener">CVE-2026-34109</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into a PH=
P exec() call in complex_start.php (line 14) without sanitization: exec(\"p=
hp jobs/complex.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authe= ntication is required. An unauthenticated remote attacker can append shell = metacharacters to execute arbitrary OS commands on the server.</td> <td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34110" target=3D= "_blank" rel=3D"noopener">CVE-2026-34110</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into a PH=
P exec() call in speechmac_text.php (line 18) without sanitization: exec(\"= php jobs/speech_audio_mac_text.php \".$login_session.\" \".$_GET['id'].\" .= ..\"). No authentication is required. An unauthenticated remote attacker ca=
n append shell metacharacters to execute arbitrary OS commands on the serve= r.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34111" target=3D= "_blank" rel=3D"noopener">CVE-2026-34111</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into a PH=
P exec() call in speechmac.php (line 18) without sanitization: exec(\"php j= obs/speech_audio_mac.php \".$login_session.\" \".$_GET['id'].\" ...\"). No = authentication is required. An unauthenticated remote attacker can append s= hell metacharacters to execute arbitrary OS commands on the server.</td> <td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34112" target=3D= "_blank" rel=3D"noopener">CVE-2026-34112</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into a PH=
P exec() call in speech_text.php (line 18) without sanitization: exec(\"php=
jobs/speech_audio_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). =
No authentication is required. An unauthenticated remote attacker can appen=
d shell metacharacters to execute arbitrary OS commands on the server.</td> <td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34113" target=3D= "_blank" rel=3D"noopener">CVE-2026-34113</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into a PH=
P exec() call in translate_text.php (line 18) without sanitization: exec(\"= php jobs/translate_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). =
No authentication is required. An unauthenticated remote attacker can appen=
d shell metacharacters to execute arbitrary OS commands on the server.</td> <td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34114" target=3D= "_blank" rel=3D"noopener">CVE-2026-34114</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into a PH=
P exec() call in transcribe_amazon.php (line 15) without sanitization: exec= (\"php jobs/transcribe_amazon.php \".$login_session.\" \".$_GET['id'].\" ..= .\"). No authentication is required. An unauthenticated remote attacker can=
append shell metacharacters to execute arbitrary OS commands on the server= .</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34115" target=3D= "_blank" rel=3D"noopener">CVE-2026-34115</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into a PH=
P exec() call in transcribe.php (line 15) without sanitization: exec(\"php = jobs/transcribe.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authe= ntication is required. An unauthenticated remote attacker can append shell = metacharacters to execute arbitrary OS commands on the server.</td> <td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34116" target=3D= "_blank" rel=3D"noopener">CVE-2026-34116</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system passes the id GET parameter directly into a PH=
P exec() call in text_to_subtitles.php (line 19) without sanitization: exec= (\"php jobs/text_to_subtitles.php \".$login_session.\" \".$_GET['id'].\" ..= .\"). No authentication is required. An unauthenticated remote attacker can=
append shell metacharacters to execute arbitrary OS commands on the server= .</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34117" target=3D= "_blank" rel=3D"noopener">CVE-2026-34117</a></td>
</tr>

<td class=3D"vendor-product">Gurmehub--POS Entegratr</td>
<td>Unauthenticated Broken Access Control in POS Entegrat=C3=83=C2=B6r &lt;= =3D 3.7.103 versions.</td>
<td>2026-07-02</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57688" target=3D= "_blank" rel=3D"noopener">CVE-2026-57688</a></td>
</tr>

<td class=3D"vendor-product">Haktan Suren--HandL UTM Grabber</td> <td>Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber &lt;=3D=
2.9.2 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57351" target=3D= "_blank" rel=3D"noopener">CVE-2026-57351</a></td>
</tr>

<td class=3D"vendor-product">Hanwang--e-Face General Management Platform</t=

<td>A vulnerability was determined in Hanwang e-Face General Management Pla= tform 6.3.5.4. This issue affects some unknown processing of the file /mana= ge/resourceUpload/upload.do. Executing a manipulation of the argument File = can lead to unrestricted upload. The attack may be launched remotely. The e= xploit has been publicly disclosed and may be utilized.</td> <td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13547" target=3D= "_blank" rel=3D"noopener">CVE-2026-13547</a></td>
</tr>

<td class=3D"vendor-product">Hanwang--e-Face General Management Platform</t=

<td>A vulnerability was identified in Hanwang e-Face General Management Pla= tform 6.3.5.4. This impacts an unknown function of the file /sysAuthStr/que= rySysAuthStr.do. The manipulation of the argument order leads to sql inject= ion. It is possible to initiate the attack remotely. The exploit is publicl=
y available and might be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14737" target=3D= "_blank" rel=3D"noopener">CVE-2026-14737</a></td>
</tr>

<td class=3D"vendor-product">Heateor Support--Heateor Social Login</td> <td>Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Log=
in &lt;=3D 1.1.39 versions.</td>
<td>2026-07-02</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57751" target=3D= "_blank" rel=3D"noopener">CVE-2026-57751</a></td>
</tr>

<td class=3D"vendor-product">Hiroaki Miyashita--Custom Field Template</td> <td>Contributor SQL Injection in Custom Field Template &lt;=3D 2.7.8 versio= ns.</td>
<td>2026-07-02</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57687" target=3D= "_blank" rel=3D"noopener">CVE-2026-57687</a></td>
</tr>

<td class=3D"vendor-product">Hitachi--Hitachi Virtual Storage Platform E390=
, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H</td>
<td>Improper Authorization Vulnerability of Maintenance Utility in Hitachi = Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platfo=
rm E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H: before DKCMA=
IN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00; Hitachi Virtual Storage Platf= orm 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H: before DKCMAIN Ver.=
90-09-27-00/00, GUM Ver. 90-09-27/00; Hitachi Virtual Storage Platform G13=
0, G150, G350, G370, G700, G900, F350, F370, F700, F900: before DKCMAIN Ver=
. 88-08-16-xx/00, GUM Ver. 88-08-20/00.</td>
<td>2026-06-29</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-2902" target=3D"= _blank" rel=3D"noopener">CVE-2025-2902</a></td>
</tr>

<td class=3D"vendor-product">hiyouga--LlamaFactory</td>
<td>LLaMA-Factory through 0.9.5 contains a remote code execution vulnerabil= ity that allows attackers with WebUI access to execute arbitrary Python cod=
e by supplying a malicious model path in the Chat or Training interfaces. T=
he application passes user-supplied model path input unvalidated into AutoT= okenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded=
trust_remote_code=3DTrue parameter, causing the Hugging Face transformers = library to fetch and execute arbitrary code from a remote or local model re= pository with the privileges of the server process.</td>
<td>2026-06-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58116" target=3D= "_blank" rel=3D"noopener">CVE-2026-58116</a></td>
</tr>

<td class=3D"vendor-product">HKUDS--DeepTutor</td>
<td>DeepTutor before version 1.4.10 contains an authorization bypass vulner= ability that allows low-privilege users to invoke unrestricted MCP tools du=
e to the allowed_mcp_tools function returning None instead of a denied resu=
lt when mcp_tools is omitted from a user's grant in deeptutor/multi_user/to= ol_access.py. Attackers or prompt-injected content acting within a user ses= sion can enumerate and invoke any configured MCP tool, including filesystem=
, shell, and browser servers, gaining unauthorized access to sensitive depl= oyment resources.</td>
<td>2026-06-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58168" target=3D= "_blank" rel=3D"noopener">CVE-2026-58168</a></td>
</tr>

<td class=3D"vendor-product">HKUDS--Vibe-Trading</td>
<td>Vibe-Trading before 0.1.10 builds the proposal file path by joining a c= aller-supplied proposal identifier onto the broker proposals directory with= out sanitization (agent/src/live/mandate/commit.py). A proposal identifier = containing path traversal sequences causes the application to load an attac= ker-controlled JSON file as an authoritative live trading mandate. Combined=
with the file upload endpoint, an admitted caller can write a JSON file to=
a known location and traverse to it, and because the ceilings validation i=
s skipped when ceilings are absent, the attacker fully controls the committ=
ed mandate.</td>
<td>2026-06-30</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58170" target=3D= "_blank" rel=3D"noopener">CVE-2026-58170</a></td>
</tr>

<td class=3D"vendor-product">HKUDS--Vibe-Trading</td>
<td>Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypa=
ss vulnerability that allows remote attackers to bypass bearer-token authen= tication by exploiting the server's trust of TCP peer addresses for loopbac=
k clients combined with missing Host header validation while binding to 0.0= .0.0 with credentialed CORS. Attackers can craft a malicious DNS rebinding = page to issue authenticated requests to the local API server, reach the she=
ll execution endpoint with a bash-enabled preset, and achieve remote code e= xecution as the API process user while also overwriting LLM and data-source=
settings to exfiltrate credentials.</td>
<td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58169" target=3D= "_blank" rel=3D"noopener">CVE-2026-58169</a></td>
</tr>

<td class=3D"vendor-product">home-assistant--core</td>
<td>Home Assistant is open source home automation software that puts local = control and privacy first. Prior to 2025.5.0, The iOS companion app ignores=
the SSID allowlist for internal networks. The app uses SSID to detect when=
to use the internal URL, but whenever the app cannot find any other URL to=
be used, it fallbacks to the internal URL as well, which can expose user's=
token when connected to a not secure network. This vulnerability is fixed =
in 2025.5.0.</td>
<td>2026-06-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55844" target=3D= "_blank" rel=3D"noopener">CVE-2026-55844</a></td>
</tr>

<td class=3D"vendor-product">hoppscotch--hoppscotch</td>
<td>Hoppscotch is an API development ecosystem. In self-hosted deployments =
of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticate=
d POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The=
global NestJS ValidationPipe is configured without whitelist: true, so ext=
ra properties on the request body that are not declared in SaveOnboardingCo= nfigRequest are not stripped and are iterated in the service layer as if th=
ey were legitimate InfraConfig entries. Because keys such as JWT_SECRET and=
SESSION_SECRET are valid InfraConfigEnum values and are not explicitly rej= ected during validation, an unauthenticated attacker who can reach a fresh = instance before onboarding completes (or when no users exist) can overwrite=
these values in the database. Overwriting JWT_SECRET gives the attacker co= ntrol of the JWT signing key, allowing them to forge tokens for any user, i= ncluding administrators, and results in full server compromise. The issue i=
s fixed in hoppscotch 2026.5.0.</td>
<td>2026-07-01</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50160" target=3D= "_blank" rel=3D"noopener">CVE-2026-50160</a></td>
</tr>

<td class=3D"vendor-product">https://wpreviewslider.com/--WP Review Slider = Pro</td>
<td>The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Inje= ction via the 'notinstring' parameter of the wprp_load_more_revs AJAX actio=
n in versions up to, and including, 12.7.2. The parameter is read via $_POS= T['notinstring'] and passed through sanitize_text_field() - which strips HT=
ML and whitespace but does not provide SQL safety. The value is then concat= enated directly into a numeric/unquoted `AND id NOT IN (...)` clause and ex= ecuted via $wpdb-&gt;get_results() without $wpdb-&gt;prepare() or intval() = casting. Because the value sits in an unquoted numeric context, WordPress's=
wp_magic_quotes protection (which only escapes embedded quotes) is ineffec= tive. The AJAX hook is registered via wp_ajax_nopriv_wprp_load_more_revs, a=
nd the required check_ajax_referer nonce is publicly available via wp_local= ize_script on any frontend page that renders the plugin shortcode, so an un= authenticated attacker who can reach a public page hosting the plugin can e= xtract arbitrary data from the database via blind/time-based injection.</td=

<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8441" target=3D"= _blank" rel=3D"noopener">CVE-2026-8441</a></td>
</tr>

<td class=3D"vendor-product">HubSpot--HubSpot</td>
<td>Insertion of Sensitive Information Into Sent Data vulnerability in HubS= pot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: fr=
om n/a through 11.3.51.</td>
<td>2026-07-01</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57736" target=3D= "_blank" rel=3D"noopener">CVE-2026-57736</a></td>
</tr>

<td class=3D"vendor-product">Hyland--PACSgear MediaWriter</td>
<td>PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port = 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteOb=
j and UIRemoteObj, without any authentication requirement. By exploiting th=
e MarshalByRefObject object unmarshalling technique and implementing .NET W= ebClient class methods, an unauthenticated remote attacker can read and wri=
te arbitrary files on the host filesystem. The ObjectURIs are identical acr= oss all installations by default. Chaining the arbitrary file write primiti=
ve with DLL hijacking opportunities in the MediaWriter service (which runs =
as NT Authority\SYSTEM and loads missing DLLs such as CRYPTBASE.DLL from th=
e application directory) enables unauthenticated remote code execution as S= YSTEM upon service restart.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58127" target=3D= "_blank" rel=3D"noopener">CVE-2026-58127</a></td>
</tr>

<td class=3D"vendor-product">Hyland--PACSgear PACS Scan</td>
<td>PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execut= ion vulnerability that allows remote attackers to read and write arbitrary = files by exploiting an exposed .NET Remoting TCP service on port 22222 via = PGImageExchQueue.exe without any authentication requirement. Attackers can = chain the arbitrary file write primitive with DLL hijacking in PGImageExcha= ngeQueueSvc.exe, which loads missing DLLs such as CRYPTSP.DLL from the appl= ication directory, to achieve remote code execution as NT Authority\SYSTEM = upon service restart.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58126" target=3D= "_blank" rel=3D"noopener">CVE-2026-58126</a></td>
</tr>

<td class=3D"vendor-product">IBM--Business Automation Manager Open Editions= </td>
<td>IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vu= lnerable to an XML external entity injection (XXE) attack when processing X=
ML data. A remote attacker could exploit this vulnerability to expose sensi= tive information or consume memory resources.</td>
<td>2026-06-30</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13449" target=3D= "_blank" rel=3D"noopener">CVE-2026-13449</a></td>
</tr>

<td class=3D"vendor-product">IBM--Db2</td>
<td>IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable =
to remote code execution due to improper pre-auth DRDA handshake handling.<=

<td>2026-06-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10109" target=3D= "_blank" rel=3D"noopener">CVE-2026-10109</a></td>
</tr>

<td class=3D"vendor-product">IBM--DevOps Automation</td>
<td>IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalida=
te session IDs after expiration which could allow an authenticated user to = impersonate another user on the system.</td>
<td>2026-06-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36359" target=3D= "_blank" rel=3D"noopener">CVE-2025-36359</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every s= ecret available to the Langflow process, read and modify every flow, conver= sation, message, file upload, and saved component in the Langflow database,=
can connect to internal services, abuse cloud metadata endpoints, laterall=
y move to other tenants on the same Langflow instance, and Establish persis= tence by modifying the public flow's `tool_code` so normal `/api/v1/build/.= ..` calls by any user re-execute attacker code at each build.</td> <td>2026-06-30</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10134" target=3D= "_blank" rel=3D"noopener">CVE-2026-10134</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shar= ed-state handling that allows reuse of API clients across tenant boundaries=
. An authenticated attacker can manipulate cache state to cause requests fr=
om other users to be processed using incorrect upstream API credentials, le= ading to cross-tenant billing and accountability misattribution.</td> <td>2026-06-30</td>
<td>9.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10140" target=3D= "_blank" rel=3D"noopener">CVE-2026-10140</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attack= ers to access protected MCP project resources and execute MCP operations du=
e to improper authorization enforcement in the Streamable MCP transport end= point.</td>
<td>2026-06-30</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7663" target=3D"= _blank" rel=3D"noopener">CVE-2026-7663</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execut= ion due to improper validation of flow nodes with missing or empty componen=
t type fields.</td>
<td>2026-06-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7803" target=3D"= _blank" rel=3D"noopener">CVE-2026-7803</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to=
execute arbitrary code with full application privileges, compromising all = secrets, data, and system integrity.</td>
<td>2026-06-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7871" target=3D"= _blank" rel=3D"noopener">CVE-2026-7871</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to=
execute arbitrary OS commands and read sensitive files including credentia= ls, enabling complete system compromise and lateral movement.</td> <td>2026-06-30</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7873" target=3D"= _blank" rel=3D"noopener">CVE-2026-7873</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure o=
f all stored credentials due to the use of a weak and reversible key deriva= tion mechanism for encryption at rest.</td>
<td>2026-06-30</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7874" target=3D"= _blank" rel=3D"noopener">CVE-2026-7874</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request For= gery (SSRF) protection bypass vulnerability in the API Request component. A=
n authenticated attacker with low-level privileges (flow author role) can b= ypass SSRF protections by enabling the follow_redirects parameter and suppl= ying a public URL that redirects to internal/localhost addresses. The vulne= rability exists because the application validates only the initial URL but = does not re-validate redirect destinations. This allows attackers to access=
internal HTTP services, localhost endpoints, cloud metadata services, and = private network resources that should be unreachable when SSRF protection i=
s enabled. Successful exploitation can lead to disclosure of sensitive info= rmation including credentials, tokens, internal API responses, and administ= rative panel data.</td>
<td>2026-06-30</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10129" target=3D= "_blank" rel=3D"noopener">CVE-2026-10129</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication = vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthe= nticated attacker to read build event data or cancel jobs using a valid job=
identifier, resulting in information disclosure and denial of service.</td=

<td>2026-06-30</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10560" target=3D= "_blank" rel=3D"noopener">CVE-2026-10560</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request For= gery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component =
in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypas= sing SSRF protections introduced in version 1.9.3. An authenticated attacke=
r can exploit this to access internal resources including cloud metadata se= rvices (AWS/Azure/GCP IMDS), potentially exfiltrating IAM credentials and e= numerating internal networks. The vulnerability can also be triggered throu=
gh prompt injection in agentic workflows due to tool_mode=3DTrue exposure.<=

<td>2026-06-30</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10564" target=3D= "_blank" rel=3D"noopener">CVE-2026-10564</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request For= gery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/components= /data_source/url.py ) due to a Time-of-Check/Time-of-Use (TOCTOU) race cond= ition that can be exploited via DNS rebinding.</td>
<td>2026-06-30</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10546" target=3D= "_blank" rel=3D"noopener">CVE-2026-10546</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-si=
te scripting vulnerability in the administrative console's integrated help = system.</td>
<td>2026-06-30</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11708" target=3D= "_blank" rel=3D"noopener">CVE-2026-11708</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-si=
te scripting vulnerability in the administrative console help system.</td> <td>2026-06-30</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11712" target=3D= "_blank" rel=3D"noopener">CVE-2026-11712</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-si=
te scripting vulnerability in the administrative console.</td> <td>2026-06-30</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11594" target=3D= "_blank" rel=3D"noopener">CVE-2026-11594</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Applica= tion Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP req= uest smuggling vulnerability.</td>
<td>2026-06-30</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11541" target=3D= "_blank" rel=3D"noopener">CVE-2026-11541</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server - Liberty</t=

<td>IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is=
affected by a server-side request forgery vulnerability with the apiDiscov= ery-1.0 feature enabled.</td>
<td>2026-06-30</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11714" target=3D= "_blank" rel=3D"noopener">CVE-2026-11714</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server - Liberty</t=

<td>IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is=
affected by a server-side request forgery vulnerability with the adminCent= er-1.0 feature enabled.</td>
<td>2026-06-30</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11546" target=3D= "_blank" rel=3D"noopener">CVE-2026-11546</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server - Liberty</t=

<td>IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is=
affected by an arbitrary file read vulnerability with the restConnector-2.=
0 feature enabled.</td>
<td>2026-06-30</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11806" target=3D= "_blank" rel=3D"noopener">CVE-2026-11806</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Extreme Scale</td>
<td>IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectI= nputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputS= tream, ObjectInputStreamResolver) that install no JEP-290 class filter; whe=
n Coherence is on the classpath, multiple RCE gadget chains including Remot= eConstructor.readResolve and PriorityQueue/ExtractorComparator are confirme=
d working, allowing a post-login attacker who can write a session attribute=
or a LAN-adjacent attacker on the grid replication wire to execute arbitra=
ry code on peer WAS JVMs</td>
<td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13759" target=3D= "_blank" rel=3D"noopener">CVE-2026-13759</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Extreme Scale</td>
<td>IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Lan= guage engine resolves attacker-supplied class names via Class.forName() and=
invokes their constructors with no allow-list at three distinct sinks (SEL= ECT NEW, enum literals, and reflection-based comparators); an authenticated=
remote attacker who can influence an application-built OQL query string ca=
n execute arbitrary constructors on the WAS JVM, and a SELECT DISTINCT vari= ant using planted grid values fires the same gadget post-readObject in a ma= nner that survives JEP-290 serialization filters across grid node boundarie= s</td>
<td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13772" target=3D= "_blank" rel=3D"noopener">CVE-2026-13772</a></td>
</tr>

<td class=3D"vendor-product">imithemes--NativeChurch</td>
<td>Unauthenticated Cross Site Scripting (XSS) in NativeChurch &lt;=3D 4.8.= 8.2 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27408" target=3D= "_blank" rel=3D"noopener">CVE-2026-27408</a></td>
</tr>

<td class=3D"vendor-product">impleCode--eCommerce Product Catalog</td> <td>Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog=
&lt;=3D 3.5.4 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57360" target=3D= "_blank" rel=3D"noopener">CVE-2026-57360</a></td>
</tr>

<td class=3D"vendor-product">iNET--iNET Webkit</td>
<td>Contributor SQL Injection in iNET Webkit 1.2.4 versions.</td> <td>2026-07-02</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57752" target=3D= "_blank" rel=3D"noopener">CVE-2026-57752</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Baptism Information Management S= ystem</td>
<td>A weakness has been identified in itsourcecode Baptism Information Mana= gement System 1.0. The impacted element is an unknown function of the file = /delbaptism.php. This manipulation of the argument ID causes sql injection.=
The attack is possible to be carried out remotely. The exploit has been ma=
de available to the public and could be used for attacks.</td> <td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13550" target=3D= "_blank" rel=3D"noopener">CVE-2026-13550</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Baptism Information Management S= ystem</td>
<td>A security vulnerability has been detected in itsourcecode Baptism Info= rmation Management System 1.0. This affects an unknown function of the file=
/editBaptism.php. Such manipulation of the argument ID leads to sql inject= ion. The attack may be performed from remote. The exploit has been disclose=
d publicly and may be used.</td>
<td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13551" target=3D= "_blank" rel=3D"noopener">CVE-2026-13551</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Online Hotel Management System</=

<td>A vulnerability was detected in itsourcecode Online Hotel Management Sy= stem 1.0. This impacts an unknown function of the file /admin/mod_amenities= /controller.php?action=3Dedit. Performing a manipulation of the argument am= en_id results in sql injection. It is possible to initiate the attack remot= ely. The exploit is now public and may be used.</td>
<td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13552" target=3D= "_blank" rel=3D"noopener">CVE-2026-13552</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Online Hotel Management System</=

<td>A flaw has been found in itsourcecode Online Hotel Management System 1.=
0. Affected is an unknown function of the file /admin/mod_amenities/control= ler.php?action=3Dadd. Executing a manipulation of the argument image can le=
ad to unrestricted upload. It is possible to launch the attack remotely. Th=
e exploit has been published and may be used.</td>
<td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13553" target=3D= "_blank" rel=3D"noopener">CVE-2026-13553</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Online Hotel Management System</=

<td>A vulnerability was found in itsourcecode Online Hotel Management Syste=
m 1.0. Affected by this issue is some unknown functionality of the file /ad= min/mod_users/controller.php?action=3Dadd. The manipulation of the argument=
Name results in sql injection. The attack can be launched remotely. The ex= ploit has been made public and could be used.</td>
<td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13555" target=3D= "_blank" rel=3D"noopener">CVE-2026-13555</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Online Hotel Management System</=

<td>A vulnerability was identified in itsourcecode Online Hotel Management = System 1.0. The affected element is an unknown function of the file /admin/= login.php. The manipulation of the argument email leads to sql injection. T=
he attack may be initiated remotely. The exploit is publicly available and = might be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14688" target=3D= "_blank" rel=3D"noopener">CVE-2026-14688</a></td>
</tr>

<td class=3D"vendor-product">Jacob N. Breetvelt--WP Photo Album Plus</td> <td>Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus &lt;=
=3D 9.2.02.004 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57675" target=3D= "_blank" rel=3D"noopener">CVE-2026-57675</a></td>
</tr>

<td class=3D"vendor-product">JAIOTlink--C492A-W6 Wi-Fi IP Camera</td> <td>JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 co= ntain a hard-coded credentials vulnerability that allows network-adjacent a= ttackers to gain unauthorized access by using the default admin username wi=
th an empty password accepted by the anyka_ipc HTTP service on port 80. Att= ackers can authenticate with these hardcoded credentials to access camera s= napshots, video streams, network configuration, and factory-level API endpo= ints including the SetMAC command injection surface.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58453" target=3D= "_blank" rel=3D"noopener">CVE-2026-58453</a></td>
</tr>

<td class=3D"vendor-product">JAIOTlink--C492A-W6 Wi-Fi IP Camera</td> <td>JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 co= ntain an OS command injection vulnerability that allows authenticated attac= kers to achieve remote code execution by supplying a malicious Wireless par= ameter to the HTTP PUT NetSDK/Factory SetMAC endpoint. Attackers can craft =
a string beginning with a valid MAC-like prefix followed by a semicolon and=
a shell payload, which bypasses partial sscanf() validation and is passed = unsanitized into an echo shell command executed through a system() wrapper.= </td>
<td>2026-07-01</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58452" target=3D= "_blank" rel=3D"noopener">CVE-2026-58452</a></td>
</tr>

<td class=3D"vendor-product">JAIOTlink--C492A-W6 Wi-Fi IP Camera</td> <td>JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 co= ntain a remote code execution vulnerability that allows authenticated attac= kers to execute arbitrary shell scripts by writing to the writable persiste=
nt JFFS2 storage path and triggering execution through the authenticated HT=
TP endpoint. Attackers can stage a malicious script in the writable persist= ent storage and request the config endpoint to invoke it via popen(), achie= ving persistent remote code execution that survives device reboots.</td> <td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58454" target=3D= "_blank" rel=3D"noopener">CVE-2026-58454</a></td>
</tr>

<td class=3D"vendor-product">jairiidriss--restaurant-website-php-mysql</td> <td>A vulnerability was found in jairiidriss restaurant-website-php-mysql u=
p to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects u= nknown code of the file /admin/ajax_files of the component AJAX Endpoint. P= erforming a manipulation results in missing authentication. The attack is p= ossible to be carried out remotely. The exploit has been made public and co= uld be used. This product adopts a rolling release strategy to maintain con= tinuous delivery. Therefore, version details for affected or updated releas=
es cannot be specified. The project was informed of the problem early throu=
gh an issue report but has not responded yet.</td>
<td>2026-07-04</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14622" target=3D= "_blank" rel=3D"noopener">CVE-2026-14622</a></td>
</tr>

<td class=3D"vendor-product">jeecgboot--JeecgBoot</td>
<td>JeecgBoot through 3.9.2 contains a broken access control vulnerability = that allows authenticated low-privilege users to perform full create, read,=
update, and delete operations on OpenAPI credentials by accessing the Open= ApiAuthController and OpenApiPermissionController endpoints which lack Shir=
o authorization annotations. Attackers can exploit the unenforced access co= ntrols to list, add, edit, and delete all AK/SK credential pairs, with the = list endpoint returning secret keys in plaintext, enabling credential theft=
and unauthorized invocation of the OpenAPI surface.</td>
<td>2026-06-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58377" target=3D= "_blank" rel=3D"noopener">CVE-2026-58377</a></td>
</tr>

<td class=3D"vendor-product">jeecgboot--jimureport</td>
<td>JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoin=
t without authentication: the handler is annotated @JimuNoLoginRequired, so=
JimuReportTokenInterceptor skips all authentication and authorization, and=
the export service streams the rendered report for any supplied report id = without verifying the auto-export configuration flag. An unauthenticated re= mote attacker can enumerate Snowflake report identifiers and export the ful=
l contents of any report, including the data returned by the report configu= red SQL queries and any credentials embedded in its data sources.</td> <td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58375" target=3D= "_blank" rel=3D"noopener">CVE-2026-58375</a></td>
</tr>

<td class=3D"vendor-product">juicedata--juicefs</td>
<td>JuiceFS through 1.3.1, fixed in commit a46979c, contains an authenticat= ion bypass vulnerability that allows unauthenticated remote attackers to ac= cess sensitive debug and metrics endpoints by exploiting improper handler r= egistration on the shared http.DefaultServeMux. Attackers can request the /= debug/pprof/cmdline endpoint to obtain the process command line containing = metadata engine connection strings with database credentials, granting full=
read/write access to filesystem metadata, while other pprof handlers leak = internal state and profiling handlers enable denial of service.</td> <td>2026-07-02</td>
<td>7.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59092" target=3D= "_blank" rel=3D"noopener">CVE-2026-59092</a></td>
</tr>

<td class=3D"vendor-product">kirilkirkov--Ecommerce-CodeIgniter-Bootstrap</=

<td>A security vulnerability has been detected in kirilkirkov Ecommerce-Cod= eIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affe= cted element is the function getCartItems in the library application/librar= ies/ShoppingCart.php. The manipulation of the argument shopping_cart leads =
to deserialization. The attack can be initiated remotely. The exploit has b= een disclosed publicly and may be used. Continious delivery with rolling re= leases is used by this product. Therefore, no version details of affected n=
or updated releases are available. The identifier of the patch is 49b20f53d= e2b7ec34e920b11c863f1491d911a04. It is recommended to apply a patch to fix = this issue.</td>
<td>2026-07-04</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14637" target=3D= "_blank" rel=3D"noopener">CVE-2026-14637</a></td>
</tr>

<td class=3D"vendor-product">kirilkirkov--Ecommerce-CodeIgniter-Bootstrap</=

<td>A security flaw has been discovered in kirilkirkov Ecommerce-CodeIgnite= r-Bootstrap up to 222ff31c06687b1c6d0e1ab63953f82c3674c52b. This issue affe= cts some unknown processing of the file application/modules/vendor/controll= ers/AddProduct.php of the component Vendor Multi-Image Endpoint. Performing=
a manipulation of the argument folder results in path traversal. It is pos= sible to initiate the attack remotely. The exploit has been released to the=
public and may be used for attacks. This product is using a rolling releas=
e to provide continious delivery. Therefore, no version details for affecte=
d nor updated releases are available. The patch is named 2a9497ff11f36e573a= d99e1c357ff0e6ded49745. Applying a patch is the recommended action to fix t= his issue.</td>
<td>2026-07-04</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14635" target=3D= "_blank" rel=3D"noopener">CVE-2026-14635</a></td>
</tr>

<td class=3D"vendor-product">KongHQ--mcp-konnect</td>
<td>A vulnerability exists in the Kong Konnect Model Context Protocol (MCP)=
server prior to version 1.0.0, which could allow a remote attacker to perf= orm an indirect prompt injection attack and execute unintended API requests= .</td>
<td>2026-07-03</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13341" target=3D= "_blank" rel=3D"noopener">CVE-2026-13341</a></td>
</tr>

<td class=3D"vendor-product">kstover--Ninja Forms The Contact Form Builder = That Grows With You</td>
<td>The Ninja Forms - The Contact Form Builder That Grows With You plugin f=
or WordPress is vulnerable to unauthorized access of data due to a missing = authorization check on the 'ninja-forms-views/token/refresh' REST callback =
in all versions up to, and including, 3.14.1. This makes it possible for un= authenticated attackers to view form submissions, which could potentially c= ontain sensitive information.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-1239" target=3D"= _blank" rel=3D"noopener">CVE-2026-1239</a></td>
</tr>

<td class=3D"vendor-product">LadybirdBrowser--Ladybird</td>
<td>Ladybird contains a dangling-reference memory-safety flaw in its WebAss= embly ESM-integration module loader. When a JavaScript function is imported=
into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a=
stack-local Wasm::FunctionType by reference to create_host_function, whose=
host callback captures and later reads that reference; once the ESM link-l= oop iteration ends the FunctionType is destroyed, leaving the callback with=
a dangling reference (the normal instantiate path uses a long-lived refere= nce and is not affected). Stale result-type data lets the host callback ret= urn an empty result vector for a statically non-empty result, so the destin= ation register retains an attacker-influenced value that is then consumed b=
y the WASM-GC array.set handler, which bit-casts the reference low bits to =
an ArrayInstance pointer after only a null check, yielding an arbitrary wri= te. A web page can chain this into code execution in the WebContent process=
. Verified reachable from HTML content without any instrumentation or sourc=
e modification.</td>
<td>2026-07-01</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58592" target=3D= "_blank" rel=3D"noopener">CVE-2026-58592</a></td>
</tr>

<td class=3D"vendor-product">latepoint--LatePoint Calendar Booking Plugin f=
or Appointments and Events</td>
<td>The LatePoint - Calendar Booking Plugin for Appointments and Events plu= gin for WordPress is vulnerable to Privilege Escalation to Administrator in=
versions up to, and including, 5.6.3 This is due to an Insecure Direct Obj= ect Reference (IDOR) in the create_or_update() function of OsOrdersControll= er, which allows an authenticated Agent to supply an arbitrary order[custom= er_id] and overwrite any LatePoint customer's email field (including one li= nked to a WordPress Administrator's account) through the public-scope custo= mer set_data() call, combined with a missing role verification in OsAuthHel= per::authorize_customer() which logs in the linked WordPress user without c= hecking its role. This makes it possible for authenticated attackers, with = custom (Agent)-level access and above, to elevate their privileges to Admin= istrator.</td>
<td>2026-07-01</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13228" target=3D= "_blank" rel=3D"noopener">CVE-2026-13228</a></td>
</tr>

<td class=3D"vendor-product">LCweb--PrivateContent</td>
<td>Incorrect Privilege Assignment vulnerability in LCweb PrivateContent al= lows Privilege Escalation. This issue affects PrivateContent: from n/a thro= ugh 9.9.2.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57692" target=3D= "_blank" rel=3D"noopener">CVE-2026-57692</a></td>
</tr>

<td class=3D"vendor-product">leshchenko1979--fast-mcp-telegram</td> <td>fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-t= elegram validates HTTP Bearer tokens by joining the raw token string into a=
session-file path. The verifier rejects the exact reserved token telegram,=
but it does not reject path separators or normalize the path before checki=
ng whether the session file exists. A remote HTTP client can therefore auth= enticate as the default legacy session with a token such as ../fast-mcp-tel= egram/telegram when the documented default session file ~/.config/fast-mcp-= telegram/telegram.session exists. This bypasses the reserved session name c= ontrol that is intended to prevent HTTP multi-user sessions from colliding = with the default stdio or legacy account. With account-prefixed MCP tools e= nabled, the attacker still sees and calls the prefixed tools for the defaul=
t account, so the prefix middleware does not stop the session selection byp= ass. This vulnerability is fixed in 0.19.1.</td>
<td>2026-07-02</td>
<td>9.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52830" target=3D= "_blank" rel=3D"noopener">CVE-2026-52830</a></td>
</tr>

<td class=3D"vendor-product">Levelfourdevelopment--WP EasyCart</td> <td>Contributor SQL Injection in WP EasyCart &lt;=3D 5.9.0 versions.</td> <td>2026-07-02</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57765" target=3D= "_blank" rel=3D"noopener">CVE-2026-57765</a></td>
</tr>

<td class=3D"vendor-product">liftoff-sr--CIPster</td>
<td>A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf569= 62807d3504b783ccdb6287f3e4. Affected by this issue is the function BufWrite= r::append of the component EtherNet IP Message Handler. Performing a manipu= lation results in out-of-bounds write. Remote exploitation of the attack is=
possible. The exploit is now public and may be used. This product follows =
a rolling release approach for continuous delivery, so version details for = affected or updated releases are not provided. The patch is named 3a0159ed4= 3125dcd024a1965f0289cb186bae9ff. To fix this issue, it is recommended to de= ploy a patch.</td>
<td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13592" target=3D= "_blank" rel=3D"noopener">CVE-2026-13592</a></td>
</tr>

<td class=3D"vendor-product">LinuxCNC--LinuxCNC</td>
<td>rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege = escalation. It is installed SUID root and loads shared library modules via = dlopen() by using a user-supplied module name. Insufficient validation of t=
he module name allows path traversal, enabling an unprivileged local user t=
o load an arbitrary shared library. Because the process retains elevated pr= ivileges during module loading, this results in local privilege escalation =
to root.</td>
<td>2026-06-30</td>
<td>8.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58302" target=3D= "_blank" rel=3D"noopener">CVE-2026-58302</a></td>
</tr>

<td class=3D"vendor-product">lobehub--lobehub</td>
<td>LobeChat before 2.2.10-canary.18 contains a server-side request forgery=
vulnerability that allows authenticated attackers to direct internal HTTP = requests to arbitrary URLs by supplying user-controlled input to the skill = import service (importFromUrl) and topic cover update (fetchImageFromUrl) e= ndpoints, which use the global fetch without the project's ssrf-safe-fetch = wrapper. Attackers can target internal addresses such as cloud instance met= adata endpoints through these unprotected code paths to disclose internal s= ervice responses and cloud credentials.</td>
<td>2026-07-02</td>
<td>7.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59095" target=3D= "_blank" rel=3D"noopener">CVE-2026-59095</a></td>
</tr>

<td class=3D"vendor-product">Melograno Venture Studio--wpDataTables</td> <td>Unauthenticated Cross Site Scripting (XSS) in wpDataTables &lt;=3D 6.5.= 1.1 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57672" target=3D= "_blank" rel=3D"noopener">CVE-2026-57672</a></td>
</tr>

<td class=3D"vendor-product">Merkulove--OpenAI Chatbot for WordPress Helper= </td>
<td>Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPr= ess - Helper &lt;=3D 1.1.4 versions.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69134" target=3D= "_blank" rel=3D"noopener">CVE-2025-69134</a></td>
</tr>

<td class=3D"vendor-product">Metagauss--ProfileGrid</td>
<td>Unauthenticated Cross Site Request Forgery (CSRF) in ProfileGrid &lt;=
=3D 5.9.9.7 versions.</td>
<td>2026-07-02</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57759" target=3D= "_blank" rel=3D"noopener">CVE-2026-57759</a></td>
</tr>

<td class=3D"vendor-product">metagauss--ProfileGrid User Profiles, Groups a=
nd Communities</td>
<td>The ProfileGrid - User Profiles, Groups and Communities plugin for Word= Press is vulnerable to privilege escalation via account takeover in all ver= sions up to, and including, 5.9.9.5. This is due to the plugin not validati=
ng a `user_login` on registration forms that don't contain this parameter, = and not properly handling the error messages. This makes it possible for un= authenticated attackers to change email address of user account with ID=3D1=
(usually an administrator), and leverage that to reset the user's password=
and gain access to their account.</td>
<td>2026-06-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12073" target=3D= "_blank" rel=3D"noopener">CVE-2026-12073</a></td>
</tr>

<td class=3D"vendor-product">metagauss--RegistrationMagic Custom Registrati=
on Forms, User Registration, Payment, and User Login</td>
<td>The RegistrationMagic - User Registration Forms Plugin plugin for WordP= ress is vulnerable to Cross-Site Request Forgery in all versions up to, and=
including, 6.0.9.1. This is due to missing or incorrect nonce validation o=
n the process_request function. This makes it possible for unauthenticated = attackers to escalate the privileges of an arbitrary form submitter to admi= nistrator by creating a malicious Chronos automation task that is executed = via WordPress cron via a forged request granted they can trick a site admin= istrator into performing an action such as clicking on a link.</td> <td>2026-07-01</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12158" target=3D= "_blank" rel=3D"noopener">CVE-2026-12158</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Azure Open AI</td>
<td>Server-side request forgery (ssrf) in Azure OpenAI allows an authorized=
attacker to elevate privileges over a network.</td>
<td>2026-07-02</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-45499" target=3D= "_blank" rel=3D"noopener">CVE-2026-45499</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft 365 Copilot</td>
<td>Url redirection to untrusted site ('open redirect') in M365 Copilot all= ows an unauthorized attacker to elevate privileges over a network.</td> <td>2026-07-02</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41106" target=3D= "_blank" rel=3D"noopener">CVE-2026-41106</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Access of resource using incompatible type ('type confusion') in Micros= oft Edge (Chromium-based) allows an unauthorized attacker to execute code o= ver a network.</td>
<td>2026-07-03</td>
<td>9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58289" target=3D= "_blank" rel=3D"noopener">CVE-2026-58289</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Use after free in Microsoft Edge (Chromium-based) allows an authorized = attacker to execute code over a network.</td>
<td>2026-07-01</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50521" target=3D= "_blank" rel=3D"noopener">CVE-2026-50521</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an=
unauthorized attacker to execute code over a network.</td>
<td>2026-07-03</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56645" target=3D= "_blank" rel=3D"noopener">CVE-2026-56645</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Integer overflow or wraparound in Microsoft Edge (Chromium-based) allow=
s an unauthorized attacker to execute code over a network.</td> <td>2026-07-03</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57974" target=3D= "_blank" rel=3D"noopener">CVE-2026-57974</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Use after free in Microsoft Edge (Chromium-based) allows an unauthorize=
d attacker to execute code over a network.</td>
<td>2026-07-03</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57981" target=3D= "_blank" rel=3D"noopener">CVE-2026-57981</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Improper authorization in Microsoft Edge (Chromium-based) allows an una= uthorized attacker to bypass a security feature over a network.</td> <td>2026-07-03</td>
<td>8.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57983" target=3D= "_blank" rel=3D"noopener">CVE-2026-57983</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Improper access control in Microsoft Edge (Chromium-based) allows an un= authorized attacker to perform spoofing over a network.</td> <td>2026-07-03</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58282" target=3D= "_blank" rel=3D"noopener">CVE-2026-58282</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Access of resource using incompatible type ('type confusion') in Micros= oft Edge (Chromium-based) allows an unauthorized attacker to perform spoofi=
ng over a network.</td>
<td>2026-07-03</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58283" target=3D= "_blank" rel=3D"noopener">CVE-2026-58283</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Improper authorization in Microsoft Edge (Chromium-based) allows an una= uthorized attacker to execute code over a network.</td>
<td>2026-07-03</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58284" target=3D= "_blank" rel=3D"noopener">CVE-2026-58284</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Access of resource using incompatible type ('type confusion') in Micros= oft Edge (Chromium-based) allows an unauthorized attacker to execute code o= ver a network.</td>
<td>2026-07-03</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58285" target=3D= "_blank" rel=3D"noopener">CVE-2026-58285</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Improper access control in Microsoft Edge (Chromium-based) allows an un= authorized attacker to perform spoofing over a network.</td> <td>2026-07-03</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58286" target=3D= "_blank" rel=3D"noopener">CVE-2026-58286</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Use after free in Microsoft Edge (Chromium-based) allows an unauthorize=
d attacker to execute code over a network.</td>
<td>2026-07-03</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58287" target=3D= "_blank" rel=3D"noopener">CVE-2026-58287</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Use after free in Microsoft Edge (Chromium-based) allows an unauthorize=
d attacker to execute code over a network.</td>
<td>2026-07-03</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58288" target=3D= "_blank" rel=3D"noopener">CVE-2026-58288</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>External control of file name or path in Microsoft Edge (Chromium-based=
) allows an unauthorized attacker to execute code over a network.</td> <td>2026-07-03</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58293" target=3D= "_blank" rel=3D"noopener">CVE-2026-58293</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Access of resource using incompatible type ('type confusion') in Micros= oft Edge (Chromium-based) allows an unauthorized attacker to bypass a secur= ity feature over a network.</td>
<td>2026-07-03</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58295" target=3D= "_blank" rel=3D"noopener">CVE-2026-58295</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Access of resource using incompatible type ('type confusion') in Micros= oft Edge (Chromium-based) allows an unauthorized attacker to execute code o= ver a network.</td>
<td>2026-07-03</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57975" target=3D= "_blank" rel=3D"noopener">CVE-2026-57975</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') in Microsoft Edge (Chromium-based) allows an unauthorized att= acker to perform spoofing over a network.</td>
<td>2026-07-03</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57977" target=3D= "_blank" rel=3D"noopener">CVE-2026-57977</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Use after free in Microsoft Edge (Chromium-based) allows an unauthorize=
d attacker to execute code over a network.</td>
<td>2026-07-03</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57984" target=3D= "_blank" rel=3D"noopener">CVE-2026-57984</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Improper input validation in Microsoft Edge (Chromium-based) allows an = unauthorized attacker to execute code over a network.</td>
<td>2026-07-03</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57985" target=3D= "_blank" rel=3D"noopener">CVE-2026-57985</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Use after free in Microsoft Edge (Chromium-based) allows an unauthorize=
d attacker to execute code over a network.</td>
<td>2026-07-03</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57986" target=3D= "_blank" rel=3D"noopener">CVE-2026-57986</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Relative path traversal in Microsoft Edge (Chromium-based) allows an un= authorized attacker to execute code over a network.</td>
<td>2026-07-03</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57988" target=3D= "_blank" rel=3D"noopener">CVE-2026-57988</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Improper link resolution before file access ('link following') in Micro= soft Edge (Chromium-based) allows an unauthorized attacker to disclose info= rmation over a network.</td>
<td>2026-07-03</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57991" target=3D= "_blank" rel=3D"noopener">CVE-2026-57991</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Use after free in Microsoft Edge (Chromium-based) allows an unauthorize=
d attacker to execute code over a network.</td>
<td>2026-07-03</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57992" target=3D= "_blank" rel=3D"noopener">CVE-2026-57992</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) a= llows an unauthorized attacker to perform spoofing over a network.</td> <td>2026-07-03</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57993" target=3D= "_blank" rel=3D"noopener">CVE-2026-57993</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Use after free in Microsoft Edge (Chromium-based) allows an unauthorize=
d attacker to execute code over a network.</td>
<td>2026-07-03</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58276" target=3D= "_blank" rel=3D"noopener">CVE-2026-58276</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Access of resource using incompatible type ('type confusion') in Micros= oft Edge (Chromium-based) allows an unauthorized attacker to execute code o= ver a network.</td>
<td>2026-07-03</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58290" target=3D= "_blank" rel=3D"noopener">CVE-2026-58290</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Improper input validation in Microsoft Edge (Chromium-based) allows an = unauthorized attacker to execute code over a network.</td>
<td>2026-07-03</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58292" target=3D= "_blank" rel=3D"noopener">CVE-2026-58292</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Use after free in Microsoft Edge (Chromium-based) allows an unauthorize=
d attacker to execute code over a network.</td>
<td>2026-07-03</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58294" target=3D= "_blank" rel=3D"noopener">CVE-2026-58294</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Exposure of private personal information to an unauthorized actor in Mi= crosoft Edge for Android allows an unauthorized attacker to disclose inform= ation over a network.</td>
<td>2026-07-03</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58296" target=3D= "_blank" rel=3D"noopener">CVE-2026-58296</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Exposure of private personal information to an unauthorized actor in Mi= crosoft Edge for Android allows an unauthorized attacker to disclose inform= ation over a network.</td>
<td>2026-07-03</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58297" target=3D= "_blank" rel=3D"noopener">CVE-2026-58297</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') in Microsoft Edge (Chromium-based) allows an unauthorized att= acker to perform spoofing over a network.</td>
<td>2026-07-03</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58298" target=3D= "_blank" rel=3D"noopener">CVE-2026-58298</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Time-of-check time-of-use (toctou) race condition in Microsoft Edge for=
Android allows an unauthorized attacker to execute code over a network.</t=

<td>2026-07-03</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58299" target=3D= "_blank" rel=3D"noopener">CVE-2026-58299</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Entra Provisioning Servic= e</td>
<td>Server-side request forgery (ssrf) in Microsoft Entra Provisioning Serv= ice (SyncFabric) allows an authorized attacker to elevate privileges over a=
network.</td>
<td>2026-07-02</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57100" target=3D= "_blank" rel=3D"noopener">CVE-2026-57100</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Exchange Online</td> <td>Incorrect authorization in Microsoft Exchange Online allows an authoriz=
ed attacker to elevate privileges over a network.</td>
<td>2026-07-02</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54998" target=3D= "_blank" rel=3D"noopener">CVE-2026-54998</a></td>
</tr>

<td class=3D"vendor-product">microsoft--OpenAPI.NET</td>
<td>The OpenAPI.NET SDK contains a useful object model for OpenAPI document=
s in .NET along with common serializers to extract raw OpenAPI JSON and YAM=
L documents from the model. From 2.0.0-preview11 until 2.7.5 and 3.5.4, a s= mall OpenAPI document containing a circular schema reference can cause proc= ess termination through stack overflow in Microsoft.OpenApi. The issue affe= cts OpenAPI document parsing through public OpenAPI.NET reader APIs and has=
been confirmed across both JSON and YAML reader paths. This vulnerability =
is fixed in 2.7.5 and 3.5.4.</td>
<td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49451" target=3D= "_blank" rel=3D"noopener">CVE-2026-49451</a></td>
</tr>

<td class=3D"vendor-product">mjperpinosa--stumasy</td>
<td>A vulnerability was identified in mjperpinosa stumasy up to 327d1b0f291= 5ba79d7ef8ebb74553e987609d9be. Impacted is the function eval of the file ap= plication/pages/imba_calculator/calculate.php. The manipulation of the argu= ment mathematical_sentence leads to code injection. The attack is possible =
to be carried out remotely. The exploit is publicly available and might be = used. This product adopts a rolling release strategy to maintain continuous=
delivery. Therefore, version details for affected or updated releases cann=
ot be specified. The project was informed of the problem early through an i= ssue report but has not responded yet.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14749" target=3D= "_blank" rel=3D"noopener">CVE-2026-14749</a></td>
</tr>

<td class=3D"vendor-product">mjperpinosa--stumasy</td>
<td>A security flaw has been discovered in mjperpinosa stumasy up to 327d1b= 0f2915ba79d7ef8ebb74553e987609d9be. The affected element is the function No= tes_controller::accessing_dictionary_authorization of the file application/= PHP/objects/notes/accessing_dictionary_authorization.php. The manipulation =
of the argument Password results in sql injection. The attack may be perfor= med from remote. The exploit has been released to the public and may be use=
d for attacks. This product utilizes a rolling release system for continuou=
s delivery, and as such, version information for affected or updated releas=
es is not disclosed. The project was informed of the problem early through =
an issue report but has not responded yet.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14750" target=3D= "_blank" rel=3D"noopener">CVE-2026-14750</a></td>
</tr>

<td class=3D"vendor-product">mjperpinosa--stumasy</td>
<td>A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915b= a79d7ef8ebb74553e987609d9be. This impacts an unknown function of the file /= PHP/objects/notes of the component Note Handler/Assignment Handler. Perform= ing a manipulation of the argument assignment_item_id results in authorizat= ion bypass. The attack can be initiated remotely. The exploit is now public=
and may be used. Continious delivery with rolling releases is used by this=
product. Therefore, no version details of affected nor updated releases ar=
e available. The project was informed of the problem early through an issue=
report but has not responded yet.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14753" target=3D= "_blank" rel=3D"noopener">CVE-2026-14753</a></td>
</tr>

<td class=3D"vendor-product">modoboa--modoboa</td>
<td>Modoboa before 2.9.0 contains an insecure direct object reference vulne= rability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows do= main administrators to change any user's password. Attackers with domain ad= min privileges can bypass object-level access controls to reset superadmin = passwords and achieve full account takeover.</td>
<td>2026-06-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56780" target=3D= "_blank" rel=3D"noopener">CVE-2026-56780</a></td>
</tr>

<td class=3D"vendor-product">Moreconvert Team--MC Woocommerce Wishlist</td> <td>Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist &= lt;=3D 1.9.19 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57356" target=3D= "_blank" rel=3D"noopener">CVE-2026-57356</a></td>
</tr>

<td class=3D"vendor-product">msgpack--msgpack-python</td>
<td>MessagePack is the serializer implementation for Python msgpack.org. Pr= ior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after =
a caught error, potentially leading to a DoS attack. If the Unpacker is use=
d repeatedly after an error occurs, the process may crash with a SEGV. This=
issue has been fixed in version 1.2.1.</td>
<td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57585" target=3D= "_blank" rel=3D"noopener">CVE-2026-57585</a></td>
</tr>

<td class=3D"vendor-product">n8n--n8n</td>
<td>The Execute Command node in n8n allows authenticated users to execute a= rbitrary commands on the host system where n8n runs. Attackers with user ac= cess or compromised credentials can exploit this node to run malicious comm= ands, potentially leading to data exfiltration, service disruption, or comp= lete system compromise.</td>
<td>2026-07-04</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71380" target=3D= "_blank" rel=3D"noopener">CVE-2025-71380</a></td>
</tr>

<td class=3D"vendor-product">neuml--txtai</td>
<td>txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex = endpoint whose function body parameter is resolved through txtai.util.Resol= ver, which performs __import__ and getattr on the caller-supplied dotted pa=
th with no allowlist. When the API is exposed with no TOKEN configured (aut= hentication is opt-in, so all endpoints are unauthenticated) and the index =
is configured writable, a remote attacker can set function to an arbitrary = callable such as subprocess.getoutput, achieving remote code execution as t=
he server process during reindexing. Exploitation requires those deployment=
conditions (API exposed, no TOKEN, writable index); it is not the default = configuration. The fix gates the endpoint behind a new reindex configuratio=
n flag.</td>
<td>2026-06-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58449" target=3D= "_blank" rel=3D"noopener">CVE-2026-58449</a></td>
</tr>

<td class=3D"vendor-product">NodeBB--NodeBB</td>
<td>NodeBB does not bind the claimed author of an inbound ActivityPub objec=
t to the authenticated remote actor. The inbound middleware verifies the HT= TP-signature actor and checks the origin of object.id, but never validates = that attributedTo corresponds to the sender. In the object mock, attributed=
To is used directly as a uid, and actors.assert silently ignores numeric id= entifiers (filtering them out without re-deriving the uid), so a federated = remote actor can set attributedTo to a bare numeric value such as 1 and hav=
e the resulting post or private message created with that local uid as auth= or, including the administrator account. This lets a remote attacker forge = posts and direct messages attributed to arbitrary local users. Requires the=
ActivityPub/federation feature to be enabled.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58593" target=3D= "_blank" rel=3D"noopener">CVE-2026-58593</a></td>
</tr>

<td class=3D"vendor-product">Notifiarr--dockwatch</td>
<td>Dockwatch through 0.6.567 contains an unauthenticated OS command inject= ion vulnerability that allows remote attackers to execute arbitrary shell c= ommands by exploiting a missing exit() after an authentication redirect in = loader.php combined with unsanitized input passed to shell_exec() in ajax/c= ompose.php. Attackers can seed the required session flag through the incomp= lete auth check, then inject arbitrary commands via the composePath POST pa= rameter in the composePull action to achieve full host compromise, facilita= ted by the standard deployment mounting of the Docker socket.</td> <td>2026-07-02</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58455" target=3D= "_blank" rel=3D"noopener">CVE-2026-58455</a></td>
</tr>

<td class=3D"vendor-product">Novalnet--Novalnet Payment Gateway for WooComm= erce</td>
<td>Unauthenticated PHP Object Injection in Novalnet Payment Gateway for Wo= oCommerce &lt;=3D 12.10.3 versions.</td>
<td>2026-07-02</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57677" target=3D= "_blank" rel=3D"noopener">CVE-2026-57677</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--AIStore framework</td>
<td>NVIDIA AIStore framework contains a vulnerability where an attacker cou=
ld bypass authentication. A successful exploit of this vulnerability might = lead to denial of service, escalation of privileges, information disclosure=
, and data tampering.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24270" target=3D= "_blank" rel=3D"noopener">CVE-2026-24270</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--BlueField GA</td>
<td>NVIDIA ConnectX and BlueField contain a vulnerability in the command in= terface where a local user with virtual function (VF) access may cause a wr= ite out of bounds by crafted input. A successful exploit of this vulnerabil= ity may lead to arbitrary code execution on the device.</td> <td>2026-07-01</td>
<td>9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-23350" target=3D= "_blank" rel=3D"noopener">CVE-2025-23350</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--BlueField GA</td>
<td>NVIDIA ConnectX and BlueField contain a vulnerability in the command in= terface where a local user with virtual function (VF) access may cause a wr= ite out of bounds by crafted input. A successful exploit of this vulnerabil= ity may lead to arbitrary code execution on the device.</td> <td>2026-07-01</td>
<td>9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-23351" target=3D= "_blank" rel=3D"noopener">CVE-2025-23351</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Container Toolkit</td>
<td>NVIDIA Container Toolkit for Linux contains a vulnerability where an at= tacker could cause a time-of-check time-of-use race condition. A successful=
exploit of this vulnerability might lead to code execution, escalation of = privileges, and data tampering.</td>
<td>2026-07-01</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24260" target=3D= "_blank" rel=3D"noopener">CVE-2026-24260</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Megatron-Bridge</td>
<td>NVIDIA Megatron Bridge for Linux contains a vulnerability where an atta= cker could cause deserialization of untrusted data. A successful exploit of=
this vulnerability might lead to code execution, escalation of privileges,=
data tampering, and information disclosure.</td>
<td>2026-07-01</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24240" target=3D= "_blank" rel=3D"noopener">CVE-2026-24240</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Megatron-Bridge</td>
<td>NVIDIA Megatron Bridge for Linux contains a vulnerability where an atta= cker could cause server-side request forgery. A successful exploit of this = vulnerability might lead to information disclosure.</td>
<td>2026-07-01</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24242" target=3D= "_blank" rel=3D"noopener">CVE-2026-24242</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Megatron-Bridge</td>
<td>NVIDIA Megatron Bridge for Linux contains a vulnerability where an atta= cker could cause deserialization of untrusted data. A successful exploit of=
this vulnerability might lead to code execution, escalation of privileges,=
data tampering, and information disclosure.</td>
<td>2026-07-01</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24243" target=3D= "_blank" rel=3D"noopener">CVE-2026-24243</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Megatron-Bridge</td>
<td>NVIDIA Megatron Bridge for Linux contains a vulnerability where an atta= cker could cause deserialization of untrusted data. A successful exploit of=
this vulnerability might lead to code execution, escalation of privileges,=
data tampering, and information disclosure.</td>
<td>2026-07-01</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24244" target=3D= "_blank" rel=3D"noopener">CVE-2026-24244</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Megatron-Bridge</td>
<td>NVIDIA Megatron Bridge for Linux contains a vulnerability where an atta= cker could cause deserialization of untrusted data. A successful exploit of=
this vulnerability might lead to code execution, escalation of privileges,=
data tampering, and information disclosure.</td>
<td>2026-07-01</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24245" target=3D= "_blank" rel=3D"noopener">CVE-2026-24245</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Megatron-Bridge</td>
<td>NVIDIA Megatron Bridge for Linux contains a vulnerability where an atta= cker could cause improper control of dynamically managed code resources. A = successful exploit of this vulnerability might lead to code execution, esca= lation of privileges, data tampering, and information disclosure.</td> <td>2026-07-01</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24246" target=3D= "_blank" rel=3D"noopener">CVE-2026-24246</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Megatron-Bridge</td>
<td>NVIDIA Megatron Bridge for Linux contains a vulnerability where an atta= cker could cause deserialization of untrusted data. A successful exploit of=
this vulnerability might lead to code execution, escalation of privileges,=
data tampering, and information disclosure.</td>
<td>2026-07-01</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24247" target=3D= "_blank" rel=3D"noopener">CVE-2026-24247</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Megatron-Bridge</td>
<td>NVIDIA Megatron Bridge for Linux contains a vulnerability where an atta= cker could cause improper control of code generation. A successful exploit =
of this vulnerability might lead to code execution, escalation of privilege=
s, data tampering, and information disclosure.</td>
<td>2026-07-01</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24248" target=3D= "_blank" rel=3D"noopener">CVE-2026-24248</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Megatron-Bridge</td>
<td>NVIDIA Megatron Bridge for Linux contains a vulnerability where an atta= cker could cause deserialization of untrusted data. A successful exploit of=
this vulnerability might lead to code execution, escalation of privileges,=
data tampering, and information disclosure.</td>
<td>2026-07-01</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24249" target=3D= "_blank" rel=3D"noopener">CVE-2026-24249</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Megatron-Bridge</td>
<td>NVIDIA Megatron Bridge for Linux contains a vulnerability where an atta= cker could cause improper validation of allowed inputs. A successful exploi=
t of this vulnerability might lead to code execution, escalation of privile= ges, data tampering, and information disclosure.</td>
<td>2026-07-01</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24250" target=3D= "_blank" rel=3D"noopener">CVE-2026-24250</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Megatron-Bridge</td>
<td>NVIDIA Megatron Bridge for Linux contains a vulnerability where an atta= cker could cause improper control of dynamically managed code resources. A = successful exploit of this vulnerability might lead to code execution, esca= lation of privileges, data tampering, and information disclosure.</td> <td>2026-07-01</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24251" target=3D= "_blank" rel=3D"noopener">CVE-2026-24251</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Triton Inference Server</td>
<td>NVIDIA Triton Inference Server for Linux contains a vulnerability where=
an attacker can cause improper handling of highly compressed data. A succe= ssful exploit of this vulnerability might lead to denial of service.</td> <td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24264" target=3D= "_blank" rel=3D"noopener">CVE-2026-24264</a></td>
</tr>

<td class=3D"vendor-product">OFFIS DICOM--DCMTK Toolkit</td>
<td>A malicious or compromised server can make a DCMTK client using bit-pre= serving C-GET storage mode write files outside the chosen output directory,=
using both relative (../) paths and absolute paths.</td>
<td>2026-06-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50003" target=3D= "_blank" rel=3D"noopener">CVE-2026-50003</a></td>
</tr>

<td class=3D"vendor-product">OFFIS DICOM--DCMTK Toolkit</td>
<td>An unauthenticated attacker can read worklist records from a directory = outside the intended per-AE worklist storage area. In a multi-area deployme= nt, this can cross departmental or clinic data separation.</td> <td>2026-06-30</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52868" target=3D= "_blank" rel=3D"noopener">CVE-2026-52868</a></td>
</tr>

<td class=3D"vendor-product">OFFIS DICOM--DCMTK Toolkit</td>
<td>An unauthenticated remote attacker can repeatedly send crafted connecti=
on requests to leak memory. In single-process deployments the memory grows = until the service is killed and the port stops responding until restart.</t=

<td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-35505" target=3D= "_blank" rel=3D"noopener">CVE-2026-35505</a></td>
</tr>

<td class=3D"vendor-product">OFFIS DICOM--DCMTK Toolkit</td>
<td>An unauthenticated attacker can crash the worklist server with a single=
crafted query when the server has a valid Called AE Title / storage direct= ory, the expected lockfile, and at least one matching worklist record.</td> <td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44628" target=3D= "_blank" rel=3D"noopener">CVE-2026-44628</a></td>
</tr>

<td class=3D"vendor-product">OFFIS DICOM--DCMTK Toolkit</td>
<td>An unauthenticated remote attacker can repeatedly send a single crafted=
connection request to leak memory. Against storescp in its default single-= process mode, memory grows quickly and the service is eventually killed, af= ter which it stops accepting connections until an operator restarts it.</td=

<td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50254" target=3D= "_blank" rel=3D"noopener">CVE-2026-50254</a></td>
</tr>

<td class=3D"vendor-product">ohler55--oj</td>
<td>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as =
a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child, when invoked r= ecursively over a deeply nested JSON document, overflows a fixed-size stack=
buffer and aborts the process, leading to DoS. In a two-step chain in ext/= oj/fast.c, doc_each_child increments doc-&gt;where past the where_path[MAX_= STACK =3D 100] array with no bounds check and never restores it (the doc-&g= t;where-- is missing), so calling each_child recursively from inside the yi= eld block drives doc-&gt;where beyond the array. On the next entry the func= tion copies the path into the 800-byte stack-local buffer save_path[MAX_STA= CK] using wlen =3D doc-&gt;where - doc-&gt;where_path, so when the previous=
recursive call left doc-&gt;where past where_path[100] the wlen exceeds MA= X_STACK and the memcpy overflows save_path on the C stack; because the Oj::= Doc parser imposes no JSON nesting-depth limit (relying on a C-stack pressu=
re check), deeply nested attacker input reaches this path. This issue has b= een fixed in version 3.17.3.</td>
<td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54592" target=3D= "_blank" rel=3D"noopener">CVE-2026-54592</a></td>
</tr>

<td class=3D"vendor-product">open62541 project / o6 Automation GmbH--open62= 541</td>
<td>An unauthenticated remote attacker can exhaust server memory via the Ge= tEndpoints Discovery Service in open62541. The endpointUrl field of GetEndp= ointsRequest is not validated for length. An attacker can declare an arbitr= arily large string (up to ~4.09 GB via the UInt32 length field) delivered a= cross intermediate chunks without ever sending the final chunk. The server = buffers all chunks in RAM indefinitely until the SecureChannel times out. T=
he attack is pre-session and bypasses all encryption configurations. The=C2= =A0issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1= .5.4, master.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11946" target=3D= "_blank" rel=3D"noopener">CVE-2026-11946</a></td>
</tr>

<td class=3D"vendor-product">open62541 project / o6 Automation GmbH--open62= 541</td>
<td>An unauthenticated remote attacker can exhaust server memory via the Fi= ndServers Discovery Service in open62541. The serverUris field of FindServe= rsRequest is not validated for length or array size. An attacker can declar=
e an arbitrarily large string (up to ~3.9 GB) delivered across intermediate=
chunks without ever sending the final chunk. The server buffers all chunks=
in RAM indefinitely until the SecureChannel times out. The attack is pre-s= ession and bypasses all encryption configuration. The=C2=A0issue affects op= en62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.</td> <td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-33592" target=3D= "_blank" rel=3D"noopener">CVE-2026-33592</a></td>
</tr>

<td class=3D"vendor-product">OpenBMB--ChatDev</td>
<td>OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path=
traversal vulnerability that allows unauthenticated remote attackers to wr= ite or delete arbitrary files by supplying a malicious multipart filename i=
n the file upload endpoint. Attackers can send a crafted filename containin=
g path traversal sequences or an absolute path to the POST uploads session = endpoint, which constructs the destination path without sanitization in sav= e_upload_file, causing file write and cleanup operations to target attacker= -chosen paths on the server filesystem.</td>
<td>2026-06-30</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58166" target=3D= "_blank" rel=3D"noopener">CVE-2026-58166</a></td>
</tr>

<td class=3D"vendor-product">openSUSE--buildservice</td>
<td>A shellcode injection in the mercurial handler of the obs tar_scm sourc=
e service before version 0.12.4 could be used by attackers able to provide =
a _service file to execute code as the source service or the local user che= cking out the malicious services</td>
<td>2026-07-02</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56004" target=3D= "_blank" rel=3D"noopener">CVE-2026-56004</a></td>
</tr>

<td class=3D"vendor-product">openwrt--luci-app-tailscale-community</td> <td>luci-app-tailscale-community contains a command injection vulnerability=
in the tailscale.do_login RPC method that allows authenticated users to ex= ecute arbitrary commands as root. The vulnerability exists because user-con= trolled loginserver and loginserver_authkey parameters are improperly quote=
d within a double-quoted shell command, allowing shell substitutions like $=
() to be evaluated by the outer shell before argument processing.</td> <td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57999" target=3D= "_blank" rel=3D"noopener">CVE-2026-57999</a></td>
</tr>

<td class=3D"vendor-product">openwrt--luci-app-travelmate</td> <td>luci-app-travelmate (and the travelmate package) contain a privilege-es= calation flaw: a LuCI/rpcd session holding the luci-app-travelmate write AC=
L is granted config-wide UCI write access to the travelmate configuration. = While the LuCI UI restricts the auto-login script picker to /etc/travelmate= /*.login, this is only a frontend restriction. The backend travelmate servi=
ce (running as root) reads the raw UCI 'script' and 'script_args' values an=
d executes the configured path when the captive-portal auto-login branch (f= _check() in travelmate-functions.sh) is reached. An attacker with delegated=
write permissions can set script to /bin/sh and script_args to attacker-co= ntrolled arguments, resulting in arbitrary command execution as root. Confi= rmed in luci-app-travelmate/travelmate 2.4.5-r3; the sink is still present =
in travelmate 2.4.6-1 and no patched version is known.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58652" target=3D= "_blank" rel=3D"noopener">CVE-2026-58652</a></td>
</tr>

<td class=3D"vendor-product">openwrt--luci-proto-openvpn</td> <td>luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a = command injection vulnerability in the generateKey ubus method where the cl= _meta parameter is interpolated into a shell command without proper escapin=
g or quoting. An authenticated LuCI user with OpenVPN protocol configuratio=
n access can inject arbitrary shell metacharacters into cl_meta to execute = commands as root via the popen function.</td>
<td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58000" target=3D= "_blank" rel=3D"noopener">CVE-2026-58000</a></td>
</tr>

<td class=3D"vendor-product">openziti--ziti</td>
<td>OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege e= scalation vulnerability that allows authenticated non-admin identities with=
fine-grained enrollment management permissions to create enrollments for a=
ny identity, including the default administrator, because the ApplyCreate f= unction in controller/model/enrollment_manager.go verifies only that the ta= rget identity exists without performing authorization checks binding the ca= ller to the target identity. Attackers can redeem the resulting one-time to= ken through the unauthenticated client API enrollment endpoint to obtain a = client certificate authenticating as the targeted admin identity, yielding = full administrative control of the controller and the zero-trust overlay it=
manages.</td>
<td>2026-06-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58165" target=3D= "_blank" rel=3D"noopener">CVE-2026-58165</a></td>
</tr>

<td class=3D"vendor-product">OPPO--O+ Connect</td>
<td>Because O+ Connect's IPC service does not authenticate clients, externa=
l applications can escalate privileges and perform sensitive actions throug=
h the IPC channel.</td>
<td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-22078" target=3D= "_blank" rel=3D"noopener">CVE-2026-22078</a></td>
</tr>

<td class=3D"vendor-product">Optimole--Optimole</td>
<td>Unauthenticated Cross Site Scripting (XSS) in Optimole &lt;=3D 4.2.7 ve= rsions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57673" target=3D= "_blank" rel=3D"noopener">CVE-2026-57673</a></td>
</tr>

<td class=3D"vendor-product">pathwaycom--pathway</td>
<td>Pathway through 0.31.1, fixed in commit d09722e, document store applies=
a caller-supplied glob pattern to indexed document paths using a hand-writ= ten recursive matcher that branches two ways on each ** token without memoi= zation, giving exponential worst-case complexity. The filepath_globpattern = value is taken from the body of the unauthenticated HTTP endpoints /v1/retr= ieve, /v1/inputs and /v2/answer and compiled into a filter evaluated once p=
er indexed document, with no length or **-count limit. A remote unauthentic= ated attacker can submit a short pattern containing many ** tokens to consu=
me CPU for tens of seconds per request, and a small number of requests deni=
es service.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59094" target=3D= "_blank" rel=3D"noopener">CVE-2026-59094</a></td>
</tr>

<td class=3D"vendor-product">Perfmatters--perfmatters</td>
<td>Unauthenticated Cross Site Scripting (XSS) in perfmatters &lt;=3D 2.6.4=
versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57671" target=3D= "_blank" rel=3D"noopener">CVE-2026-57671</a></td>
</tr>

<td class=3D"vendor-product">perfmatters--Perfmatters</td>
<td>The Perfmatters plugin for WordPress is vulnerable to Directory Travers=
al in all versions up to, and including, 2.6.4 via the 's' parameter. This = makes it possible for unauthenticated attackers to read the contents of arb= itrary files on the server, which can contain sensitive information. Exploi= tation requires the Local Google Fonts feature to be enabled (disabled by d= efault), pretty permalinks to be active, and RSS feed links to remain enabl=
ed in the plugin settings.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13251" target=3D= "_blank" rel=3D"noopener">CVE-2026-13251</a></td>
</tr>

<td class=3D"vendor-product">pfefferle--Webmention</td>
<td>The Webmention plugin for WordPress is vulnerable to Stored Cross-Site = Scripting in versions up to and including 5.8.0 via parser-derived 'avatar'=
and 'url' author metadata. This is due to insufficient input sanitization = and output escaping on user-supplied MF2 author properties processed by the=
unauthenticated webmention REST endpoint and rendered directly into HTML '= value' attributes by the edit-comment-form template without esc_attr() or e= sc_url(). This makes it possible for unauthenticated attackers to inject ar= bitrary web scripts in pages that will execute whenever a privileged user (= moderator or administrator) opens the affected comment edit screen.</td> <td>2026-06-30</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10513" target=3D= "_blank" rel=3D"noopener">CVE-2026-10513</a></td>
</tr>

<td class=3D"vendor-product">phpMyFAQ--phpMyFAQ</td>
<td>phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in = GroupController::updatePermissions that allows GROUP_EDIT administrators to=
grant arbitrary rights to groups without verifying they hold those rights = themselves. A delegated administrator can exploit this by assigning high-va= lue permissions to a group they belong to, inheriting those rights and esca= lating privileges up to full administrative control.</td>
<td>2026-06-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57995" target=3D= "_blank" rel=3D"noopener">CVE-2026-57995</a></td>
</tr>

<td class=3D"vendor-product">Picklescan--Picklescan</td>
<td>Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.ge= tlincoef gadget in pickle __reduce__ methods, allowing arbitrary code execu= tion. Attackers can craft malicious pickle files that execute arbitrary Pyt= hon code when loaded, bypassing Picklescan's safety checks and enabling sup= ply-chain poisoning of shared model files.</td>
<td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71372" target=3D= "_blank" rel=3D"noopener">CVE-2025-71372</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.30 fails to detect malicious pickle files using i= dlelib.run.Executive.runcode in reduce methods. Attackers can embed undetec= ted code in pickle files that executes during pickle.load, enabling remote = code execution in PyTorch models and supply chain attacks.</td> <td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71342" target=3D= "_blank" rel=3D"noopener">CVE-2025-71342</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.30 fails to detect malicious pickle files that ex= ploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in the reduce = method. Attackers can craft malicious pickle files with embedded code that = evades detection but executes arbitrary commands when pickle.load() is call= ed.</td>
<td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71343" target=3D= "_blank" rel=3D"noopener">CVE-2025-71343</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.30 fails to detect malicious pickle files that in= voke torch.utils.bottleneck.__main__.run_autograd_prof function. Attackers = can embed undetected code in pickle files that executes during deserializat= ion, enabling remote code execution.</td>
<td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71345" target=3D= "_blank" rel=3D"noopener">CVE-2025-71345</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.33 fails to detect malicious pickle files using n= umpy.f2py.crackfortran.param_eval function in reduce methods, allowing atta= ckers to bypass security checks. Remote attackers can embed undetected code=
in pickle files that executes during deserialization, enabling arbitrary c= ode execution in applications loading untrusted pickle data.</td> <td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71347" target=3D= "_blank" rel=3D"noopener">CVE-2025-71347</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.29 fails to detect the built-in trace.Trace.run f= unction when analyzing pickle files, allowing attackers to embed undetected=
malicious code. Remote attackers can craft malicious pickle files using tr= ace.Trace.run in the reduce method to achieve arbitrary code execution when=
pickle.load processes the file.</td>
<td>2026-06-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71349" target=3D= "_blank" rel=3D"noopener">CVE-2025-71349</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.28 fails to detect malicious pickle files using t= orch.utils.collect_env.run function in reduce methods. Attackers can embed = undetected code in pickle files that executes remote commands when loaded b=
y victims.</td>
<td>2026-06-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71350" target=3D= "_blank" rel=3D"noopener">CVE-2025-71350</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.29 fails to detect the built-in Python trace.Trac= e.runctx function when used in pickle file reduce methods, allowing attacke=
rs to execute arbitrary code. Remote attackers can craft malicious pickle f= iles with trace.Trace.runctx payloads that bypass picklescan detection and = execute code upon pickle.load() invocation.</td>
<td>2026-06-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71352" target=3D= "_blank" rel=3D"noopener">CVE-2025-71352</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.28 fails to detect malicious pickle files that ex= ploit torch._dynamo.guards.GuardBuilder.get function in reduce methods. Att= ackers can craft pickle files with embedded code that evades picklescan det= ection and executes arbitrary commands when loaded.</td>
<td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71353" target=3D= "_blank" rel=3D"noopener">CVE-2025-71353</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.28 fails to detect malicious torch.fx.experimenta= l.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pic= kle files. Attackers can embed undetected code in pickle files that execute=
s remote code when loaded by victims.</td>
<td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71356" target=3D= "_blank" rel=3D"noopener">CVE-2025-71356</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.29 fails to detect malicious pickle payloads that=
utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing=
remote code execution. Attackers can craft pickle files embedding dangerou=
s code that evades picklescan detection and executes during pickle.load() d= eserialization.</td>
<td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71359" target=3D= "_blank" rel=3D"noopener">CVE-2025-71359</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.29 fails to detect malicious pickle files using i= dlelib.calltip.get_entity function in reduce methods. Attackers can embed u= ndetected code in pickle files that executes remote commands when loaded by=
victims.</td>
<td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71360" target=3D= "_blank" rel=3D"noopener">CVE-2025-71360</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.33 fails to detect unsafe deserialization when nu= mpy.f2py.crackfortran functions call eval on arbitrary strings. Attackers c=
an embed malicious code in pickle files that executes when loaded from untr= usted sources.</td>
<td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71362" target=3D= "_blank" rel=3D"noopener">CVE-2025-71362</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.30 fails to detect cProfile.run function calls in=
pickle reduce methods, allowing attackers to execute arbitrary code. Remot=
e attackers can craft malicious pickle files with cProfile.run payloads tha=
t bypass picklescan detection and achieve code execution upon deserializati= on.</td>
<td>2026-06-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71363" target=3D= "_blank" rel=3D"noopener">CVE-2025-71363</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixS= ubprocessTransport._start function in pickle reduce methods, allowing remot=
e code execution. Attackers can craft malicious pickle files embedding this=
built-in function that evade detection but execute arbitrary commands when=
loaded.</td>
<td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71364" target=3D= "_blank" rel=3D"noopener">CVE-2025-71364</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.28 fails to detect malicious torch.utils.bottlene= ck.__main__.run_cprofile function calls in pickle files, allowing attackers=
to bypass safety checks. Remote attackers can embed undetected code in pic= kle files to achieve arbitrary code execution when victims load the files.<=

<td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71366" target=3D= "_blank" rel=3D"noopener">CVE-2025-71366</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.34 fails to detect _operator.attrgetter function = calls in pickle payloads, allowing attackers to bypass security checks. Rem= ote attackers can craft malicious pickle files using _operator.attrgetter i=
n reduce methods to execute arbitrary code when pickle.load() processes the=
file.</td>
<td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71367" target=3D= "_blank" rel=3D"noopener">CVE-2025-71367</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.30 fails to detect the doctest.debug_script funct= ion when analyzing pickle files, allowing attackers to execute arbitrary co= de. Remote attackers can craft malicious pickle files embedding doctest.deb= ug_script calls that bypass picklescan detection and execute arbitrary comm= ands upon pickle.load invocation.</td>
<td>2026-06-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71368" target=3D= "_blank" rel=3D"noopener">CVE-2025-71368</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.28 fails to detect malicious pickle files that us=
e torch.utils.data.datapipes.utils.decoder.basichandlers in reduce methods,=
allowing attackers to bypass safety checks. Remote attackers can embed und= etected malicious code in pickle files that executes during deserialization=
, enabling remote code execution.</td>
<td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71369" target=3D= "_blank" rel=3D"noopener">CVE-2025-71369</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.29 fails to detect malicious pickle files using c= ode.InteractiveInterpreter.runcode in reduce methods. Attackers can craft p= ickle payloads that bypass picklescan detection and execute arbitrary code = when loaded via pickle.load().</td>
<td>2026-06-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71371" target=3D= "_blank" rel=3D"noopener">CVE-2025-71371</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.33 fails to detect operator.methodcaller function=
calls in pickle files, allowing attackers to bypass security checks. Remot=
e attackers can craft malicious pickle payloads using operator.methodcaller=
that execute arbitrary code when loaded, compromising systems relying on p= icklescan for validation.</td>
<td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71373" target=3D= "_blank" rel=3D"noopener">CVE-2025-71373</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.29 fails to detect the built-in python profile.Pr= ofile.run function when used in pickle reduce methods, allowing attackers t=
o execute arbitrary code. Remote attackers can craft malicious pickle files=
that bypass picklescan detection and achieve code execution upon deseriali= zation.</td>
<td>2026-06-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71374" target=3D= "_blank" rel=3D"noopener">CVE-2025-71374</a></td>
</tr>

<td class=3D"vendor-product">picklescan--picklescan</td>
<td>picklescan before 0.0.34 fails to detect the _operator.methodcaller bui= lt-in function when scanning pickle files for malicious code. Attackers can=
craft malicious pickle payloads using _operator.methodcaller that evade de= tection and execute arbitrary code when loaded by pickle.load().</td> <td>2026-07-04</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71375" target=3D= "_blank" rel=3D"noopener">CVE-2025-71375</a></td>
</tr>

<td class=3D"vendor-product">pinpoint-apm--pinpoint</td>
<td>Pinpoint through 3.1.0 contains a server-side request forgery vulnerabi= lity in the webhook registration endpoint that allows authenticated users t=
o register internal URLs due to missing SSRF protection. Attackers can trig= ger alarm threshold breaches to force the server to issue POST requests to = internal hosts and metadata endpoints, enabling unauthorized access to inte= rnal network resources.</td>
<td>2026-06-29</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57947" target=3D= "_blank" rel=3D"noopener">CVE-2026-57947</a></td>
</tr>

<td class=3D"vendor-product">ploudapp--pCloud WP Backup</td> <td>Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup &= lt;=3D 2.0.2 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57757" target=3D= "_blank" rel=3D"noopener">CVE-2026-57757</a></td>
</tr>

<td class=3D"vendor-product">PluginOps--Landing Page Builder</td> <td>Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder &lt;= =3D 1.5.3.5 versions.</td>
<td>2026-06-29</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57337" target=3D= "_blank" rel=3D"noopener">CVE-2026-57337</a></td>
</tr>

<td class=3D"vendor-product">printcart--Printcart Web to Print Product Desi= gner for WooCommerce</td>
<td>The Printcart Web to Print Product Designer for WooCommerce plugin for = WordPress is vulnerable to Arbitrary File Deletion in versions up to, and i= ncluding, 2.5.2 This is due to insufficient path validation in the store_de= sign_data() function, which constructs a filesystem path from the user-supp= lied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field(=
) - which does not strip path traversal sequences - and then passes that pa=
th directly to Nbdesigner_IO::delete_folder() and PHP's rename(). The nonce=
protecting the nbd_save_customer_design AJAX action is freely obtainable b=
y unauthenticated users via the nbd_check_use_logged_in endpoint. This make=
s it possible for unauthenticated attackers to delete arbitrary files on th=
e affected site's server which may make remote code execution possible.</td=

<td>2026-07-03</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9725" target=3D"= _blank" rel=3D"noopener">CVE-2026-9725</a></td>
</tr>

<td class=3D"vendor-product">qlstudio--Export User Data</td>
<td>The Export User Data plugin for WordPress is vulnerable to arbitrary fi=
le deletion due to insufficient file path validation in the unserialize fun= ction in all versions up to, and including, 2.2.6. This makes it possible f=
or authenticated attackers, with subscriber-level access and above, to dele=
te arbitrary files on the server, which can easily lead to remote code exec= ution when the right file is deleted (such as wp-config.php). Successful ex= ploitation requires an administrator to trigger a user data export while a = subscriber-level (or higher) user has stored a crafted serialized XLSXWrite=
r object payload as their display name.</td>
<td>2026-06-30</td>
<td>8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12240" target=3D= "_blank" rel=3D"noopener">CVE-2026-12240</a></td>
</tr>

<td class=3D"vendor-product">QuantumCloud--ChatBot</td>
<td>Unauthenticated Cross Site Scripting (XSS) in ChatBot &lt;=3D 8.3.2 ver= sions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57362" target=3D= "_blank" rel=3D"noopener">CVE-2026-57362</a></td>
</tr>

<td class=3D"vendor-product">QuantumCloud--Simple Link Directory</td> <td>Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory &lt= ;=3D 15.0.5 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57682" target=3D= "_blank" rel=3D"noopener">CVE-2026-57682</a></td>
</tr>

<td class=3D"vendor-product">quantumcloud--WPBot AI ChatBot for Live Suppor=
t, Lead Generation, AI Services</td>
<td>The WPBot - AI ChatBot for Live Support, Lead Generation, AI Services p= lugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c= onversation' parameter in all versions up to, and including, 8.4.9 due to i= nsufficient input sanitization and output escaping. This makes it possible = for unauthenticated attackers to inject arbitrary web scripts in pages that=
will execute whenever a user accesses an injected page. The AJAX nonce req= uired to authenticate the save request is publicly emitted on every fronten=
d page via wp_localize_script, making it freely obtainable by any anonymous=
visitor and removing any practical barrier to exploitation.</td> <td>2026-07-01</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13731" target=3D= "_blank" rel=3D"noopener">CVE-2026-13731</a></td>
</tr>

<td class=3D"vendor-product">RadiusTheme--Classified Listing</td> <td>Unauthenticated Cross Site Scripting (XSS) in Classified Listing &lt;=
=3D 5.4.2 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57344" target=3D= "_blank" rel=3D"noopener">CVE-2026-57344</a></td>
</tr>

<td class=3D"vendor-product">Raera - Ankara Web Design and Digital Advertis= ing Agency--Destekz</td>
<td>Improper neutralization of special elements used in an SQL command ('SQ=
L injection') vulnerability in Raera - Ankara Web Design and Digital Advert= ising Agency Destekz allows SQL Injection. This issue affects Destekz: thro= ugh 02062026.=C2=A0NOTE: The vendor was contacted and it was learned that t=
he product is not supported.</td>
<td>2026-07-03</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4321" target=3D"= _blank" rel=3D"noopener">CVE-2026-4321</a></td>
</tr>

<td class=3D"vendor-product">RARLAB--WinRAR</td>
<td>An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) p= arser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The Rec= Items vector is sized only when the first .rev file in a set is processed; = subsequent .rev files supply an independent RecNum value that is validated = against that file's own TotalCount field but never against the actual size =
of RecItems. A crafted set of two or more .rev files can therefore write an=
attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[R= ecNum] at an attacker-controlled offset up to 65534 * sizeof(RecVolItem) by= tes past the allocation, corrupting adjacent heap objects. Triggering requi= res the victim to run a recovery/test operation on an attacker-supplied .re=
v set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive', or auto-= recovery when extracting a volume set with a missing .rar part). This is th=
e RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path onl=
y in WinRAR 6.23). Fixed in WinRAR / RAR 7.23.</td>
<td>2026-07-01</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14191" target=3D= "_blank" rel=3D"noopener">CVE-2026-14191</a></td>
</tr>

<td class=3D"vendor-product">RealMag777--BEAR</td>
<td>Unauthenticated Cross Site Scripting (XSS) in BEAR &lt;=3D 1.1.8 versio= ns.</td>
<td>2026-06-29</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57320" target=3D= "_blank" rel=3D"noopener">CVE-2026-57320</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>
<td>A flaw was found in HPLIP (HP Linux Imaging and Printing Software). Thi=
s vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote at= tacker to escalate privileges or achieve arbitrary code execution. This can=
occur through an integer overflow in the hpcups processing path when handl= ing specially crafted print data.</td>
<td>2026-07-03</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14544" target=3D= "_blank" rel=3D"noopener">CVE-2026-14544</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 6</td>
<td>A flaw was found in Yelp due to an overly permissive Content Security P= olicy (CSP) implementation provided by yelp-xsl. A malicious Flatpak applic= ation can open crafted help content through the OpenURI portal. By embeddin=
g an untrusted CSS stylesheet within a structured SVG document, attacker-co= ntrolled content can bypass Flatpak's intended sandbox isolation, allowing = Yelp to evaluate local XML inclusions and disclose arbitrary user-readable = host files through remote CSS resource requests. This may result in the una= uthorized disclosure of sensitive information.</td>
<td>2026-06-29</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13601" target=3D= "_blank" rel=3D"noopener">CVE-2026-13601</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 6</td>
<td>A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. Thi=
s heap buffer overflow vulnerability allows a remote attacker to cause arbi= trary code execution or a denial of service (DoS) by tricking a user into o= pening a specially crafted PSP image file. The vulnerability occurs because=
the software incorrectly calculates buffer sizes when processing low bit-d= epth images, leading to an overwrite of adjacent memory.</td> <td>2026-07-03</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58379" target=3D= "_blank" rel=3D"noopener">CVE-2026-58379</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Hardened Images</td>
<td>A flaw was found in libtiff. A remote attacker could exploit this vulne= rability by providing a specially crafted PixarLog-compressed TIFF image. T= his issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAF= MT_8BITABGR output format and a specific stride value, leading to a heap-ba= sed buffer overflow. This could potentially result in arbitrary code execut= ion or a denial of service (DoS).</td>
<td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12912" target=3D= "_blank" rel=3D"noopener">CVE-2026-12912</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Hardened Images</td>
<td>A double free issue has been identified in libarchive's RAR5 reader. Du= ring parsing of a specially crafted RAR5 archive, the filtered_buf pointer = may remain stale after being freed during unpacking state reinitialization.=
Subsequent processing of another archive entry can trigger a second free o=
f the same memory region, resulting in a double-free condition. Successful = exploitation may cause applications using the vulnerable libarchive API to = terminate unexpectedly, leading to a denial of service.</td> <td>2026-06-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14164" target=3D= "_blank" rel=3D"noopener">CVE-2026-14164</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat OpenShift Dev Spaces</td>
<td>A flaw was found in the vscode-java extension, which provides Java lang= uage support for Visual Studio Code. The extension incorrectly trusts all M= arkdown content in JavaDoc hovers, allowing a malicious Java file to includ=
e hidden commands. If a user clicks a specially crafted link within a JavaD=
oc hover popup, an attacker can execute arbitrary VS Code commands, which c=
an lead to full system compromise in trusted workspaces.</td> <td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12856" target=3D= "_blank" rel=3D"noopener">CVE-2026-12856</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Satellite 6.16 for RHEL 8</td=

<td>A flaw was found in Foreman. The Usergroup model in Foreman does not pr= operly validate role assignments against the calling user's permissions. Th=
is allows an authenticated user with usergroup management permissions to at= tach arbitrary roles, including administrative roles, to a user group and t= hen add themselves as a member. Successful exploitation of this vulnerabili=
ty leads to full privilege escalation, granting the attacker administrator-= level access.</td>
<td>2026-07-01</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5136" target=3D"= _blank" rel=3D"noopener">CVE-2026-5136</a></td>
</tr>

<td class=3D"vendor-product">Repute InfoSystems--ARForms</td> <td>Unauthenticated Cross Site Scripting (XSS) in ARForms &lt;=3D 7.1.2 ver= sions.</td>
<td>2026-06-29</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57338" target=3D= "_blank" rel=3D"noopener">CVE-2026-57338</a></td>
</tr>

<td class=3D"vendor-product">Repute Infosystems--BookingPress Appointment B= ooking Pro</td>
<td>The BookingPress Appointment Booking Pro plugin for WordPress is vulner= able to SQL Injection via the 'store_service_date' parameter of the bpa_ass= ign_staffmember_to_slots() function in versions up to and including 5.7.1. = This is due to the explicit use of stripslashes_deep() on user-supplied POS=
T data before it is interpolated verbatim into a SQL LIKE clause without us=
e of $wpdb-&gt;prepare() or any parameterization. This makes it possible fo=
r unauthenticated attackers to append additional SQL queries into already e= xisting queries that can be used to extract sensitive information from the = database.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11823" target=3D= "_blank" rel=3D"noopener">CVE-2026-11823</a></td>
</tr>

<td class=3D"vendor-product">Reputeinfosystems--ARMember Premium</td> <td>Contributor PHP Object Injection in ARMember Premium &lt;=3D 7.0 versio= ns.</td>
<td>2026-07-02</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27060" target=3D= "_blank" rel=3D"noopener">CVE-2026-27060</a></td>
</tr>

<td class=3D"vendor-product">ReviewX--ReviewX</td>
<td>Unauthenticated Cross Site Scripting (XSS) in ReviewX &lt;=3D 2.3.10 ve= rsions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57359" target=3D= "_blank" rel=3D"noopener">CVE-2026-57359</a></td>
</tr>

<td class=3D"vendor-product">RT-Thread--RT-Thread</td>
<td>A vulnerability was identified in RT-Thread up to 5.0.2. Affected by th=
is vulnerability is the function recvmsg in the library bsp/loongson/ls1cde= v/libraries/ls1c_can.h of the component ls1c CAN Handler. Such manipulation=
leads to stack-based buffer overflow. Local access is required to approach=
this attack. The exploit is publicly available and might be used. The vend=
or was contacted early about this disclosure but did not respond in any way= .</td>
<td>2026-07-03</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14605" target=3D= "_blank" rel=3D"noopener">CVE-2026-14605</a></td>
</tr>

<td class=3D"vendor-product">RT-Thread--RT-Thread</td>
<td>A security flaw has been discovered in RT-Thread up to 5.0.2. Affected =
by this issue is the function CAN_Receive in the library bsp/synwit/librari= es/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h of the component SWM341 CAN Hand= ler. Performing a manipulation results in stack-based buffer overflow. The = attack needs to be approached locally. The exploit has been released to the=
public and may be used for attacks. The vendor was contacted early about t= his disclosure but did not respond in any way.</td>
<td>2026-07-03</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14606" target=3D= "_blank" rel=3D"noopener">CVE-2026-14606</a></td>
</tr>

<td class=3D"vendor-product">Ruijie--RG-UAC</td>
<td>A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The imp= acted element is an unknown function of the file user_auth_commit.php. Perf= orming a manipulation of the argument upload_image results in unrestricted = upload. The attack is possible to be carried out remotely. The exploit has = been made public and could be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14736" target=3D= "_blank" rel=3D"noopener">CVE-2026-14736</a></td>
</tr>

<td class=3D"vendor-product">Rustaurius--Five Star Business Profile and Sch= ema</td>
<td>Editor Arbitrary Code Execution in Five Star Business Profile and Schem=
a &lt;=3D 2.3.19 versions.</td>
<td>2026-07-02</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27436" target=3D= "_blank" rel=3D"noopener">CVE-2026-27436</a></td>
</tr>

<td class=3D"vendor-product">SaturdayDrive--Ninja Forms - File Uploads</td> <td>The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Ar= bitrary File Read via the attach_files() function in versions up to, and in= cluding, 3.3.29. This is due to the get_files_for_attachment() function acc= epting a raw attacker-controlled 'files' array when the process() method re= turns early due to a client-supplied saveProgress flag, bypassing all uploa=
d validation, path normalization, and database record creation steps, and a= llowing an attacker-supplied file_path value to reach wp_mail() as an email=
attachment with only a file_exists() check. This makes it possible for una= uthenticated attackers to read arbitrary files on the affected site's serve= r.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13369" target=3D= "_blank" rel=3D"noopener">CVE-2026-13369</a></td>
</tr>

<td class=3D"vendor-product">Search Atlas Group--Search Atlas SEO</td> <td>Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO &lt;=3D = 2.6.6 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57357" target=3D= "_blank" rel=3D"noopener">CVE-2026-57357</a></td>
</tr>

<td class=3D"vendor-product">seaweedfs--seaweedfs</td>
<td>SeaweedFS before 4.34 contains a path traversal vulnerability in the S3=
gateway DeleteMultipleObjectsHandler that allows authenticated S3 principa=
ls with write access to a single bucket to delete arbitrary objects in othe=
r tenants' buckets by supplying object keys containing ../ sequences in the=
DeleteObjects XML request body. Attackers can bypass authorization control=
s through a confused deputy condition, as the validateRequestPath middlewar=
e only inspects URL-captured path variables and never examines request-body=
keys, allowing the filer path to collapse directory traversal sequences an=
d resolve deletions outside the authorized bucket.</td>
<td>2026-06-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58372" target=3D= "_blank" rel=3D"noopener">CVE-2026-58372</a></td>
</tr>

<td class=3D"vendor-product">Shenzhen Aitemi E Commerce Co. Ltd.--M300 Wi-F=
i Repeater</td>
<td>Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an u= nauthenticated OS command injection vulnerability that allows network-adjac= ent attackers to execute arbitrary shell commands by injecting unsanitized = input through the smacfilter_conf handler in the commuos web backend. Attac= kers can append semicolon-delimited payloads to the name, enable, or mac GE=
T parameters, which are passed without sanitization into sprintf() to build=
uci shell commands executed via doSystemCmdComlib(), granting full root-le= vel control of the device.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58457" target=3D= "_blank" rel=3D"noopener">CVE-2026-58457</a></td>
</tr>

<td class=3D"vendor-product">Shenzhen Landray Software Co., Ltd.--Landry Of= fice Automation (OA)</td>
<td>Landray OA contains an unauthenticated HQL injection vulnerability that=
allows unauthenticated attackers to query arbitrary Hibernate entity class=
es by injecting malicious HQL syntax into the uid POST parameter of the wec= hatLoginHelper.do endpoint. Attackers can exploit the lack of input sanitiz= ation in the string-concatenated filter expression passed to the Hibernate = findList() call to extract sensitive data such as administrator password ha= shes and, with sufficient database privileges, perform file-write operation=
s enabling remote code execution. Exploitation evidence was first observed =
by the Shadowserver Foundation on 2024-03-11 (UTC).</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2024-58352" target=3D= "_blank" rel=3D"noopener">CVE-2024-58352</a></td>
</tr>

<td class=3D"vendor-product">shimosyan--phpUploader</td>
<td>phpUploader before 2.0.2 contains an unauthenticated information disclo= sure vulnerability that allows remote attackers to access the full contents=
of the uploaded-files database table by visiting any page of the applicati= on. The index model executes an unbounded SELECT query and embeds the compl= ete JSON-encoded result set in an inline script block, exposing uploader IP=
addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprin= ts.</td>
<td>2026-06-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56124" target=3D= "_blank" rel=3D"noopener">CVE-2026-56124</a></td>
</tr>

<td class=3D"vendor-product">Shopify Help Center--Shopify</td>
<td>Contributor Local File Inclusion in Shopify &lt;=3D 1.0.0 versions.</td=

<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57748" target=3D= "_blank" rel=3D"noopener">CVE-2026-57748</a></td>
</tr>

<td class=3D"vendor-product">SigNoz--signoz</td>
<td>SigNoz through 0.130.1 contains a SQL injection vulnerability that allo=
ws authenticated attackers to execute arbitrary ClickHouse queries by injec= ting URL-encoded quotes into the rule ID path parameter of the alert-histor=
y endpoints. Attackers can manipulate the unsanitized rule ID interpolated = into ClickHouse queries to read all stored traces, logs, and metrics, or ab= use the url() function to perform server-side request forgery.</td> <td>2026-06-29</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57955" target=3D= "_blank" rel=3D"noopener">CVE-2026-57955</a></td>
</tr>

<td class=3D"vendor-product">Snowflake--Snowflake CLI</td>
<td>Improper neutralization of attacker-controlled content in Snowflake CLI=
versions prior to 3.19 allowed unintended SQL execution. By supplying craf= ted repository content, project configuration, manifest data, or specificat= ion input, an attacker could cause Snowflake CLI to execute unintended SQL =
in the context of the victim user's Snowflake session. Successful exploitat= ion requires the victim to process attacker-controlled content through a vu= lnerable command path and is limited by the privileges assigned to that ses= sion. The fix is available in Snowflake CLI version 3.19. Users must manual=
ly upgrade.</td>
<td>2026-06-29</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13744" target=3D= "_blank" rel=3D"noopener">CVE-2026-13744</a></td>
</tr>

<td class=3D"vendor-product">Snowflake--Snowflake CLI</td>
<td>Improper neutralization in the Snowpark annotation processor callback t= emplate in Snowflake CLI versions prior to 3.19 allowed arbitrary code exec= ution during application bundling or deployment. An attacker could exploit = this by supplying crafted project content that is interpolated into generat=
ed Python code, causing Snowflake CLI to execute attacker-controlled code i=
n the local context of the user running the CLI. Successful exploitation re= quires the victim to run the relevant bundling or deployment workflow again=
st attacker-controlled project content, and any resulting code runs with th=
e privileges of that local execution context. The fix is available in Snowf= lake CLI version 3.19, and users must manually upgrade.</td> <td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13749" target=3D= "_blank" rel=3D"noopener">CVE-2026-13749</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Class and Exam Timetabling Sys= tem</td>
<td>A vulnerability was identified in SourceCodester Class and Exam Timetab= ling System 1.0/5.php. Affected by this vulnerability is an unknown functio= nality of the file /preview5.php. Such manipulation of the argument course_= year_section leads to sql injection. The attack may be performed from remot=
e. The exploit is publicly available and might be used.</td> <td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13521" target=3D= "_blank" rel=3D"noopener">CVE-2026-13521</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Class and Exam Timetabling Sys= tem</td>
<td>A flaw has been found in SourceCodester Class and Exam Timetabling Syst=
em 1.0. Impacted is an unknown function of the file /edit_class.php. This m= anipulation of the argument ID causes sql injection. The attack may be init= iated remotely. The exploit has been published and may be used.</td> <td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13526" target=3D= "_blank" rel=3D"noopener">CVE-2026-13526</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Class and Exam Timetabling Sys= tem</td>
<td>A vulnerability has been found in SourceCodester Class and Exam Timetab= ling System 1.0. The affected element is an unknown function of the file /p= review4.php. Such manipulation of the argument course_year_section leads to=
sql injection. The attack may be launched remotely. The exploit has been d= isclosed to the public and may be used.</td>
<td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13527" target=3D= "_blank" rel=3D"noopener">CVE-2026-13527</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Class and Exam Timetabling Sys= tem</td>
<td>A vulnerability was determined in SourceCodester Class and Exam Timetab= ling System 1.0/1.php. Affected by this vulnerability is an unknown functio= nality of the file /edit_class1.php. Executing a manipulation of the argume=
nt ID can lead to sql injection. The attack can be launched remotely. The e= xploit has been publicly disclosed and may be utilized.</td> <td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13565" target=3D= "_blank" rel=3D"noopener">CVE-2026-13565</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Class and Exam Timetabling Sys= tem</td>
<td>A vulnerability was identified in SourceCodester Class and Exam Timetab= ling System 1.0. Affected by this issue is some unknown functionality of th=
e file /preview3.php. The manipulation of the argument course_year_section = leads to sql injection. The attack may be initiated remotely. The exploit i=
s publicly available and might be used.</td>
<td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13566" target=3D= "_blank" rel=3D"noopener">CVE-2026-13566</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Class and Exam Timetabling Sys= tem</td>
<td>A vulnerability was determined in SourceCodester Class and Exam Timetab= ling System 1.0. Affected by this vulnerability is an unknown functionality=
of the file /edit_course.php. Executing a manipulation of the argument ID = can lead to sql injection. The attack can be executed remotely. The exploit=
has been publicly disclosed and may be utilized.</td>
<td>2026-07-04</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14641" target=3D= "_blank" rel=3D"noopener">CVE-2026-14641</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Class and Exam Timetabling Sys= tem</td>
<td>A vulnerability was identified in SourceCodester Class and Exam Timetab= ling System 1.0. Affected by this issue is some unknown functionality of th=
e file /edit_class2.php. The manipulation of the argument ID leads to sql i= njection. The attack is possible to be carried out remotely. The exploit is=
publicly available and might be used.</td>
<td>2026-07-04</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14642" target=3D= "_blank" rel=3D"noopener">CVE-2026-14642</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Class and Exam Timetabling Sys= tem</td>
<td>A security vulnerability has been detected in SourceCodester Class and = Exam Timetabling System 1.0. This vulnerability affects unknown code of the=
file /edit_exam.php. The manipulation of the argument ID leads to sql inje= ction. The attack may be initiated remotely. The exploit has been disclosed=
publicly and may be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14732" target=3D= "_blank" rel=3D"noopener">CVE-2026-14732</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Class and Exam Timetabling Sys= tem</td>
<td>A vulnerability was detected in SourceCodester Class and Exam Timetabli=
ng System 1.0. This issue affects some unknown processing of the file /edit= _coursea.php. The manipulation of the argument ID results in sql injection.=
The attack may be launched remotely. The exploit is now public and may be = used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14733" target=3D= "_blank" rel=3D"noopener">CVE-2026-14733</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Class and Exam Timetabling Sys= tem</td>
<td>A flaw has been found in SourceCodester Class and Exam Timetabling Syst=
em 1.0. Impacted is an unknown function of the file /edit_product.php. This=
manipulation of the argument ID causes sql injection. Remote exploitation =
of the attack is possible. The exploit has been published and may be used.<=

<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14734" target=3D= "_blank" rel=3D"noopener">CVE-2026-14734</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Class and Exam Timetabling Sys= tem</td>
<td>A vulnerability was detected in SourceCodester Class and Exam Timetabli=
ng System 1.0. Impacted is an unknown function of the file /edit_room.php. = Performing a manipulation of the argument ID results in sql injection. It i=
s possible to initiate the attack remotely. The exploit is now public and m=
ay be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14770" target=3D= "_blank" rel=3D"noopener">CVE-2026-14770</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Class and Exam Timetabling Sys= tem</td>
<td>A flaw has been found in SourceCodester Class and Exam Timetabling Syst=
em 1.0/1.php. The affected element is an unknown function of the file /edit= _exam1.php. Executing a manipulation of the argument ID can lead to sql inj= ection. It is possible to launch the attack remotely. The exploit has been = published and may be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14771" target=3D= "_blank" rel=3D"noopener">CVE-2026-14771</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Class and Exam Timetabling Sys= tem</td>
<td>A vulnerability has been found in SourceCodester Class and Exam Timetab= ling System 1.0/1.php. The impacted element is an unknown function of the f= ile /edit_course1.php. The manipulation of the argument ID leads to sql inj= ection. The attack can be initiated remotely. The exploit has been disclose=
d to the public and may be used.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14772" target=3D= "_blank" rel=3D"noopener">CVE-2026-14772</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Inventory Management System</t=

<td>A weakness has been identified in SourceCodester Inventory Management S= ystem 1.0. This vulnerability affects unknown code of the file /api/users_h= andler.php of the component User Registration Endpoint. This manipulation o=
f the argument role causes improper access controls. Remote exploitation of=
the attack is possible. The exploit has been made available to the public = and could be used for attacks.</td>
<td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13568" target=3D= "_blank" rel=3D"noopener">CVE-2026-13568</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Multi-Vendor Online Grocery Ma= nagement System</td>
<td>A weakness has been identified in SourceCodester Multi-Vendor Online Gr= ocery Management System 1.0. This affects the function save_users of the fi=
le classes/Users.php. This manipulation causes improper authorization. Remo=
te exploitation of the attack is possible. The exploit has been made availa= ble to the public and could be used for attacks.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14690" target=3D= "_blank" rel=3D"noopener">CVE-2026-14690</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Multi-Vendor Online Grocery Ma= nagement System</td>
<td>A vulnerability was found in SourceCodester Multi-Vendor Online Grocery=
Management System 1.0. This affects the function save_client of the file c= lasses/Users.php of the component Registration Handler. The manipulation of=
the argument Name results in sql injection. It is possible to launch the a= ttack remotely. The exploit has been made public and could be used.</td> <td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14695" target=3D= "_blank" rel=3D"noopener">CVE-2026-14695</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Onlne Examination &amp; Learni=
ng Management System</td>
<td>A flaw has been found in SourceCodester Onlne Examination &amp; Learnin=
g Management System 1.0. The impacted element is an unknown function of the=
file register.php of the component Registration Endpoint. Executing a mani= pulation of the argument role can lead to improper privilege management. Th=
e attack can be executed remotely. The exploit has been published and may b=
e used. The name of the affected product appears to have a typo in it.</td> <td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14719" target=3D= "_blank" rel=3D"noopener">CVE-2026-14719</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Onlne Examination &amp; Learni=
ng Management System</td>
<td>A security vulnerability has been detected in SourceCodester Onlne Exam= ination &amp; Learning Management System 1.0. This affects an unknown part =
of the file /ajax_enroll.php of the component Enrollment Management. The ma= nipulation of the argument student_id/schedule_id/action leads to improper = authorization. The attack is possible to be carried out remotely. The explo=
it has been disclosed publicly and may be used. The name of the affected pr= oduct appears to have a typo in it.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14778" target=3D= "_blank" rel=3D"noopener">CVE-2026-14778</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Pizzafy E-Commerce System</td> <td>A security flaw has been discovered in SourceCodester Pizzafy E-Commerc=
e System 1.0. This vulnerability affects unknown code of the file /admin/aj= ax.php?action=3Dconfirm_order. The manipulation of the argument ID results =
in sql injection. The attack can be launched remotely. The exploit has been=
released to the public and may be used for attacks.</td>
<td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14713" target=3D= "_blank" rel=3D"noopener">CVE-2026-14713</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Simple and Nice Shopping Cart = Script</td>
<td>A vulnerability was found in SourceCodester Simple and Nice Shopping Ca=
rt Script 1.0. This affects an unknown function of the file /admin/login.ph=
p of the component Admin Login. The manipulation of the argument Username r= esults in sql injection. The attack may be launched remotely. The exploit h=
as been made public and could be used.</td>
<td>2026-07-04</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14652" target=3D= "_blank" rel=3D"noopener">CVE-2026-14652</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Simple and Nice Shopping Cart = Script</td>
<td>A vulnerability was determined in SourceCodester Simple and Nice Shoppi=
ng Cart Script 1.0. This impacts an unknown function of the file /admin/men= sproductdeletequery.php. This manipulation of the argument user_id causes s=
ql injection. Remote exploitation of the attack is possible. The exploit ha=
s been publicly disclosed and may be utilized.</td>
<td>2026-07-04</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14653" target=3D= "_blank" rel=3D"noopener">CVE-2026-14653</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Simple and Nice Shopping Cart = Script</td>
<td>A vulnerability was identified in SourceCodester Simple and Nice Shoppi=
ng Cart Script 1.0. Affected is an unknown function of the file /admin/girl= sproductdeletequery.php. Such manipulation of the argument user_id leads to=
sql injection. The attack can be executed remotely. The exploit is publicl=
y available and might be used.</td>
<td>2026-07-04</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14654" target=3D= "_blank" rel=3D"noopener">CVE-2026-14654</a></td>
</tr>

<td class=3D"vendor-product">Spencer Haws--Link Whisper Free</td> <td>Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free &lt;=3D=
0.9.4 versions.</td>
<td>2026-06-29</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57333" target=3D= "_blank" rel=3D"noopener">CVE-2026-57333</a></td>
</tr>

<td class=3D"vendor-product">StoneFly--Storage Concentrator</td>
<td>Storage Concentrator (SC &amp; SCVM) contains a command injection vulne= rability in the ms_service.pl service, which listens on TCP port 9000 by de= fault and accepts custom network packets to perform device actions. An unau= thenticated remote attacker can send a specially crafted packet containing =
a malicious payload that is processed without adequate sanitization, result= ing in arbitrary command execution with root-level privileges.</td> <td>2026-06-30</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56413" target=3D= "_blank" rel=3D"noopener">CVE-2026-56413</a></td>
</tr>

<td class=3D"vendor-product">StoneFly--Storage Concentrator</td>
<td>Storage Concentrator (SC &amp; SCVM) contains hardcoded credentials for=
numerous internal services embedded within a configuration file. While the=
credentials are stored in an encoded format, the encoding can be reversed =
to plaintext. The exposed credentials span a broad range of internal servic= es, including database accounts, licensing, replication services, and third= -party integrations, meaning successful exploitation of this vulnerability = could provide an attacker with unauthorized access to multiple interconnect=
ed systems.</td>
<td>2026-06-30</td>
<td>9.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50110" target=3D= "_blank" rel=3D"noopener">CVE-2026-50110</a></td>
</tr>

<td class=3D"vendor-product">StoneFly--Storage Concentrator</td>
<td>Storage Concentrator (SC &amp; SCVM) is vulnerable to SQL injection thr= ough cookie values processed by the login.pl and debug.pl scripts. The cook=
ie value is incorporated directly into database queries without adequate sa= nitization, allowing an unauthenticated remote attacker to manipulate those=
queries and extract sensitive information from the underlying database, in= cluding session tokens, password hashes, and stored secret keys.</td> <td>2026-06-30</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55721" target=3D= "_blank" rel=3D"noopener">CVE-2026-55721</a></td>
</tr>

<td class=3D"vendor-product">Stonefly--Storage Concentrator</td>
<td>Storage Concentrator (SC &amp; SCVM) contains a command injection vulne= rability within the debug.pl script that is reachable without authenticatio=
n. A remote attacker can submit a specially crafted HTTP request containing=
a malicious payload that is processed without adequate input sanitization,=
resulting in arbitrary command execution with root-level privileges on the=
underlying system.</td>
<td>2026-06-30</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56415" target=3D= "_blank" rel=3D"noopener">CVE-2026-56415</a></td>
</tr>

<td class=3D"vendor-product">StylemixThemes--Pearl - Corporate Business</td=

<td>Unauthenticated Local File Inclusion in Pearl - Corporate Business &lt;= =3D 3.4.10 versions.</td>
<td>2026-07-02</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27412" target=3D= "_blank" rel=3D"noopener">CVE-2026-27412</a></td>
</tr>

<td class=3D"vendor-product">SUSE--libzypp</td>
<td>A relative path traversal bug problem when processing repository metada=
ta in libzypp before 17.38.10 could be used by remote attackers supplying r= epositories to overwrite files on the system, leading to denial of service =
or privilege escalation.</td>
<td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-25707" target=3D= "_blank" rel=3D"noopener">CVE-2026-25707</a></td>
</tr>

<td class=3D"vendor-product">SUSE--libzypp</td>
<td>A relative path traversal in the "keyhint" option in repomd.xml parsing=
of libzypp before 17.38.12 can be used by attackers able to supply a malic= ious repository to inject or overwrite files in the target system as root.<=

<td>2026-07-02</td>
<td>8.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44941" target=3D= "_blank" rel=3D"noopener">CVE-2026-44941</a></td>
</tr>

<td class=3D"vendor-product">SUSE--Rancher</td>
<td>Missing validation of "valuesFrom" references in Helm Deployer of SUSE = Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 a=
nd 0.12 before 0.12.15 could be used by owners of one tenant to access flee=
t credentials of other tenants.</td>
<td>2026-07-02</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44935" target=3D= "_blank" rel=3D"noopener">CVE-2026-44935</a></td>
</tr>

<td class=3D"vendor-product">SUSE--Rancher</td>
<td>Incorrect authentication caching in the team member ship expansion of t=
he Rancher Github authentication provider caused it granting principal acce=
ss to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.</td=

<td>2026-06-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41053" target=3D= "_blank" rel=3D"noopener">CVE-2026-41053</a></td>
</tr>

<td class=3D"vendor-product">swaldman--mchange-commons-java</td> <td>mchange-commons-java is a Java library of shared utility classes used b=
y mchange projects like the c3p0 connection pool. Prior to version 0.6.0, i=
ts JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectF= actory) will construct objects of arbitrary classes and initialize "JavaBea= n"-style properties, which for certain classes enables JNDI injection and "= deserialization gadgets." Such initialization is unsafe for some classes: f=
or example, setting the contentType property of a Swing JEditorPane to text= /html and its text property to HTML containing a stylesheet &lt;link&gt; wi=
ll provoke an HTTP GET on an arbitrary URL, potentially from within a trust=
ed security domain. The problem is aggravated by the library's ReferenceInd= irector, through which malicious JNDI Reference objects can be smuggled in = for dereferencing wherever an application reads a Java-serialized object. T= his has been resolved in version 0.6.0.</td>
<td>2026-07-01</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55153" target=3D= "_blank" rel=3D"noopener">CVE-2026-55153</a></td>
</tr>

<td class=3D"vendor-product">SysBasics--Customize My Account for WooCommerc= e</td>
<td>Unauthenticated Cross Site Scripting (XSS) in Customize My Account for = WooCommerce &lt;=3D 4.3.9 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57358" target=3D= "_blank" rel=3D"noopener">CVE-2026-57358</a></td>
</tr>

<td class=3D"vendor-product">Tenda--JD12L</td>
<td>A flaw has been found in Tenda JD12L 16.03.53.23. The impacted element =
is the function formWifiBasicSet of the file /goform/WifiBasicSet. Executin=
g a manipulation of the argument security_5g can lead to stack-based buffer=
overflow. The attack may be launched remotely. The exploit has been publis= hed and may be used.</td>
<td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13517" target=3D= "_blank" rel=3D"noopener">CVE-2026-13517</a></td>
</tr>

<td class=3D"vendor-product">Tenda--JD12L</td>
<td>A vulnerability has been found in Tenda JD12L 16.03.53.23. This affects=
the function fromAddressNat of the file /goform/addressNat. The manipulati=
on of the argument page leads to stack-based buffer overflow. Remote exploi= tation of the attack is possible. The exploit has been disclosed to the pub= lic and may be used.</td>
<td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13518" target=3D= "_blank" rel=3D"noopener">CVE-2026-13518</a></td>
</tr>

<td class=3D"vendor-product">Tenda--JD12L</td>
<td>A vulnerability was found in Tenda JD12L 16.03.53.23. This impacts the = function fromNatStaticSetting of the file /goform/NatStaticSetting. The man= ipulation of the argument page results in stack-based buffer overflow. The = attack can be executed remotely. The exploit has been made public and could=
be used.</td>
<td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13519" target=3D= "_blank" rel=3D"noopener">CVE-2026-13519</a></td>
</tr>

<td class=3D"vendor-product">The Libreswan Project--libreswan</td> <td>Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), = did not correctly verify the length of the authentication hash when the SIG=
payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per=
RFC 2313. A remote attacker can use a variation on the Bleichenbacher atta=
ck to forge the SIG payload when small public exponents are being used (e.g=
., e=3D3), which could lead to impersonation. Additionally, a remote attack= er, by encoding a shorter than expected hash in the SIG payload, could trig= ger an assertion leading to denial-of-service. The daemon aborts and restar= ts; continued exploitation causes sustained denial of service. Remote code = execution is not possible. X.509 certificate verifications of remote IKE pe= ers are not affected.</td>
<td>2026-07-02</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50721" target=3D= "_blank" rel=3D"noopener">CVE-2026-50721</a></td>
</tr>

<td class=3D"vendor-product">The Libreswan Project--libreswan</td> <td>Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_r= sa(), did not correctly verify the DER encoding of the ASN.1 digest when th=
e IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remo=
te attacker can use a variation on the Bleichenbacher attack to forge the A= UTH payload when small public exponents are used (e.g., e=3D3), leading to = impersonation. Additionally, a remote attacker, by encoding a shorter than = expected hash in the AUTH payload, could trigger an assertion leading to de= nial-of-service. The daemon aborts and restarts; continued exploitation cau= ses sustained denial of service. Remote code execution is not possible. X.5=
09 certificate verifications of the remote IKE peer are not affected.</td> <td>2026-07-02</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50722" target=3D= "_blank" rel=3D"noopener">CVE-2026-50722</a></td>
</tr>

<td class=3D"vendor-product">The Libreswan Project--libreswan</td>
<td>An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon=
to crash and restart. Continued exploitation would cause a denial of servi= ce. The function reassemble_v2_incoming_fragments() would ignore unknown ou= ter payloads but still store these in a fixed size array msg_digest.digest[= PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md-&gt;dige= st_roof &lt; elemsof(md-&gt;digest)) causes the daemon to abort. No remote = code execution is possible. Any configuration that allows IKEv2 connections=
that do not set fragmentation=3Dno are vulnerable. IKEv1 is not affected.<=

<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12413" target=3D= "_blank" rel=3D"noopener">CVE-2026-12413</a></td>
</tr>

<td class=3D"vendor-product">ThemeBoy--SportsPress Pro</td>
<td>Contributor Local File Inclusion in SportsPress Pro &lt;=3D 2.7.29 vers= ions.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57749" target=3D= "_blank" rel=3D"noopener">CVE-2026-57749</a></td>
</tr>

<td class=3D"vendor-product">ThemeGoods--Artale | Wedding Photography WordP= ress</td>
<td>Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photogra= phy WordPress &lt;=3D 2.2.2 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69152" target=3D= "_blank" rel=3D"noopener">CVE-2025-69152</a></td>
</tr>

<td class=3D"vendor-product">themeisle--Visualizer Tables &amp; Charts Mana= ger with Built-in AI Generator</td>
<td>The Visualizer - Tables &amp; Charts Manager with Built-in AI Generator=
plugin for WordPress is vulnerable to authorization bypass in all versions=
up to, and including, 4.0.3. This is due to the plugin not properly verify= ing that a user is authorized to perform an action. This makes it possible = for unauthenticated attackers to access and export the contents of any visu= alizer chart on the site - including charts in draft, private, pending, fut= ure, or trash status - as CSV, Excel, or HTML via the /wp-json/visualizer/v= 1/action/{chart}/{type}/ REST endpoint. This bypass is particularly impactf=
ul because the standard WordPress REST endpoint for the non-public 'visuali= zer' custom post type correctly enforces capability checks and returns HTTP=
401 to unauthenticated callers, whereas this plugin-registered route circu= mvents that protection entirely.</td>
<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13468" target=3D= "_blank" rel=3D"noopener">CVE-2026-13468</a></td>
</tr>

<td class=3D"vendor-product">ThemeMove--Unicamp</td>
<td>Subscriber SQL Injection in Unicamp &lt;=3D 2.2.2 versions.</td> <td>2026-07-02</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69094" target=3D= "_blank" rel=3D"noopener">CVE-2025-69094</a></td>
</tr>

<td class=3D"vendor-product">ThemePunch--Slider Revolution</td>
<td>Improper Neutralization of Input During Web Page Generation ('Cross-sit=
e Scripting') vulnerability in ThemePunch Slider Revolution allows Reflecte=
d XSS. This issue affects Slider Revolution: from 7.0.0 through 7.0.16.</td=

<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57678" target=3D= "_blank" rel=3D"noopener">CVE-2026-57678</a></td>
</tr>

<td class=3D"vendor-product">ThemeREX--Booked</td>
<td>Subscriber Broken Access Control in Booked &lt;=3D 3.0.0 versions.</td> <td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57746" target=3D= "_blank" rel=3D"noopener">CVE-2026-57746</a></td>
</tr>

<td class=3D"vendor-product">Themesuite--Automotive Car Dealership Business= </td>
<td>Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership=
Business &lt;=3D 13.3.3 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27426" target=3D= "_blank" rel=3D"noopener">CVE-2026-27426</a></td>
</tr>

<td class=3D"vendor-product">Themesuite--Automotive Listings</td> <td>Unauthenticated Cross Site Scripting (XSS) in Automotive Listings &lt;=
=3D 18.6 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27425" target=3D= "_blank" rel=3D"noopener">CVE-2026-27425</a></td>
</tr>

<td class=3D"vendor-product">Themify--Themify Popup</td>
<td>Deserialization of Untrusted Data vulnerability in Themify Themify Popu=
p allows Object Injection. This issue affects Themify Popup: from n/a throu=
gh 1.4.3.</td>
<td>2026-07-02</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56037" target=3D= "_blank" rel=3D"noopener">CVE-2026-56037</a></td>
</tr>

<td class=3D"vendor-product">ThreeMammals--Ocelot</td>
<td>Ocelot through 24.1.0, fixed in commit f156fd4, contains a security con= trol bypass vulnerability that allows denied clients to circumvent IP-based=
access restrictions by sending WebSocket upgrade requests. The WebSocket u= pgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.c=
s omits SecurityMiddleware, causing requests from blocked IP addresses to b=
e proxied to downstream services without enforcement of the configured allo= w/block list.</td>
<td>2026-06-30</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58172" target=3D= "_blank" rel=3D"noopener">CVE-2026-58172</a></td>
</tr>

<td class=3D"vendor-product">tiddly-gittly--TidGi-Desktop</td>
<td>A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. = This impacts an unknown function of the file src/services/wiki/wikiWorker/l= oadWikiTiddlersWithSubWikis.ts of the component Git Repository Import. The = manipulation results in code injection. The attack may be performed from re= mote. The exploit has been made public and could be used.</td> <td>2026-07-05</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14722" target=3D= "_blank" rel=3D"noopener">CVE-2026-14722</a></td>
</tr>

<td class=3D"vendor-product">tinacms--tinacms</td>
<td>Tina is a headless content management system. @tinacms/cli versions pri=
or to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-t= o-Tina migration command. The internal helper addVariablesToCode unquotes a=
ny value matching the marker "__TINA_INTERNAL__:::(.*?):::" inside the stri= ngified collection JSON. User-supplied label and name fields from .forestry= /**/*.yml are placed into that JSON without any sanitisation. An attacker w=
ho controls a Forestry-style project can therefore inject arbitrary JavaScr= ipt into the generated tina/templates.{ts,js} file. The injected code is wr= itten at module top level, so it executes the moment the developer runs tin= acms dev or tinacms build, with the developer's privileges. This issue has = been fixed in version 2.4.3.</td>
<td>2026-07-01</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54074" target=3D= "_blank" rel=3D"noopener">CVE-2026-54074</a></td>
</tr>

<td class=3D"vendor-product">tinypng--TinyPNG JPEG, PNG &amp; WebP image co= mpression</td>
<td>The TinyPNG - JPEG, PNG &amp; WebP image compression plugin for WordPre=
ss is vulnerable to arbitrary file deletion due to insufficient file path v= alidation in the delete_converted_image_size function in all versions up to=
, and including, 3.6.13. This makes it possible for authenticated attackers=
, with author-level access and above, to delete arbitrary files on the serv= er, which can easily lead to remote code execution when the right file is d= eleted (such as wp-config.php). An attacker can exploit this by injecting a=
n arbitrary server file path into the 'convert.path' field of the 'tiny_com= press_images' post meta on an attachment they own, then triggering attachme=
nt deletion to invoke the vulnerable code path.</td>
<td>2026-07-02</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7311" target=3D"= _blank" rel=3D"noopener">CVE-2026-7311</a></td>
</tr>

<td class=3D"vendor-product">TR7 Cyber Defense Inc.--WAF-ASP</td>
<td>Missing authentication for critical function vulnerability in TR7 Cyber=
--Defense Inc. WAF-ASP allows Authentication Abuse. This issue affects WAF= -ASP: from v1.0.324.900 before v1.4.0.117.</td>
<td>2026-07-02</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4767" target=3D"= _blank" rel=3D"noopener">CVE-2026-4767</a></td>
</tr>

<td class=3D"vendor-product">trailofbits--fickling</td>
<td>Trail of Bits fickling versions up to and including 0.1.10 do not inclu=
de the Python standard library modules _posixsubprocess, site, and atexit i=
n the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent=
from the denylist, fickling's check_safety() function returns LIKELY_SAFE = with zero findings for pickle payloads that invoke dangerous functions incl= uding _posixsubprocess.fork_exec (C-level process spawner capable of execut= ing arbitrary binaries), site.execsitecustomize (executes arbitrary site cu= stomization code), and atexit._run_exitfuncs (triggers all registered exit = handler callbacks). The fickling.load() API chains check_safety() into pick= le.loads() as an explicit security gate; a LIKELY_SAFE verdict causes the p= ayload to be deserialized and executed. This shares the same root cause as = CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-2025-67747 (marsha= l/types). OvertlyBadEvals does not flag these modules because they are stan= dard library imports. UnsafeImports does not flag them because they are not=
in the denylist. The UnusedVariables heuristic is defeated by the SETITEMS=
opcode pattern.</td>
<td>2026-07-04</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14534" target=3D= "_blank" rel=3D"noopener">CVE-2026-14534</a></td>
</tr>

<td class=3D"vendor-product">trailofbits--fickling</td>
<td>In Trail of Bits fickling versions up to and including 0.1.11, the Unsa= feImportsML analysis pass unconditionally calls AnalysisContext.shorten_cod= e(node) on every import node it inspects, regardless of whether the import =
is flagged as unsafe. This call registers the shortened code representation=
in the shared AnalysisContext.reported_shortened_code set. When the MLAllo= wlist analysis pass subsequently runs, it calls the same shorten_code() met= hod, receives already_reported=3DTrue for every import, and executes a cont= inue statement that skips its allowlist check entirely. This renders MLAllo= wlist dead code for all imports - it never evaluates whether an import is i=
n the ML allowlist or not. The MLAllowlist pass was designed to catch impor=
ts of modules outside the known-safe ML ecosystem (torch, numpy, transforme= rs, etc.) that slip past the UnsafeImports denylist. With MLAllowlist inope= rative, any standard library module not in the UNSAFE_IMPORTS denylist can =
be invoked via pickle deserialization while fickling's check_safety() retur=
ns LIKELY_SAFE. The fickling.load() API chains check_safety() into pickle.l= oads() as an explicit security gate, meaning a LIKELY_SAFE verdict causes t=
he payload to be deserialized and executed. The root cause is shared mutabl=
e state between independently-correct analysis passes - UnsafeImportsML wor=
ks as designed in isolation, MLAllowlist works as designed in isolation, bu=
t the shared reported_shortened_code set causes UnsafeImportsML to poison M= LAllowlist's deduplication logic.</td>
<td>2026-07-04</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14535" target=3D= "_blank" rel=3D"noopener">CVE-2026-14535</a></td>
</tr>

<td class=3D"vendor-product">tranmautritam--TheFox</td>
<td>Unauthenticated Cross Site Scripting (XSS) in TheFox &lt;=3D 3.9.76 ver= sions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27430" target=3D= "_blank" rel=3D"noopener">CVE-2026-27430</a></td>
</tr>

<td class=3D"vendor-product">TUBITAK BILGEM Software Technologies Research = Institute--Pardus Domain Joiner</td>
<td>Invocation of process using visible sensitive information vulnerability=
in TUBITAK BILGEM Software Technologies Research Institute Pardus Domain J= oiner allows Excavation. This issue affects Pardus Domain Joiner: from 0.5.=
2 before 0.5.4.</td>
<td>2026-07-05</td>
<td>7.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12250" target=3D= "_blank" rel=3D"noopener">CVE-2026-12250</a></td>
</tr>

<td class=3D"vendor-product">TUBITAK BILGEM Software Technologies Research = Institute--Pardus Update</td>
<td>Missing Authorization vulnerability in TUBITAK BILGEM Software Technolo= gies Research Institute Pardus Update allows Privilege Escalation. This iss=
ue affects Pardus Update: from &lt;=3D0.6.3 before 0.6.6.</td> <td>2026-07-05</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6509" target=3D"= _blank" rel=3D"noopener">CVE-2026-6509</a></td>
</tr>

<td class=3D"vendor-product">TUBITAK BILGEM Software Technologies Research = Institute--Pardus-Parental-Control</td>
<td>Incorrect Permission Assignment for Critical Resource, Improper Access = Control vulnerability in TUBITAK BILGEM Software Technologies Research Inst= itute Pardus-Parental-Control allows DNS Spoofing. This issue affects Pardu= s-Parental-Control: from &lt;=3D0.5.1 before 0.7.0.</td>
<td>2026-07-05</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9085" target=3D"= _blank" rel=3D"noopener">CVE-2026-9085</a></td>
</tr>

<td class=3D"vendor-product">TUBITAK BILGEM Software Technologies Research = Institute--pardus-software</td>
<td>Improper neutralization of argument delimiters in a command ('argument = injection') vulnerability in TUBITAK BILGEM Software Technologies Research = Institute pardus-software allows Argument Injection. This issue affects par= dus-software: from &lt;=3D 1.0.4 before 1.0.5.</td>
<td>2026-07-03</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14459" target=3D= "_blank" rel=3D"noopener">CVE-2026-14459</a></td>
</tr>

<td class=3D"vendor-product">TUBITAK BILGEM Software Technologies Research = Institute--pardus-software</td>
<td>Missing Authorization vulnerability in TUBITAK BILGEM Software Technolo= gies Research Institute pardus-software allows Argument Injection. This iss=
ue affects pardus-software: from &lt;=3D 1.0.4 before 1.0.5.</td> <td>2026-07-03</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14460" target=3D= "_blank" rel=3D"noopener">CVE-2026-14460</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--Dream Machines</td>
<td>A malicious actor with access to the network and under certain network = configurations could exploit an Improper Access Control vulnerability found=
in certain devices running UniFi OS to make unauthorized changes to such U= niFi OS devices.</td>
<td>2026-07-02</td>
<td>9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55116" target=3D= "_blank" rel=3D"noopener">CVE-2026-55116</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--Dream Machines</td>
<td>A malicious actor with access to the network and low privileges and und=
er certain conditions could exploit an Improper Access Control vulnerabilit=
y found in UniFi OS with UniFi Protect Application to escalate privileges o=
n the host device.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55112" target=3D= "_blank" rel=3D"noopener">CVE-2026-55112</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Access Application</td>
<td>A malicious actor with access to the network and low privileges could e= xploit an Improper Input Validation vulnerability found in UniFi Access App= lication to execute a Command Injection on the host device.</td> <td>2026-07-02</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50748" target=3D= "_blank" rel=3D"noopener">CVE-2026-50748</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Access Application</td>
<td>A malicious actor with access to the network and high privileges could = exploit an Improper Access Control vulnerability found in UniFi Access Appl= ication to escalate privileges on the host device.</td>
<td>2026-07-02</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54400" target=3D= "_blank" rel=3D"noopener">CVE-2026-54400</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Access Application</td>
<td>A malicious actor with access to the network could exploit a Path Trave= rsal vulnerability found in UniFi Access Application to access files on the=
host device.</td>
<td>2026-07-02</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55117" target=3D= "_blank" rel=3D"noopener">CVE-2026-55117</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Connect Application</td>
<td>A malicious actor with access to the network could exploit an Improper = Access Control vulnerability found in UniFi Connect Application to execute =
a Command Injection on the host device.</td>
<td>2026-07-02</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50746" target=3D= "_blank" rel=3D"noopener">CVE-2026-50746</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Network Application</td>
<td>A malicious actor with access to the network and high privileges could = exploit a Path Traversal vulnerability found in self-hosted instances of Un= iFi Network Application to escalate write permission on the host device.</t=

<td>2026-07-02</td>
<td>8.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54406" target=3D= "_blank" rel=3D"noopener">CVE-2026-54406</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Network Application</td>
<td>A malicious actor with access to the network and low privileges could e= xploit an Improper Access Control vulnerability found in UniFi Network Appl= ication to escalate privileges within the UniFi Network Application.</td> <td>2026-07-02</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55114" target=3D= "_blank" rel=3D"noopener">CVE-2026-55114</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Network Application</td>
<td>A malicious actor with access to the network,low privileges and under c= ertain conditions could exploit an Improper Access Control vulnerability fo= und in UniFi Network Application to escalate privileges within the UniFi Ne= twork Application.</td>
<td>2026-07-02</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55118" target=3D= "_blank" rel=3D"noopener">CVE-2026-55118</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Network Application</td>
<td>A malicious actor with access to the network could exploit an Improper = Input Validation vulnerability found in UniFi Network Application to execut=
e a Denial of Service (DoS) attack on the application.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54405" target=3D= "_blank" rel=3D"noopener">CVE-2026-54405</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Network Application</td>
<td>A malicious actor with access to the network and under certain conditio=
ns could exploit an Incorrect Authorization vulnerability found in UniFi Ne= twork Application to persist privileges within UniFi Network Application af= ter such access had been removed.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56842" target=3D= "_blank" rel=3D"noopener">CVE-2026-56842</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi OS Server</td>
<td>A malicious actor with access to the network and low privileges could e= xploit an Improper Input Validation vulnerability found in UniFi OS to exec= ute a Command Injection on the host device.</td>
<td>2026-07-02</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54402" target=3D= "_blank" rel=3D"noopener">CVE-2026-54402</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi OS Server</td>
<td>A malicious actor with access to the network could exploit a Path Trave= rsal vulnerability found in certain devices running UniFi OS to bypass auth= entication of such UniFi OS devices or instances.</td>
<td>2026-07-02</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54403" target=3D= "_blank" rel=3D"noopener">CVE-2026-54403</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi OS Server</td>
<td>A malicious actor with access to the network and low privileges could e= xploit a series of authenticated SQL Injection vulnerabilities found in Uni=
Fi OS to escalate privileges within such UniFi OS devices or instances.</td=

<td>2026-07-02</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54404" target=3D= "_blank" rel=3D"noopener">CVE-2026-54404</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi OS Server</td>
<td>A malicious actor with access to the network and low privileges could e= xploit a Server-Side Request Forgery (SSRF) to escalate privileges within s= uch UniFi OS devices or instances.</td>
<td>2026-07-02</td>
<td>7.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54401" target=3D= "_blank" rel=3D"noopener">CVE-2026-54401</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi OS Server</td>
<td>A malicious actor who lures an authenticated user to a malicious page c= ould exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found =
in UniFi OS to trigger actions in UniFi OS using that user's session.</td> <td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55110" target=3D= "_blank" rel=3D"noopener">CVE-2026-55110</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Protect Application</td>
<td>A malicious actor with access to the network and low privileges could e= xploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to=
escalate privileges on the host device.</td>
<td>2026-07-02</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55115" target=3D= "_blank" rel=3D"noopener">CVE-2026-55115</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Protect Application</td>
<td>A malicious actor with access to the network could exploit an Improper = Access Control vulnerability found in UniFi Protect Application to bypass a= uthentication in certain UniFi Protect Application API endpoints.</td> <td>2026-07-02</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54407" target=3D= "_blank" rel=3D"noopener">CVE-2026-54407</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Protect Application</td>
<td>A malicious actor with access to the network could exploit an Improper = Access Control vulnerability found in UniFi Protect Application to bypass a= uthentication for data streaming.</td>
<td>2026-07-02</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54408" target=3D= "_blank" rel=3D"noopener">CVE-2026-54408</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Protect Application</td>
<td>A malicious actor with access to the network and low privileges could e= xploit an authenticated SQL Injection vulnerability found in UniFi Protect = Application to escalate privileges on the host device.</td>
<td>2026-07-02</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56841" target=3D= "_blank" rel=3D"noopener">CVE-2026-56841</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Protect Application</td>
<td>A malicious actor with access to the network and under certain conditio=
ns could exploit an Improper Initialization vulnerability found in UniFi Pr= otect Application to bypass authentication in UniFi Protect Cameras.</td> <td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54409" target=3D= "_blank" rel=3D"noopener">CVE-2026-54409</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Protect Floodlight</td>
<td>A malicious actor with access to the network could exploit a Path Trave= rsal vulnerability found in UniFi Protect Floodlight devices to access file=
s on the UniFi Protect Floodlight.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55111" target=3D= "_blank" rel=3D"noopener">CVE-2026-55111</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Talk Application</td>
<td>A malicious actor with access to the network and low privileges could e= xploit a series of authenticated SQL Injection vulnerabilities found in Uni=
Fi Talk Application to escalate privileges on the host device.</td> <td>2026-07-02</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50747" target=3D= "_blank" rel=3D"noopener">CVE-2026-50747</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Talk Application</td>
<td>A malicious actor with access to the network and low privileges could e= xploit an Improper Access Control vulnerability found in UniFi Talk Applica= tion to escalate privileges within the UniFi Talk Application.</td> <td>2026-07-02</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55119" target=3D= "_blank" rel=3D"noopener">CVE-2026-55119</a></td>
</tr>

<td class=3D"vendor-product">Ubiquiti Inc--UniFi Talk Application</td>
<td>A malicious actor with access to the network could exploit a Server-Sid=
e Request Forgery (SSRF) vulnerability found in UniFi Talk Application to e= xecute a Denial of Service (DoS) attack and bypass authentication in certai=
n UniFi Talk API endpoints.</td>
<td>2026-07-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55113" target=3D= "_blank" rel=3D"noopener">CVE-2026-55113</a></td>
</tr>

<td class=3D"vendor-product">Unisoc (Shanghai) Technologies Co., Ltd.--SC77= 31E/SC9832E/SC9863A/T310/T610/T618/T7200/T7225/T7250/T7255/T7280/T7300/T810= 0/T9100/T8200/T8300</td>
<td>In IMS, there is a possible out of bounds read due to a missing bounds = check. This could lead to remote denial of service with no additional execu= tion privileges needed.</td>
<td>2026-07-03</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4967" target=3D"= _blank" rel=3D"noopener">CVE-2026-4967</a></td>
</tr>

<td class=3D"vendor-product">Unity--Parsec</td>
<td>An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Wi= ndows hosts leads to a potential Elevation of Privilege. This issue affects=
Parsec through v2026-05-04.0. The patched version is=C2=A0Parsec for Windo=
ws version 150-104a. A user can generate a situation where there is an inst= ance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled v= alue of the AppData environment variable.</td>
<td>2026-07-04</td>
<td>8.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54424" target=3D= "_blank" rel=3D"noopener">CVE-2026-54424</a></td>
</tr>

<td class=3D"vendor-product">UTT--HiPER 1250GW</td>
<td>A vulnerability has been found in UTT HiPER 1250GW up to 3.2.7-210907-1= 80535. This affects an unknown function of the file /goform/ConfigWirelessB= ase_5g of the component Web Endpoint. The manipulation of the argument ssid=
leads to stack-based buffer overflow. The attack is possible to be carried=
out remotely. The exploit has been disclosed to the public and may be used= .</td>
<td>2026-07-05</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14721" target=3D= "_blank" rel=3D"noopener">CVE-2026-14721</a></td>
</tr>

<td class=3D"vendor-product">uvnc--UltraVNC</td>
<td>UltraVNC repeater through 1.8.2.2 initializes the HTTP administration s= erver with a hardcoded default password. In repeater/webgui/settings.c:197,=
when settings2.txt is absent on first run the repeater writes the literal = string "adminadmi2" as the admin password via strcpy_s(saved_password, 64, = "adminadmi2"). The HTTP Basic-auth handler wi_decode_auth() checks this pas= sword without rate-limiting or lockout. Any remote attacker who can reach t=
he repeater HTTP port (default TCP 80) can authenticate as administrator us= ing the well-known default credential on a fresh or unmodified installation=
, gaining full control of the repeater configuration including allow/deny r= ules and session visibility.</td>
<td>2026-07-01</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7839" target=3D"= _blank" rel=3D"noopener">CVE-2026-7839</a></td>
</tr>

<td class=3D"vendor-product">uvnc--UltraVNC</td>
<td>UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in = its embedded HTTP administration server. The functions wi_senderr() and wi_= replyhdr() in repeater/webgui/webutils.c write the caller-supplied HTTP req= uest URI into a fixed 1000-byte global buffer (hdrbuf) via unchecked sprint=
f calls. The HTTP receive buffer accepts URIs up to approximately 150 KB (W= I_RXBUFSIZE =3D 153600), so an unauthenticated attacker who can reach the r= epeater HTTP port (default TCP 80) can overflow hdrbuf by at least 500 byte=
s with a single HTTP request containing a URI of 1500 bytes or longer, corr= upting adjacent .bss-segment globals. The overflow occurs before any authen= tication check, making it reachable without credentials. A remote, unauthen= ticated attacker can achieve arbitrary code execution on the host running t=
he repeater.</td>
<td>2026-07-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7840" target=3D"= _blank" rel=3D"noopener">CVE-2026-7840</a></td>
</tr>

<td class=3D"vendor-product">uvnc--UltraVNC</td>
<td>UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to=
a heap buffer overflow in the RFB protocol failure-response parsing path. =
In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen fi= eld (type CARD32) is passed as reasonLen+1 to CheckBufferSize(). Because bo=
th operands are unsigned 32-bit, a reasonLen of 0xFFFFFFFF overflows to 0, = causing CheckBufferSize to allocate only 256 bytes. The subsequent ReadStri= ng(m_netbuf, reasonLen) call then performs ReadExact for the original 4 GiB=
length into that 256-byte heap buffer. This overflow is reachable via rfbC= onnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post-handshake) m= essage types without successful authentication. A malicious VNC server, or = any man-in-the-middle on the RFB stream, can trigger this condition when th=
e victim viewer connects, potentially resulting in remote code execution as=
the user running the viewer. The crash was confirmed with AddressSanitizer=
on a portable reproduction harness (heap-buffer-overflow WRITE at offset 2= 56).</td>
<td>2026-07-01</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7838" target=3D"= _blank" rel=3D"noopener">CVE-2026-7838</a></td>
</tr>

<td class=3D"vendor-product">uvnc--UltraVNC</td>
<td>UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of= -bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:= 225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte des= tination) or temp2/temp3 (16-byte destination), the code unconditionally wr= ites a NUL terminator at temp1[rule1][len] =3D 0 without clamping len to th=
e destination size. When an authenticated administrator saves a rule with a=
token length equal to or greater than the destination size, the NUL byte i=
s written one or more bytes past the end of the stack-allocated array, corr= upting adjacent stack data. An attacker who has obtained admin credentials = (including via CVE-2026-7839 default password) can trigger this to gain cod=
e execution on the repeater host.</td>
<td>2026-07-01</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7829" target=3D"= _blank" rel=3D"noopener">CVE-2026-7829</a></td>
</tr>

<td class=3D"vendor-product">uvnc--UltraVNC</td>
<td>UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon I=
I authentication scheme (rfbUltraVNC_MsLogonIIAuth). In rfb/dh.cpp the Diff= ie-Hellman key exchange is performed with parameters that fit in an unsigne=
d 64-bit integer (DH_MAX_BITS controls the prime size). A 64-bit DH key can=
be broken by Pollard's rho algorithm in under one second on current hardwa= re. Additionally, the private exponent is generated by the rng() function, = which multiplies three libc rand() values seeded from time(NULL). With appr= oximately 31 bits of internal state and a time-based seed, the private expo= nent is recoverable in under a minute by a passive observer. A network atta= cker who can observe the MS-Logon II handshake (via sniffing, recording, or=
man-in-the-middle) can derive the shared DH key and decrypt the encapsulat=
ed username and password, resulting in full credential disclosure. This aff= ects legacy MS-Logon II connections; MS-Logon III (X25519 + AES-256-GCM) is=
unaffected.</td>
<td>2026-07-01</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7830" target=3D"= _blank" rel=3D"noopener">CVE-2026-7830</a></td>
</tr>

<td class=3D"vendor-product">uvnc--UltraVNC</td>
<td>UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer ove= rflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.= cpp, when the server-supplied nameLength equals exactly 2024 the code decla= res a 2024-byte stack buffer _dn[2024] and calls ReadString(_dn, 2024). Rea= dString writes the NUL terminator at buf[length], i.e., _dn[2024], one byte=
past the end of the stack buffer. A malicious VNC server can trigger this = condition by advertising a desktop name of length 2024 in its ServerInit me= ssage. On release builds without stack canaries the single-byte NUL overwri=
te adjacent stack data. On builds with /GS stack protection the canary is c= orrupted and the process terminates, resulting in denial of service. User i= nteraction (connecting the viewer to the malicious server) is required.</td=

<td>2026-07-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7831" target=3D"= _blank" rel=3D"noopener">CVE-2026-7831</a></td>
</tr>

<td class=3D"vendor-product">videowhisper--Paid Videochat Turnkey Site</td> <td>Performer Arbitrary File Deletion in Paid Videochat Turnkey Site &lt;=
=3D 7.4.8 versions.</td>
<td>2026-06-29</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57331" target=3D= "_blank" rel=3D"noopener">CVE-2026-57331</a></td>
</tr>

<td class=3D"vendor-product">wagtail--wagtail</td>
<td>Wagtail is an open source content management system built on Django. In=
versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (= XSS) vulnerability exists on the dynamic image URL generator view within th=
e Wagtail admin interface. A user with a limited-permission editor account = for the Wagtail admin could craft a URL that, when viewed by a user with hi= gher privileges, could perform actions with that user's credentials. The vu= lnerability is present for all sites, even if they do not enable the dynami=
c image serve view. The vulnerability is not exploitable by an ordinary sit=
e visitor without access to the Wagtail admin. This issue has been fixed in=
versions 7.0.8, 7.3.3, and 7.4.2.</td>
<td>2026-07-01</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54263" target=3D= "_blank" rel=3D"noopener">CVE-2026-54263</a></td>
</tr>

<td class=3D"vendor-product">Wavlink--WL-NU516U1-A</td>
<td>A vulnerability was identified in Wavlink WL-NU516U1-A M16U1_V240425. T=
he impacted element is the function sub_407504 of the file /cgi-bin/wireles= s.cgi of the component POST Parameter Handler. Such manipulation of the arg= ument Guest_ssid leads to stack-based buffer overflow. The attack can be ex= ecuted remotely. The exploit is publicly available and might be used. It is=
suggested to upgrade the affected component. The vendor was contacted earl=
y, responded in a very professional manner and quickly released a fixed ver= sion of the affected product.</td>
<td>2026-06-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13539" target=3D= "_blank" rel=3D"noopener">CVE-2026-13539</a></td>
</tr>

<td class=3D"vendor-product">weaviate--weaviate</td>
<td>Weaviate before 1.38.0 does not verify that a principal performing an R= BAC role assignment holds the permissions granted by the assigned role. The=
assignRoleToUser and assignRoleToGroup handlers (POST /authz/users/{id}/as= sign and /authz/groups/{id}/assign) authorize only that the caller may assi=
gn roles to the target user or group, not the permissions contained in the = assigned roles, unlike role creation which enforces that a user can only cr= eate roles with permissions less than or equal to its own. A user holding o= nly the delegated assign_and_revoke_users or assign_and_revoke_groups permi= ssion can assign the built-in admin role, or any high-privilege custom role=
, to itself or others, escalating to full administrative control of the dat= abase.</td>
<td>2026-07-02</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59093" target=3D= "_blank" rel=3D"noopener">CVE-2026-59093</a></td>
</tr>

<td class=3D"vendor-product">webandprint--AR for WooCommerce</td>
<td>The AR for WooCommerce plugin for WordPress is vulnerable to Directory = Traversal in all versions up to, and including, 8.40 via the 'file' paramet=
er parameter. This makes it possible for unauthenticated attackers to read = the contents of arbitrary files on the server, which can contain sensitive = information. The three intended access controls all fail: valid nonces are = freely minted by unauthenticated callers via the nopriv ar_get_fresh_nonce = and ar_process_user_image AJAX handlers; the AES-256-CBC encryption key is = derived from get_option('ar_licence_key'), which returns false on default f= ree installations and yields a predictable key attackers can use to encrypt=
their own path payloads; and the Referer check is trivially bypassed becau=
se the Referer header is attacker-controlled.</td>
<td>2026-07-03</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14352" target=3D= "_blank" rel=3D"noopener">CVE-2026-14352</a></td>
</tr>

<td class=3D"vendor-product">webandprint--AR for WordPress</td>
<td>The AR for WordPress plugin for WordPress is vulnerable to Directory Tr= aversal in all versions up to, and including, 8.40 via the 'file' parameter=
parameter. This makes it possible for unauthenticated attackers to read th=
e contents of arbitrary files on the server, which can contain sensitive in= formation. Exploitation requires an attacker to first obtain a valid nonce = and secure nonce via the publicly accessible ar_get_fresh_nonce and ar_proc= ess_user_image nopriv AJAX handlers, and to reproduce the encryption key lo= cally - both steps are fully achievable by an unauthenticated attacker on a=
ny default free or unlicensed installation where ar_licence_key is unset.</=

<td>2026-07-03</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14327" target=3D= "_blank" rel=3D"noopener">CVE-2026-14327</a></td>
</tr>

<td class=3D"vendor-product">webaways--NEX-Forms Ultimate Forms Plugin for = WordPress</td>
<td>The NEX-Forms - Ultimate Forms Plugin for WordPress plugin for WordPres=
s is vulnerable to Stored Cross-Site Scripting via '_name[]' Array Paramete=
r in all versions up to, and including, 9.2.2 due to insufficient input san= itization and output escaping. This makes it possible for unauthenticated a= ttackers to inject arbitrary web scripts in pages that will execute wheneve=
r a user accesses an injected page. The wp_kses() output filtering pass pro= vides no mitigation because NEXForms_allowed_tags() explicitly permits &amp= ;lt;script&amp;gt;, &amp;lt;iframe src/srcdoc&amp;gt;, and JS event handler=
s such as onClick, onBlur, and onChange in its allow-list.</td> <td>2026-07-01</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12142" target=3D= "_blank" rel=3D"noopener">CVE-2026-12142</a></td>
</tr>

<td class=3D"vendor-product">webaways--NEX-Forms Ultimate Forms Plugin for = WordPress</td>
<td>The NEX-Forms - Ultimate Forms Plugin for WordPress plugin for WordPres=
s is vulnerable to Stored Cross-Site Scripting via the 'real_val__' paramet=
er in all versions up to, and including, 9.2.2 due to insufficient input sa= nitization and output escaping. This makes it possible for unauthenticated = attackers to inject arbitrary web scripts in pages that will execute whenev=
er a user accesses an injected page. The submission endpoint is registered = via wp_ajax_nopriv_submit_nex_form with no nonce verification, making it fu= lly accessible to unauthenticated attackers without any CSRF token.</td> <td>2026-07-03</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13040" target=3D= "_blank" rel=3D"noopener">CVE-2026-13040</a></td>
</tr>

<td class=3D"vendor-product">Webraketen--Internal Links Manager</td> <td>Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager &l= t;=3D 3.0.3 versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57345" target=3D= "_blank" rel=3D"noopener">CVE-2026-57345</a></td>
</tr>

<td class=3D"vendor-product">wedevs--Dokan Pro</td>
<td>The Dokan Pro plugin for WordPress is vulnerable to privilege escalatio=
n via update_capabilities REST Endpoint in all versions up to, and includin=
g, 5.0.4. This is due to the `update_capabilities()` REST handler accepting=
arbitrary capability strings from the request body and passing them direct=
ly to WP_User::add_cap() with no allowlist validation, only verifying that = the caller holds the dokandar capability. This makes it possible for authen= ticated attackers with a self-provisioned Vendor-level access and above, on=
sites with the Vendor Staff module enabled, to grant arbitrary WordPress c= apabilities, including administrator, to any vendor_staff account, leading =
to a full site takeover.</td>
<td>2026-07-01</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12224" target=3D= "_blank" rel=3D"noopener">CVE-2026-12224</a></td>
</tr>

<td class=3D"vendor-product">woodpecker-ci--woodpecker</td>
<td>Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list a= gainst pipeline.Author. For the GitLab forge driver, pipeline.Author is pop= ulated from the git commit author name (commit.author.name) carried in the = webhook payload, which is attacker-controlled and not verified by GitLab. A=
user who can open a merge request from a fork can set the commit author na=
me to match an entry in ApprovalAllowedUsers, causing needsApproval to retu=
rn false so the pipeline runs without the required approval. This defeats t=
he fork-approval security boundary and allows execution of attacker-control= led pipeline steps on a Woodpecker agent and exfiltration of CI secrets exp= osed to the run. Other built-in forge drivers (Gitea, Forgejo, GitHub, Bitb= ucket) derive pipeline.Author from the forge-validated sender/actor identit=
y and are not affected.</td>
<td>2026-06-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58370" target=3D= "_blank" rel=3D"noopener">CVE-2026-58370</a></td>
</tr>

<td class=3D"vendor-product">WP Swings--Wallet System for WooCommerce</td> <td>Subscriber Broken Access Control in Wallet System for WooCommerce &lt;=
=3D 2.7.6 versions.</td>
<td>2026-06-29</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57332" target=3D= "_blank" rel=3D"noopener">CVE-2026-57332</a></td>
</tr>

<td class=3D"vendor-product">WPXPO--WowAddons</td>
<td>Unauthenticated Cross Site Scripting (XSS) in WowAddons &lt;=3D 1.6.14 = versions.</td>
<td>2026-07-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57686" target=3D= "_blank" rel=3D"noopener">CVE-2026-57686</a></td>
</tr>

<td class=3D"vendor-product">xdan--jodit</td>
<td>Jodit Editor is a WYSIWYG editor with written in pure TypeScript file a=
nd image editing capabilities. In versions prior to 4.12.28, the built-in c= lean-html sanitizer can be bypassed by a MathML/&lt;style&gt; carrier that = hides a dangerous element from the sanitizer's element walk, so a no-intera= ction event handler survives into the editor value, potentially causing Mut= ation XSS. When an application supplies attacker-influenced HTML to the edi= tor's value-set or insertion paths, the sanitized output still contains a l= ive &lt;img ... onload=3D...&gt; (or another non-onerror handler such as on= focus). A consumer that renders that output (element.innerHTML =3D editor.v= alue) executes the handler with no user interaction. This issue has been fi= xed in version 4.12.28.</td>
<td>2026-07-01</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58263" target=3D= "_blank" rel=3D"noopener">CVE-2026-58263</a></td>
</tr>

<td class=3D"vendor-product">XplodedThemes--WPIDE File Manager &amp; Code E= ditor</td>
<td>Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE - File Manag=
er &amp; Code Editor &lt;=3D 3.5.6 versions.</td>
<td>2026-07-02</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57766" target=3D= "_blank" rel=3D"noopener">CVE-2026-57766</a></td>
</tr>

<td class=3D"vendor-product">Yonyou Network Technology Co., Ltd.--KSOA</td> <td>Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulne= rability in the com.sksoft.bill.ImageUpload servlet that allows unauthentic= ated attackers to upload arbitrary files by submitting a POST request with = attacker-controlled filepath and filename parameters without any authentica= tion, file type, extension, or content validation. Attackers can upload a J=
SP webshell by specifying a malicious filename and root filepath, with the = uploaded file stored under the pictures directory and directly executed by = the web server, resulting in unauthenticated remote code execution. Exploit= ation evidence was first observed by the Shadowserver Foundation on 2023-11= -07 (UTC).</td>
<td>2026-07-02</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2022-50973" target=3D= "_blank" rel=3D"noopener">CVE-2022-50973</a></td>
</tr>

<td class=3D"vendor-product">Yunai--ruoyi-vue-pro</td>
<td>ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broke=
n access control vulnerability in ErpSaleOrderController that allows attack= ers with erp:sale-out permissions to gain unauthorized access to sale order=
operations by exploiting an incorrect permission namespace enforcement. At= tackers holding shipment-level permissions can perform unauthorized create,=
update, delete, and read operations on financially sensitive sale orders d=
ue to the controller enforcing erp:sale-out instead of the intended erp:sal= e-order namespace.</td>
<td>2026-06-29</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57950" target=3D= "_blank" rel=3D"noopener">CVE-2026-57950</a></td>
</tr>

<td class=3D"vendor-product">YunaiV--ruoyi-vue-pro</td>
<td>A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2= 026.04-jdk8-SNAPSHOT. The impacted element is the function generateUploadPa=
th of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/inf= ra/service/file/FileServiceImpl.java of the component AppFileController Fil=
e Upload Endpoint. Performing a manipulation results in path traversal. Rem= ote exploitation of the attack is possible. The exploit has been made publi=
c and could be used. The patch is named 4ae3f6b2c9883978837638c14e3d1841981= 9eeb0. It is recommended to apply a patch to fix this issue. This product i=
s published by multiple vendors.</td>
<td>2026-06-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13528" target=3D= "_blank" rel=3D"noopener">CVE-2026-13528</a></td>
</tr>

<td class=3D"vendor-product">zedeus--nitter</td>
<td>Nitter's /video media proxy endpoint fails to validate target URLs agai= nst Twitter/X domains and uses a hardcoded default HMAC key, allowing unaut= henticated attackers to compute valid HMACs for arbitrary URLs. Attackers c=
an retrieve HTTP responses from any host reachable by the server, including=
cloud metadata services and internal network resources.</td> <td>2026-06-29</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56285" target=3D= "_blank" rel=3D"noopener">CVE-2026-56285</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handl= e_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean exp= ression that combined the RFC 4861 validity checks with the ICMPv6 code che=
ck using the wrong operator precedence: the form was '((length/hop/source/t= arget checks) &amp;&amp; (icmp_hdr-code !=3D 0))'. Because every legitimate=
ND message carries ICMPv6 code 0, an attacker setting code =3D=3D 0 (the n= ormal value) caused the entire predicate to evaluate false, so the packet w=
as never dropped and all of the other checks were silently skipped. The byp= assed checks include the mandatory Hop Limit =3D=3D 255 verification (which=
proves an ND packet originated on-link and was not forwarded) and, for Rou= ter Advertisements, the requirement that the source be a link-local address=
, as well as multicast-target sanity checks. As a result, an adjacent on-li=
nk attacker - and, because the Hop-Limit-255 guard is bypassed, potentially=
a remote/off-link attacker whose packets would otherwise be rejected - can=
have forged Router Advertisement, Neighbor Solicitation, and Neighbor Adve= rtisement messages accepted. A forged RA lets the attacker reconfigure the = victim's default router, on-link prefixes (SLAAC), MTU, reachable/retransmi=
t timers, and (with CONFIG_NET_IPV6_RA_RDNSS) DNS servers, while forged NS/=
NA enable neighbor-cache poisoning, enabling man-in-the-middle, traffic red= irection, and denial of service. The flaw is an input-validation/authentica= tion weakness rather than a memory-safety issue: the underlying packet-pars= ing primitives (net_pkt_get_data, net_pkt_read, net_pkt_skip) are independe= ntly bounds-safe and the validated 'length' is the true buffer length, so s= kipping the length check causes no out-of-bounds access. The defect has exi= sted since the logic was introduced in 2018 and shipped in all releases thr= ough v4.4.0; it is fixed by splitting the condition so any failing check dr= ops the packet.</td>
<td>2026-06-29</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7656" target=3D"= _blank" rel=3D"noopener">CVE-2026-7656</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem=
resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SY= STEM is enabled) that serves files from a configured root directory. Before=
this fix, both the HTTP/1 and HTTP/2 front-ends placed the raw, attacker-c= ontrolled request path into client-url_buffer (assembled in on_url() for HT= TP/1 and copied verbatim from the :path pseudo-header for HTTP/2) without r= esolving ./.. segments. The static-FS handler then built the on-disk filena=
me by directly concatenating the configured root with that raw URL (snprint= k(fname, ..., "%s%s", static_fs_detail-fs_path, client-url_buffer) at http_= server_http1.c:603 and http_server_http2.c:490) and opened it with fs_open(= fname, FS_O_READ). Because the handler is reached via wildcard/leading-dir = (fnmatch FNM_LEADING_DIR) or fallback resource matching, a request such as = GET /&lt;prefix/../../&lt;file is dispatched to the handler and, after the = underlying filesystem (e.g. LittleFS/FAT) resolves the .. segments, escapes=
the configured web root, letting an unauthenticated remote client read arb= itrary readable files on the mounted volume (information disclosure). The H= TTP server requires no TLS or authentication to reach this path. The fix ad=
ds http_server_remove_dot_segments(), which canonicalizes the path portion =
of the URL before resource lookup in both protocol handlers, neutralizing t=
he traversal. Affects releases v4.0.0 through v4.4.0 for deployments that r= egister a static-filesystem resource.</td>
<td>2026-06-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8023" target=3D"= _blank" rel=3D"noopener">CVE-2026-8023</a></td>
</tr>

<td class=3D"vendor-product">Zozothemes--Zegen</td>
<td>Subscriber Arbitrary File Upload in Zegen &lt;=3D 1.1.9 versions.</td> <td>2026-07-02</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27419" target=3D= "_blank" rel=3D"noopener">CVE-2026-27419</a></td>
</tr>
</tbody>
</table>
<p><a href=3D"#top">Back to top</a></p>
</div>
<div id=3D"medium_v">
<h2 id=3D"medium_v_title">Medium Vulnerabilities</h2>
<table class=3D"table no-tablesaw" style=3D"table-layout: fixed; width: 100= %;" border=3D"1" summary=3D"Medium Vulnerabilities">
<thead>

<th class=3D"vendor-product" style=3D"width: 24%;" scope=3D"col">
<span class=3D"primary-vendor">Primary</span><br><span class=3D"primary-ven= dor">Vendor</span> -- Product</th>
<th style=3D"width: 44%;" scope=3D"col">Description</th>
<th style=3D"width: 10%;" scope=3D"col">Published</th>
<th style=3D"width: 8%;" scope=3D"col">CVSS Score</th>
<th style=3D"width: 7%;" scope=3D"col">Source Info</th>
</tr>
</thead>
<tbody>

<td class=3D"vendor-product">666ghj--BettaFish</td>
<td>A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacte=
d is the function _deduplicate_results of the file InsightEngine/agent.py o=
f the component InsightEngine search-result Deduplication. Executing a mani= pulation can lead to partial string comparison. The attack can be launched = remotely. The exploit has been publicly disclosed and may be utilized. The = pull request to fix this issue awaits acceptance.</td>
<td>2026-07-05</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14687" target=3D= "_blank" rel=3D"noopener">CVE-2026-14687</a></td>
</tr>

<td class=3D"vendor-product">acl project--acl</td>
<td>acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTO=
U) race condition vulnerability that allows local attackers to escalate pri= vileges by replacing a pathname component with a symbolic link between an l= stat() check and subsequent symlink-following operations such as stat(), ch= own(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a=
pathname component can redirect file access control list operations to arb= itrary files when getfacl, setfacl, or chacl is invoked by a privileged pro= cess over an attacker-controlled path, resulting in local privilege escalat= ion.</td>
<td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54370" target=3D= "_blank" rel=3D"noopener">CVE-2026-54370</a></td>
</tr>

<td class=3D"vendor-product">AD-Security--AD_Miner</td>
<td>A vulnerability was determined in AD-Security AD_Miner 1.9.0. Affected =
is the function request_a of the file ad_miner/scripts/analyse_cache.py of = the component Cache Handler. This manipulation of the argument sys.argv[1] = causes deserialization. The attack can only be executed locally. The pull r= equest to fix this issue awaits acceptance.</td>
<td>2026-07-05</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14723" target=3D= "_blank" rel=3D"noopener">CVE-2026-14723</a></td>
</tr>

<td class=3D"vendor-product">Addify--Tax Exempt for WooCommerce</td> <td>Customer Path Traversal in Tax Exempt for WooCommerce &lt;=3D 1.9.3 ver= sions.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49779" target=3D= "_blank" rel=3D"noopener">CVE-2026-49779</a></td>
</tr>

<td class=3D"vendor-product">Adobe--ColdFusion</td>
<td>ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Impr= oper Limitation of a Pathname to a Restricted Directory ('Path Traversal') = vulnerability that could result in a Security feature bypass. An attacker c= ould leverage this vulnerability to gain limited read and write access to u= nauthorized files or directories outside the intended restrictions. Exploit= ation of this issue does not require user interaction.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48314" target=3D= "_blank" rel=3D"noopener">CVE-2026-48314</a></td>
</tr>

<td class=3D"vendor-product">Ads WPQuads--Ads by WPQuads</td>
<td>Subscriber Broken Access Control in Ads by WPQuads &lt;=3D 3.0.3 versio= ns.</td>
<td>2026-06-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57335" target=3D= "_blank" rel=3D"noopener">CVE-2026-57335</a></td>
</tr>

<td class=3D"vendor-product">agentejo--Cockpit CMS</td>
<td>A security vulnerability has been detected in agentejo Cockpit CMS up t=
o 0.12.2. Affected by this issue is the function Spyc::YAMLLoad of the file=
/config/config.yaml of the component htaccess Handler. Such manipulation l= eads to files or directories accessible. It is possible to launch the attac=
k remotely. The exploit has been disclosed publicly and may be used. Config= uration settings should be changed. The vendor was contacted early about th=
is disclosure but did not respond in any way.</td>
<td>2026-06-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13533" target=3D= "_blank" rel=3D"noopener">CVE-2026-13533</a></td>
</tr>

<td class=3D"vendor-product">AIAnytime--Awesome-MCP-Server</td>
<td>A flaw has been found in AIAnytime Awesome-MCP-Server up to a884bb51bcd= 99e08e14fd712c749d55d9d9a13ab. Affected by this issue is some unknown funct= ionality of the file mcp-wiki/src/mcp_wiki/server.py of the component mcp-w= iki/wiki-summary. This manipulation of the argument url causes server-side = request forgery. The attack may be initiated remotely. The exploit has been=
published and may be used. This product uses a rolling release model to de= liver continuous updates. As a result, specific version information for aff= ected or updated releases is not available. The project was informed of the=
problem early through an issue report but has not responded yet.</td> <td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14748" target=3D= "_blank" rel=3D"noopener">CVE-2026-14748</a></td>
</tr>

<td class=3D"vendor-product">andrasweb--PixMagix WordPress Image Editor</td=

<td>The PixMagix - WordPress Image Editor plugin for WordPress is vulnerabl=
e to Directory Traversal in all versions up to, and including, 1.7.2 via th=
e move_image_on_server function. This makes it possible for authenticated a= ttackers, with author-level access and above, to write files with attacker-= controlled content to arbitrary locations on the server. The unsanitized 'l= ayers[].id' parameter is concatenated into a filesystem path and passed to = PHP's copy() function, allowing traversal sequences (e.g. '../../') to esca=
pe the intended upload directory and write attacker-supplied file contents =
to arbitrary paths accessible by the web server process. The save_template = REST endpoint is gated by the create_projects permission (edit_pixmagix + u= pload_files), which Author-level users hold by default after plugin activat= ion, making this exploitable by any Author on sites running PixMagix.</td> <td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11367" target=3D= "_blank" rel=3D"noopener">CVE-2026-11367</a></td>
</tr>

<td class=3D"vendor-product">Andrew Fiebert--Simple URLs</td>
<td>Author Cross Site Scripting (XSS) in Simple URLs &lt;=3D 151 versions.<=

<td>2026-07-02</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57762" target=3D= "_blank" rel=3D"noopener">CVE-2026-57762</a></td>
</tr>

<td class=3D"vendor-product">api-platform--core</td>
<td>API Platform Core is a system to create hypermedia-driven REST and Grap= hQL APIs. In versions prior to 4.1.30, 4.2.26 and 4.3.12, the serializer's = AbstractItemNormalizer does not validate the resource type returned when re= solving relation IRIs, allowing type confusion where a resource of an unint= ended type can be silently assigned to a relation property. An attacker who=
can submit write requests (POST/PUT/PATCH) to an API Platform endpoint wit=
h writable relations can supply a relation IRI pointing to a resource of a = different type than the relation's declared class. Because getResourceFromI= ri() does not pass an $operation to IriConverter::getResourceFromIri(), the=
is_a type guard at IriConverter.php:86 is skipped. For untyped relation pr= operties (legacy @var-only style), the wrong-typed object is silently assig= ned, corrupting invariants and potentially feeding downstream logic that as= sumes the declared type (CWE-843). For typed properties (modern PHP 8.x), t=
he substitution is blocked by Symfony's PropertyAccessor with an InvalidTyp= eException. This issue has been fixed in versions 4.1.30, 4.2.26 and 4.3.12= .</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54164" target=3D= "_blank" rel=3D"noopener">CVE-2026-54164</a></td>
</tr>

<td class=3D"vendor-product">api-platform--core</td>
<td>API Platform Core is a system to create hypermedia-driven REST and Grap= hQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a mis= sing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a = cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per r= equest to decide whether a property is exposed. The componentsCache arrays =
in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serial= izer\ItemNormalizer are keyed on $context['cache_key'], which is set uncond= itionally before delegating to the parent normalizer. The component structu=
re (attributes, relationships, links) computed for one request can therefor=
e be reused for a subsequent request whose user has a different set of acce= ssible properties. A user with lower privileges may end up seeing the struc= ture of properties that the security predicate would otherwise have hidden = for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12.= </td>
<td>2026-07-01</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49858" target=3D= "_blank" rel=3D"noopener">CVE-2026-49858</a></td>
</tr>

<td class=3D"vendor-product">AsyncHttpClient--async-http-client</td>
<td>The AsyncHttpClient (AHC) library allows Java applications to easily ex= ecute HTTP requests and asynchronously process HTTP responses. In versions = from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafe= CookieStore stored a cookie under the value of its Domain attribute without=
verifying that the responding host is allowed to set a cookie for that dom= ain, leading to a cookie tossing / cookie injection issue. A host the clien=
t connects to can therefore plant a cookie scoped to an unrelated domain, a=
nd the client will then send that cookie on later requests to that domain. = Applications that use a single AsyncHttpClient instance - and thus the defa= ult, shared CookieStore - to reach both an attacker-influenced host and a t= rusted host are impacted. This issue has been fixed in versions 2.16.0 and = 3.0.11.</td>
<td>2026-07-01</td>
<td>4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55688" target=3D= "_blank" rel=3D"noopener">CVE-2026-55688</a></td>
</tr>

<td class=3D"vendor-product">Averta LTD--Shortcodes and extra features for = Phlox theme</td>
<td>Improper Neutralization of Input During Web Page Generation ('Cross-sit=
e Scripting') vulnerability in Averta LTD Shortcodes and extra features for=
Phlox theme allows DOM-Based XSS. This issue affects Shortcodes and extra = features for Phlox theme: from n/a through 2.17.16.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57737" target=3D= "_blank" rel=3D"noopener">CVE-2026-57737</a></td>
</tr>

<td class=3D"vendor-product">AWS--AWS CLI</td>
<td>Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2= .34.29 (v2) on Unix-like systems where the umask has not been configured to=
restrict file permissions (the default on most systems) may allow other lo= cal users on the same host to read credentials written by certain CLI subco= mmands (aws codeartifact login, aws iam create-virtual-mfa-device, aws depl=
oy register). To remediate this issue, users should upgrade to AWS CLI 1.44= .78 (v1) or 2.34.29 (v2) or later.</td>
<td>2026-07-01</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13769" target=3D= "_blank" rel=3D"noopener">CVE-2026-13769</a></td>
</tr>

<td class=3D"vendor-product">beardev--JoomSport for Sports: Team &amp; Leag= ue, Football, Hockey &amp; more</td>
<td>The JoomSport - for Sports: Team &amp; League, Football, Hockey &amp; m= ore plugin for WordPress is vulnerable to Missing Authorization to Arbitrar=
y Group Deletion in versions up to, and including, 5.7.8. This is due to a = missing capability check in the joomsport_season_groupdel() AJAX handler, w= hich only verifies a nonce before executing a DELETE query on attacker-supp= lied group IDs. This makes it possible for authenticated attackers, with Su= bscriber-level access and above, to delete arbitrary JoomSport group record= s.</td>
<td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12133" target=3D= "_blank" rel=3D"noopener">CVE-2026-12133</a></td>
</tr>

<td class=3D"vendor-product">beardev--JoomSport for Sports: Team &amp; Leag= ue, Football, Hockey &amp; more</td>
<td>The JoomSport - for Sports: Team &amp; League, Football, Hockey &amp; m= ore plugin for WordPress is vulnerable to authorization bypass in all versi= ons up to, and including, 5.7.8. This is due to the plugin not properly ver= ifying that a user is authorized to perform an action. This makes it possib=
le for authenticated attackers, with subscriber-level access and above, to = create arbitrary season groups or modify existing group names, participants=
, and round-type options. Exploitation requires obtaining the joomsportajax= nonce, which is exposed on frontend pages that render a JoomSport shortcode= .</td>
<td>2026-07-02</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12134" target=3D= "_blank" rel=3D"noopener">CVE-2026-12134</a></td>
</tr>

<td class=3D"vendor-product">BMC--Control-M/Enterprise Manager</td>
<td>The Control-M/Enterprise Manager uses weak protections for stored hashe=
s of account passwords, potentially allowing offline password recovery atta= cks if credential data is obtained by an attacker. This vulnerability affec=
ts Control-M/Enterprise Manager unsupported versions 9.0.20.x and potential=
ly earlier unsupported versions</td>
<td>2026-07-01</td>
<td>5.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10540" target=3D= "_blank" rel=3D"noopener">CVE-2026-10540</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 allows multiple public channels for the same app = and platform to coexist simultaneously, while unnamed /updates requests wit= hout defaultChannel implicitly resolve to a single hidden winner channel. A=
n authorized app or channel manager can create ambiguous default update sta=
te and silently influence which bundle unnamed clients receive, breaking re= lease routing integrity and predictability.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56328" target=3D= "_blank" rel=3D"noopener">CVE-2026-56328</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo console.capgo.app/login before 12.128.2 accepts access_token and = refresh_token in URL query parameters, automatically authenticating users w= ithout confirmation. Attackers can craft malicious links to force victims i= nto attacker-controlled sessions, exposing tokens in browser history and lo= gs.</td>
<td>2026-06-30</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56224" target=3D= "_blank" rel=3D"noopener">CVE-2026-56224</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 contains an information disclosure vulnerability =
in the /private/validate_password_compliance endpoint that returns differen=
t error responses for malformed, non-existent, and existing organization ID=
s. Unauthenticated attackers can enumerate valid organization UUIDs by obse= rving response status codes and error messages, allowing confirmation of or= ganization existence.</td>
<td>2026-06-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56318" target=3D= "_blank" rel=3D"noopener">CVE-2026-56318</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 contains an information disclosure vulnerability =
in the public.invite_user_to_org RPC function that allows unauthenticated a= ttackers to enumerate organization existence by observing distinct error re= sponses. Attackers can call the SECURITY DEFINER function with a publishabl=
e API key to determine if an organization ID exists based on NO_ORG versus = NO_RIGHTS responses, enabling tenant enumeration attacks.</td> <td>2026-06-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56327" target=3D= "_blank" rel=3D"noopener">CVE-2026-56327</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 contains improper error handling in the /private/= accept_invitation endpoint that returns HTTP 500 instead of safe 4xx errors=
when magic_invite_string is invalid. Attackers can trigger this vulnerabil= ity using only the public key by submitting malformed magic_invite_string v= alues to cause server errors and leak internal processing details.</td> <td>2026-06-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56331" target=3D= "_blank" rel=3D"noopener">CVE-2026-56331</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 contains a server-side validation bypass vulnerab= ility in organization security settings that allows authenticated org admin=
s to persist invalid security policy state. Attackers can bypass backend va= lidation by directly updating the public.orgs table from the browser, circu= mventing field-level validation checks for max_apikey_expiration_days and o= ther security-sensitive configuration parameters.</td>
<td>2026-06-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56333" target=3D= "_blank" rel=3D"noopener">CVE-2026-56333</a></td>
</tr>

<td class=3D"vendor-product">Capgo--Capgo</td>
<td>Capgo before 12.128.2 lacks an UPDATE row-level security policy for the=
build_requests table, preventing API-key and anonymous access from persist= ing builder status updates. Attackers can exploit this missing policy to ca= use build status and error details to remain unpersisted, leaving build_req= uests rows stuck in pending state with null last_error values.</td> <td>2026-06-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56334" target=3D= "_blank" rel=3D"noopener">CVE-2026-56334</a></td>
</tr>

<td class=3D"vendor-product">ccfos--nightingale</td>
<td>Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configura= tions, including plaintext database passwords, HTTP bearer tokens, HTTP bas= ic-auth passwords, and mTLS client keys, to any authenticated low-privilege=
(Standard role) user through POST /api/n9e/datasource/list. The route is r= egistered without an admin authorization gate, unlike the sibling datasourc=
e mutation routes, and the open-source DatasourceFilter does not redact sec= ret fields, so the secret-bearing settings, http, and auth objects are seri= alized in the response. The disclosed credentials enable access to the conn= ected downstream systems.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58167" target=3D= "_blank" rel=3D"noopener">CVE-2026-58167</a></td>
</tr>

<td class=3D"vendor-product">ChaN--FatFs</td>
<td>FatFs R0.16 and earlier exhibits a stale dirty-cache skip via unsigned-= subtraction wrap in f_read() / f_write() (fp-&gt;sect - sect &lt; cc) durin=
g interleaved read/write on fragmented filesystems. This maps to CWE-191 (I= nteger Underflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N= /S:U/C:N/I:H/A:H (6.1, Medium). The estimated CISA SSVC vectors are Exploit= ation: PoC, Technical Impact: Total.</td>
<td>2026-07-01</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6685" target=3D"= _blank" rel=3D"noopener">CVE-2026-6685</a></td>
</tr>

<td class=3D"vendor-product">ChaN--FatFs</td>
<td>FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic b=
ug when crafted metadata causes n_fatent - 2 to be zero during write/sync o= perations. This maps to CWE-369 (Divide By Zero). Estimated CVSS v3.1 vecto=
r: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). Network-deli= vered update media can make this remote in some pipelines. The estimated CI=
SA SSVC vectors are Exploitation: PoC, Technical Impact: Partial.</td> <td>2026-07-01</td>
<td>4.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6683" target=3D"= _blank" rel=3D"noopener">CVE-2026-6683</a></td>
</tr>

<td class=3D"vendor-product">ChaN--FatFs</td>
<td>FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 =3D 1' contai=
ns an issue where an unbounded loop count derived from GPT header field GPT= H_PtNum, enabling extremely long or effectively infinite mount-time scans. = This maps to CWE-835 (Loop with Unreachable Exit Condition). Estimated CVSS=
v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (4.6, Medium). T=
he estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Par= tial.</td>
<td>2026-07-01</td>
<td>4.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6684" target=3D"= _blank" rel=3D"noopener">CVE-2026-6684</a></td>
</tr>

<td class=3D"vendor-product">ChaN--FatFs</td>
<td>FatFs R0.16 and earlier contains an uninitialized cluster exposure when=
f_lseek() extends files beyond EOF without zero-filling newly allocated cl= usters. This maps to CWE-908 (Use of Uninitialized Resource). Estimated CVS=
S v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (4.6, Medium). = The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Pa= rtial.</td>
<td>2026-07-01</td>
<td>4.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6686" target=3D"= _blank" rel=3D"noopener">CVE-2026-6686</a></td>
</tr>

<td class=3D"vendor-product">CherryHQ--cherry-studio</td>
<td>A security vulnerability has been detected in CherryHQ cherry-studio up=
to 1.9.6. This vulnerability affects unknown code of the file src/main/ser= vices/mcp/oauth/callback.ts of the component MCP OAuth Local Callback Serve=
r. The manipulation of the argument code leads to improper authorization. T=
he attack can be initiated remotely. The attack is considered to have high = complexity. It is stated that the exploitability is difficult. The exploit = has been disclosed publicly and may be used. The pull request to fix this i= ssue awaits acceptance.</td>
<td>2026-06-29</td>
<td>5.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13524" target=3D= "_blank" rel=3D"noopener">CVE-2026-13524</a></td>
</tr>

<td class=3D"vendor-product">CherryHQ--cherry-studio</td>
<td>A vulnerability was detected in CherryHQ cherry-studio up to 1.9.7. Thi=
s affects the function sha256 of the file src/main/services/memory/MemorySe= rvice.ts of the component CherryIN Preload API. Performing a manipulation o=
f the argument state results in authorization bypass. The attack can be ini= tiated remotely. The attack's complexity is rated as high. It is indicated = that the exploitability is difficult. The exploit is now public and may be = used. The vendor explains, that "[m]emory is planned to be removed in v2 ve= rsion."</td>
<td>2026-06-29</td>
<td>5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13534" target=3D= "_blank" rel=3D"noopener">CVE-2026-13534</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Assessment Management</td>
<td>A flaw has been found in code-projects Assessment Management 1.0. This = issue affects some unknown processing of the file /lecturer/marking-scheme.= php of the component Database Query Handler. This manipulation of the argum= ent squestions[] causes sql injection. The attack can be initiated remotely=
. The exploit has been published and may be used.</td>
<td>2026-07-04</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14657" target=3D= "_blank" rel=3D"noopener">CVE-2026-14657</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Assessment Management</td>
<td>A vulnerability was detected in code-projects Assessment Management 1.0=
. This vulnerability affects unknown code of the file /lecturer/marking-sch= eme.php. The manipulation of the argument smarksrange[] results in sql inje= ction. It is possible to launch the attack remotely. The exploit is now pub= lic and may be used.</td>
<td>2026-07-04</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14658" target=3D= "_blank" rel=3D"noopener">CVE-2026-14658</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Assessment Management</td>
<td>A security vulnerability has been detected in code-projects Assessment = Management 1.0. This affects an unknown part of the file /admin/remove-user= .php. The manipulation of the argument ID leads to cross site scripting. It=
is possible to initiate the attack remotely. The exploit has been disclose=
d publicly and may be used.</td>
<td>2026-07-04</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14656" target=3D= "_blank" rel=3D"noopener">CVE-2026-14656</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Internship Management System</t=

<td>A vulnerability was detected in code-projects Internship Management Sys= tem 1.0. This affects an unknown function of the file employer/details/chan= ge_password.php of the component Password Change Endpoint. The manipulation=
of the argument Current results in sql injection. The attack can be execut=
ed remotely. The exploit is now public and may be used.</td> <td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14701" target=3D= "_blank" rel=3D"noopener">CVE-2026-14701</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Online Examination</td>
<td>A vulnerability was identified in code-projects Online Examination 1.0.=
This affects an unknown part of the file /update.php?q=3Daddquiz of the co= mponent Quiz Creation Feature. The manipulation of the argument name/total/= right/wrong/time/tag/desc leads to sql injection. The attack can be initiat=
ed remotely. The exploit is publicly available and might be used.</td> <td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14706" target=3D= "_blank" rel=3D"noopener">CVE-2026-14706</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Online Music Site</td>
<td>A security flaw has been discovered in code-projects Online Music Site = 1.0. This affects an unknown part of the file /Frontend/Feedback.php of the=
component POST Request Handler. The manipulation of the argument fname/fem= ail/faddress/fmessage results in cross site scripting. The attack may be la= unched remotely. The exploit has been released to the public and may be use=
d for attacks.</td>
<td>2026-06-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13567" target=3D= "_blank" rel=3D"noopener">CVE-2026-13567</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Apartment Visitor Management System= </td>
<td>A security flaw has been discovered in CodeAstro Apartment Visitor Mana= gement System 1.0. The impacted element is an unknown function of the file = /apartment-visitor/add-apartment.php. The manipulation of the argument apar= tmentno results in sql injection. The attack may be launched remotely. The = exploit has been released to the public and may be used for attacks.</td> <td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14689" target=3D= "_blank" rel=3D"noopener">CVE-2026-14689</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Apartment Visitor Management System= </td>
<td>A vulnerability was identified in CodeAstro Apartment Visitor Managemen=
t System 1.0. Affected by this issue is some unknown functionality of the f= ile /apartment-visitor/search-result.php of the component POST Parameter Ha= ndler. The manipulation of the argument searchdata leads to sql injection. = Remote exploitation of the attack is possible. The exploit is publicly avai= lable and might be used.</td>
<td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14766" target=3D= "_blank" rel=3D"noopener">CVE-2026-14766</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Complaint Management System</td>
<td>A security flaw has been discovered in CodeAstro Complaint Management S= ystem 1.0. The affected element is the function deletereport of the file ap= plication/controllers/Report.php of the component Report Endpoint. The mani= pulation results in authorization bypass. The attack can be executed remote= ly. The exploit has been released to the public and may be used for attacks= .</td>
<td>2026-06-29</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13549" target=3D= "_blank" rel=3D"noopener">CVE-2026-13549</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Ecommerce Website</td>
<td>A vulnerability has been found in CodeAstro Ecommerce Website 1.0. This=
impacts an unknown function of the file /ecommerce-website-php/customer/my= _account.php?edit_account. Such manipulation of the argument c_name leads t=
o sql injection. The attack may be launched remotely. The exploit has been = disclosed to the public and may be used.</td>
<td>2026-07-04</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14639" target=3D= "_blank" rel=3D"noopener">CVE-2026-14639</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Ecommerce Website</td>
<td>A security flaw has been discovered in CodeAstro Ecommerce Website 1.0.=
This affects an unknown part of the file /ecommerce-website-php/customer/c= onfirm.php of the component POST Parameter Handler. The manipulation of the=
argument invoice_no results in sql injection. The attack can be executed r= emotely. The exploit has been released to the public and may be used for at= tacks.</td>
<td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14767" target=3D= "_blank" rel=3D"noopener">CVE-2026-14767</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Human Resource Management System</t=

<td>A vulnerability was detected in CodeAstro Human Resource Management Sys= tem 1.0. This issue affects the function emselectByCode of the file applica= tion/models/Employee_model.php of the component Update_Earn_Leave Endpoint.=
The manipulation of the argument emid results in sql injection. The attack=
can be launched remotely. The exploit is now public and may be used.</td> <td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13525" target=3D= "_blank" rel=3D"noopener">CVE-2026-13525</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Human Resource Management System</t=

<td>A flaw has been found in CodeAstro Human Resource Management System 1.0=
. This vulnerability affects the function GetFileInfo of the file hrsystem/= application/models/Employee_model.php of the component View Endpoint. Execu= ting a manipulation of the argument ID can lead to sql injection. The attac=
k can be launched remotely. The exploit has been published and may be used.= </td>
<td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13535" target=3D= "_blank" rel=3D"noopener">CVE-2026-13535</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Human Resource Management System</t=

<td>A vulnerability was found in CodeAstro Human Resource Management System=
1.0. Impacted is an unknown function. The manipulation results in cross-si=
te request forgery. The attack may be launched remotely. The exploit has be=
en made public and could be used.</td>
<td>2026-06-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13537" target=3D= "_blank" rel=3D"noopener">CVE-2026-13537</a></td>
</tr>

<td class=3D"vendor-product">codename065--Download Manager</td>
<td>The Download Manager plugin for WordPress is vulnerable to Stored Cross= -Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to=
, and including, 3.3.60 due to insufficient input sanitization and output e= scaping. This makes it possible for authenticated attackers, with contribut= or-level access and above, to inject arbitrary web scripts in pages that wi=
ll execute whenever a user accesses an injected page. Although wp_kses_post=
is applied to post content on save, it only strips HTML tokens and does no=
t neutralize C-style escape sequences embedded within shortcode attribute v= alues, meaning contributors can craft a payload that survives the kses filt=
er and is silently reconstructed into a raw script tag at render time.</td> <td>2026-07-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13733" target=3D= "_blank" rel=3D"noopener">CVE-2026-13733</a></td>
</tr>

<td class=3D"vendor-product">codepeople--Appointment Booking Calendar</td> <td>The Appointment Booking Calendar plugin for WordPress is vulnerable to = Sensitive Information Exposure in all versions up to, and including, 1.4.02=
via the cpabc_appointments_filter_list. This makes it possible for authent= icated attackers, with contributor-level access and above, to extract custo= mer names, email addresses, phone numbers, appointment comments, and other = booking personally identifiable information.</td>
<td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12113" target=3D= "_blank" rel=3D"noopener">CVE-2026-12113</a></td>
</tr>

<td class=3D"vendor-product">Codexpert Inc--ThumbPress</td>
<td>Missing Authorization vulnerability in Codexpert Inc ThumbPress allows = Exploiting Incorrectly Configured Access Control Security Levels. This issu=
e affects ThumbPress: from n/a through 6.3.2.</td>
<td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57720" target=3D= "_blank" rel=3D"noopener">CVE-2026-57720</a></td>
</tr>

<td class=3D"vendor-product">Colissimo--Colissimo Officiel : Mthodes de liv= raison pour WooCommerce</td>
<td>Unauthenticated Insecure Direct Object References (IDOR) in Colissimo O= fficiel : M=C3=83=C2=A9thodes de livraison pour WooCommerce &lt;=3D 2.9.0 v= ersions.</td>
<td>2026-06-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57341" target=3D= "_blank" rel=3D"noopener">CVE-2026-57341</a></td>
</tr>

<td class=3D"vendor-product">coollabsio--coolify</td>
<td>Coolify is an open-source and self-hostable tool for managing servers, = applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker()=
helper wraps commands in bash -c '{$command}' without escaping single quot= es. User-controlled docker_compose_custom_build_command and docker_compose_= custom_start_command fields are interpolated directly, allowing a single qu= ote to break out of the bash -c argument and execute commands on the manage=
d server host (outside the intended Docker container context). This vulnera= bility is fixed in 4.0.0-beta.464.</td>
<td>2026-06-30</td>
<td>6.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27955" target=3D= "_blank" rel=3D"noopener">CVE-2026-27955</a></td>
</tr>

<td class=3D"vendor-product">coollabsio--coolify</td>
<td>Coolify is an open-source and self-hostable tool for managing servers, = applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/deployme= nts/{uuid}` in DeployController.php retrieves deployment details without va= lidating that the deployment belongs to the authenticated user's team. Any = authenticated API user can read deployment records from other teams by prov= iding a valid deployment UUID. This vulnerability is fixed in 4.0.0-beta.46= 4.</td>
<td>2026-06-30</td>
<td>5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27881" target=3D= "_blank" rel=3D"noopener">CVE-2026-27881</a></td>
</tr>

<td class=3D"vendor-product">coollabsio--coolify</td>
<td>Coolify is an open-source and self-hostable tool for managing servers, = applications, and databases. Prior to 4.0.0-beta.464, the `GET /api/v1/depl= oyments/{uuid}` endpoint allows any authenticated user to access deployment=
details belonging to any team, bypassing team-based authorization. The $te= amId is extracted from the authentication token but never used to scope the=
database query. This vulnerability is fixed in 4.0.0-beta.464.</td> <td>2026-06-30</td>
<td>5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27883" target=3D= "_blank" rel=3D"noopener">CVE-2026-27883</a></td>
</tr>

<td class=3D"vendor-product">coollabsio--coolify</td>
<td>Coolify is an open-source and self-hostable tool for managing servers, = applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook en= dpoint uses a non-constant-time string comparison operator (!=3D=3D) to val= idate the webhook secret token. This implementation is vulnerable to timing=
attacks, which could allow an attacker to gradually discover the secret to= ken by measuring response time differences. This vulnerability is fixed in = 4.0.0-beta.461.</td>
<td>2026-06-30</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27882" target=3D= "_blank" rel=3D"noopener">CVE-2026-27882</a></td>
</tr>

<td class=3D"vendor-product">coollabsio--coolify</td>
<td>Coolify is an open-source and self-hostable tool for managing servers, = applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/servers/= {server_uuid}/domains?uuid=3D{app_uuid}` bypasses team scoping when the opt= ional uuid query parameter is provided. Any authenticated API user can enum= erate domain names (FQDNs) of applications belonging to other teams. This v= ulnerability is fixed in 4.0.0-beta.464.</td>
<td>2026-06-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27956" target=3D= "_blank" rel=3D"noopener">CVE-2026-27956</a></td>
</tr>

<td class=3D"vendor-product">creativemindssolutions--CM Business Directory = Optimise and showcase local business</td>
<td>The CM Business Directory - Optimise and showcase local business plugin=
for WordPress is vulnerable to Stored Cross-Site Scripting via Business Ad= dress Meta Fields in all versions up to, and including, 1.5.7 due to insuff= icient input sanitization and output escaping. This makes it possible for a= uthenticated attackers, with contributor-level access and above, to inject = arbitrary web scripts in pages that will execute whenever a user accesses a=
n injected page. Because the malicious payload is stored in post meta rathe=
r than post_content, WordPress's unfiltered_html capability restriction doe=
s not apply, meaning contributors who lack that capability can still inject=
executable HTML via the address meta fields such as cmbd_address, cmbd_cit= yTown, cmbd_stateCounty, cmbd_postalcode, cmbd_region, and cmbd_country.</t=

<td>2026-07-03</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8892" target=3D"= _blank" rel=3D"noopener">CVE-2026-8892</a></td>
</tr>

<td class=3D"vendor-product">crmperks--Database for Contact Form 7, WPforms=
, Elementor forms</td>
<td>The Database for Contact Form 7, WPforms, Elementor forms plugin for Wo= rdPress is vulnerable to Arbitrary File Copy via the create_entry_el() func= tion in versions up to, and including, 1.5.1. The function reads raw_value = from Elementor Pro's Form_Record object for upload-type fields and passes i=
t directly to PHP's copy() without validating that the value corresponds to=
a legitimately uploaded file - when no file is present in $_FILES, raw_val=
ue reflects the attacker-controlled POST string. copy() accepts both local = filesystem paths and URL sources, so the attacker can target any file reada= ble by the PHP process or supply an attacker-controlled remote URL. Element=
or Pro is a prerequisite for triggering the code path (it owns the elemento= r_pro/forms/new_record hook and populates the Form_Record object), but the = bug itself is entirely in Contact Form Entries' handler. This could allow u= nauthenticated attackers to disclose arbitrary files on the affected site's=
server. The file is copied to a directory unknown to the attacker; the has= hed directory name provides defense-in-depth but is generated from non-cryp= tographic sources (uniqid() + rand()) and should not be relied upon as the = primary mitigation.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9145" target=3D"= _blank" rel=3D"noopener">CVE-2026-9145</a></td>
</tr>

<td class=3D"vendor-product">Crocoblock. Jetimpex Inc.--JetReviews</td> <td>Subscriber Cross Site Scripting (XSS) in JetReviews &lt;=3D 3.0.0.1 ver= sions.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57354" target=3D= "_blank" rel=3D"noopener">CVE-2026-57354</a></td>
</tr>

<td class=3D"vendor-product">cvat-ai--cvat</td>
<td>CVAT before 2.69.0 contains an improper authorization vulnerability in = QualityReportViewSet.get_queryset that allows authenticated attackers to en= umerate quality report identifiers belonging to other organizations by expl= oiting a missing check_object_permissions call on the parent_id query param= eter of the quality reports API endpoint. Attackers can send requests with = sequential integer parent_id values and distinguish between existing and no= n-existing reports via HTTP 500 versus HTTP 404 response differences, discl= osing cross-organization report existence without returning report content.= </td>
<td>2026-06-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58373" target=3D= "_blank" rel=3D"noopener">CVE-2026-58373</a></td>
</tr>

<td class=3D"vendor-product">DALIBO--PostgreSQL Anonymizer</td>
<td>PostgreSQL Anonymizer contains a vulnerability that allows unprivileged=
masked users to repeatedly call the anon.hash() function and collects (see=
d, hash_output) pairs to perform an offline brute-force attack and deduce t=
he salt. The problem is resolved in PostgreSQL Anonymizer 3.1.2 and later v= ersions</td>
<td>2026-06-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13455" target=3D= "_blank" rel=3D"noopener">CVE-2026-13455</a></td>
</tr>

<td class=3D"vendor-product">DeepMyst--Mysti</td>
<td>A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the=
function _isTrackedConversation of the file src/managers/ChannelBridge.ts =
of the component Contact Tracking. This manipulation of the argument _chann= elType causes improper authorization. The attack may be initiated remotely.=
A high degree of complexity is needed for the attack. The exploitability i=
s told to be difficult. The exploit has been made available to the public a=
nd could be used for attacks. Patch name: 9b4aff0f106db424aa45a35aa89dd0b8f= 2eb9a48. It is suggested to install a patch to address this issue.</td> <td>2026-06-29</td>
<td>5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13591" target=3D= "_blank" rel=3D"noopener">CVE-2026-13591</a></td>
</tr>

<td class=3D"vendor-product">DeepMyst--Mysti</td>
<td>A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affec= ted element is the function initProjectMemory of the file src/managers/Memo= ryManager.ts of the component Per-Project Auto-Memory Handler. Such manipul= ation of the argument workspacePath leads to exposure of resource. The atta=
ck may be performed from remote. Upgrading to version 0.4.0 is sufficient t=
o fix this issue. The name of the patch is 6d709229b5199f6769fb3cf763e5122d= cc43c079. It is advisable to upgrade the affected component.</td> <td>2026-07-03</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14611" target=3D= "_blank" rel=3D"noopener">CVE-2026-14611</a></td>
</tr>

<td class=3D"vendor-product">Dell--Inspiron 15 3520</td>
<td>Dell Client Platform BIOS contains an Authentication Bypass by Primary = Weakness vulnerability. An unauthenticated attacker with physical access co= uld potentially exploit this vulnerability, leading to Information Disclosu= re.</td>
<td>2026-07-03</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-35159" target=3D= "_blank" rel=3D"noopener">CVE-2026-35159</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an improper neutralization of special Elements used in an OS command ('OS c= ommand Injection') vulnerability. A high privileged attacker with remote ac= cess could potentially exploit this vulnerability, leading to command execu= tion.</td>
<td>2026-07-03</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-26355" target=3D= "_blank" rel=3D"noopener">CVE-2026-26355</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an integer overflow or wraparound vulnerability. An unauthenticated attacke=
r with remote access could potentially exploit this vulnerability, leading =
to denial of service.</td>
<td>2026-07-03</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-46463" target=3D= "_blank" rel=3D"noopener">CVE-2026-46463</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an improper neutralization of special elements used in an OS command ('OS c= ommand Injection') vulnerability. A high privileged attacker with local acc= ess could potentially exploit this vulnerability, leading to arbitrary comm= and execution.</td>
<td>2026-07-03</td>
<td>6.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49813" target=3D= "_blank" rel=3D"noopener">CVE-2026-49813</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an improper neutralization of special elements used in an OS command ('OS c= ommand Injection') vulnerability. A high privileged attacker with local acc= ess could potentially exploit this vulnerability, leading to Command execut= ion.</td>
<td>2026-07-03</td>
<td>6.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54483" target=3D= "_blank" rel=3D"noopener">CVE-2026-54483</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an use of externally-controlled format string vulnerability. A high privile= ged attacker with remote access could potentially exploit this vulnerabilit=
y, leading to Information disclosure and denial of service.</td> <td>2026-07-03</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-46465" target=3D= "_blank" rel=3D"noopener">CVE-2026-46465</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an insertion of sensitive information into log file vulnerability. A low pr= ivileged attacker with local access could potentially exploit this vulnerab= ility, leading to information exposure.</td>
<td>2026-07-03</td>
<td>5.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-46467" target=3D= "_blank" rel=3D"noopener">CVE-2026-46467</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an improper access control vulnerability in the RBAC. A low privileged atta= cker with remote access could potentially exploit this vulnerability, leadi=
ng to information tampering.</td>
<td>2026-07-03</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41123" target=3D= "_blank" rel=3D"noopener">CVE-2026-41123</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an incorrect permission Assignment for critical resource vulnerability. A h= igh privileged attacker with local access could potentially exploit this vu= lnerability, leading to unauthorized access.</td>
<td>2026-07-03</td>
<td>4.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44268" target=3D= "_blank" rel=3D"noopener">CVE-2026-44268</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an improper link resolution before file access ('link following') vulnerabi= lity. A high privileged attacker with local access could potentially exploi=
t this vulnerability, leading to unauthorized access.</td>
<td>2026-07-03</td>
<td>4.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44269" target=3D= "_blank" rel=3D"noopener">CVE-2026-44269</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an improper link resolution before file access ('Link following') vulnerabi= lity. A high privileged attacker with remote access could potentially explo=
it this vulnerability, leading to information disclosure.</td> <td>2026-07-03</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-46464" target=3D= "_blank" rel=3D"noopener">CVE-2026-46464</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an improper link resolution before file access ('Link following') vulnerabi= lity. A high privileged attacker with local access could potentially exploi=
t this vulnerability, leading to information exposure.</td>
<td>2026-07-03</td>
<td>4.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-46468" target=3D= "_blank" rel=3D"noopener">CVE-2026-46468</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an incorrect authorization vulnerability. A high privileged attacker with l= ocal access could potentially exploit this vulnerability, leading to unauth= orized command execution.</td>
<td>2026-07-03</td>
<td>4.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-46730" target=3D= "_blank" rel=3D"noopener">CVE-2026-46730</a></td>
</tr>

<td class=3D"vendor-product">DivvyDrive Information Technologies Inc.--Divv= yDrive</td>
<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') vulnerability in DivvyDrive Information Technologies Inc. Div= vyDrive allows Stored XSS. This issue affects DivvyDrive: from 4.8.2.23 bef= ore v.4.8.3.1.</td>
<td>2026-07-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5220" target=3D"= _blank" rel=3D"noopener">CVE-2026-5220</a></td>
</tr>

<td class=3D"vendor-product">DivvyDrive Information Technologies Inc.--Divv= yDrive</td>
<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') vulnerability in DivvyDrive Information Technologies Inc. Div= vyDrive allows Stored XSS. This issue affects DivvyDrive: from v.4.8.2.23 b= efore v.4.8.3.1.</td>
<td>2026-07-01</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6283" target=3D"= _blank" rel=3D"noopener">CVE-2026-6283</a></td>
</tr>

<td class=3D"vendor-product">Documenso--Documenso</td>
<td>A vulnerability was detected in Documenso up to 2.11.0. Affected by thi=
s vulnerability is an unknown functionality of the file packages/auth/serve= r/lib/utils/handle-oauth-callback-url.ts of the component Google OAuth Logi=
n. The manipulation results in improper authentication. It is possible to l= aunch the attack remotely. This attack is characterized by high complexity.=
The exploitation appears to be difficult. The exploit is now public and ma=
y be used. The pull request to fix this issue awaits acceptance.</td> <td>2026-06-29</td>
<td>5.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13543" target=3D= "_blank" rel=3D"noopener">CVE-2026-13543</a></td>
</tr>

<td class=3D"vendor-product">drfuri--Martfury - WooCommerce Marketplace Wor= dPress Theme</td>
<td>Subscriber Broken Access Control in Martfury - WooCommerce Marketplace = WordPress Theme &lt;=3D 3.2.8 versions.</td>
<td>2026-07-02</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57685" target=3D= "_blank" rel=3D"noopener">CVE-2026-57685</a></td>
</tr>

<td class=3D"vendor-product">dromara--RuoYi-Vue-Plus</td>
<td>RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow=
task management endpoints under /workflow/task (FlwTaskController) without=
any permission check: the controller declares no class-level or method-lev=
el authorization annotation, so the endpoints are gated only by global auth= entication. Any authenticated user, regardless of assigned role, can theref= ore reassign workflow approval tasks to arbitrary users via updateAssignee = (defeating segregation of duties in the approval process), urge arbitrary t= asks, and enumerate all pending and finished tasks via the pageByAllTaskWai=
t and pageByAllTaskFinish listing endpoints. The issue was resolved by addi=
ng permission identifiers (SaCheckPermission) to these endpoints.</td> <td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58176" target=3D= "_blank" rel=3D"noopener">CVE-2026-58176</a></td>
</tr>

<td class=3D"vendor-product">dylan ngo--Woostify Sites Library</td> <td>Unauthenticated Broken Access Control in Woostify Sites Library &lt;=3D=
1.6.2 versions.</td>
<td>2026-07-02</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-66076" target=3D= "_blank" rel=3D"noopener">CVE-2025-66076</a></td>
</tr>

<td class=3D"vendor-product">e4jvikwp--VikBooking Hotel Booking Engine &amp=
; PMS</td>
<td>The VikBooking Hotel Booking Engine &amp; PMS plugin for WordPress is v= ulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter=
in all versions up to, and including, 1.8.12 due to insufficient input san= itization and output escaping. This makes it possible for unauthenticated a= ttackers to inject arbitrary web scripts in pages that execute if they can = successfully trick a user into performing an action such as clicking on a l= ink. Exploitation requires the targeted page to render the [vikbooking view= =3D"roomslist"] shortcode, as the vulnerable layoutstyle parameter is only = processed in that view context.</td>
<td>2026-07-01</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12754" target=3D= "_blank" rel=3D"noopener">CVE-2026-12754</a></td>
</tr>

<td class=3D"vendor-product">Eclipse Foundation--Eclipse Open VSX</td>
<td>In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves u= ser-supplied HTML files with Content-Type: text/html and without a Content-= Security-Policy or Content-Disposition: attachment response header. An unau= thenticated attacker can register a publisher account, upload a VSIX contai= ning a crafted HTML payload, and induce an authenticated user to visit the = resulting URL. The browser renders the file inline in the open-vsx.org orig=
in context, enabling session token exfiltration, persistent Personal Access=
Token (PAT) generation, and unauthorized publication of malicious extensio=
n versions. Because Open VSX extensions are distributed to VS Code, VSCodiu=
m, Cursor, Windsurf, and compatible editors, a compromised extension update=
constitutes a supply chain attack against all downstream users.</td> <td>2026-07-01</td>
<td>4.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13323" target=3D= "_blank" rel=3D"noopener">CVE-2026-13323</a></td>
</tr>

<td class=3D"vendor-product">edge22--GenerateBlocks</td>
<td>The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-S= ite Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute=
in all versions up to, and including, 2.2.1 due to insufficient input sani= tization and output escaping. This makes it possible for authenticated atta= ckers, with contributor-level access and above, to inject arbitrary web scr= ipts in pages that will execute whenever a user accesses an injected page. =
A contributor-level attacker can store a JavaScript payload in their own pr= ofile description (allowlisted by get_safe_user_meta_keys()) and prepend 'j= avascript:' via the linkMetaFieldType attribute, creating a fully attacker-= controlled href that executes when any user, including an administrator, cl= icks the rendered headline link.</td>
<td>2026-07-03</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9756" target=3D"= _blank" rel=3D"noopener">CVE-2026-9756</a></td>
</tr>

<td class=3D"vendor-product">Edimax--EW-7478APC</td>
<td>A security vulnerability has been detected in Edimax EW-7478APC 1.04. T=
he affected element is the function formAccept of the file /goform/formAcce=
pt of the component POST Request Handler. The manipulation of the argument = submit-url leads to os command injection. The attack is possible to be carr= ied out remotely. The exploit has been disclosed publicly and may be used. = The vendor was contacted early about this disclosure but did not respond in=
any way.</td>
<td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13560" target=3D= "_blank" rel=3D"noopener">CVE-2026-13560</a></td>
</tr>

<td class=3D"vendor-product">Edimax--EW-7478APC</td>
<td>A vulnerability was detected in Edimax EW-7478APC 1.04. The impacted el= ement is the function formiNICbasic of the file /goform/formiNICbasic of th=
e component POST Request Handler. The manipulation of the argument rootAPma=
c results in os command injection. The attack may be performed from remote.=
The exploit is now public and may be used. The vendor was contacted early = about this disclosure but did not respond in any way.</td>
<td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13561" target=3D= "_blank" rel=3D"noopener">CVE-2026-13561</a></td>
</tr>

<td class=3D"vendor-product">Edimax--EW-7478APC</td>
<td>A vulnerability was detected in Edimax EW-7478APC 1.04. This vulnerabil= ity affects the function formStaDrvSetup of the file /goform/formStaDrvSetu=
p of the component POST Request Handler. The manipulation of the argument r= ootAPmac results in os command injection. The attack can be executed remote= ly. The exploit is now public and may be used. The vendor was contacted ear=
ly about this disclosure but did not respond in any way.</td> <td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13581" target=3D= "_blank" rel=3D"noopener">CVE-2026-13581</a></td>
</tr>

<td class=3D"vendor-product">Eksagate Electronic Engineering and Computer I= ndustry Trade Inc.--SYSGUARD 6001</td>
<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') vulnerability in Eksagate Electronic Engineering and Computer=
Industry Trade Inc. SYSGUARD 6001 allows Stored XSS. This issue affects SY= SGUARD 6001: from 2.0.2 before 6.1.4.0.=C2=A0 NOTE: The vendor was contacte=
d and it was learned that the product is not supported.</td> <td>2026-06-30</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8403" target=3D"= _blank" rel=3D"noopener">CVE-2026-8403</a></td>
</tr>

<td class=3D"vendor-product">Elastic--Elastic Defend</td>
<td>Incorrect Authorization (CWE-863) in Elastic Defend can lead to unautho= rized information disclosure via Accessing Functionality Not Properly Const= rained by ACLs (CAPEC-1). Under certain conditions, a low-privileged authen= ticated user can access response action data that they are not authorized t=
o view.</td>
<td>2026-07-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56152" target=3D= "_blank" rel=3D"noopener">CVE-2026-56152</a></td>
</tr>

<td class=3D"vendor-product">Elastic--Elasticsearch</td>
<td>Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead t=
o a denial of service via Excessive Allocation (CAPEC-130). An authenticate=
d user can submit a specially crafted bulk request that causes sustained hi=
gh CPU consumption, which can render the affected node unable to process re= quests.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49090" target=3D= "_blank" rel=3D"noopener">CVE-2026-49090</a></td>
</tr>

<td class=3D"vendor-product">Elastic--Elasticsearch</td>
<td>Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial =
of service via Excessive Allocation (CAPEC-130). An authenticated user can = submit a specially crafted query that causes excessive resource consumption=
while the request is processed, which may render the affected node unavail= able.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56148" target=3D= "_blank" rel=3D"noopener">CVE-2026-56148</a></td>
</tr>

<td class=3D"vendor-product">Elastic--Elasticsearch</td>
<td>Allocation of Resources Without Limits or Throttling (CWE-770) in Elast= icsearch can lead to a denial of service via Excessive Allocation (CAPEC-13= 0). A user with elevated privileges can submit a specially crafted machine = learning request that causes excessive memory consumption, which may render=
the affected node unavailable.</td>
<td>2026-07-01</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56149" target=3D= "_blank" rel=3D"noopener">CVE-2026-56149</a></td>
</tr>

<td class=3D"vendor-product">Elastic--Fleet Server</td>
<td>Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet=
Server can lead to a denial of service via Excessive Allocation (CAPEC-130=
). An attacker can submit a specially crafted request to an upload endpoint=
that causes excessive memory consumption, which may render Fleet Server un= available.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56150" target=3D= "_blank" rel=3D"noopener">CVE-2026-56150</a></td>
</tr>

<td class=3D"vendor-product">Elastic--Kibana</td>
<td>Allocation of Resources Without Limits or Throttling (CWE-770) in Kiban=
a can lead to a denial of service via Excessive Allocation (CAPEC-130). An = authenticated user can submit a specially crafted bulk deletion request tha=
t causes excessive resource consumption, which may render Kibana unavailabl= e.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49087" target=3D= "_blank" rel=3D"noopener">CVE-2026-49087</a></td>
</tr>

<td class=3D"vendor-product">Elastic--Kibana</td>
<td>Improper Input Validation (CWE-20) in Kibana can lead to a denial of se= rvice via Input Data Manipulation (CAPEC-153). An authenticated user can su= bmit a specially crafted Fleet policy input that is not correctly validated=
, which can render Fleet agent, server, and policy management functionality=
unavailable.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56151" target=3D= "_blank" rel=3D"noopener">CVE-2026-56151</a></td>
</tr>

<td class=3D"vendor-product">Elastic--Kibana</td>
<td>Insertion of Sensitive Information into Log File (CWE-532) in Kibana ca=
n lead to information disclosure. When the optional application performance=
monitoring (APM) instrumentation is enabled, sensitive request header valu=
es could be recorded in application logs, where they may be accessible to o= perators with log access.</td>
<td>2026-07-01</td>
<td>4.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49088" target=3D= "_blank" rel=3D"noopener">CVE-2026-49088</a></td>
</tr>

<td class=3D"vendor-product">engagementanalytics--Plugin for Google Analyti=
cs by IO technologies</td>
<td>The Plugin for Google Analytics by IO technologies plugin for WordPress=
is vulnerable to Cross-Site Request Forgery in versions up to, and includi= ng, 1.1. This is due to missing or incorrect nonce validation on the Google=
Analytics settings page (ga.php). This makes it possible for unauthenticat=
ed attackers to update the plugin's stored Google Analytics tracking ID opt= ion (io-ga-id) via a forged request granted they can trick a site administr= ator into performing an action such as clicking on a link.</td> <td>2026-06-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8944" target=3D"= _blank" rel=3D"noopener">CVE-2026-8944</a></td>
</tr>

<td class=3D"vendor-product">envothemes--Envo's Templates &amp; Widgets for=
Elementor and WooCommerce</td>
<td>The Envo's Templates &amp; Widgets for Elementor and WooCommerce plugin=
for WordPress is vulnerable to unauthorized access of data due to a missin=
g authorization check on the Envo Tabs (and Off Canvas) widget's template r= endering in versions up to, and including, 1.4.26. The render() method of t=
he Tabs widget passes a user-controlled template/post ID directly to Elemen= tor's get_builder_content_for_display() without verifying the referenced po= st's status (published/private/draft) or the visitor's authorization to vie=
w it. This makes it possible for authenticated attackers, with Author-level=
access and above, to disclose the contents of private Elementor-driven pag=
es and templates to anonymous visitors by configuring an Envo Tabs widget o=
n a public post to reference the private content's ID (which can be supplie=
d by editing the underlying Elementor widget JSON via the Elementor editor = REST API).</td>
<td>2026-07-02</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11600" target=3D= "_blank" rel=3D"noopener">CVE-2026-11600</a></td>
</tr>

<td class=3D"vendor-product">EstrellaXD--Auto_Bangumi</td>
<td>AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) = vulnerability that allows unauthenticated remote attackers to probe interna=
l network services by supplying arbitrary host values to an unprotected set=
up endpoint. Attackers can send requests to the POST /api/v1/setup/test-dow= nloader endpoint during the initial setup window, causing the server to iss=
ue HTTP GET requests to internal or reserved addresses and leak information=
through echoed connection-error messages.</td>
<td>2026-07-02</td>
<td>5.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59101" target=3D= "_blank" rel=3D"noopener">CVE-2026-59101</a></td>
</tr>

<td class=3D"vendor-product">expresstech--Quiz and Survey Master (QSM) Easy=
Quiz and Survey Maker</td>
<td>The Quiz and Survey Master (QSM) - Easy Quiz and Survey Maker plugin fo=
r WordPress is vulnerable to authorization bypass in all versions up to, an=
d including, 11.1.4. This is due to the plugin not properly verifying that =
a user is authorized to perform an action. This makes it possible for authe= nticated attackers, with contributor-level access and above, to modify quiz= zes they do not own, overwrite quiz results pages, and reroute quiz-result = notification emails to attacker-controlled addresses. An attacker first cal=
ls the /quiz/structure endpoint with an arbitrary victim quiz ID to obtain =
a valid nonce bound to that quiz ID and their own user ID, then presents th=
at nonce to the /quizzes/{id}/emails save endpoint, which accepts it withou=
t verifying quiz ownership.</td>
<td>2026-07-03</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9230" target=3D"= _blank" rel=3D"noopener">CVE-2026-9230</a></td>
</tr>

<td class=3D"vendor-product">Feehi--CMS</td>
<td>A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue =
is some unknown functionality of the file /api/users of the component API. = This manipulation causes improper access controls. The attack can be initia= ted remotely. The exploit has been published and may be used. The project w=
as informed of the problem early through an issue report but has not respon= ded yet.</td>
<td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13544" target=3D= "_blank" rel=3D"noopener">CVE-2026-13544</a></td>
</tr>

<td class=3D"vendor-product">figureone--Insert Pages</td>
<td>The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Sit=
e Scripting via post custom field keys (meta key names) in all versions up = to, and including, 3.11.4. This is due to insufficient output escaping in t=
he the_meta() function: while the custom field VALUE is sanitized with wp_k= ses_post(), the custom field KEY ($key) is interpolated into the rendered H= TML (lines 1786-1791) and echoed (line 1806) without any escaping when an i= nserted page is rendered with the [insert page=3D'ID' display=3D'all'] shor= tcode. This makes it possible for authenticated attackers, with author-leve=
l access and above, to inject arbitrary web scripts in pages that will exec= ute whenever a user accesses an injected page.</td>
<td>2026-07-02</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10089" target=3D= "_blank" rel=3D"noopener">CVE-2026-10089</a></td>
</tr>

<td class=3D"vendor-product">foliovision--FV Flowplayer Video Player</td> <td>The FV Flowplayer Video Player plugin for WordPress is vulnerable to St= ored Cross-Site Scripting via the 'video_player' shortcode 'align' attribut=
e in all versions up to, and including, 7.5.51.7212 due to insufficient inp=
ut sanitization and output escaping on user supplied attributes. This makes=
it possible for authenticated attackers, with contributor-level access and=
above, to inject arbitrary web scripts in pages that will execute whenever=
a user accesses an injected page.</td>
<td>2026-07-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12135" target=3D= "_blank" rel=3D"noopener">CVE-2026-12135</a></td>
</tr>

<td class=3D"vendor-product">forgejo--forgejo</td>
<td>Forgejo before 15.0.3 contains a stored cross-site scripting vulnerabil= ity that allows authenticated attackers to execute arbitrary JavaScript in = other users' browsers by setting a full name containing an HTML payload and=
triggering an Actions run. When the DEFAULT_SHOW_FULL_NAME option is enabl= ed, the run description is assembled server-side with the user's display na=
me interpolated into an HTML string via a translation function that does no=
t escape its arguments, and the frontend renders the result using a Vue v-h= tml binding, causing script execution for any user who views the affected A= ctions run page.</td>
<td>2026-07-02</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59102" target=3D= "_blank" rel=3D"noopener">CVE-2026-59102</a></td>
</tr>

<td class=3D"vendor-product">Fuelthemes--Werkstatt</td>
<td>Subscriber Broken Access Control in Werkstatt &lt;=3D 4.7.2 versions.</=

<td>2026-07-02</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57689" target=3D= "_blank" rel=3D"noopener">CVE-2026-57689</a></td>
</tr>

<td class=3D"vendor-product">Fuelthemes--Werkstatt</td>
<td>Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt &lt;=3D = 4.7.2 versions.</td>
<td>2026-07-02</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57690" target=3D= "_blank" rel=3D"noopener">CVE-2026-57690</a></td>
</tr>

<td class=3D"vendor-product">Gardyn--Gardyn Home Firmware</td>
<td>The admin panel lacks standard security headers, enabling clickjacking = and cross-site scripting attacks.</td>
<td>2026-07-02</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54477" target=3D= "_blank" rel=3D"noopener">CVE-2026-54477</a></td>
</tr>

<td class=3D"vendor-product">Gardyn--Gardyn Home Firmware</td>
<td>The Azure Blob Storage container used for Gardyn device logs is publicl=
y listable without authentication. A malicious user would be able to access=
any device log file available in the blob storage container.</td> <td>2026-07-02</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55726" target=3D= "_blank" rel=3D"noopener">CVE-2026-55726</a></td>
</tr>

<td class=3D"vendor-product">genua--genucenter</td>
<td>The genucenter web interface before version 8.0p11 unnecessarily expose=
s sensitive SNMP authentication and encryption keys in its HTTP responses t=
o users with the "Service" or "Admin" role.</td>
<td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13211" target=3D= "_blank" rel=3D"noopener">CVE-2026-13211</a></td>
</tr>

<td class=3D"vendor-product">GitBucket--GitBucket</td>
<td>A security flaw has been discovered in GitBucket up to 4.46.1. This aff= ects the function Git.cloneRepository.setURI of the file src/main/scala/git= bucket/core/service/RepositoryCreationService.scala. Performing a manipulat= ion of the argument url results in server-side request forgery. The attack =
is possible to be carried out remotely. The exploit has been released to th=
e public and may be used for attacks. The patch is named 487a9b980f56aa73b6= a044b1e86a92eed5043215. To fix this issue, it is recommended to deploy a pa= tch.</td>
<td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13540" target=3D= "_blank" rel=3D"noopener">CVE-2026-13540</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>SSRF via HTTP Redirect in Repository Migration</td>
<td>2026-07-03</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58418" target=3D= "_blank" rel=3D"noopener">CVE-2026-58418</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions up to and including 1.26.1 do not apply public-only toke=
n filtering consistently to the user organization API, leaving an incomplet=
e fix for CVE-2025-68941.</td>
<td>2026-07-03</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-25714" target=3D= "_blank" rel=3D"noopener">CVE-2026-25714</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions up to and including 1.26.2 allow repository RSS and Atom=
feed endpoints to bypass API access token scope checks, exposing private r= epository commit data to tokens without the required repository scope.</td> <td>2026-07-03</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27761" target=3D= "_blank" rel=3D"noopener">CVE-2026-27761</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions up to and including 1.26.1 do not enforce repository-uni=
t authorization on issue-template API endpoints.</td>
<td>2026-07-03</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27783" target=3D= "_blank" rel=3D"noopener">CVE-2026-27783</a></td>
</tr>

<td class=3D"vendor-product">GNOME--GLib</td>
<td>A flaw was found in GLib. An off-by-one error can occur in the gvs_tupl= e_is_normal function in the glib/gvariant-serialiser.c file when doing an a= lignment padding check because the bounds check uses &gt; instead of &gt;=
=3D, causing an out-of-bounds read of only 1 byte. This issue can cause a m= inor information disclosure of 1 byte and a denial of service when the out-= of-bounds read crosses a page boundary.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58010" target=3D= "_blank" rel=3D"noopener">CVE-2026-58010</a></td>
</tr>

<td class=3D"vendor-product">GNOME--GLib</td>
<td>A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occ=
ur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an=
invalid GDateTime object produced by the g_date_time_add_full function is = processed. This flaw can corrupt the date output and potentially cause logi=
c errors that may lead to a denial of service.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58011" target=3D= "_blank" rel=3D"noopener">CVE-2026-58011</a></td>
</tr>

<td class=3D"vendor-product">GNOME--GLib</td>
<td>A flaw was found in GLib. A buffer over-read can occur in the g_regex_r= eplace function when used with the `G_REGEX_RAW` compile flag and case-chan=
ge replacement escapes because the string_append function processes matched=
substrings using UTF-8 functions that assume valid UTF-8 input, even when = the string is treated as raw bytes. This vulnerability can cause a minor in= formation disclosure of 1-5 bytes and a denial of service when the buffer o= ver-read crosses a page boundary.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58012" target=3D= "_blank" rel=3D"noopener">CVE-2026-58012</a></td>
</tr>

<td class=3D"vendor-product">GNOME--GLib</td>
<td>A flaw was found in GLib. A buffer over-read can occur in g_io_channel_= read_line_backend() in the giochannel.c file when a custom line terminator = with a length greater than one is set, causing memcmp to read past the GStr= ing buffer. This vulnerability can cause a minor information disclosure of =
7 bytes or a denial of service when the buffer over-read crosses a page bou= ndary.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58013" target=3D= "_blank" rel=3D"noopener">CVE-2026-58013</a></td>
</tr>

<td class=3D"vendor-product">GNOME--GLib</td>
<td>A flaw was found in GLib. The D-Bus client-side implementation of the D= BUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_= context parameter received from the server. A malicious D-Bus server can su= pply a cookie_context containing path traversal sequences, causing the clie=
nt to read an arbitrary file and exfiltrate sensitive data by verifying gue= ssed file contents against a generated hash.</td>
<td>2026-06-30</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58015" target=3D= "_blank" rel=3D"noopener">CVE-2026-58015</a></td>
</tr>

<td class=3D"vendor-product">Gordon Bhme--Structured Content</td> <td>Contributor Cross Site Scripting (XSS) in Structured Content &lt;=3D 1.= 7.0 versions.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57763" target=3D= "_blank" rel=3D"noopener">CVE-2026-57763</a></td>
</tr>

<td class=3D"vendor-product">GotoHTTP--GotoHTTP</td>
<td>A vulnerability has been found in GotoHTTP up to 10.2. This issue affec=
ts some unknown processing of the file /reg.12x. The manipulation of the ar= gument sn leads to cross site scripting. The attack may be initiated remote= ly. The exploit has been disclosed to the public and may be used. The vendo=
r explains: "We immediately removed unnecessary parameter echo from source = code. However the URL in the issue description will never be used in browse=
r nor exposed to user, so it will not bring secure problem in fact. So we d= on't upgrade server right now, it will be included in next version together=
with other features."</td>
<td>2026-06-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13536" target=3D= "_blank" rel=3D"noopener">CVE-2026-13536</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system fails to sanitize the name GET parameter befor=
e outputting it into an HTML input value attribute in designer.php (line 57=
). An authenticated attacker can craft a URL containing script tags that ex= ecute in the victim's browser session.</td>
<td>2026-07-01</td>
<td>4.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34096" target=3D= "_blank" rel=3D"noopener">CVE-2026-34096</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system fails to sanitize the id GET parameter before = inserting it into multiple HTML form action attributes in text_file.php (li= nes 94, 101, 323, 403, 826, 852). An authenticated attacker can craft a URL=
that injects script tags executing in the victim's browser session.</td> <td>2026-07-01</td>
<td>4.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34097" target=3D= "_blank" rel=3D"noopener">CVE-2026-34097</a></td>
</tr>

<td class=3D"vendor-product">guardian--language-system</td>
<td>Guardian language-system fails to sanitize the id GET parameter before = inserting it into HTML source and form action attributes in media.php (line=
s 119, 129). An authenticated attacker can craft a URL that injects script = tags executing in the victim's browser session.</td>
<td>2026-07-01</td>
<td>4.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34098" target=3D= "_blank" rel=3D"noopener">CVE-2026-34098</a></td>
</tr>

<td class=3D"vendor-product">HashiCorp--Vault</td>
<td>HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device valida= tion logic did not consistently apply plugin directory protections when the=
legacy file audit path option was used. This vulnerability (CVE-2026-5051)=
is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.</td>
<td>2026-07-01</td>
<td>4.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5051" target=3D"= _blank" rel=3D"noopener">CVE-2026-5051</a></td>
</tr>

<td class=3D"vendor-product">HCLSoftware--HCL DevOps Deploy / HCL Launch</t=

<td>HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensiti=
ve information vulnerability in output logs. This exposure could allow an a= ttacker with access to the logs to potentially obtain sensitive values rela= ted to that step.</td>
<td>2026-06-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56457" target=3D= "_blank" rel=3D"noopener">CVE-2026-56457</a></td>
</tr>

<td class=3D"vendor-product">HiEventsDev--Hi.Events</td>
<td>Hi.Events through 1.9.0 public check-in list endpoints use short_id as = sole access control, allowing unauthenticated access to retrieve full atten= dee lists including emails and personal information. Attackers with knowled=
ge of the short_id can call GET /api/public/check-in-lists/{short_id}/atten= dees to read attendee data and create or delete check-in records without au= thentication.</td>
<td>2026-06-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57960" target=3D= "_blank" rel=3D"noopener">CVE-2026-57960</a></td>
</tr>

<td class=3D"vendor-product">HiEventsDev--Hi.Events</td>
<td>Hi.Events through 1.9.0 contains a promo code validation vulnerability = where reservation validates usage count before asynchronous UpdateEventStat= isticsJob increments it, allowing attackers to redeem limited promo codes u= nlimited times. Attackers can sequentially reserve multiple orders with the=
same restricted promo code, each reading order_usage_count=3D0 and passing=
validation, then complete them all at discounted prices without concurrent=
requests.</td>
<td>2026-06-29</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57959" target=3D= "_blank" rel=3D"noopener">CVE-2026-57959</a></td>
</tr>

<td class=3D"vendor-product">Hitachi--Hitachi Virtual Storage Platform 5100=
, 5200, 5500, 5600, 5100H, 5200H, 5500H, 5600H, VX8</td>
<td>Information exposure vulnerability in Hitachi Storage Navigator. This i= ssue affects Hitachi Virtual Storage Platform 5100, 5200, 5500, 5600, 5100H=
, 5200H, 5500H, 5600H, VX8: before DKCMAIN Ver. 90-09-24-00/00, SVP Ver. 90= -09-24/00, before DKCMAIN Ver. 90-08-86-00/00, SVP Ver. 90-08-86/00; Hitach=
i Virtual Storage Platform G1000, G1500, F1500, VX7: before DKCMAIN Ver. 80= -06-96-00/00, SVP Ver. 80-06-91/00.</td>
<td>2026-06-29</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-7386" target=3D"= _blank" rel=3D"noopener">CVE-2025-7386</a></td>
</tr>

<td class=3D"vendor-product">HKUDS--Vibe-Trading</td>
<td>Vibe-Trading before 0.1.10 contains a path traversal vulnerability that=
allows attackers to write files outside the intended memory root directory=
by supplying a malicious memory_type value containing path traversal seque= nces through the remember tool. Attackers can manipulate the memory_type pa= rameter in the persistent memory store to cause the application to write ar= bitrary Markdown files to unintended locations on the filesystem.</td> <td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58173" target=3D= "_blank" rel=3D"noopener">CVE-2026-58173</a></td>
</tr>

<td class=3D"vendor-product">HKUDS--Vibe-Trading</td>
<td>Vibe-Trading before 0.1.10 constructs the swarm run directory by joinin=
g a caller-supplied run identifier onto the runs base directory without val= idation in run_dir (agent/src/swarm/store.py). A crafted run identifier sup= plied through the MCP swarm tools causes the application to read arbitrary = run.json files outside the runs directory and to overwrite existing run.jso=
n files at traversed locations.</td>
<td>2026-06-30</td>
<td>4.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58171" target=3D= "_blank" rel=3D"noopener">CVE-2026-58171</a></td>
</tr>

<td class=3D"vendor-product">Hono--Hono</td>
<td>Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middle= ware: when the origin is not set to "*", the middleware copies the Vary hea= der from the incoming request into the response. Because Vary is a response=
header that should be managed by the server, an attacker can supply arbitr= ary Vary values that are reflected into the response, potentially causing c= ache key pollution and inconsistent CORS enforcement in environments that r= ely on shared caches or proxies.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71381" target=3D= "_blank" rel=3D"noopener">CVE-2025-71381</a></td>
</tr>

<td class=3D"vendor-product">horde--imp</td>
<td>Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/C= ompose.php that allows authenticated attackers to read arbitrary files from=
the server filesystem by embedding traversal sequences after a CKEditor pa=
th prefix in img src URLs. Attackers can bypass the stripos() prefix valida= tion by appending sequences such as traversal segments after the matching p= refix, causing file_get_contents() to read sensitive files whose contents a=
re then exfiltrated as MIME parts in outgoing email; unauthenticated exploi= tation is also achievable via CSRF against an active authenticated session.= </td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58451" target=3D= "_blank" rel=3D"noopener">CVE-2026-58451</a></td>
</tr>

<td class=3D"vendor-product">IBM--App Connect Enterprise</td>
<td>IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 thro= ugh 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 i=
s vulnerable to SQL injection. A remote attacker could socially engineer a = user into accidentally creating files they may not be aware of.</td> <td>2026-06-30</td>
<td>4.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-3602" target=3D"= _blank" rel=3D"noopener">CVE-2026-3602</a></td>
</tr>

<td class=3D"vendor-product">IBM--Db2</td>
<td>IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNI=
X and Windows (includes Db2 Connect Server) could allow an=C2=A0authenticat=
ed user to cause a denial of service due to improper neutralization of spec= ial=C2=A0elements in the data query logic of XMLTable-derived columns.</td> <td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11906" target=3D= "_blank" rel=3D"noopener">CVE-2026-11906</a></td>
</tr>

<td class=3D"vendor-product">IBM--Db2</td>
<td>IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNI=
X and Windows (includes Db2 Connect Server) could disclose sensitive inform= ation to an authenticated user from the monitoring and event tables.</td> <td>2026-06-30</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36372" target=3D= "_blank" rel=3D"noopener">CVE-2025-36372</a></td>
</tr>

<td class=3D"vendor-product">IBM--UCD - IBM DevOps Deploy</td>
<td>IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.=
0 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker t=
o carry out privileged actions and retrieve sensitive information as the do= main name is not being limited to only trusted domains.</td> <td>2026-06-30</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12084" target=3D= "_blank" rel=3D"noopener">CVE-2026-12084</a></td>
</tr>

<td class=3D"vendor-product">IBM--UCD - IBM UrbanCode Deploy</td>
<td>IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM D= evOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2= .1.0 IBM DevOps Deploy could disclose sensitive configurations and secrets =
to authenticated users in API responses that could be used in further attac=
ks against the system.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12085" target=3D= "_blank" rel=3D"noopener">CVE-2026-12085</a></td>
</tr>

<td class=3D"vendor-product">IBM--UCD - IBM UrbanCode Deploy</td>
<td>IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.= 3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.= 1.2.6, and 8.2 through 8.2.1.0 stores potentially sensitive information in = log files that could be read by a local user.</td>
<td>2026-06-30</td>
<td>6.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12086" target=3D= "_blank" rel=3D"noopener">CVE-2026-12086</a></td>
</tr>

<td class=3D"vendor-product">IBM--watsonx.data intelligence</td>
<td>IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable =
to stored cross-site scripting. This vulnerability allows an authenticated = user to embed arbitrary JavaScript code in the Web UI thus altering the int= ended functionality potentially leading to credentials disclosure within a = trusted session.</td>
<td>2026-06-30</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36320" target=3D= "_blank" rel=3D"noopener">CVE-2025-36320</a></td>
</tr>

<td class=3D"vendor-product">IBM--watsonx.data intelligence</td>
<td>IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an=
authenticated user to bypass security controls and perform unauthorized ac= tions due to client-side enforcement of sever-side security.</td> <td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36327" target=3D= "_blank" rel=3D"noopener">CVE-2025-36327</a></td>
</tr>

<td class=3D"vendor-product">IBM--watsonx.data intelligence</td>
<td>IBM watsonx.data intelligence 5.2.2, 5.3.0, 5.3.1, 5.3.1 through patch-=
1 transmits data in clear text that could allow an attacker to obtain sensi= tive information using man in the middle techniques.</td>
<td>2026-06-30</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-12530" target=3D= "_blank" rel=3D"noopener">CVE-2025-12530</a></td>
</tr>

<td class=3D"vendor-product">IBM--watsonx.data intelligence</td>
<td>IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable =
to HTML injection. A remote attacker could inject malicious HTML code, whic=
h when viewed, would be executed in the victim's Web browser within the sec= urity context of the hosting site.</td>
<td>2026-06-30</td>
<td>5.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36321" target=3D= "_blank" rel=3D"noopener">CVE-2025-36321</a></td>
</tr>

<td class=3D"vendor-product">IBM--watsonx.data intelligence</td>
<td>IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable =
to cross-site scripting. This vulnerability allows an authenticated user to=
embed arbitrary JavaScript code in the Web UI thus altering the intended f= unctionality potentially leading to credentials disclosure within a trusted=
session.</td>
<td>2026-06-30</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36323" target=3D= "_blank" rel=3D"noopener">CVE-2025-36323</a></td>
</tr>

<td class=3D"vendor-product">IBM--watsonx.data intelligence</td>
<td>IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 transmits data=
in clear text that could allow an attacker to obtain sensitive information=
using man in the middle techniques.</td>
<td>2026-06-30</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36336" target=3D= "_blank" rel=3D"noopener">CVE-2025-36336</a></td>
</tr>

<td class=3D"vendor-product">IBM--watsonx.data intelligence</td>
<td>IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an=
authenticated user to cause a temporary denial using a specially crafted H= TTP request due to improper allocation of resource throttling.</td> <td>2026-06-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36319" target=3D= "_blank" rel=3D"noopener">CVE-2025-36319</a></td>
</tr>

<td class=3D"vendor-product">IBM--watsonx.data intelligence</td>
<td>IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 s vulnerable t=
o server-side request forgery (SSRF). This may allow an authenticated attac= ker to send unauthorized requests from the system, potentially leading to n= etwork enumeration or facilitating other attacks.</td>
<td>2026-06-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36324" target=3D= "_blank" rel=3D"noopener">CVE-2025-36324</a></td>
</tr>

<td class=3D"vendor-product">IBM--watsonx.data intelligence</td>
<td>IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a = remote attacker to obtain sensitive information when a detailed technical e= rror message is returned in the browser.=C2=A0 This information could be us=
ed in further attacks against the system.</td>
<td>2026-06-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36328" target=3D= "_blank" rel=3D"noopener">CVE-2025-36328</a></td>
</tr>

<td class=3D"vendor-product">IBM--watsonx.data intelligence</td>
<td>IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an=
authenticated user to perform unauthorized actions due to the improper enf= orcement of behavioral workflow.</td>
<td>2026-06-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36333" target=3D= "_blank" rel=3D"noopener">CVE-2025-36333</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 could allow a remote atta= cker to obtain sensitive information from the administrative console's inte= grated help system.</td>
<td>2026-06-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11595" target=3D= "_blank" rel=3D"noopener">CVE-2026-11595</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Extreme Scale</td>
<td>IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 ge= nerated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call O= RB.string_to_object() on an attacker-controlled IOR string during Java dese= rialization, turning any unfiltered ObjectInputStream sink in WAS into outb= ound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's = getUserException class-instantiation flaw (WAS-26), this SSRF escalates to = remote code execution on the calling JVM.</td>
<td>2026-06-30</td>
<td>6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13773" target=3D= "_blank" rel=3D"noopener">CVE-2026-13773</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Extreme Scale</td>
<td>IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could allow an adja= cent attacker to cause a denial of service due to improper validation in th=
e XDF decoder. The application processes deeply nested Protocol Buffers mes= sages and attacker-controlled length prefixes without sufficient bounds che= cking, which may allow an attacker on the same network to trigger a StackOv= erflowError or OutOfMemoryError, resulting in a crash of the WebSphere Appl= ication Server JVM.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9002" target=3D"= _blank" rel=3D"noopener">CVE-2026-9002</a></td>
</tr>

<td class=3D"vendor-product">icegram--Email Subscribers &amp; Newsletters E= mail Marketing, Post Notifications &amp; Newsletter Plugin for WordPress</t=

<td>The Email Subscribers &amp; Newsletters - Email Marketing, Post Notific= ations &amp; Newsletter Plugin for WordPress plugin for WordPress is vulner= able to authorization bypass in all versions up to, and including, 5.9.27. = This is due to the plugin not properly verifying that a user is authorized =
to perform an action. This makes it possible for authenticated attackers, w= ith contributor-level access and above, to overwrite plugin mail settings (= from name and from email address), create audience lists, insert arbitrary = contacts into those lists, create and overwrite newsletter broadcasts and p= ost notifications, add workflows, and queue and dispatch mass email to arbi= trary recipients.</td>
<td>2026-07-02</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11592" target=3D= "_blank" rel=3D"noopener">CVE-2026-11592</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick is free and open-source software used for editing and manip= ulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an intege=
r overflow in the XCF decoder can result in an out of bounds read when a cr= afted image is read, potentially resulting in a crash. This issue has been = fixed in versions 6.9.13-51 and 7.1.2-26.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53466" target=3D= "_blank" rel=3D"noopener">CVE-2026-53466</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick is free and open-source software used for editing and manip= ulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG d= ecoder contains a possible heap information disclosure vulnerability becaus=
e part of the pixels are left unchanged. This issue has been fixed in versi= ons 6.9.13-51 and 7.1.2-26.</td>
<td>2026-07-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53467" target=3D= "_blank" rel=3D"noopener">CVE-2026-53467</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick is free and open-source software used for editing and manip= ulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when iden= tifying an image with a crafted 8BIM profile with a specific format string =
a use-after-free will occur. This issue has been fixed in versions 6.9.13-5=
1 and 7.1.2-26.</td>
<td>2026-07-01</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55510" target=3D= "_blank" rel=3D"noopener">CVE-2026-55510</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick is free and open-source software used for editing and manip= ulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap bu= ffer overflow occurs in the MVG decoder that could result in an out of boun=
ds write when processing a crafted image. This issue has been fixed in vers= ions 6.9.13-51 and 7.1.2-26.</td>
<td>2026-07-01</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55577" target=3D= "_blank" rel=3D"noopener">CVE-2026-55577</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick is free and open-source software used for editing and manip= ulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing=
depth check in the MVG decoder will result in a stack overflow when a craf= ted image is provided. This issue has been fixed in versions 6.9.13-51 and = 7.1.2-26.</td>
<td>2026-07-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55594" target=3D= "_blank" rel=3D"noopener">CVE-2026-55594</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick is free and open-source software used for editing and manip= ulating digital images. Prior to version 7.1.2-26, an incorrect handling of=
arguments can cause a heap buffer over-write in the JP2 encoder. This issu=
e has been fixed in version7.1.2-26.</td>
<td>2026-07-01</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55597" target=3D= "_blank" rel=3D"noopener">CVE-2026-55597</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>In versions prior to 7.1.2-26he, the `-concatenate` operation is missin=
g policy checks, potentially resulting in both reading and writing to paths=
disallowed by the security policy. This issue has been fixed in version 7.= 1.2-26.</td>
<td>2026-07-01</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55628" target=3D= "_blank" rel=3D"noopener">CVE-2026-55628</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick is free and open-source software used for editing and manip= ulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when prov= iding invalid arguments to the connected-components option an infinite loop=
will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.<=

<td>2026-07-01</td>
<td>4.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55595" target=3D= "_blank" rel=3D"noopener">CVE-2026-55595</a></td>
</tr>

<td class=3D"vendor-product">infiniflow--ragflow</td>
<td>RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without = sanitization: the agent update endpoint normalizes the submitted DSL via no= rmalize_dsl, which only performs JSON serialization validation and preserve=
s the node name verbatim. The dataflow-result web UI then renders that name=
into the "Rerun from current step" confirmation modal via dangerouslySetIn= nerHTML, and the i18next configuration sets escapeValue:false, so the value=
is inserted into the DOM without HTML encoding. An authenticated workspace=
user who can create or edit an agent can inject arbitrary JavaScript that = executes in the session of another workspace member who opens the dataflow = result and clicks rerun, enabling session/token theft and account takeover = across the user trust boundary.</td>
<td>2026-07-02</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58579" target=3D= "_blank" rel=3D"noopener">CVE-2026-58579</a></td>
</tr>

<td class=3D"vendor-product">inovector--mixpost</td>
<td>Mixpost through 2.6.0 contains a reflected cross-site scripting vulnera= bility that allows unauthenticated attackers to execute arbitrary JavaScrip=
t in authenticated users' browsers by crafting malicious OAuth callback URL=
s with unsanitized error query parameters. Attackers can exploit the OAuth = callback controller's failure to sanitize error parameters before rendering=
them through Laravel flash messages via the Vue v-html directive to hijack=
authenticated user sessions or perform unauthorized actions.</td> <td>2026-06-29</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57958" target=3D= "_blank" rel=3D"noopener">CVE-2026-57958</a></td>
</tr>

<td class=3D"vendor-product">Investintech--SlimPDFReader</td>
<td>A security flaw has been discovered in Investintech SlimPDFReader up to=
2.0.14. Affected by this issue is the function SlimPDFReader!Investintech:= :PCV::TeighaDo+0x25cde0 of the file SlimPDFReader.exe of the component PDF = File Handler. Performing a manipulation results in out-of-bounds read. It i=
s possible to initiate the attack remotely. This vulnerability only affects=
products that are no longer supported by the maintainer.</td> <td>2026-06-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13522" target=3D= "_blank" rel=3D"noopener">CVE-2026-13522</a></td>
</tr>

<td class=3D"vendor-product">invoiceninja--invoiceninja</td>
<td>Invoice Ninja through 5.13.26 contains an open redirect vulnerability i=
n the client portal login that allows unauthenticated attackers to redirect=
authenticated victims to attacker-controlled external URLs by injecting a = malicious value into the intended query parameter. Attackers can craft a cl= ient login link with an external URL in the intended parameter, which is st= ored in the session without host validation and emitted verbatim via a bare=
redirect in the ContactLoginController authenticated() handler after the v= ictim completes a legitimate login, enabling phishing attacks.</td> <td>2026-06-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58450" target=3D= "_blank" rel=3D"noopener">CVE-2026-58450</a></td>
</tr>

<td class=3D"vendor-product">its-a-feature--Mythic</td>
<td>Mythic before 3.4.0.60 contains a broken hasura permission filter on th=
e payload_build_step table with an always-satisfied _or condition that bypa= sses operation-scoped access controls. Authenticated operators and spectato=
rs can query payload_build_step to read step_stdout, step_stderr, step_name=
, and step_description across all operations on the server.</td> <td>2026-06-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57951" target=3D= "_blank" rel=3D"noopener">CVE-2026-57951</a></td>
</tr>

<td class=3D"vendor-product">its-a-feature--Mythic</td>
<td>Mythic before 3.4.0.60 contains an authorization bypass vulnerability i=
n four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_r= ules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) = that fail to verify payload ownership. An operator in one operation can inv= oke these endpoints with a known payload UUID from another operation to acc= ess that operation's C2 profile configuration including encryption keys and=
callback parameters.</td>
<td>2026-06-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57952" target=3D= "_blank" rel=3D"noopener">CVE-2026-57952</a></td>
</tr>

<td class=3D"vendor-product">its-a-feature--Mythic</td>
<td>Mythic before 3.4.0.60 contains an authorization bypass vulnerability t= hat allows authenticated spectator-role users to perform unauthorized write=
operations by accessing the eventing_import_automatic_webhook endpoint reg= istered under spectator-permitted middleware. Attackers with spectator role=
can exploit this misconfigured access control to create and delete automat= ion workflows, making unauthorized modifications to operation automation co= nfiguration and EventGroups.</td>
<td>2026-06-29</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57953" target=3D= "_blank" rel=3D"noopener">CVE-2026-57953</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A vulnerability was determined in itsourcecode Hospital Management Syst=
em 1.0. Affected is an unknown function of the file /appointmentapproval.ph=
p of the component Appointment Handler. This manipulation of the argument e= ditid causes sql injection. The attack is possible to be carried out remote= ly. The exploit has been publicly disclosed and may be utilized.</td> <td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13520" target=3D= "_blank" rel=3D"noopener">CVE-2026-13520</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A vulnerability was identified in itsourcecode Hospital Management Syst=
em 1.0. This impacts an unknown function of the file /appointmentdetail.php=
of the component Appointment Handler. The manipulation of the argument edi= tid leads to sql injection. The attack is possible to be carried out remote= ly. The exploit is publicly available and might be used.</td> <td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13530" target=3D= "_blank" rel=3D"noopener">CVE-2026-13530</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A security flaw has been discovered in itsourcecode Hospital Management=
System 1.0. Affected is an unknown function of the file /department.php. T=
he manipulation of the argument editid results in sql injection. The attack=
may be performed from remote. The exploit has been released to the public = and may be used for attacks.</td>
<td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13531" target=3D= "_blank" rel=3D"noopener">CVE-2026-13531</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A weakness has been identified in itsourcecode Hospital Management Syst=
em 1.0. Affected by this vulnerability is an unknown functionality of the f= ile /departmentDoctor.php. This manipulation of the argument deptid causes = sql injection. It is possible to initiate the attack remotely. The exploit = has been made available to the public and could be used for attacks.</td> <td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13532" target=3D= "_blank" rel=3D"noopener">CVE-2026-13532</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A weakness has been identified in itsourcecode Hospital Management Syst=
em 1.0. This impacts an unknown function of the file /doctorchangepassword.= php. Executing a manipulation of the argument newpassword can lead to sql i= njection. The attack may be performed from remote. The exploit has been mad=
e available to the public and could be used for attacks.</td> <td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13541" target=3D= "_blank" rel=3D"noopener">CVE-2026-13541</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A security vulnerability has been detected in itsourcecode Hospital Man= agement System 1.0. Affected is an unknown function of the file /doctorprof= ile.php. The manipulation of the argument doctorname leads to sql injection=
. It is possible to initiate the attack remotely. The exploit has been disc= losed publicly and may be used.</td>
<td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13542" target=3D= "_blank" rel=3D"noopener">CVE-2026-13542</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A vulnerability was identified in itsourcecode Hospital Management Syst=
em 1.0. Impacted is an unknown function of the file /doctortimings.php. The=
manipulation of the argument editid leads to sql injection. Remote exploit= ation of the attack is possible. The exploit is publicly available and migh=
t be used.</td>
<td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13548" target=3D= "_blank" rel=3D"noopener">CVE-2026-13548</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A vulnerability has been found in itsourcecode Hospital Management Syst=
em 1.0. The impacted element is an unknown function of the file /insertbill= ingrecord.php. The manipulation of the argument patientid leads to sql inje= ction. It is possible to initiate the attack remotely. The exploit has been=
disclosed to the public and may be used.</td>
<td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13572" target=3D= "_blank" rel=3D"noopener">CVE-2026-13572</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A security flaw has been discovered in itsourcecode Hospital Management=
System 1.0. Affected by this vulnerability is an unknown functionality of = the file /patientdetail.php. Performing a manipulation of the argument edit=
id results in sql injection. The attack may be initiated remotely. The expl= oit has been released to the public and may be used for attacks.</td> <td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13578" target=3D= "_blank" rel=3D"noopener">CVE-2026-13578</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A weakness has been identified in itsourcecode Hospital Management Syst=
em 1.0. Affected by this issue is some unknown functionality of the file /p= atientchangepassword.php. Executing a manipulation of the argument newpassw= ord can lead to sql injection. The attack may be launched remotely. The exp= loit has been made available to the public and could be used for attacks.</=

<td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13579" target=3D= "_blank" rel=3D"noopener">CVE-2026-13579</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A flaw has been found in itsourcecode Hospital Management System 1.0. A= ffected by this issue is some unknown functionality of the file /medicine.p= hp. This manipulation of the argument editid causes sql injection. Remote e= xploitation of the attack is possible. The exploit has been published and m=
ay be used.</td>
<td>2026-07-04</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14619" target=3D= "_blank" rel=3D"noopener">CVE-2026-14619</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A flaw has been found in itsourcecode Hospital Management System 1.0. T= his affects an unknown function of the file /patient.php. This manipulation=
of the argument editid causes sql injection. The attack may be initiated r= emotely. The exploit has been published and may be used.</td> <td>2026-07-04</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14638" target=3D= "_blank" rel=3D"noopener">CVE-2026-14638</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A vulnerability has been found in itsourcecode Hospital Management Syst=
em 1.0. Impacted is an unknown function of the file /patientappointment.php=
. Such manipulation of the argument patiente leads to sql injection. The at= tack can be launched remotely. The exploit has been disclosed to the public=
and may be used.</td>
<td>2026-07-04</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14659" target=3D= "_blank" rel=3D"noopener">CVE-2026-14659</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A vulnerability has been found in itsourcecode Hospital Management Syst=
em 1.0. Affected is an unknown function of the file /patientorder.php. Such=
manipulation of the argument editid leads to sql injection. The attack may=
be performed from remote. The exploit has been disclosed to the public and=
may be used.</td>
<td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14703" target=3D= "_blank" rel=3D"noopener">CVE-2026-14703</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A vulnerability was detected in itsourcecode Hospital Management System=
1.0. The affected element is an unknown function of the file /patientlogin= .php. Performing a manipulation of the argument loginid results in sql inje= ction. Remote exploitation of the attack is possible. The exploit is now pu= blic and may be used.</td>
<td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14717" target=3D= "_blank" rel=3D"noopener">CVE-2026-14717</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A security flaw has been discovered in itsourcecode Hospital Management=
System 1.0. Affected by this issue is some unknown functionality of the fi=
le /patientprofile.php. Performing a manipulation of the argument patientna=
me results in sql injection. The attack can be initiated remotely. The expl= oit has been released to the public and may be used for attacks.</td> <td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14730" target=3D= "_blank" rel=3D"noopener">CVE-2026-14730</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A weakness has been identified in itsourcecode Hospital Management Syst=
em 1.0. This affects an unknown part of the file /patientreport.php. Execut= ing a manipulation of the argument editid can lead to sql injection. The at= tack can be launched remotely. The exploit has been made available to the p= ublic and could be used for attacks.</td>
<td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14731" target=3D= "_blank" rel=3D"noopener">CVE-2026-14731</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A vulnerability was found in itsourcecode Hospital Management System 1.=
0. This affects an unknown function of the file /payment.php. The manipulat= ion of the argument patientid results in sql injection. The attack can be l= aunched remotely. The exploit has been made public and could be used.</td> <td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14773" target=3D= "_blank" rel=3D"noopener">CVE-2026-14773</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Hospital Management System</td> <td>A vulnerability was determined in itsourcecode Hospital Management Syst=
em 1.0. This impacts an unknown function of the file /paymentdischarge.php.=
This manipulation of the argument patientid causes sql injection. The atta=
ck may be initiated remotely. The exploit has been publicly disclosed and m=
ay be utilized.</td>
<td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14774" target=3D= "_blank" rel=3D"noopener">CVE-2026-14774</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Online Hotel Management System</=

<td>A vulnerability has been found in itsourcecode Online Hotel Management = System 1.0. Affected by this vulnerability is an unknown functionality of t=
he file /admin/mod_amenities/controller.php?action=3Dadd of the component P= OST Request Handler. The manipulation of the argument Name leads to cross s= ite scripting. The attack can be initiated remotely. The exploit has been d= isclosed to the public and may be used.</td>
<td>2026-06-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13554" target=3D= "_blank" rel=3D"noopener">CVE-2026-13554</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Online Hotel Management System</=

<td>A vulnerability was determined in itsourcecode Online Hotel Management = System 1.0. This affects an unknown part of the file /admin/mod_users/contr= oller.php?action=3Dedit of the component POST Request Handler. This manipul= ation of the argument Name causes cross site scripting. The attack may be i= nitiated remotely. The exploit has been publicly disclosed and may be utili= zed.</td>
<td>2026-06-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13556" target=3D= "_blank" rel=3D"noopener">CVE-2026-13556</a></td>
</tr>

<td class=3D"vendor-product">itsourcecode--Online Hotel Management System</=

<td>A vulnerability was identified in itsourcecode Online Hotel Management = System 1.0. This vulnerability affects unknown code of the file /admin/mod_= room/controller.php?action=3Dadd of the component POST Request Handler. Suc=
h manipulation of the argument Name leads to cross site scripting. The atta=
ck may be launched remotely. The exploit is publicly available and might be=
used.</td>
<td>2026-06-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13557" target=3D= "_blank" rel=3D"noopener">CVE-2026-13557</a></td>
</tr>

<td class=3D"vendor-product">iv-org--Invidious</td>
<td>Invidious through 2.20260626.0, fixed in commit 77ad416, contains a bro= ken object level authorization vulnerability that allows authenticated atta= ckers to delete videos from other users' playlists by supplying an arbitrar=
y global video index in the remove_video action of the playlist endpoint. A= ttackers can obtain per-video index values from the public playlist JSON AP=
I and submit them to the playlist video deletion endpoint without ownership=
validation, permanently removing videos from playlists they do not own.</t=

<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58447" target=3D= "_blank" rel=3D"noopener">CVE-2026-58447</a></td>
</tr>

<td class=3D"vendor-product">jetmonsters--Hotel Booking Lite</td> <td>Subscriber Sensitive Data Exposure in Hotel Booking Lite &lt;=3D 6.0.3 = versions.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57347" target=3D= "_blank" rel=3D"noopener">CVE-2026-57347</a></td>
</tr>

<td class=3D"vendor-product">jetmonsters--JetFormBuilder Dynamic Blocks For=
m Builder</td>
<td>The JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress i=
s vulnerable to authorization bypass in all versions up to, and including, = 3.6.3. This is due to the plugin not properly verifying that a user is auth= orized to perform an action. This makes it possible for unauthenticated att= ackers to retrieve every distinct value stored under any arbitrary wp_postm= eta key on the site - including WooCommerce billing PII such as _billing_em= ail, _billing_phone, and _billing_address fields, order totals, attachment = paths, and any third-party plugin credentials or tokens stored in post meta=
- provided at least one published JetFormBuilder form with a get_from_db g= enerator field exists on the site. Exploitation requires that the target si=
te has at least one published jet-form-builder post containing a field whos=
e generator_function is set to get_from_db; an attacker must supply a match= ing form ID, field name, and generator ID in the request, but all of these = can be discovered by browsing the site's public forms.</td>
<td>2026-07-02</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13459" target=3D= "_blank" rel=3D"noopener">CVE-2026-13459</a></td>
</tr>

<td class=3D"vendor-product">jetmonsters--JetWidgets For Elementor</td>
<td>The JetWidgets For Elementor plugin for WordPress is vulnerable to Stor=
ed Cross-Site Scripting in versions up to and including 1.0.21. This is due=
to insufficient output escaping and missing server-side validation of the = Animated Box widget's animation_effect setting before it is rendered inside=
an HTML class attribute. This makes it possible for authenticated attacker=
s, with author-level access and above, to inject arbitrary web scripts in p= ages that will execute whenever a user accesses an injected page.</td> <td>2026-07-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11380" target=3D= "_blank" rel=3D"noopener">CVE-2026-11380</a></td>
</tr>

<td class=3D"vendor-product">jetmonsters--MotoPress Appointment Booking</td=

<td>The MotoPress Appointment Booking plugin for WordPress is vulnerable to=
generic SQL Injection via the 's' parameter in all versions up to, and inc= luding, 2.4.5 due to insufficient escaping on the user supplied parameter a=
nd lack of sufficient preparation on the existing SQL query. This makes it = possible for authenticated attackers, with custom-level access and above, t=
o append additional SQL queries into already existing queries that can be u= sed to extract sensitive information from the database. Exploitation requir=
es the mpa_appointment_employee custom role, meaning any user assigned this=
role can perform the attack.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13454" target=3D= "_blank" rel=3D"noopener">CVE-2026-13454</a></td>
</tr>

<td class=3D"vendor-product">jetmonsters--MotoPress Appointment Booking</td=

<td>The MotoPress Appointment Booking plugin for WordPress is vulnerable to=
Authorization Bypass Through User-Controlled Key in all versions up to, an=
d including, 2.4.4. This is due to the `POST /motopress/appointment/v1/book= ings` REST endpoint being registered with `'permission_callback' =3D&gt; '_= _return_true'`, allowing unauthenticated access, while the `createBooking` = handler in `BookingsRestController.php` accepts an attacker-supplied `payme= nt_details.booking_id` value and loads the referenced booking via `findById= ()` without verifying that the caller owns or has any rights to that bookin=
g. This makes it possible for unauthenticated attackers to overwrite the cu= stomer name, email address, phone number, and `customer_id` of any non-conf= irmed victim booking by submitting a request with no reservation items, cau= sing `BookingService::createBooking()` to load the existing victim booking = object and persist it with attacker-controlled customer data. Victim bookin=
g IDs can be harvested prior to exploitation without authentication by quer= ying the also-publicly-accessible `GET /motopress/appointment/v1/bookings/r= eservations` endpoint with a guessable `service_id` and date range, and onl=
y bookings whose status is not `STATUS_CONFIRMED` (e.g., pending or auto-dr= aft) are valid targets.</td>
<td>2026-07-03</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9180" target=3D"= _blank" rel=3D"noopener">CVE-2026-9180</a></td>
</tr>

<td class=3D"vendor-product">jgwhite33--WP Google Review Slider</td>
<td>The Wp Google Places Review Slider plugin for WordPress is vulnerable t=
o Reflected Cross-Site Scripting via the 'place' parameter in versions up t=
o, and including, 18.1. This is due to insufficient input sanitization and = output escaping in admin/partials/googlecrawl_dfs.php, where the $_GET['pla= ce'] value is URL-decoded, stripslashes()'d, and echoed directly into an HT=
ML value attribute with no esc_attr() call when the supplied place is not a= lready a stored key in the wprev_google_crawls option. This makes it possib=
le for unauthenticated attackers to inject arbitrary web scripts in pages t= hat execute if they can successfully trick a user into performing an action=
such as clicking on a specially crafted link.</td>
<td>2026-07-01</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13015" target=3D= "_blank" rel=3D"noopener">CVE-2026-13015</a></td>
</tr>

<td class=3D"vendor-product">joedolson--My Calendar Accessible Event Manage= r</td>
<td>The My Calendar - Accessible Event Manager plugin for WordPress is vuln= erable to Insecure Direct Object Reference in all versions up to, and inclu= ding, 3.7.14 via the 'vcal' parameter due to missing validation on a user c= ontrolled key. This makes it possible for unauthenticated attackers to enum= erate occurrence IDs and access the full iCalendar export of non-public, dr= aft, trashed, and personal calendar events, disclosing sensitive event meta= data including titles, descriptions, dates, locations, organizer and host d= etails, permalinks, and related calendar metadata.</td>
<td>2026-07-02</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11896" target=3D= "_blank" rel=3D"noopener">CVE-2026-11896</a></td>
</tr>

<td class=3D"vendor-product">Keksdieb--ez Form Calculator Premium</td> <td>Unauthenticated Broken Access Control in ez Form Calculator Premium &lt= ;=3D 2.14.1.2 versions.</td>
<td>2026-07-02</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57750" target=3D= "_blank" rel=3D"noopener">CVE-2026-57750</a></td>
</tr>

<td class=3D"vendor-product">kirilkirkov--Ecommerce-CodeIgniter-Bootstrap</=

<td>A weakness has been identified in kirilkirkov Ecommerce-CodeIgniter-Boo= tstrap up to 23105f25dadf57b4314fc015a63a7c6e910c89df. Impacted is the func= tion do_upload_others_images of the file application/modules/vendor/control= lers/AddProduct.php of the component Vendor Image Manager. Executing a mani= pulation of the argument folder can lead to path traversal. It is possible =
to launch the attack remotely. This product takes the approach of rolling r= eleases to provide continious delivery. Therefore, version details for affe= cted and updated releases are not available. This patch is called de1c9e73c= cf3bd032d9a0525c4752290d959dd8b. It is best practice to apply a patch to re= solve this issue.</td>
<td>2026-07-04</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14636" target=3D= "_blank" rel=3D"noopener">CVE-2026-14636</a></td>
</tr>

<td class=3D"vendor-product">kirilkirkov--Ecommerce-CodeIgniter-Bootstrap</=

<td>A vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstra=
p up to 95dfa8cebbb87ab46ae450643a07241274a74dce. Affected by this issue is=
the function setReferrer of the file application/core/MY_Controller.php of=
the component Trusted Backend Interface. The manipulation of the argument = href results in open redirect. The attack can be executed remotely. The exp= loit has been made public and could be used. This product implements a roll= ing release for ongoing delivery, which means version information for affec= ted or updated releases is unavailable. The patch is identified as 213babdb= aa949e94557246414db0130e01394517. A patch should be applied to remediate th=
is issue.</td>
<td>2026-07-04</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14632" target=3D= "_blank" rel=3D"noopener">CVE-2026-14632</a></td>
</tr>

<td class=3D"vendor-product">kirilkirkov--Ecommerce-CodeIgniter-Bootstrap</=

<td>A vulnerability was determined in kirilkirkov Ecommerce-CodeIgniter-Boo= tstrap up to 49b20f53de2b7ec34e920b11c863f1491d911a04. This affects an unkn= own part of the file /index.php/api/product/set of the component Hidden RES=
T API Endpoint. This manipulation of the argument title/description causes = cross site scripting. The attack is possible to be carried out remotely. Th=
e exploit has been publicly disclosed and may be utilized. This product ado= pts a rolling release strategy to maintain continuous delivery. Therefore, = version details for affected or updated releases cannot be specified. Patch=
name: d9785f995da77bdc62fb2d34bad5f7a162c9ad23. To fix this issue, it is r= ecommended to deploy a patch.</td>
<td>2026-07-04</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14633" target=3D= "_blank" rel=3D"noopener">CVE-2026-14633</a></td>
</tr>

<td class=3D"vendor-product">kirilkirkov--Ecommerce-CodeIgniter-Bootstrap</=

<td>A vulnerability was identified in kirilkirkov Ecommerce-CodeIgniter-Boo= tstrap up to 213babdbaa949e94557246414db0130e01394517. This vulnerability a= ffects the function checkForPostRequests of the file application/core/MY_Co= ntroller.php of the component Subscribed Emails Admin Page. Such manipulati=
on of the argument User-Agent leads to cross site scripting. The attack may=
be performed from remote. The exploit is publicly available and might be u= sed. This product utilizes a rolling release system for continuous delivery=
, and as such, version information for affected or updated releases is not = disclosed. The name of the patch is 23105f25dadf57b4314fc015a63a7c6e910c89d=
f. It is advisable to implement a patch to correct this issue.</td> <td>2026-07-04</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14634" target=3D= "_blank" rel=3D"noopener">CVE-2026-14634</a></td>
</tr>

<td class=3D"vendor-product">kodezen--Academy LMS WordPress LMS Plugin for = Complete eLearning Solution</td>
<td>The Academy LMS - WordPress LMS Plugin for Complete eLearning Solution = plugin for WordPress is vulnerable to Insecure Direct Object Reference in v= ersions up to, and including, 3.8.1. This is due to the '/topics' REST API = endpoint being registered with a permission callback set to '__return_true'=
, allowing unauthenticated access to course curriculum data without verifyi=
ng the course's post status or user enrollment. This makes it possible for = unauthenticated attackers to access detailed curriculum information for pri= vate, draft, scheduled, or password-protected courses by enumerating course=
IDs.</td>
<td>2026-07-02</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5348" target=3D"= _blank" rel=3D"noopener">CVE-2026-5348</a></td>
</tr>

<td class=3D"vendor-product">latepoint--LatePoint Calendar Booking Plugin f=
or Appointments and Events</td>
<td>The LatePoint - Calendar Booking Plugin for Appointments and Events plu= gin for WordPress is vulnerable to authorization bypass in all versions up = to, and including, 5.6.1. This is due to the plugin not properly verifying = that a user is authorized to perform an action. This makes it possible for = unauthenticated attackers to modify the personally identifiable information=
(first name, last name, phone number, and notes) of any existing customer = record, including those linked to administrator accounts, by submitting the=
booking form with a known customer's email address. Exploitation requires = the plugin to be configured with guest bookings enabled (is_customer_auth_d= isabled() returning true), which is necessary for the vulnerable unauthenti= cated code path in process_step_customer() to be reached.</td> <td>2026-07-03</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11398" target=3D= "_blank" rel=3D"noopener">CVE-2026-11398</a></td>
</tr>

<td class=3D"vendor-product">latepoint--LatePoint Calendar Booking Plugin f=
or Appointments and Events</td>
<td>The LatePoint - Calendar Booking Plugin for Appointments and Events plu= gin for WordPress is vulnerable to Insecure Direct Object Reference in all = versions up to, and including, 5.6.2 via the 'service_id' parameter due to = missing validation on a user controlled key. This makes it possible for una= uthenticated attackers to create approved bookings against services explici= tly restricted to admins and agents, consuming restricted appointment capac= ity and triggering unauthorized bookings for admin/agent-only services. The=
bypass works via both the params[booking][service_id] parameter in steps__= load_step and the presets[selected_service] parameter in steps__start, both=
of which are publicly accessible without authentication.</td> <td>2026-07-02</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12657" target=3D= "_blank" rel=3D"noopener">CVE-2026-12657</a></td>
</tr>

<td class=3D"vendor-product">LibrePhotos--librephotos</td>
<td>LibrePhotos before 1.0.0 contains a broken object level authorization v= ulnerability in the SetPhotosShared endpoint that allows authenticated user=
s to grant themselves access to other users' private photos by bypassing ow= nership validation. Attackers can manipulate shared_to relations without pr= oper owner checks to read arbitrary private photos belonging to other users= .</td>
<td>2026-06-29</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57943" target=3D= "_blank" rel=3D"noopener">CVE-2026-57943</a></td>
</tr>

<td class=3D"vendor-product">LibreTranslate--LibreTranslate</td> <td>LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP s= poofing vulnerability in the get_remote_address() function that allows unau= thenticated attackers to spoof client IP addresses by injecting arbitrary v= alues into the X-Forwarded-For header without trusted proxy validation. Att= ackers can bypass per-IP rate limiting and flood bans by supplying forged a= ddresses in the X-Forwarded-For header to enable unlimited API abuse.</td> <td>2026-06-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57942" target=3D= "_blank" rel=3D"noopener">CVE-2026-57942</a></td>
</tr>

<td class=3D"vendor-product">LinkWhisper--Link Whisper Premium</td> <td>Subscriber Broken Access Control in Link Whisper Premium &lt;=3D 2.9.0 = versions.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57353" target=3D= "_blank" rel=3D"noopener">CVE-2026-57353</a></td>
</tr>

<td class=3D"vendor-product">Livemesh--Livemesh Addons for WPBakery Page Bu= ilder</td>
<td>Contributor Cross Site Scripting (XSS) in Livemesh Addons for WPBakery = Page Builder &lt;=3D 3.9.4 versions.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57754" target=3D= "_blank" rel=3D"noopener">CVE-2026-57754</a></td>
</tr>

<td class=3D"vendor-product">lobehub--lobehub</td>
<td>LobeChat before version 2.2.10-canary.15 contains a regular expression = denial of service (ReDoS) vulnerability that allows authenticated attackers=
to block the Node.js event loop by supplying a catastrophic-backtracking p= attern in a GitHub repository URL path during skill import. Attackers can c= raft a malicious basePath value containing unescaped regex metacharacters s= uch as catastrophic-backtracking patterns, which are injected into a dynami= cally constructed regular expression in the findSkillMd function and execut=
ed synchronously against archive entries, denying service to all concurrent=
users for tens of seconds per request.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58578" target=3D= "_blank" rel=3D"noopener">CVE-2026-58578</a></td>
</tr>

<td class=3D"vendor-product">lobehub--lobehub</td>
<td>LobeChat through 2.2.9 contains a broken access control vulnerability i=
n the retrieval-augmented-generation semantic search functionality that all= ows authenticated attackers to access other users' data by exploiting missi=
ng user-identifier predicates in the chunk model semanticSearch method. Att= ackers can supply arbitrary victim file or knowledge-base identifiers throu=
gh the chunk retrieval and chat knowledge-base paths to retrieve text conte= nt, file names, and metadata belonging to other users.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59098" target=3D= "_blank" rel=3D"noopener">CVE-2026-59098</a></td>
</tr>

<td class=3D"vendor-product">lobehub--lobehub</td>
<td>LobeChat through 2.2.9 server-database deployments are vulnerable to br= oken object-level authorization in MessageModel. The updateMessagePlugin, u= pdatePluginState, updatePluginError, updateTTS and updateTranslate methods = filter target rows by message id alone, omitting the userId scope that sibl= ing methods apply, and findMessagePlugin reads back by id alone. Reachable = via the corresponding tRPC message procedures, an authenticated user who kn= ows another user's message identifier can overwrite that victim's plugin to= ol-call metadata, plugin state/error, text-to-speech and translation record=
s on the same instance, and the tampered content is served back to the vict= im. Exploitation requires knowledge of the victim's non-enumerable message = identifier.</td>
<td>2026-07-02</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58580" target=3D= "_blank" rel=3D"noopener">CVE-2026-58580</a></td>
</tr>

<td class=3D"vendor-product">lobehub--lobehub</td>
<td>LobeChat through 2.2.9 contains a broken object level authorization vul= nerability that allows authenticated attackers to access and modify other u= sers' chat-group agent data by supplying arbitrary group identifiers. Attac= kers can invoke the getGroupAgents, updateAgentInGroup, and removeAgentsFro= mGroup operations without user-scoped predicates to read agent listings, mo= dify agent roles and ordering, and remove agents from chat groups belonging=
to other users.</td>
<td>2026-07-02</td>
<td>5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59100" target=3D= "_blank" rel=3D"noopener">CVE-2026-59100</a></td>
</tr>

<td class=3D"vendor-product">mainwp--MainWP</td>
<td>Subscriber Broken Access Control in MainWP &lt;=3D 6.1.1 versions.</td> <td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57327" target=3D= "_blank" rel=3D"noopener">CVE-2026-57327</a></td>
</tr>

<td class=3D"vendor-product">Matteo Manna--Simple User Avatar</td> <td>Authorization Bypass Through User-Controlled Key vulnerability in Matte=
o Manna Simple User Avatar allows Exploiting Incorrectly Configured Access = Control Security Levels. This issue affects Simple User Avatar: from n/a th= rough 4.9.</td>
<td>2026-06-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57676" target=3D= "_blank" rel=3D"noopener">CVE-2026-57676</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Azure Synapse</td>
<td>Improper access control in Azure Synapse allows an authorized attacker =
to elevate privileges over a network.</td>
<td>2026-07-02</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-26145" target=3D= "_blank" rel=3D"noopener">CVE-2026-26145</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Microsoft Edge (Chromium-based) Spoofing Vulnerability</td> <td>2026-07-03</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-45489" target=3D= "_blank" rel=3D"noopener">CVE-2026-45489</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Exposure of sensitive information to an unauthorized actor in Microsoft=
Edge (Chromium-based) allows an unauthorized attacker to perform spoofing = over a network.</td>
<td>2026-07-03</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56646" target=3D= "_blank" rel=3D"noopener">CVE-2026-56646</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) a= llows an unauthorized attacker to perform spoofing over a network.</td> <td>2026-07-03</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57987" target=3D= "_blank" rel=3D"noopener">CVE-2026-57987</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Operation on a resource after expiration or release in Microsoft Edge (= Chromium-based) allows an unauthorized attacker to disclose information ove=
r a network.</td>
<td>2026-07-03</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58291" target=3D= "_blank" rel=3D"noopener">CVE-2026-58291</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Absolute path traversal in Microsoft Edge for Android allows an unautho= rized attacker to disclose information locally.</td>
<td>2026-07-03</td>
<td>6.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58300" target=3D= "_blank" rel=3D"noopener">CVE-2026-58300</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Relative path traversal in Microsoft Edge for Android allows an unautho= rized attacker to disclose information locally.</td>
<td>2026-07-03</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58522" target=3D= "_blank" rel=3D"noopener">CVE-2026-58522</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Improper access control in Microsoft Edge for Android allows an unautho= rized attacker to bypass a security feature over a network.</td> <td>2026-07-03</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58523" target=3D= "_blank" rel=3D"noopener">CVE-2026-58523</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>User interface (ui) misrepresentation of critical information in Micros= oft Edge (Chromium-based) allows an unauthorized attacker to perform spoofi=
ng over a network.</td>
<td>2026-07-03</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-45488" target=3D= "_blank" rel=3D"noopener">CVE-2026-45488</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) a= llows an unauthorized attacker to perform spoofing over a network.</td> <td>2026-07-03</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58278" target=3D= "_blank" rel=3D"noopener">CVE-2026-58278</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') in Microsoft Edge (Chromium-based) allows an unauthorized att= acker to perform spoofing over a network.</td>
<td>2026-07-03</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58524" target=3D= "_blank" rel=3D"noopener">CVE-2026-58524</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Concurrent execution using shared resource with improper synchronizatio=
n ('race condition') in Microsoft Edge (Chromium-based) allows an authorize=
d attacker to disclose information locally.</td>
<td>2026-07-03</td>
<td>4.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55945" target=3D= "_blank" rel=3D"noopener">CVE-2026-55945</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge (Chromium-based)</td=

<td>Insufficient ui warning of dangerous operations in Microsoft Edge (Chro= mium-based) allows an unauthorized attacker to perform spoofing over a netw= ork.</td>
<td>2026-07-03</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58597" target=3D= "_blank" rel=3D"noopener">CVE-2026-58597</a></td>
</tr>

<td class=3D"vendor-product">Misbah WP--Mosaic Gallery - Advanced Gallery</=

<td>Contributor Cross Site Scripting (XSS) in Mosaic Gallery &amp;#8211; Ad= vanced Gallery &lt;=3D 1.2.0 versions.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57755" target=3D= "_blank" rel=3D"noopener">CVE-2026-57755</a></td>
</tr>

<td class=3D"vendor-product">mjperpinosa--stumasy</td>
<td>A weakness has been identified in mjperpinosa stumasy up to 327d1b0f291= 5ba79d7ef8ebb74553e987609d9be. The impacted element is the function Notes_c= ontroller::search_scratch_data of the file application/PHP/objects/notes/se= arch_scratch_data.php. This manipulation of the argument field_name causes = sql injection. It is possible to initiate the attack remotely. The exploit = has been made available to the public and could be used for attacks. This p= roduct is using a rolling release to provide continious delivery. Therefore=
, no version details for affected nor updated releases are available. The p= roject was informed of the problem early through an issue report but has no=
t responded yet.</td>
<td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14751" target=3D= "_blank" rel=3D"noopener">CVE-2026-14751</a></td>
</tr>

<td class=3D"vendor-product">n8n--n8n</td>
<td>n8n before 2.8.0 contains an authentication bypass vulnerability allowi=
ng authenticated SSO users to disable SSO enforcement through the API. Atta= ckers can create local password credentials to authenticate directly, bypas= sing organizational SSO policies and identity-provider-enforced multi-facto=
r authentication.</td>
<td>2026-06-30</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56350" target=3D= "_blank" rel=3D"noopener">CVE-2026-56350</a></td>
</tr>

<td class=3D"vendor-product">n8n--n8n</td>
<td>n8n contains a stored cross-site scripting vulnerability in the Chat Tr= igger node's Custom CSS field due to a misconfiguration of the sanitize-htm=
l library. Affected releases are those before 1.123.27, the 2.0.0 through 2= .13.2 line, and 2.14.0 (fixed in 1.123.27, 2.13.3, and 2.14.1). An authenti= cated user with permission to create or modify workflows can inject JavaScr= ipt that bypasses sanitization, resulting in stored XSS against any user wh=
o visits the public chat page.</td>
<td>2026-06-30</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56356" target=3D= "_blank" rel=3D"noopener">CVE-2026-56356</a></td>
</tr>

<td class=3D"vendor-product">n8n--n8n</td>
<td>n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax = tree (AST) security validator bypass in the Python Code node. An authentica= ted user with permission to create or modify workflows containing a Python = Code node can bypass the validator and access the task executor module name= space. The issue only affects self-hosted instances where the Python Task R= unner is enabled; where N8N_BLOCK_RUNNER_ENV_ACCESS is configured to allow = it, this can disclose environment variables accessible to the task runner p= rocess.</td>
<td>2026-06-30</td>
<td>5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56777" target=3D= "_blank" rel=3D"noopener">CVE-2026-56777</a></td>
</tr>

<td class=3D"vendor-product">Nathanbarry--Kit (formerly ConvertKit) for Woo= Commerce</td>
<td>Unauthenticated Sensitive Data Exposure in Kit (formerly ConvertKit) fo=
r WooCommerce &lt;=3D 2.1.5 versions.</td>
<td>2026-07-02</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57753" target=3D= "_blank" rel=3D"noopener">CVE-2026-57753</a></td>
</tr>

<td class=3D"vendor-product">nesquena--hermes-webui</td>
<td>Hermes WebUI before 0.51.521 validates the workspace of an imported ses= sion under the active named profile but constructs the Session object witho=
ut setting its profile in the /api/session/import handler, so the imported = session is persisted with a null profile. Because a null profile is treated=
as the default profile by the profile authorization check, a user on the d= efault profile can export the imported session transcript and use its sessi=
on identifier to read files from the named profile's workspace, defeating t=
he application's profile isolation.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58174" target=3D= "_blank" rel=3D"noopener">CVE-2026-58174</a></td>
</tr>

<td class=3D"vendor-product">netdata--netdata</td>
<td>Netdata before 2.3.1 reflects the user-supplied love query parameter of=
the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the gene= rated SVG document (into a text element) without HTML or XML escaping, and = serves the response with Content-Type image/svg+xml. An attacker can craft =
a URL such as /api/v2/ilove.svg?love=3D&lt;script&gt;...&lt;/script&gt;; wh=
en a victim navigates to it the injected script executes in the victim brow= ser in the origin of the Netdata instance (reflected cross-site scripting).=
These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access = and, because bearer-token protection is disabled by default, are reachable = without authentication on a default Netdata agent. The issue was resolved b=
y removing the ilove endpoint.</td>
<td>2026-07-02</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71385" target=3D= "_blank" rel=3D"noopener">CVE-2025-71385</a></td>
</tr>

<td class=3D"vendor-product">nextlevelbuilder--GoClaw</td>
<td>A security vulnerability has been detected in nextlevelbuilder GoClaw u=
p to 3.13.0-beta.2. Impacted is the function MethodRouter.Handle of the fil=
e internal/gateway/router.go of the component WebSocket RPC Handler. Such m= anipulation leads to incorrect authorization. The attack may be launched re= motely. The exploit has been disclosed publicly and may be used. The projec=
t was informed of the problem early through an issue report.</td> <td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14716" target=3D= "_blank" rel=3D"noopener">CVE-2026-14716</a></td>
</tr>

<td class=3D"vendor-product">nikhilgadhiya--Product Video Gallery for Wooco= mmerce</td>
<td>The Product Video Gallery for Woocommerce plugin for WordPress is vulne= rable to Stored Cross-Site Scripting via custom_thumbnail Parameter in all = versions up to, and including, 1.5.1.8 due to insufficient input sanitizati=
on and output escaping. This makes it possible for authenticated attackers,=
with shop manager-level access and above, to inject arbitrary web scripts =
in pages that will execute whenever a user accesses an injected page.</td> <td>2026-07-02</td>
<td>4.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10104" target=3D= "_blank" rel=3D"noopener">CVE-2026-10104</a></td>
</tr>

<td class=3D"vendor-product">NousResearch--hermes-agent</td>
<td>A security flaw has been discovered in NousResearch hermes-agent up to = 0.15.2. The affected element is the function shell.exec of the file tui_gat= eway/server.py. The manipulation results in protection mechanism failure. I=
t is possible to launch the attack remotely. The exploit has been released =
to the public and may be used for attacks. The vendor was contacted early a= bout this disclosure but did not respond in any way.</td>
<td>2026-07-04</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14625" target=3D= "_blank" rel=3D"noopener">CVE-2026-14625</a></td>
</tr>

<td class=3D"vendor-product">NousResearch--hermes-agent</td>
<td>A security vulnerability has been detected in NousResearch hermes-agent=
up to 0.15.2. This affects the function DiscordAdapter._is_allowed_user of=
the file gateway/platforms/discord.py of the component Discord Platform In= tegration. Such manipulation leads to improper authentication. The attack c=
an be launched remotely. This attack is characterized by high complexity. T=
he exploitability is reported as difficult. The exploit has been disclosed = publicly and may be used. The vendor was contacted early about this disclos= ure but did not respond in any way.</td>
<td>2026-07-04</td>
<td>5.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14627" target=3D= "_blank" rel=3D"noopener">CVE-2026-14627</a></td>
</tr>

<td class=3D"vendor-product">NousResearch--hermes-agent</td>
<td>A vulnerability was detected in NousResearch hermes-agent up to 2026.5.= 16. This impacts the function extract_media of the file gateway/platforms/b= ase.py of the component Live Webhook Endpoint. Performing a manipulation re= sults in path traversal. The attack may be initiated remotely. The exploit =
is now public and may be used. The vendor was contacted early about this di= sclosure but did not respond in any way.</td>
<td>2026-07-04</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14628" target=3D= "_blank" rel=3D"noopener">CVE-2026-14628</a></td>
</tr>

<td class=3D"vendor-product">NousResearch--hermes-agent</td>
<td>A weakness has been identified in NousResearch hermes-agent up to 2026.= 4.30. The impacted element is the function AIAgent.run_conversation of the = file run_agent.py of the component HTTP API. This manipulation of the argum= ent todos causes denial of service. The attack can be initiated remotely. T=
he exploit has been made available to the public and could be used for atta= cks. The vendor was contacted early about this disclosure but did not respo=
nd in any way.</td>
<td>2026-07-04</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14626" target=3D= "_blank" rel=3D"noopener">CVE-2026-14626</a></td>
</tr>

<td class=3D"vendor-product">NousResearch--hermes-agent</td>
<td>A vulnerability was determined in NousResearch hermes-agent 2026.5.29.2=
. The impacted element is the function skill_view of the file tools/skills_= tool.py. Executing a manipulation of the argument Name can lead to path tra= versal. The attack can be launched remotely. The exploit has been publicly = disclosed and may be utilized. This patch is called 56f833efa427ccb444c0f9a= d1759af1012f2124d. It is advisable to implement a patch to correct this iss= ue.</td>
<td>2026-07-05</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14783" target=3D= "_blank" rel=3D"noopener">CVE-2026-14783</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--Triton Inference Server</td>
<td>NVIDIA Triton Inference Server for Linux contains a vulnerability where=
an attacker can cause a use-after-free issue. A successful exploit of this=
vulnerability might lead to denial of service.</td>
<td>2026-07-01</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24266" target=3D= "_blank" rel=3D"noopener">CVE-2026-24266</a></td>
</tr>

<td class=3D"vendor-product">octagonwebstudio--Premium Addons for KingCompo= ser</td>
<td>The Premium Addons for KingComposer plugin for WordPress is vulnerable =
to unauthorized modification and loss of data in versions up to, and includ= ing, 1.1.1. This is due to missing authorization and capability checks on t=
he add_custom_sidebar() and remove_custom_sidebar() AJAX handlers, both of = which are exposed through wp_ajax_nopriv_* hooks and write directly to the = octagon_custom_sidebar option via update_option(). This makes it possible f=
or unauthenticated attackers to create arbitrary custom widget areas or del= ete existing custom sidebars, which can cause widgets assigned to those are=
as to silently lose their registration and stop rendering.</td> <td>2026-06-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12349" target=3D= "_blank" rel=3D"noopener">CVE-2026-12349</a></td>
</tr>

<td class=3D"vendor-product">ohler55--oj</td>
<td>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as =
a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads unin= itialized stack memory (and, for long keys, reads out of bounds) when parsi=
ng a JSON object whose key is 254 bytes or longer. The interned bytes can s= urface to the caller, disclosing process stack memory. In ext/oj/intern.c, = form_attr() handles the long-key path by allocating a heap buffer, `b`, pop= ulating it with the attribute name, and then freeing it - but it passed the=
uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefo=
re reads len + 1 bytes of uninitialized stack memory. When the key length i=
s &gt;=3D 256, it also reads out of bounds past the 256-byte buf. The resul= ting bytes are interned and can reach the caller via the produced Symbol or=
via the EncodingError message raised on invalid UTF-8, leaking process sta=
ck contents. This issue has been fixed in version 3.17.3.</td> <td>2026-06-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54500" target=3D= "_blank" rel=3D"noopener">CVE-2026-54500</a></td>
</tr>

<td class=3D"vendor-product">omec-project--amf</td>
<td>A vulnerability was determined in omec-project amf up to 2.1.1. This is= sue affects the function RRCInactiveTransitionReport of the component NGAP = Message Handler. Executing a manipulation can lead to denial of service. Th=
e attack may be performed from remote. The exploit has been publicly disclo= sed and may be utilized. This patch is called 34bc6724acc97dba1f8691e586da9= 5b042cb612d. A patch should be applied to remediate this issue.</td> <td>2026-07-04</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14623" target=3D= "_blank" rel=3D"noopener">CVE-2026-14623</a></td>
</tr>

<td class=3D"vendor-product">omec-project--amf</td>
<td>A vulnerability was identified in omec-project amf up to 2.0.2/2.1.1. I= mpacted is an unknown function of the file /go/src/amf/ngap/handler.go of t=
he component NGSetupRequest Handler. The manipulation leads to denial of se= rvice. It is possible to initiate the attack remotely. The exploit is publi= cly available and might be used. The identifier of the patch is 34bc6724acc= 97dba1f8691e586da95b042cb612d. To fix this issue, it is recommended to depl=
oy a patch.</td>
<td>2026-07-04</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14624" target=3D= "_blank" rel=3D"noopener">CVE-2026-14624</a></td>
</tr>

<td class=3D"vendor-product">onnx--onnx</td>
<td>A weakness has been identified in onnx up to 1.21.x. This vulnerability=
affects the function convPoolShapeInference_opset19 of the file onnx/defs/= nn/old.cc of the component onnxruntime. This manipulation causes out-of-bou= nds read. It is possible to initiate the attack remotely. The exploit has b= een made available to the public and could be used for attacks. Patch name:=
a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a pat=
ch to fix this issue.</td>
<td>2026-07-04</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14647" target=3D= "_blank" rel=3D"noopener">CVE-2026-14647</a></td>
</tr>

<td class=3D"vendor-product">opajaap--WP Photo Album Plus</td>
<td>The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cr= oss-Site Scripting via the 'subtext' parameter in all versions up to, and i= ncluding, 9.1.13.005 due to insufficient input sanitization and output esca= ping. This makes it possible for authenticated attackers, with contributor-= level access and above, to inject arbitrary web scripts in pages that will = execute whenever a user accesses an injected page. A contributor-level atta= cker can embed the malicious [photo] shortcode in a post submitted for revi= ew, causing the stored payload to execute when an administrator or any othe=
r user views the post.</td>
<td>2026-07-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10095" target=3D= "_blank" rel=3D"noopener">CVE-2026-10095</a></td>
</tr>

<td class=3D"vendor-product">Open Asset Import Library--Assimp</td>
<td>A vulnerability was determined in Open Asset Import Library Assimp up t=
o 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the fil=
e code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This = manipulation causes double free. The attack can be initiated remotely. The = exploit has been publicly disclosed and may be utilized. The project was in= formed of the problem early through an issue report.</td>
<td>2026-07-03</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14604" target=3D= "_blank" rel=3D"noopener">CVE-2026-14604</a></td>
</tr>

<td class=3D"vendor-product">Open Asset Import Library--Assimp</td>
<td>A security vulnerability has been detected in Open Asset Import Library=
Assimp up to 5.4.3. Affected by this vulnerability is the function Assimp:= :SceneCombiner::Copy of the file code/Common/SceneCombiner.cpp of the compo= nent Model File Handler. Such manipulation of the argument width/height lea=
ds to heap-based buffer overflow. An attack has to be approached locally. T=
he exploit has been disclosed publicly and may be used. This and similar de= fects are tracked and handled via issue #6128.</td>
<td>2026-07-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-15666" target=3D= "_blank" rel=3D"noopener">CVE-2025-15666</a></td>
</tr>

<td class=3D"vendor-product">Open Asset Import Library--Assimp</td>
<td>A flaw has been found in Open Asset Import Library Assimp up to 6.0.5. = Impacted is the function Assimp::CSMImporter::InternReadFile of the file co= de/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. This manip= ulation causes heap-based buffer overflow. The attack is restricted to loca=
l execution. The exploit has been published and may be used. Patch name: eb= 84eec580d3f4ba2f0fd87409b7d0744620f11e. Applying a patch is the recommended=
action to fix this issue.</td>
<td>2026-07-03</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14610" target=3D= "_blank" rel=3D"noopener">CVE-2026-14610</a></td>
</tr>

<td class=3D"vendor-product">open-telemetry--opentelemetry-java-instrumenta= tion</td>
<td>OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrume= ntation and instrumentation libraries for Java. In versions prior to 2.28.0=
, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNE=
CT statements when the password is double-quoted. As a result, clear-text d= atabase passwords can be added to trace span attributes and exported to obs= ervability backends. This issue has been fixed in version 2.28.0.</td> <td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54704" target=3D= "_blank" rel=3D"noopener">CVE-2026-54704</a></td>
</tr>

<td class=3D"vendor-product">open-telemetry--opentelemetry-java-instrumenta= tion</td>
<td>OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrume= ntation and instrumentation libraries for Java. In versions prior to 2.27.0=
, the RMI context propagation payload reader limits the number of context e= ntries but does not limit the aggregate size of the strings read from the s= tream. An attacker who can reach an RMI endpoint on an instrumented JVM can=
send an oversized context propagation payload. This can cause excessive me= mory allocation while the JVM reads the payload, potentially leading to den= ial of service. The issue affects only deployments where RMI instrumentatio=
n is enabled and an RMI endpoint is network-reachable. This issue has been = fixed in version 2.27.0.</td>
<td>2026-07-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54712" target=3D= "_blank" rel=3D"noopener">CVE-2026-54712</a></td>
</tr>

<td class=3D"vendor-product">open-webui--open-webui</td>
<td>Open WebUI before 0.6.27 contains a server-side request forgery vulnera= bility in the /api/v1/retrieval/process/web endpoint that allows authentica= ted users to bypass SSRF protections. Attackers can manipulate URL paramete=
rs with location redirect headers to access internal services and potential=
ly execute commands via instance secrets.</td>
<td>2026-06-30</td>
<td>5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56399" target=3D= "_blank" rel=3D"noopener">CVE-2026-56399</a></td>
</tr>

<td class=3D"vendor-product">Open5GS--Open5GS</td>
<td>A vulnerability was detected in Open5GS up to 2.7.7. Affected by this v= ulnerability is the function amf_nnrf_handle_nf_discover of the file src/am= f/nnrf-handler.c of the component AMF. The manipulation results in denial o=
f service. The attack may be launched remotely. The exploit is now public a=
nd may be used. The patch is identified as fb5f67703de0213fb9c6e6ef3b48b6c1= 707e9503. It is best practice to apply a patch to resolve this issue.</td> <td>2026-07-04</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14618" target=3D= "_blank" rel=3D"noopener">CVE-2026-14618</a></td>
</tr>

<td class=3D"vendor-product">openGauss-server--openGauss-server-7.0.0-RC2</=

<td>See CVE Link for Additional Details</td>
<td>2026-06-30</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14178" target=3D= "_blank" rel=3D"noopener">CVE-2026-14178</a></td>
</tr>

<td class=3D"vendor-product">Paolo--GeoDirectory</td>
<td>Subscriber Server Side Request Forgery (SSRF) in GeoDirectory &lt;=3D 2= .8.161 versions.</td>
<td>2026-07-02</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57681" target=3D= "_blank" rel=3D"noopener">CVE-2026-57681</a></td>
</tr>

<td class=3D"vendor-product">papermark--papermark</td>
<td>Papermark through 0.22.0 contains a cross-origin resource sharing (CORS=
) misconfiguration vulnerability that allows unauthenticated remote attacke=
rs to perform credentialed cross-origin requests by exploiting the TUS-base=
d viewer upload endpoint reflecting arbitrary request Origins with Access-C= ontrol-Allow-Credentials set to true. Attackers can lure authenticated vict= ims to malicious pages that silently issue credentialed cross-origin reques=
ts to upload arbitrary files into victim datarooms and read credentialed re= sponses.</td>
<td>2026-06-29</td>
<td>4.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57957" target=3D= "_blank" rel=3D"noopener">CVE-2026-57957</a></td>
</tr>

<td class=3D"vendor-product">parorrey--JSON API User</td>
<td>The JSON API User plugin for WordPress is vulnerable to Stored Cross-Si=
te Scripting via the 'content' parameter of the post_comment API endpoint i=
n versions up to, and including, 4.1.0 This is due to insufficient input sa= nitization in the post_comment() function, which passes the attacker-contro= lled comment_content value directly to wp_insert_comment() without applying=
any HTML sanitization, and additionally allows the caller to set comment_a= pproved=3D1 to self-approve the comment and bypass moderation. This makes i=
t possible for authenticated attackers, with subscriber-level access and ab= ove, to inject arbitrary web scripts in pages that will execute whenever a = user accesses an injected page.</td>
<td>2026-07-03</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9626" target=3D"= _blank" rel=3D"noopener">CVE-2026-9626</a></td>
</tr>

<td class=3D"vendor-product">parseablehq--parseable</td>
<td>Parseable before 2.9.2 contains an information disclosure vulnerability=
in the notification-target API endpoints that returns webhook tokens and b= asic-auth credentials in cleartext due to commented-out secret-masking func= tionality. Any authenticated user with the GetAlert action, including low-p= rivilege reader roles, can recover credentials and internal endpoint URLs f=
or all configured notification targets by querying GET /api/v1/targets or r= elated endpoints.</td>
<td>2026-06-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56783" target=3D= "_blank" rel=3D"noopener">CVE-2026-56783</a></td>
</tr>

<td class=3D"vendor-product">photoprism--photoprism</td>
<td>PhotoPrism before 260601-a7d098548 contains a broken access control vul= nerability that allows authenticated non-admin users to modify other users'=
profile information by sending requests to arbitrary user endpoints. Attac= kers can exploit the missing session-to-user identifier validation in the P=
UT users API endpoint to overwrite another user's profile details without a= uthorization.</td>
<td>2026-06-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57945" target=3D= "_blank" rel=3D"noopener">CVE-2026-57945</a></td>
</tr>

<td class=3D"vendor-product">php--php</td>
<td>In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before = 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in Op= enSSL extension contains a buffer allocation flaw. The output buffer for th=
e AES key-wrap-with-padding operation is sized from the plaintext length wi= thout accounting for RFC 5649 expansion. This may cause OpenSSL to write be= yond allocated memory, corrupting heap metadata and triggering application = abort.</td>
<td>2026-07-03</td>
<td>5.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14355" target=3D= "_blank" rel=3D"noopener">CVE-2026-14355</a></td>
</tr>

<td class=3D"vendor-product">pinpoint-apm--pinpoint</td>
<td>Pinpoint through version 3.1.0 contains an insecure session management = vulnerability that allows attackers to access the pinpointJwt session cooki=
e due to missing HttpOnly and Secure attributes, enabling JavaScript access=
via document.cookie and cleartext transmission over HTTP. Attackers can ex= ploit stored or reflected cross-site scripting vulnerabilities to exfiltrat=
e the session token or intercept it through network sniffing to perform ses= sion hijacking.</td>
<td>2026-06-29</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57948" target=3D= "_blank" rel=3D"noopener">CVE-2026-57948</a></td>
</tr>

<td class=3D"vendor-product">PraisonAI--PraisonAI</td>
<td>PraisonAI before 0.1.7 fails to validate that project_id in issue creat=
e and update request bodies belongs to the URL workspace. An attacker can c= reate issues referencing projects from other workspaces, causing cross-tena=
nt data pollution in project statistics aggregation without workspace const= raints.</td>
<td>2026-07-02</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58653" target=3D= "_blank" rel=3D"noopener">CVE-2026-58653</a></td>
</tr>

<td class=3D"vendor-product">presenton--presenton</td>
<td>Presenton before 0.8.8-beta bundles an MCP server that, on server/Docke=
r deployments configured with session authentication (AUTH_USERNAME/AUTH_PA= SSWORD), is reachable unauthenticated at /mcp because the nginx front-end d= oes not apply the auth_request gate to that path and the MCP server auto-mi= nts a valid internal session token for the configured user. A remote unauth= enticated attacker can invoke MCP tools such as generate_presentation, perf= orming authenticated application actions, consuming the operators configure=
d LLM API keys, and creating presentations in the operators instance. The E= lectron desktop build is not affected (MCP disabled).</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58446" target=3D= "_blank" rel=3D"noopener">CVE-2026-58446</a></td>
</tr>

<td class=3D"vendor-product">properfraction--CrawlWP SEO</td>
<td>Cross-Site Request Forgery (CSRF) vulnerability in properfraction Crawl=
WP SEO allows Cross Site Request Forgery. This issue affects CrawlWP SEO: f= rom n/a through 3.0.16.</td>
<td>2026-07-05</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59520" target=3D= "_blank" rel=3D"noopener">CVE-2026-59520</a></td>
</tr>

<td class=3D"vendor-product">propertyhive--Houzez Property Feed</td>
<td>The Houzez Property Feed plugin for WordPress is vulnerable to SQL Inje= ction via the 'orderby' parameter in all versions up to, and including, 2.5= .46 due to insufficient escaping on the user supplied parameter and lack of=
sufficient preparation on the existing SQL query in the prepare_items() me= thod of the Houzez_Property_Feed_Admin_Logs_Export_Table (and Houzez_Proper= ty_Feed_Admin_Logs_Import_Table) class. The user-controlled $_GET['orderby'=
] and $_GET['order'] values are filtered only with sanitize_text_field() an=
d then concatenated into the SQL format string before $wpdb-&gt;prepare() i=
s called - prepare() only parameterizes the appended LIMIT/OFFSET clause an=
d cannot retroactively secure the already-tainted ORDER BY clause. This mak=
es it possible for authenticated attackers, with Administrator-level access=
and above, to append additional SQL queries into already existing queries = that can be used to extract sensitive information from the database.</td> <td>2026-07-02</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13357" target=3D= "_blank" rel=3D"noopener">CVE-2026-13357</a></td>
</tr>

<td class=3D"vendor-product">qodeinteractive--Qi Blocks</td>
<td>The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Obj= ect Reference in all versions up to, and including, 1.4.9 via the 'page_id'=
parameter due to missing validation on a user controlled key. This makes i=
t possible for authenticated attackers, with author-level access and above,=
to modify the stored Qi Blocks styles of arbitrary posts, templates, or wi= dgets they do not own - including site-wide surfaces via the reserved 'temp= late' and 'widget' page_id values - enabling unauthorized frontend defaceme= nt, content hiding, and degradation of any page on the site. The endpoint's=
permission_callback checks only the generic edit_posts and publish_posts c= apabilities, meaning any user with the built-in Author role satisfies the c= heck regardless of post ownership.</td>
<td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10096" target=3D= "_blank" rel=3D"noopener">CVE-2026-10096</a></td>
</tr>

<td class=3D"vendor-product">radareorg--radare2</td>
<td>A vulnerability was determined in radareorg radare2 up to 6.1.6. This a= ffects the function core_anal_bytes of the file libr/core/cmd_anal.inc. Thi=
s manipulation causes integer overflow. The attack needs to be launched loc= ally. The exploit has been publicly disclosed and may be utilized. It is su= ggested to install a patch to address this issue.</td>
<td>2026-07-05</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14757" target=3D= "_blank" rel=3D"noopener">CVE-2026-14757</a></td>
</tr>

<td class=3D"vendor-product">RadiusTheme--Classified Listing</td> <td>Subscriber Broken Access Control in Classified Listing &lt;=3D 5.4.2 ve= rsions.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57355" target=3D= "_blank" rel=3D"noopener">CVE-2026-57355</a></td>
</tr>

<td class=3D"vendor-product">Raera - Ankara Web Design and Digital Advertis= ing Agency--Destekz</td>
<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') vulnerability in Raera - Ankara Web Design and Digital Advert= ising Agency Destekz allows Reflected XSS. This issue affects Destekz: thro= ugh 02062026.=C2=A0NOTE: The vendor was contacted and it was learned that t=
he product is not supported.</td>
<td>2026-07-03</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4322" target=3D"= _blank" rel=3D"noopener">CVE-2026-4322</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the Identity Provider (IdP) mapper component of Key= cloak, which is used to manage how user information from external services =
is mapped to Keycloak users. An administrator with limited permissions to m= anage identity providers can exploit this flaw by creating a "Hardcoded Rol=
e" mapper that assigns high-level administrative roles (like realm-admin) t=
o themselves or others. This allows a restricted administrator to bypass se= curity checks and gain full control over the entire realm.</td> <td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12388" target=3D= "_blank" rel=3D"noopener">CVE-2026-12388</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in Keycloak. A highly privileged user with `manage-cli= ents` permission can exploit this vulnerability by injecting a hardcoded ro=
le mapper into any client. This action allows the user to bypass existing s= cope restrictions and inject the `realm-admin` role into generated tokens, = resulting in privilege escalation and full administrative access to the rea= lm.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4629" target=3D"= _blank" rel=3D"noopener">CVE-2026-4629</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the ClientResource component of Keycloak's admin se= rvices when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue=
allows a delegated administrator, who should only have limited control ove=
r specific clients, to attach or remove hidden client scopes that they are = not authorized to see or manage. As a result, an attacker could inject unau= thorized data or permissions into the security tokens issued to end-users, = potentially tricking other applications into granting higher levels of acce=
ss than intended.</td>
<td>2026-07-03</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14614" target=3D= "_blank" rel=3D"noopener">CVE-2026-14614</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A vulnerability was discovered in Keycloak's Admin UI extension that al= lows certain administrative users to bypass security restrictions. When Fin= e-Grained Admin Permissions (FGAPv2) are enabled, an administrator who shou=
ld only be able to search for users (but not view their full details) can u=
se a specific "brute-force-user" endpoint to access a user's full profile. = This includes sensitive information and security metadata. The issue occurs=
because the system fails to check if the administrator has the required "v= iew" permission for that specific user when using this particular search pa= th.</td>
<td>2026-06-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14209" target=3D= "_blank" rel=3D"noopener">CVE-2026-14209</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A vulnerability was discovered in Keycloak's administrative interface t= hat allows certain administrators to see information about groups they shou= ldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2)=
are turned on, an administrator who is allowed to see a specific "role" ca=
n also see a list of all groups assigned to that role. The system fails to = check if the administrator has permission to see those specific groups. Thi=
s could allow a restricted administrator to discover "hidden" groups and se=
e their details, such as internal names and custom settings, which might co= ntain sensitive deployment information.</td>
<td>2026-07-03</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14613" target=3D= "_blank" rel=3D"noopener">CVE-2026-14613</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implem= entation within Keycloak's administrative services. When FGAP v2 is enabled=
, the system fails to properly filter child groups based on the caller's sp= ecific permissions when requested through a parent group. This allows a del= egated administrator to view details of child groups they are not authorize=
d to access directly, including group names, paths, and custom attributes.<=

<td>2026-07-03</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14615" target=3D= "_blank" rel=3D"noopener">CVE-2026-14615</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw exists in the org.keycloak.broker.oidc package where the OIDC br= oker incorrectly synchronizes the email_verified claim. When an OIDC identi=
ty provider is configured with trustEmail=3Dtrue and the userinfo endpoint =
is enabled, Keycloak retrieves the email address from the userinfo response=
but retrieves the email_verified status exclusively from the id_token. The=
root cause is a lack of validation ensuring that the email_verified claim =
in the id_token actually refers to the email address returned by the userin=
fo endpoint. If these two sources return different email addresses, the id_= token's email_verified=3Dtrue claim is blindly applied to the userinfo emai=
l. Exploitation Conditions: The OIDC identity provider must have trustEmail=
set to true (non-default). The userinfo endpoint must be enabled (default)=
. The attacker must control or have compromised the upstream OIDC provider.=
Concrete Impact: Mark arbitrary email addresses as verified in the Keycloa=
k database. Bypass email-based security controls or verification workflows.=
Potential account takeover if the application relies solely on the email_v= erified flag from the IdP to link accounts.</td>
<td>2026-07-05</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14781" target=3D= "_blank" rel=3D"noopener">CVE-2026-14781</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>
<td>A flaw was found in sssd. When authenticating with a YubiKey, the SSSD = PAM responder can crash due to a use-after-free vulnerability, where a memo=
ry pointer is incorrectly handled. A local attacker could exploit this flaw=
by manipulating smartcard or YubiKey contents, leading to a denial of serv= ice that disrupts authentication. This vulnerability also presents a potent= ial for privilege escalation, although it is difficult to exploit.</td> <td>2026-06-30</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12610" target=3D= "_blank" rel=3D"noopener">CVE-2026-12610</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>
<td>A flaw was found in p11-kit. The RPC message attribute parsing function=
s p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_v= alue() form a mutually-recursive call chain with no recursion depth limit w= hen processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIV= E_TEMPLATE attributes. An unauthenticated attacker with local access to the=
p11-kit RPC Unix domain socket can send a specially crafted request with d= eeply nested template attributes, causing stack exhaustion and crashing the=
p11-kit server process and its dependent services.</td>
<td>2026-06-29</td>
<td>6.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13757" target=3D= "_blank" rel=3D"noopener">CVE-2026-13757</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>
<td>A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertiseme=
nt processing. A specially crafted IPv6 Router Advertisement containing a z= ero-length Neighbor Discovery option can bypass validation during packet st= orage and later be reparsed without adequate validation, causing the parser=
to enter a non-advancing loop. Successful exploitation may result in exces= sive CPU consumption, leading to a denial of service.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14258" target=3D= "_blank" rel=3D"noopener">CVE-2026-14258</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>
<td>RAOP module accepts unbounded Content-Length values and does not check = the pw_array_add() return.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14324" target=3D= "_blank" rel=3D"noopener">CVE-2026-14324</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td> <td>Multiple unbounded alloca() calls in the PulseAudio protocol server.</t=

<td>2026-07-01</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14330" target=3D= "_blank" rel=3D"noopener">CVE-2026-14330</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>
<td>A flaw was found in spice-vdagent. A malicious or compromised SPICE hos=
t can trigger an integer overflow by sending a specially crafted message. T= his vulnerability can lead to a heap buffer overflow, causing the spice-vda= gent daemon to crash and resulting in a Denial of Service (DoS) for the vir= tual machine. This issue requires the SPICE host to be untrusted or comprom= ised for exploitation.</td>
<td>2026-06-29</td>
<td>5.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57965" target=3D= "_blank" rel=3D"noopener">CVE-2026-57965</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>
<td>Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device au= thorization handler can cause out-of-bounds memory access when processing a=
n oversized response from a configured external OAuth2/OIDC Identity Provid= er. An attacker who controls or can man-in-the-middle the IdP endpoint may =
be able to trigger ipa-otpd to write or read one byte past the end of a fix= ed-size buffer. Exploitation requires FreeIPA to be configured with an exte= rnal IdP, attacker control or MITM of that IdP, and a user to initiate the = OAuth2 device authorization flow. The most likely impact is limited denial =
of service affecting the ipa-otpd daemon.</td>
<td>2026-07-03</td>
<td>4.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14612" target=3D= "_blank" rel=3D"noopener">CVE-2026-14612</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>
<td>A path traversal vulnerability was found in spice-vdagent. This flaw al= lows a malicious or compromised SPICE host to write arbitrary files to any = location on the guest operating system. This occurs because the filename pr= ovided by the SPICE host during file transfers is not properly sanitized be= fore being used. An attacker could exploit this to write to sensitive locat= ions with the privileges of the spice-vdagent process, typically the logged= -in user. This issue requires the SPICE host to be untrusted or compromised=
for exploitation.</td>
<td>2026-06-29</td>
<td>4.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57966" target=3D= "_blank" rel=3D"noopener">CVE-2026-57966</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 6</td>
<td>A flaw was found in GIMP's PSP file format parser. A double-free condit= ion occurs in the read_layer_block() function when processing a specially c= rafted PSP file. This could allow an attacker to cause memory corruption, p= otentially leading to denial of service or arbitrary code execution.</td> <td>2026-07-02</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58381" target=3D= "_blank" rel=3D"noopener">CVE-2026-58381</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Hardened Images</td>
<td>A flaw was found in the libblkid library of util-linux. During nested p= artition probing, the BSD, Minix, Solaris x86, and UnixWare partition probe=
rs cache a raw pointer to a parent partition entry in a dynamically allocat=
ed array. When subsequent partition additions cause the array to be realloc= ated, this pointer becomes stale, leading to a heap use-after-free read. An=
attacker who can present a crafted block device image (for example, via US=
B insertion or a loop-mounted disk image) can trigger this flaw without use=
r interaction, as libblkid is invoked automatically by udev/udisks as root =
on block-device hot-plug events. This could lead to limited information dis= closure or denial of service.</td>
<td>2026-06-29</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13595" target=3D= "_blank" rel=3D"noopener">CVE-2026-13595</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Satellite 6</td>
<td>A flaw has been found in foreman when HTTP parameters are modified in h= ttp_proxies_controller and http_proxy files. Attackers can perform an SSRF = attack and steal cloud metadata service on AWS/GCP/Azure environment throug=
h foreman component.</td>
<td>2026-06-30</td>
<td>4.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13316" target=3D= "_blank" rel=3D"noopener">CVE-2026-13316</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Satellite 6.16 for RHEL 8</td=

<td>A flaw was found in Foreman. This broken access control vulnerability a= llows an authenticated user with host-edit permissions to retarget an exist= ing lookup value override to a different host. This is achieved by modifyin=
g the match field through nested host attributes, effectively bypassing aut= horisation checks. The consequence is the potential for unauthorised modifi= cation of managed host configurations across different organisational and l= ocation boundaries.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5135" target=3D"= _blank" rel=3D"noopener">CVE-2026-5135</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Satellite 6.16 for RHEL 8</td=

<td>A flaw was found in foreman. Authenticated users with 'view_keypairs' p= ermission can bypass taxonomy scoping, allowing them to download private SS=
H (Secure Shell) keys from other organizations by directly querying key pai=
r IDs. This vulnerability leads to cross-tenant data exposure in multi-tena=
nt deployments, potentially compromising sensitive information.</td> <td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5142" target=3D"= _blank" rel=3D"noopener">CVE-2026-5142</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Satellite 6.16 for RHEL 8</td=

<td>A flaw was found in Foreman. An authenticated user with host-edit permi= ssions could exploit a cross-tenant information disclosure vulnerability. T= his flaw occurs because the taxonomy_scope controller method does not prope= rly validate organization and location IDs from nested request parameters, = bypassing existing authorization checks. This allows the user to leak sensi= tive infrastructure metadata, including subnet topology, IP ranges, gateway=
s, DNS servers, and VLAN IDs, from organizations and locations they are not=
authorized to access.</td>
<td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5138" target=3D"= _blank" rel=3D"noopener">CVE-2026-5138</a></td>
</tr>

<td class=3D"vendor-product">rilwis--Slim SEO A Fast &amp; Automated SEO Pl= ugin For WordPress</td>
<td>The Slim SEO - A Fast &amp; Automated SEO Plugin For WordPress plugin f=
or WordPress is vulnerable to Unauthorized Private Content Disclosure in al=
l versions up to, and including, 4.9.8 via the `/wp-json/slim-seo/meta-tags= /ai` REST API endpoint. This is due to the endpoint's `permission_callback`=
performing only a top-level `edit_posts` capability check without verifyin=
g that the requesting user has read access to the specific post supplied vi=
a the `object.ID` parameter, allowing the `generate` function to pass the a= ttacker-controlled post ID to `Data::get_post_content()`, which calls `get_= post()` regardless of post status or ownership. This makes it possible for = authenticated attackers with Contributor-level access and above to retrieve=
AI-generated summaries of the raw `post_content` of arbitrary posts they a=
re not authorized to view - including private posts, drafts, pending, futur=
e, and password-protected content authored by other users - with the substa= nce of the protected content disclosed via the HTTP response.</td> <td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12408" target=3D= "_blank" rel=3D"noopener">CVE-2026-12408</a></td>
</tr>

<td class=3D"vendor-product">rometheme--RTMKit</td>
<td>The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scri= pting via the Advanced Heading widget's 'Background Text' parameter in vers= ions up to, and including, 2.0.7 This is due to insufficient output escapin=
g on the 'background_text_heading' setting in the render() function, which = concatenates the value directly into an HTML attribute without applying esc= _attr(). This makes it possible for authenticated attackers, with contribut= or-level access and above, to inject arbitrary web scripts in pages that wi=
ll execute whenever a user accesses an injected page.</td>
<td>2026-07-03</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8351" target=3D"= _blank" rel=3D"noopener">CVE-2026-8351</a></td>
</tr>

<td class=3D"vendor-product">rometheme--RTMKit</td>
<td>The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable=
to Local File Inclusion in versions up to, and including, 2.0.7 This is du=
e to insufficient path validation on the 'template' parameter in the render= _templates AJAX endpoint, which is used directly in a require/include state= ment without sanitization. This makes it possible for authenticated attacke= rs, with Contributor-level access and above, to include and execute files o=
n the server ending in _templates.php, allowing the execution of any PHP co=
de in those files.</td>
<td>2026-07-03</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5137" target=3D"= _blank" rel=3D"noopener">CVE-2026-5137</a></td>
</tr>

<td class=3D"vendor-product">RT-Thread--RT-Thread</td>
<td>A weakness has been identified in RT-Thread up to 5.0.2. This affects t=
he function sys_getaddrinfo of the file components/lwp/lwp_syscall.c. Execu= ting a manipulation of the argument ai_addr can lead to memory corruption. = The attack can only be executed locally. The exploit has been made availabl=
e to the public and could be used for attacks. The pull request to fix this=
issue awaits acceptance.</td>
<td>2026-07-03</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14607" target=3D= "_blank" rel=3D"noopener">CVE-2026-14607</a></td>
</tr>

<td class=3D"vendor-product">RT-Thread--RT-Thread</td>
<td>A flaw has been found in RT-Thread up to 5.2.2. Affected is the functio=
n read/write/sys_ioctl of the file components/lwp/lwp_syscall.c of the comp= onent Parameter Handler. Executing a manipulation can lead to divide by zer=
o. The attack may be launched remotely. The exploit has been published and = may be used. The pull request to fix this issue awaits acceptance.</td> <td>2026-07-04</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14629" target=3D= "_blank" rel=3D"noopener">CVE-2026-14629</a></td>
</tr>

<td class=3D"vendor-product">Samsung Open Source--Escargot</td> <td>Time-of-check time-of-use (TOCTOU) race condition vulnerability in Sams= ung Open Source Escargot allows Leveraging Race Conditions. This issue affe= cts Escargot: bab3a5797557014ce3c2e28419a6310cfba90d0d.</td> <td>2026-06-30</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14160" target=3D= "_blank" rel=3D"noopener">CVE-2026-14160</a></td>
</tr>

<td class=3D"vendor-product">SaturdayDrive--Ninja Forms - File Uploads</td> <td>The Ninja Forms - File Uploads plugin for WordPress is vulnerable to au= thorization bypass in all versions up to, and including, 3.3.29. This is du=
e to the plugin not properly verifying that a user is authorized to perform=
an action. This makes it possible for unauthenticated attackers to read al=
l plugin debug log entries stored in the wp_nf3_log table or permanently de= lete all rows from that table.</td>
<td>2026-07-03</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12557" target=3D= "_blank" rel=3D"noopener">CVE-2026-12557</a></td>
</tr>

<td class=3D"vendor-product">seladb--PcapPlusPlus</td>
<td>A vulnerability was determined in seladb PcapPlusPlus 25.05. The impact=
ed element is the function pcpp::SSLClientHelloMessage::getHandshakeVersion=
of the file Packet++/src/SSLHandshake.cpp of the component TLS Hello Handl= er. Executing a manipulation of the argument handshakeVersion can lead to h= eap-based buffer overflow. It is possible to launch the attack remotely. Th=
is attack is characterized by high complexity. The exploitability is regard=
ed as difficult. The exploit has been publicly disclosed and may be utilize=
d. This patch is called 98e671010bc7c87b95898c22ae289220ae92542b. It is bes=
t practice to apply a patch to resolve this issue.</td>
<td>2026-06-29</td>
<td>5.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13588" target=3D= "_blank" rel=3D"noopener">CVE-2026-13588</a></td>
</tr>

<td class=3D"vendor-product">seladb--PcapPlusPlus</td>
<td>A vulnerability was identified in seladb PcapPlusPlus 25.05. This affec=
ts the function pcpp::TelnetLayer::getSubCommand of the file Packet++/src/T= elnetLayer.cpp of the component Telnet Subnegotiation Packet Handler. The m= anipulation leads to heap-based buffer overflow. The attack can be initiate=
d remotely. The complexity of an attack is rather high. The exploitability =
is reported as difficult. The exploit is publicly available and might be us= ed. The identifier of the patch is 98e671010bc7c87b95898c22ae289220ae92542b=
. It is recommended to apply a patch to fix this issue.</td> <td>2026-06-29</td>
<td>5.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13589" target=3D= "_blank" rel=3D"noopener">CVE-2026-13589</a></td>
</tr>

<td class=3D"vendor-product">seladb--PcapPlusPlus</td>
<td>A security flaw has been discovered in seladb PcapPlusPlus 25.05. This = impacts the function pcpp::ModbusLayer::getLength in the library Packet++/h= eader/ModbusLayer.h of the component Modbus Protocol Handler. The manipulat= ion of the argument length results in heap-based buffer overflow. The attac=
k can be launched remotely. A high complexity level is associated with this=
attack. The exploitability is said to be difficult. The exploit has been r= eleased to the public and may be used for attacks. The patch is identified =
as 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454. Applying a patch is advised to=
resolve this issue.</td>
<td>2026-06-29</td>
<td>5.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13590" target=3D= "_blank" rel=3D"noopener">CVE-2026-13590</a></td>
</tr>

<td class=3D"vendor-product">Sendcloud--Sendcloud Shipping</td>
<td>Missing Authorization vulnerability in Sendcloud Sendcloud Shipping all= ows Exploiting Incorrectly Configured Access Control Security Levels. This = issue affects Sendcloud Shipping: from n/a through 1.0.29.</td> <td>2026-07-02</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57760" target=3D= "_blank" rel=3D"noopener">CVE-2026-57760</a></td>
</tr>

<td class=3D"vendor-product">shohei.tanaka--Japanized For WooCommerce</td> <td>Unauthenticated Broken Access Control in Japanized For WooCommerce &lt;= =3D 2.9.12 versions.</td>
<td>2026-06-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57340" target=3D= "_blank" rel=3D"noopener">CVE-2026-57340</a></td>
</tr>

<td class=3D"vendor-product">ShortPixel--Enable Media Replace</td>
<td>Improper Neutralization of Input During Web Page Generation ('Cross-sit=
e Scripting') vulnerability in ShortPixel Enable Media Replace allows Store=
d XSS. This issue affects Enable Media Replace: from n/a through 4.2.1.</td=

<td>2026-07-01</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57722" target=3D= "_blank" rel=3D"noopener">CVE-2026-57722</a></td>
</tr>

<td class=3D"vendor-product">ShortPixel--ShortPixel Adaptive Images</td> <td>Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images &lt= ;=3D 3.11.3 versions.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57342" target=3D= "_blank" rel=3D"noopener">CVE-2026-57342</a></td>
</tr>

<td class=3D"vendor-product">Siemens--Mendix Studio Pro 10.11</td>
<td>A vulnerability has been identified in Mendix Studio Pro 10.11 (All ver= sions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.13 (Al=
l versions), Mendix Studio Pro 10.14 (All versions), Mendix Studio Pro 10.1=
5 (All versions), Mendix Studio Pro 10.16 (All versions), Mendix Studio Pro=
10.17 (All versions), Mendix Studio Pro 10.18 (All versions), Mendix Studi=
o Pro 10.19 (All versions), Mendix Studio Pro 10.20 (All versions), Mendix = Studio Pro 10.21 (All versions), Mendix Studio Pro 10.22 (All versions), Me= ndix Studio Pro 10.23 (All versions), Mendix Studio Pro 10.24 (All versions=
&lt; V10.24.21), Mendix Studio Pro 11.0 (All versions), Mendix Studio Pro = 11.1 (All versions), Mendix Studio Pro 11.10 (All versions), Mendix Studio = Pro 11.11 (All versions), Mendix Studio Pro 11.2 (All versions), Mendix Stu= dio Pro 11.3 (All versions), Mendix Studio Pro 11.4 (All versions), Mendix = Studio Pro 11.5 (All versions), Mendix Studio Pro 11.6 (All versions &lt; V= 11.6.7), Mendix Studio Pro 11.7 (All versions), Mendix Studio Pro 11.8 (All=
versions), Mendix Studio Pro 11.9 (All versions). Affected versions of Men= dix Studio Pro do not properly validate or sanitize project files processed=
during the build pipeline. This could allow an attacker who tricks a user = into opening and running a specially crafted malicious project locally on t= heir system to execute arbitrary code in the context of that user.</td> <td>2026-06-30</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48192" target=3D= "_blank" rel=3D"noopener">CVE-2026-48192</a></td>
</tr>

<td class=3D"vendor-product">SigNoz--signoz</td>
<td>SigNoz through 0.130.1 contains a broken access control vulnerability t= hat allows authenticated users to access other organizations' alert rules b=
y supplying a target rule UUID, as the alert rule store predicates fail to = filter by organization ID. Attackers can read, edit, and delete alert rules=
belonging to other organizations by exploiting the missing tenant isolatio=
n check, bypassing multi-tenant access controls.</td>
<td>2026-06-29</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57956" target=3D= "_blank" rel=3D"noopener">CVE-2026-57956</a></td>
</tr>

<td class=3D"vendor-product">silverstripe--silverstripe-framework</td> <td>Silverstripe Framework is a PHP framework which powers the Silverstripe=
CMS. In versions prior to 6.2.2, the "Insert media from web" functionality=
in the CMS is vulnerable to XSS from a specially crafted embed. This issue=
was fixed in version 6.2.2/</td>
<td>2026-07-01</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54720" target=3D= "_blank" rel=3D"noopener">CVE-2026-54720</a></td>
</tr>

<td class=3D"vendor-product">smub--WPForms AI Form Builder for WordPress Co= ntact Forms, Payment Forms, Survey Form, Quiz &amp; More</td>
<td>The WPForms - Easy Form Builder for WordPress - Contact Forms, Payment = Forms, Surveys, &amp; More plugin for WordPress is vulnerable to Improper N= eutralization of CRLF Sequences ('CRLF Injection') in all versions up to, a=
nd including, 1.10.2 This is due to `get_reply_to_address()` processing the=
Reply-To display name through smart-tag expansion with context `'notificat= ion'` instead of `'notification-reply-to'`, which bypasses email-address va= lidation while `wpforms_sanitize_textarea_field()` intentionally preserves = CR/LF characters that are never stripped before the display name is concate= nated into the raw `Reply-To:` mail header string. This makes it possible f=
or unauthenticated attackers to inject arbitrary additional email headers -=
such as `Bcc:` - into outgoing notification emails, silently blind-copying=
all notification email copies to an attacker-controlled address. Exploitat= ion requires that a form notification is configured to use a Paragraph Text=
(textarea) field as the Reply-To display name via a Smart Tag.</td> <td>2026-07-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12127" target=3D= "_blank" rel=3D"noopener">CVE-2026-12127</a></td>
</tr>

<td class=3D"vendor-product">Snowflake--Snowflake CLI</td>
<td>Improper restriction of file path resolution in Snowflake CLI versions = prior to 3.19 allowed arbitrary local file content to be read and transmitt=
ed to Snowflake services. An attacker could exploit this by supplying craft=
ed repository or project content that referenced files outside the intended=
project boundary, causing Snowflake CLI to read local files and upload or = embed their contents during deployment or SQL template processing. Successf=
ul exploitation required the victim to process attacker-controlled project = content, and retrieval of exfiltrated data depended on access to the victim=
's Snowflake account artifacts such as query history or uploaded stage cont= ent. The fix is available in Snowflake CLI version 3.19, and users must man= ually upgrade.</td>
<td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13748" target=3D= "_blank" rel=3D"noopener">CVE-2026-13748</a></td>
</tr>

<td class=3D"vendor-product">Snowflake--Snowflake CLI</td>
<td>Improper neutralization of parameters in Snowflake CLI versions prior t=
o 3.19 allowed unintended SQL execution. An attacker could exploit this by = supplying crafted values to vulnerable command paths, causing Snowflake CLI=
to execute unintended SQL in the context of the user's Snowflake session. = Successful exploitation required crafted values to reach vulnerable paramet= ers, including through socially engineered input, malicious repository conf= iguration, or compromised automation feeding external values into the CLI, = and impact is limited by the privileges assigned to the active session. The=
fix is available in Snowflake CLI version 3.19, and users must manually up= grade.</td>
<td>2026-06-29</td>
<td>6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13752" target=3D= "_blank" rel=3D"noopener">CVE-2026-13752</a></td>
</tr>

<td class=3D"vendor-product">Snowflake--Snowflake CLI</td>
<td>Insertion of sensitive information into log files in Snowflake CLI vers= ions prior to 3.19 allowed plaintext credentials to be written to persisten=
t local debug logs. An attacker could exploit this by obtaining read access=
to the affected user's local log files, causing credentials such as passwo= rds, tokens, or private key material to be exposed without additional appli= cation-level safeguards. Successful exploitation requires credentials to be=
present in the affected connection context and the resulting logs to be ac= cessible from the local environment. The fix is available in Snowflake CLI = version 3.19, and users must manually upgrade.</td>
<td>2026-06-29</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13750" target=3D= "_blank" rel=3D"noopener">CVE-2026-13750</a></td>
</tr>

<td class=3D"vendor-product">Snowflake--Snowflake CLI</td>
<td>Improper handling of untrusted remote references in Snowflake CLI versi= ons prior to 3.19 allowed server-side request forgery. The SQL statement re= ader's !source/!load directives could reference remote URLs that were retri= eved at runtime without sufficient restriction on the request destination. =
By supplying crafted SQL content processed through a vulnerable command pat=
h, an attacker could cause the victim's environment to issue unintended out= bound requests to internal or otherwise non-public network locations, and c= ould cause remote SQL content to be retrieved and executed in the context o=
f the victim user's session. Successful exploitation requires the victim to=
process attacker-controlled content through a vulnerable command path and =
is limited by the privileges available to that session and environment. The=
fix is available in Snowflake CLI version 3.19, which adds an option to di= sable remote URL retrieval.</td>
<td>2026-06-29</td>
<td>4.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13751" target=3D= "_blank" rel=3D"noopener">CVE-2026-13751</a></td>
</tr>

<td class=3D"vendor-product">Softaculous--FormLayer</td>
<td>Insertion of Sensitive Information Into Sent Data vulnerability in Soft= aculous FormLayer allows Retrieve Embedded Sensitive Data. This issue affec=
ts FormLayer: from n/a through 1.0.6.</td>
<td>2026-07-05</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59519" target=3D= "_blank" rel=3D"noopener">CVE-2026-59519</a></td>
</tr>

<td class=3D"vendor-product">SolarWinds--Database Performance Analyzer</td> <td>SolarWinds Database Performance Analyzer was found to be affected by a = stored cross-site scripting vulnerability, which when exploited, can lead t=
o unintended script execution.</td>
<td>2026-06-30</td>
<td>5.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28322" target=3D= "_blank" rel=3D"noopener">CVE-2026-28322</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--CET Automated Grading System w= ith AI Predictive Analytics</td>
<td>A vulnerability was detected in SourceCodester CET Automated Grading Sy= stem with AI Predictive Analytics 1.0. This issue affects some unknown proc= essing. The manipulation results in session fixiation. The attack can be ex= ecuted remotely. The attack requires a high level of complexity. The exploi= tability is assessed as difficult. The exploit is now public and may be use= d.</td>
<td>2026-07-03</td>
<td>5.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14609" target=3D= "_blank" rel=3D"noopener">CVE-2026-14609</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--CET Automated Grading System w= ith AI Predictive Analytics</td>
<td>A security vulnerability has been detected in SourceCodester CET Automa= ted Grading System with AI Predictive Analytics 1.0. This vulnerability aff= ects unknown code of the file /index.php?action=3Dview_student of the compo= nent POST Handler. The manipulation of the argument ID leads to authorizati=
on bypass. Remote exploitation of the attack is possible. The exploit has b= een disclosed publicly and may be used.</td>
<td>2026-07-03</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14608" target=3D= "_blank" rel=3D"noopener">CVE-2026-14608</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Multi-Vendor Online Grocery Ma= nagement System</td>
<td>A security vulnerability has been detected in SourceCodester Multi-Vend=
or Online Grocery Management System 1.0. This impacts the function update_s= ettings_info of the file classes/SystemSettings.php of the component Settin=
g Handler. Such manipulation of the argument content[] leads to code inject= ion. The attack can be executed remotely. The exploit has been disclosed pu= blicly and may be used.</td>
<td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14691" target=3D= "_blank" rel=3D"noopener">CVE-2026-14691</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Multi-Vendor Online Grocery Ma= nagement System</td>
<td>A vulnerability was detected in SourceCodester Multi-Vendor Online Groc= ery Management System 1.0/5.7.26. Affected is the function save_shop_type o=
f the file classes/Master.php of the component POST Parameter Handler. Perf= orming a manipulation results in sql injection. The attack is possible to b=
e carried out remotely. The exploit is now public and may be used.</td> <td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14692" target=3D= "_blank" rel=3D"noopener">CVE-2026-14692</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Multi-Vendor Online Grocery Ma= nagement System</td>
<td>A vulnerability has been found in SourceCodester Multi-Vendor Online Gr= ocery Management System 1.0. Affected by this issue is the function cancel_= order of the file classes/Master.php of the component POST Parameter Handle=
r. The manipulation of the argument ID leads to sql injection. It is possib=
le to initiate the attack remotely. The exploit has been disclosed to the p= ublic and may be used.</td>
<td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14694" target=3D= "_blank" rel=3D"noopener">CVE-2026-14694</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Multi-Vendor Online Grocery Ma= nagement System</td>
<td>A flaw has been found in SourceCodester Multi-Vendor Online Grocery Man= agement System 1.0. Affected by this vulnerability is the function cancel_o= rder of the file classes/Master.php. Executing a manipulation can lead to i= mproper authorization. The attack may be performed from remote. The exploit=
has been published and may be used.</td>
<td>2026-07-05</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14693" target=3D= "_blank" rel=3D"noopener">CVE-2026-14693</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Online Boat Reservation System= </td>
<td>A vulnerability was identified in SourceCodester Online Boat Reservatio=
n System 1.0. Affected by this vulnerability is an unknown functionality. S= uch manipulation leads to session expiration. It is possible to launch the = attack remotely. The exploit is publicly available and might be used.</td> <td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14725" target=3D= "_blank" rel=3D"noopener">CVE-2026-14725</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Onlne Examination &amp; Learni=
ng Management System</td>
<td>A vulnerability was identified in SourceCodester Onlne Examination &amp=
; Learning Management System 1.0. Affected is an unknown function of the fi=
le /process_lesson.php. Such manipulation of the argument user_id leads to = unrestricted upload. The attack may be launched remotely. The exploit is pu= blicly available and might be used. The name of the affected product appear=
s to have a typo in it.</td>
<td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14775" target=3D= "_blank" rel=3D"noopener">CVE-2026-14775</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Onlne Examination &amp; Learni=
ng Management System</td>
<td>A security flaw has been discovered in SourceCodester Onlne Examination=
&amp; Learning Management System 1.0. Affected by this vulnerability is th=
e function pathinfo of the file /upload_files.php of the component Filename=
Extension. Performing a manipulation results in unrestricted upload. Remot=
e exploitation of the attack is possible. The exploit has been released to = the public and may be used for attacks. The name of the affected product ap= pears to have a typo in it.</td>
<td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14776" target=3D= "_blank" rel=3D"noopener">CVE-2026-14776</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Onlne Examination &amp; Learni=
ng Management System</td>
<td>A weakness has been identified in SourceCodester Onlne Examination &amp=
; Learning Management System 1.0. Affected by this issue is some unknown fu= nctionality of the file /announcements.php. Executing a manipulation can le=
ad to unrestricted upload. The attack can be executed remotely. The exploit=
has been made available to the public and could be used for attacks. The n= ame of the affected product appears to have a typo in it.</td> <td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14777" target=3D= "_blank" rel=3D"noopener">CVE-2026-14777</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Simple Food Ordering System</t=

<td>A flaw has been found in SourceCodester Simple Food Ordering System 1.0=
. The affected element is an unknown function of the file /cart.php. Execut= ing a manipulation of the argument item_price can lead to business logic er= rors. The attack may be performed from remote. The exploit has been publish=
ed and may be used.</td>
<td>2026-06-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13571" target=3D= "_blank" rel=3D"noopener">CVE-2026-13571</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Syllabus-Aligned Learning Mana= gement and Examination System</td>
<td>A security flaw has been discovered in SourceCodester Syllabus-Aligned = Learning Management and Examination System 1.0. Impacted is an unknown func= tion of the file upload_files.php. Performing a manipulation results in unr= estricted upload. The attack may be initiated remotely. The exploit has bee=
n released to the public and may be used for attacks.</td>
<td>2026-07-05</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14698" target=3D= "_blank" rel=3D"noopener">CVE-2026-14698</a></td>
</tr>

<td class=3D"vendor-product">spacetime--Ad Inserter Ad Manager &amp; AdSens=
e Ads</td>
<td>The Ad Inserter - Ad Manager &amp; AdSense Ads plugin for WordPress is = vulnerable to Insecure Direct Object Reference in versions up to and includ= ing 2.8.16 via the 'data' attribute of the [adinserter] shortcode. This is = due to the replace_ai_tags() function processing a {reusable-block-N} tag p= attern that calls get_post_field('post_content', N) without verifying the r= equesting user's capability with current_user_can('read_post'), without res= tricting the post type to 'wp_block', and without checking the post status.=
This makes it possible for authenticated attackers, with Contributor-level=
access and above, to read the full content of arbitrary posts including Pr= ivate, Draft, Pending, Trashed, and password-protected posts owned by other=
users, by placing the shortcode in a post they own and previewing it.</td> <td>2026-07-03</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11900" target=3D= "_blank" rel=3D"noopener">CVE-2026-11900</a></td>
</tr>

<td class=3D"vendor-product">stellarwp--GiveWP Donation Plugin and Fundrais= ing Platform</td>
<td>The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPr= ess is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and ot= her) shortcode attributes of the 'givewp_campaign_comments' shortcode in ve= rsions up to, and including, 4.16.0. This is due to insufficient input sani= tization and output escaping on user supplied attributes in CampaignComment= sShortcode::parseAttributes() and BlockRenderController::render(), where th=
e blockId value is interpolated directly into a single-quoted HTML attribut=
e without esc_attr(). This makes it possible for authenticated attackers, w= ith author-level access and above, to inject arbitrary web scripts in pages=
that will execute whenever a user accesses an injected page.</td> <td>2026-07-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13246" target=3D= "_blank" rel=3D"noopener">CVE-2026-13246</a></td>
</tr>

<td class=3D"vendor-product">stellarwp--GiveWP Donation Plugin and Fundrais= ing Platform</td>
<td>The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPr= ess is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduct= ion][image]' parameter in all versions up to, and including, 4.16.1 due to = insufficient input sanitization and output escaping. This makes it possible=
for authenticated attackers, with Give Worker-level access and above, to i= nject arbitrary web scripts in pages that will execute whenever a user acce= sses an injected page.</td>
<td>2026-07-02</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13704" target=3D= "_blank" rel=3D"noopener">CVE-2026-13704</a></td>
</tr>

<td class=3D"vendor-product">stellarwp--GiveWP Donation Plugin and Fundrais= ing Platform</td>
<td>The GiveWP plugin for WordPress is vulnerable to Cross-Site Request For= gery in versions up to, and including, 4.15.3 This is due to missing nonce = validation on the give_set_notification_status_handler() function. This mak=
es it possible for unauthenticated attackers to disable donation email noti= fications via a forged request granted they can trick a site administrator = into performing an action such as clicking on a link.</td>
<td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11981" target=3D= "_blank" rel=3D"noopener">CVE-2026-11981</a></td>
</tr>

<td class=3D"vendor-product">stellarwp--Kadence Blocks Page Builder Toolkit=
for Gutenberg Editor</td>
<td>The Kadence Blocks - Page Builder Toolkit for Gutenberg Editor plugin f=
or WordPress is vulnerable to authorization bypass in all versions up to, a=
nd including, 3.7.7. This is due to the plugin not properly verifying that =
a user is authorized to perform an action. This makes it possible for authe= nticated attackers, with contributor-level access and above, to create arbi= trary Media Library attachments by downloading remote images to the site's = uploads directory via wp_upload_bits() and wp_insert_attachment(), bypassin=
g the upload_files capability boundary.</td>
<td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12902" target=3D= "_blank" rel=3D"noopener">CVE-2026-12902</a></td>
</tr>

<td class=3D"vendor-product">stellarwp--Kadence Blocks Page Builder Toolkit=
for Gutenberg Editor</td>
<td>The Kadence Blocks - Gutenberg Blocks for Page Builder Features plugin = for WordPress is vulnerable to Insecure Direct Object Reference in versions=
up to and including 3.7.7. This is due to a mismatch between the object us=
ed for authorization and the object actually accessed in the Optimize_Rest_= Controller's create_item(), get_item(), delete_item(), and bulk_delete_item= s() endpoints - authorization is checked via current_user_can('edit_post'/'= delete_post', $post_id) against the user-supplied post_id, while the storag=
e layer keys analysis records on sha256($post_path) from a separately suppl= ied, attacker-controlled post_path parameter, with no enforcement that post= _path corresponds to post_id. This makes it possible for authenticated atta= ckers, with Contributor-level access and above, to read or delete optimizer=
analysis records belonging to posts owned by other users by submitting the=
ir own post_id (which passes the capability check) together with the victim=
post's path.</td>
<td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12904" target=3D= "_blank" rel=3D"noopener">CVE-2026-12904</a></td>
</tr>

<td class=3D"vendor-product">stephen-kruger--bluebox</td>
<td>A vulnerability was found in stephen-kruger bluebox up to 4.5.12. Affec= ted by this vulnerability is an unknown functionality. Performing a manipul= ation of the argument code results in cross site scripting. It is possible =
to initiate the attack remotely. The exploit has been made public and could=
be used. The project was informed of the problem early through an issue re= port.</td>
<td>2026-07-05</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14704" target=3D= "_blank" rel=3D"noopener">CVE-2026-14704</a></td>
</tr>

<td class=3D"vendor-product">stephenharris--Event Organiser</td>
<td>The Event Organiser plugin for WordPress is vulnerable to Stored Cross-= Site Scripting in all versions up to, and including, 3.12.9. This is due to=
the 'eo_events' shortcode accepting attacker-controlled 'no_events' conten=
t and rendering it in event list templates without output escaping. This ma= kes it possible for authenticated attackers, with Contributor-level access = and above, to inject arbitrary web scripts in pages that will execute whene= ver a user accesses an injected page.</td>
<td>2026-07-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-2387" target=3D"= _blank" rel=3D"noopener">CVE-2026-2387</a></td>
</tr>

<td class=3D"vendor-product">StoneFly--Storage Concentrator</td>
<td>Storage Concentrator (SC &amp; SCVM) is vulnerable to reflected cross-s= ite scripting due to unsanitized content being echoed back in 404 error pag= es. An attacker can craft a malicious URL that, when visited by an authenti= cated user, causes arbitrary script content to execute within the victim's = browser session in the context of the application. This could be leveraged =
to steal session cookies, redirect users, or perform unauthorized actions o=
n behalf of the victim.</td>
<td>2026-06-30</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50040" target=3D= "_blank" rel=3D"noopener">CVE-2026-50040</a></td>
</tr>

<td class=3D"vendor-product">Stormshield--Stormshield Network Security</td> <td>A vulnerability was discovered on Stormshield Network Security 4.3.0=C2= =A0 to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (i= ncluded) A revoked client certificate can still be used to authenticate to = the captive-admin portal, allowing an attacker who possesses the revoked ce= rtificate to gain administrative access.</td>
<td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8480" target=3D"= _blank" rel=3D"noopener">CVE-2026-8480</a></td>
</tr>

<td class=3D"vendor-product">Stormshield--Stormshield Network Security</td> <td>A vulnerability was discovered on StormShield Network Security 4.3.0 to=
4.3.41 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (included) = There is a possible leak of secret information if administration commands h= ave been passed with the CLI command line tool. Someone with SSH access to = the firewall (if SSH multiuser mode is enabled) could possibly get the prox=
y CA passphrase or TPM password.</td>
<td>2026-07-02</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8482" target=3D"= _blank" rel=3D"noopener">CVE-2026-8482</a></td>
</tr>

<td class=3D"vendor-product">strapi--strapi</td>
<td>Strapi users-permissions plugin fails to restrict JWT algorithms when p= lugin::users-permissions.jwt.algorithm is not explicitly configured, allowi=
ng acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessi=
ng the jwtSecret can mint tokens with non-standard HMAC variants to bypass = algorithm restrictions and weaken authentication controls.</td> <td>2026-06-29</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57997" target=3D= "_blank" rel=3D"noopener">CVE-2026-57997</a></td>
</tr>

<td class=3D"vendor-product">Strategy11 Team--Business Directory</td> <td>Unauthenticated Cross Site Scripting (XSS) in Business Directory &lt;=
=3D 6.4.22 versions.</td>
<td>2026-06-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57326" target=3D= "_blank" rel=3D"noopener">CVE-2026-57326</a></td>
</tr>

<td class=3D"vendor-product">Strategy11 Team--Business Directory</td> <td>Subscriber Cross Site Scripting (XSS) in Business Directory &lt;=3D 6.4= .22 versions.</td>
<td>2026-06-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57328" target=3D= "_blank" rel=3D"noopener">CVE-2026-57328</a></td>
</tr>

<td class=3D"vendor-product">Strategy11 Team--Business Directory</td> <td>Unauthenticated Broken Access Control in Business Directory &lt;=3D 6.4= .23 versions.</td>
<td>2026-06-29</td>
<td>6.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57339" target=3D= "_blank" rel=3D"noopener">CVE-2026-57339</a></td>
</tr>

<td class=3D"vendor-product">Stylemix--MasterStudy LMS</td>
<td>Subscriber Cross Site Scripting (XSS) in MasterStudy LMS &lt;=3D 3.7.27=
versions.</td>
<td>2026-06-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57330" target=3D= "_blank" rel=3D"noopener">CVE-2026-57330</a></td>
</tr>

<td class=3D"vendor-product">stylemix--Motors Car Dealership &amp; Classifi=
ed Listings Plugin</td>
<td>The Motors - Car Dealership &amp; Classified Listings Plugin plugin for=
WordPress is vulnerable to authorization bypass in all versions up to, and=
including, 1.4.111. This is due to the plugin not properly verifying that =
a user is authorized to perform an action. This makes it possible for authe= nticated attackers, with subscriber-level access and above, to mark or unma=
rk any other user's car listing as sold by replaying a valid nonce harveste=
d from their own listing against an arbitrary victim post ID, triggering a = site-wide 'Sold' badge on the victim's listing and silently stripping its s= pecial_car featured post meta as a side effect. Exploitation requires the a= ttacker to hold an active listing of their own (obtainable by a Subscriber = via the plugin's add-listing form) in order to harvest a valid nonce for th=
e 'stm_mark_as_sold_car' action, which can then be replayed against any oth=
er listing's post ID.</td>
<td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12435" target=3D= "_blank" rel=3D"noopener">CVE-2026-12435</a></td>
</tr>

<td class=3D"vendor-product">StylemixThemes--Motors</td>
<td>Unauthenticated Broken Access Control in Motors &lt;=3D 5.6.80 versions= .</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27433" target=3D= "_blank" rel=3D"noopener">CVE-2026-27433</a></td>
</tr>

<td class=3D"vendor-product">Surbma--Surbma | Yoast SEO Breadcrumb Shortcod= e</td>
<td>Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb=
Shortcode &lt;=3D 1.2 versions.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57764" target=3D= "_blank" rel=3D"noopener">CVE-2026-57764</a></td>
</tr>

<td class=3D"vendor-product">taiga--taiga-back</td>
<td>Taiga before 6.10.2 contains a missing authorization vulnerability that=
allows unauthenticated remote attackers to create default due-date records=
in any project by exploiting unprotected POST endpoints on the user-story,=
task, and issue due-date API viewsets. Attackers can supply an arbitrary p= roject identifier to these endpoints, which bypass permission checks and ap= ply the AllowAny default, to pre-empt project administrators from initializ= ing due dates by creating records before they can do so themselves.</td> <td>2026-07-02</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59097" target=3D= "_blank" rel=3D"noopener">CVE-2026-59097</a></td>
</tr>

<td class=3D"vendor-product">taskbuilder--Taskbuilder Project Management &a= mp; Task Management Tool With Kanban Board</td>
<td>The Taskbuilder - Project Management &amp; Task Management Tool With Ka= nban Board plugin for WordPress is vulnerable to generic SQL Injection via = the 'wppm_proj_filter' parameter in all versions up to, and including, 5.0.=
8 due to insufficient escaping on the user supplied parameter and lack of s= ufficient preparation on the existing SQL query. This makes it possible for=
authenticated attackers, with subscriber-level access and above, to append=
additional SQL queries into already existing queries that can be used to e= xtract sensitive information from the database. No nonce verification is pe= rformed on the wp_ajax_wppm_view_project_tasks handler, meaning any authent= icated session - including subscriber-level - can reach the vulnerable code=
path without any additional preconditions.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12090" target=3D= "_blank" rel=3D"noopener">CVE-2026-12090</a></td>
</tr>

<td class=3D"vendor-product">taskbuilder--Taskbuilder Project Management &a= mp; Task Management Tool With Kanban Board</td>
<td>The Taskbuilder - Project Management &amp; Task Management Tool With Ka= nban Board plugin for WordPress is vulnerable to generic SQL Injection via = the 'task_search' parameter in all versions up to, and including, 5.0.8 due=
to insufficient escaping on the user supplied parameter and lack of suffic= ient preparation on the existing SQL query. This makes it possible for auth= enticated attackers, with subscriber-level access and above, to append addi= tional SQL queries into already existing queries that can be used to extrac=
t sensitive information from the database. The wppm_get_task_list AJAX hand= ler performs no capability check and no nonce verification, meaning any aut= henticated user including those with Subscriber-level access can invoke it = directly.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12110" target=3D= "_blank" rel=3D"noopener">CVE-2026-12110</a></td>
</tr>

<td class=3D"vendor-product">teableio--teable</td>
<td>Teable before 2026-06-15T04-43-24Z.1912 contains an improper access con= trol vulnerability that allows anonymous attackers to access hidden field d= ata by supplying arbitrary field IDs in the projection parameter of the sha=
re view records endpoint. Attackers can enumerate hidden field IDs from sha=
re metadata and specify them in projection parameters to read field values = that are intended to be restricted from public view.</td>
<td>2026-06-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56781" target=3D= "_blank" rel=3D"noopener">CVE-2026-56781</a></td>
</tr>

<td class=3D"vendor-product">themegrill--Zakra</td>
<td>The Zakra theme for WordPress is vulnerable to Stored Cross-Site Script= ing via post meta values in all versions up to, and including, 4.2.0. This =
is due to the theme registering three post meta fields (zakra_menu_item_col= or, zakra_menu_item_hover_color, and zakra_menu_item_active_color) with 'sh= ow_in_rest' =3D&gt; true and 'auth_callback' =3D&gt; '__return_true', but w= ithout any sanitize_callback parameter in the register_post_meta() calls. W= hile the classic editor save path applies sanitize_hex_color() sanitization=
, the REST API path completely bypasses this protection. The unsanitized me=
ta values are then retrieved via get_post_meta() and concatenated directly = into CSS strings that are output through wp_add_inline_style() without any = escaping. This makes it possible for authenticated attackers, with Contribu= tor-level access and above, to inject arbitrary web scripts in pages that w= ill execute whenever a user accesses the injected page.</td> <td>2026-07-03</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4804" target=3D"= _blank" rel=3D"noopener">CVE-2026-4804</a></td>
</tr>

<td class=3D"vendor-product">themeisle--RSS Aggregator by Feedzy Feed to Po= st, Autoblogging, News &amp; YouTube Video Feeds Aggregator</td>
<td>The RSS Aggregator by Feedzy - Feed to Post, Autoblogging, News &amp; Y= ouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored = Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and=
including, 5.2.1 due to insufficient input sanitization and output escapin=
g. This makes it possible for authenticated attackers, with contributor-lev=
el access and above, to inject arbitrary web scripts in pages that will exe= cute whenever a user accesses an injected page.</td>
<td>2026-07-02</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13252" target=3D= "_blank" rel=3D"noopener">CVE-2026-13252</a></td>
</tr>

<td class=3D"vendor-product">ThemeREX--Booked</td>
<td>Unauthenticated Cross Site Request Forgery (CSRF) in Booked &lt;=3D 3.0=
.0 versions.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57747" target=3D= "_blank" rel=3D"noopener">CVE-2026-57747</a></td>
</tr>

<td class=3D"vendor-product">Themeum--Kirki</td>
<td>Unauthenticated Insecure Direct Object References (IDOR) in Kirki &lt;=
=3D 6.0.11 versions.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57680" target=3D= "_blank" rel=3D"noopener">CVE-2026-57680</a></td>
</tr>

<td class=3D"vendor-product">themeum--Kirki Freeform Page Builder, Website = Builder &amp; Customizer</td>
<td>The Kirki - Freeform Page Builder, Website Builder &amp; Customizer plu= gin for WordPress is vulnerable to Sensitive Information Exposure in all ve= rsions up to, and including, 6.0.11 via the get_single_symbol. This makes i=
t possible for unauthenticated attackers to extract the full builder metada=
ta and rendered HTML of any kirki_symbol post - including unpublished draft=
s - by supplying a sequential WordPress post ID.</td>
<td>2026-07-02</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12122" target=3D= "_blank" rel=3D"noopener">CVE-2026-12122</a></td>
</tr>

<td class=3D"vendor-product">themeum--Kirki Freeform Page Builder, Website = Builder &amp; Customizer</td>
<td>The Kirki - Freeform Page Builder, Website Builder &amp; Customizer plu= gin for WordPress is vulnerable to authorization bypass in all versions up = to, and including, 6.0.11. This is due to the plugin not properly verifying=
that a user is authorized to perform an action. This makes it possible for=
unauthenticated attackers to send arbitrary HTML-injected emails - includi=
ng phishing messages embedding a real, valid WordPress password-reset URL f=
or the targeted user - to any registered user via the site's own mail serve=
r, abusing its SPF/DKIM reputation. The attacker-controlled emailSubject pa= rameter is passed to wp_mail() with only sanitize_text_field() applied, whi=
le emailBody 'text' items are concatenated raw into the HTML email body wit=
h no escaping, and 'chip' items can include the genuine WordPress password-= reset link for the targeted account.</td>
<td>2026-07-02</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12472" target=3D= "_blank" rel=3D"noopener">CVE-2026-12472</a></td>
</tr>

<td class=3D"vendor-product">themeum--Tutor LMS eLearning and online course=
solution</td>
<td>The Tutor LMS - eLearning and online course solution plugin for WordPre=
ss is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title=
in all versions up to, and including, 3.9.13 due to insufficient input san= itization and output escaping. This makes it possible for authenticated att= ackers, with author-level access and above, to inject arbitrary web scripts=
in pages that will execute whenever a user accesses an injected page.</td> <td>2026-07-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13443" target=3D= "_blank" rel=3D"noopener">CVE-2026-13443</a></td>
</tr>

<td class=3D"vendor-product">thimpress--LearnPress WordPress LMS Plugin for=
Create and Sell Online Courses</td>
<td>The LearnPress - WordPress LMS Plugin for Create and Sell Online Course=
s plugin for WordPress is vulnerable to Insecure Direct Object Reference in=
all versions up to, and including, 4.3.9.1 via the 'userId' parameter due =
to missing validation on a user controlled key. This makes it possible for = authenticated attackers, with subscriber-level access and above, to view th=
e course enrollment progress and completion data belonging to any instructo=
r or administrator account on the site. This IDOR does not apply when the t= arget user is a regular subscriber, as the guard correctly blocks cross-sub= scriber access; exploitation is limited to cases where the victim user hold=
s the LP_TEACHER_ROLE or administrator role.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11988" target=3D= "_blank" rel=3D"noopener">CVE-2026-11988</a></td>
</tr>

<td class=3D"vendor-product">thimpress--LearnPress WordPress LMS Plugin for=
Create and Sell Online Courses</td>
<td>The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site = Scripting via the 'class_wrapper_form' shortcode attribute in versions up t=
o, and including, 4.4.0. This is due to insufficient input sanitization and=
output escaping in the FilterCourseTemplate::sections() method at line 98,=
where the attacker-controlled attribute is inserted into an HTML class att= ribute via sprintf('&lt;form class=3D"%s"&gt;', $class_wrapper_form) withou=
t esc_attr() escaping. The FilterCourseShortcode::render() handler does not=
apply shortcode_atts() filtering, so raw user attributes flow directly thr= ough do_action('learn-press/filter-courses/layout', $data) into the templat=
e. This makes it possible for authenticated attackers, with contributor-lev=
el access and above, to inject arbitrary web scripts in pages that will exe= cute whenever a user accesses an injected page.</td>
<td>2026-07-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12732" target=3D= "_blank" rel=3D"noopener">CVE-2026-12732</a></td>
</tr>

<td class=3D"vendor-product">Tim Strifler--Exclusive Addons Elementor</td> <td>Insertion of Sensitive Information Into Sent Data vulnerability in Tim = Strifler Exclusive Addons Elementor allows Retrieve Embedded Sensitive Data=
. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.9.<=

<td>2026-07-05</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59511" target=3D= "_blank" rel=3D"noopener">CVE-2026-59511</a></td>
</tr>

<td class=3D"vendor-product">TR7 Cyber Defense Inc.--WAF-ASP</td>
<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') vulnerability in TR7 Cyber-Defense Inc. WAF-ASP allows Stored=
XSS. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.</td> <td>2026-07-02</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4772" target=3D"= _blank" rel=3D"noopener">CVE-2026-4772</a></td>
</tr>

<td class=3D"vendor-product">TR7 Cyber Defense Inc.--WAF-ASP</td>
<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') vulnerability in TR7 Cyber-Defense Inc. Web Application Firew= all allows DOM-Based XSS. This issue affects Web Application Firewall: from=
v1.0.42.239 before v1.4.0.117.</td>
<td>2026-07-02</td>
<td>4.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4770" target=3D"= _blank" rel=3D"noopener">CVE-2026-4770</a></td>
</tr>

<td class=3D"vendor-product">trainingbusinesspros--Groundhogg CRM, Newslett= ers, and Marketing Automation</td>
<td>The Groundhogg - CRM, Newsletters, and Marketing Automation plugin for = WordPress is vulnerable to generic SQL Injection via the 'select' parameter=
in all versions up to, and including, 4.5.8 due to insufficient escaping o=
n the user supplied parameter and lack of sufficient preparation on the exi= sting SQL query. This makes it possible for authenticated attackers, with c= ustom-level access and above, to append additional SQL queries into already=
existing queries that can be used to extract sensitive information from th=
e database. Exploitation requires the attacker to hold a Groundhogg custom = role with the view_contacts capability, which is granted by default to seve= ral built-in Groundhogg roles above the base subscriber level.</td> <td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14029" target=3D= "_blank" rel=3D"noopener">CVE-2026-14029</a></td>
</tr>

<td class=3D"vendor-product">tranmautritam--TheFox</td>
<td>Contributor Cross Site Scripting (XSS) in TheFox &lt;=3D 3.9.70 version= s.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57684" target=3D= "_blank" rel=3D"noopener">CVE-2026-57684</a></td>
</tr>

<td class=3D"vendor-product">ultimatemember--Ultimate Member User Profile, = Registration, Login, Member Directory, Content Restriction &amp; Membership=
Plugin</td>
<td>The Ultimate Member - User Profile, Registration, Login, Member Directo= ry, Content Restriction &amp; Membership Plugin plugin for WordPress is vul= nerable to Stored Cross-Site Scripting via the 'about_me' parameter in all = versions up to, and including, 2.11.4 due to insufficient input sanitizatio=
n and output escaping. This makes it possible for authenticated attackers, = with subscriber-level access and above, to inject arbitrary web scripts in = pages that will execute whenever a user accesses an injected page.</td> <td>2026-07-03</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8489" target=3D"= _blank" rel=3D"noopener">CVE-2026-8489</a></td>
</tr>

<td class=3D"vendor-product">uvnc--UltraVNC</td>
<td>UltraVNC repeater through 1.8.2.2 contains an integer overflow in the H= TTP request logging path. In repeater/webgui/settings.c:336, the win_log() = function allocates list nodes via malloc(sizeof(struct LIST) + strlen(line)=
), where line is derived from HTTP request URIs. If strlen(line) is suffici= ently large, the addition overflows to a value smaller than sizeof(struct L= IST), causing a heap allocation smaller than required. The subsequent strcp=
y of the full string into the undersized allocation produces a heap buffer = overflow. In the current implementation this overflow is bounded by the HTT=
P receive buffer size (WI_RXBUFSIZE =3D 153600 bytes, well below SIZE_MAX o=
n 32-bit builds), limiting practical exploitability to a partial heap write=
. A remote unauthenticated attacker can trigger the theoretical overflow pa=
th by sending a maximally-sized URI in an HTTP request to the repeater HTTP=
port.</td>
<td>2026-07-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7828" target=3D"= _blank" rel=3D"noopener">CVE-2026-7828</a></td>
</tr>

<td class=3D"vendor-product">uvnc--UltraVNC</td>
<td>UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random nu= mber generator to produce VNC authentication challenge bytes. In rfb/vncaut= h.c:119-129, the vncRandomBytes() function seeds libc rand() with time(0) +=
getpid() + rand() and generates a 16-byte challenge. The combined seed spa=
ce is approximately 31 bits (libc rand() internal state) and is entirely de= termined by publicly-observable values (wall-clock time and process ID). An=
attacker who can observe the authentication exchange can enumerate the see=
d space and predict the challenge within seconds, enabling forgery or offli=
ne brute-forcing of responses. Note: on Windows, the active code path may u=
se vncEncryptBytes2.cpp which calls CryptGenRandom; reachability on shipped=
Windows binaries requires compile-graph verification and is under investig= ation.</td>
<td>2026-07-01</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44040" target=3D= "_blank" rel=3D"noopener">CVE-2026-44040</a></td>
</tr>

<td class=3D"vendor-product">uvnc--UltraVNC</td>
<td>UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-str= ing to multibyte conversion helper. In rfb/dh.cpp:204, the vncWc2Mb() funct= ion passes a caller-supplied WCHAR pointer to wcslen() before any bounds ch= eck. If the caller provides a wide-character buffer that is not properly NU= L-terminated, wcslen() reads past the end of the buffer until it encounters=
a NUL wchar, resulting in an out-of-bounds read. Under typical Win32 API u= sage this requires an abnormal caller contract. Impact is limited to a pote= ntial information disclosure from adjacent memory regions or a process cras=
h (denial of service) if the over-read crosses a page boundary.</td> <td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44041" target=3D= "_blank" rel=3D"noopener">CVE-2026-44041</a></td>
</tr>

<td class=3D"vendor-product">UX-themes--Flatsome</td>
<td>Contributor Broken Access Control in Flatsome &lt;=3D 3.20.5 versions.<=

<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57731" target=3D= "_blank" rel=3D"noopener">CVE-2026-57731</a></td>
</tr>

<td class=3D"vendor-product">UX-themes--Flatsome</td>
<td>Subscriber Broken Access Control in Flatsome &lt;=3D 3.20.5 versions.</=

<td>2026-07-02</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57730" target=3D= "_blank" rel=3D"noopener">CVE-2026-57730</a></td>
</tr>

<td class=3D"vendor-product">VillaTheme--ALD Dropshipping and Fulfillment f=
or AliExpress and WooCommerce</td>
<td>Unauthenticated Broken Authentication in ALD - Dropshipping and Fulfill= ment for AliExpress and WooCommerce &lt;=3D 2.2.0 versions.</td> <td>2026-07-02</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57352" target=3D= "_blank" rel=3D"noopener">CVE-2026-57352</a></td>
</tr>

<td class=3D"vendor-product">villatheme--CURCY Multi Currency for WooCommer=
ce Smoothly on WooCommerce 9.x</td>
<td>The The CURCY - Multi Currency for WooCommerce - Smoothly on WooCommerc=
e 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution i=
n all versions up to, and including, 2.2.14. This is due to the software al= lowing users to execute an action that does not properly validate a value b= efore running do_shortcode. This makes it possible for unauthenticated atta= ckers to execute arbitrary shortcodes.</td>
<td>2026-07-03</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11778" target=3D= "_blank" rel=3D"noopener">CVE-2026-11778</a></td>
</tr>

<td class=3D"vendor-product">vjinfotech--WP Import Export Lite</td>
<td>The WP Import Export Lite plugin for WordPress is vulnerable to Server-= Side Request Forgery in all versions up to and including 3.9.30 via the wpi= e_import_upload_file_from_url AJAX action. The plugin's URL downloader firs=
t calls wp_safe_remote_get() (which correctly blocks private/reserved IP ra= nges), but when that call returns a WP_Error - the exact outcome for any bl= ocked internal host - the Download::download_file() method falls back to Gu= zzleHttp\Client::request() with the original attacker-supplied URL and no S= SRF protection (and with TLS verification disabled). This makes it possible=
for authenticated attackers, with administrator-level access and above, to=
make web requests to arbitrary locations originating from the web applicat= ion and can be used to query and modify information from internal services = such as the cloud metadata endpoint at 169.</td>
<td>2026-07-03</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11397" target=3D= "_blank" rel=3D"noopener">CVE-2026-11397</a></td>
</tr>

<td class=3D"vendor-product">Vsourz Digital--Advanced Contact form 7 DB</td=

<td>Subscriber Broken Access Control in Advanced Contact form 7 DB &lt;=3D = 2.0.9 versions.</td>
<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57669" target=3D= "_blank" rel=3D"noopener">CVE-2026-57669</a></td>
</tr>

<td class=3D"vendor-product">w1.fi--hostapd</td>
<td>In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE=
802.11be) Multi-Link Operation (MLO) association request processing allows=
an unauthenticated attacker within wireless range to send a crafted manage= ment frame containing a malformed Multi-Link Element or Per-STA Profile sub= element. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the = received link_id field can be parsed as value 15, but the corresponding lin= ks[] storage only has valid entries for lower link IDs (0 through 14). This=
causes an out-of-bounds write / small memory corruption during association=
processing before the 4-way handshake. The attack does not require network=
credentials, prior authentication, or user interaction. The confirmed prac= tical impact is denial of service through hostapd process termination. This=
affects hostapd v2.11 and newer development snapshots before v2.12 when bu= ilt with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 an=
d the upstream 2026-1 fixes.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58374" target=3D= "_blank" rel=3D"noopener">CVE-2026-58374</a></td>
</tr>

<td class=3D"vendor-product">wagtail--wagtail</td>
<td>Wagtail is an open source content management system built on Django. In=
versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission chec=
k on the image preview endpoint, a user with access to the Wagtail admin ca=
n preview any image. The existing data of the image object itself is not ex= posed. The vulnerability is not exploitable by an ordinary site visitor wit= hout access to the Wagtail admin. This issue has been fixed in versions 7.0= .8, 7.3.3, and 7.4.2.</td>
<td>2026-07-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54261" target=3D= "_blank" rel=3D"noopener">CVE-2026-54261</a></td>
</tr>

<td class=3D"vendor-product">wagtail--wagtail</td>
<td>Wagtail is an open source content management system built on Django. In=
versions prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser=
's chosen endpoint incorrectly listed items for which the user has not been=
granted choose permission. A user with access to the Wagtail admin could s=
ee the filename and name and URLs of documents and images in those collecti= ons. The vulnerability is not exploitable by an ordinary site visitor witho=
ut access to the Wagtail admin. This issue has been fixed in versions 7.0.8=
, 7.3.3, and 7.4.2.</td>
<td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54259" target=3D= "_blank" rel=3D"noopener">CVE-2026-54259</a></td>
</tr>

<td class=3D"vendor-product">wagtail--wagtail</td>
<td>Wagtail is an open source content management system built on Django. In=
versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can = trigger expensive rendition processing with purposefully crafted filter spe=
cs resulting in potentially service degradation. The vulnerability is not e= xploitable by an ordinary site visitor without access to the Wagtail admin.=
This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.</td> <td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54260" target=3D= "_blank" rel=3D"noopener">CVE-2026-54260</a></td>
</tr>

<td class=3D"vendor-product">wagtail--wagtail</td>
<td>Wagtail is an open source content management system built on Django. In=
versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can s= ubmit translation" permission can create translations for any page, includi=
ng those they do not have permissions for. This issue has been fixed in ver= sions 7.0.8, 7.3.3, and 7.4.2.</td>
<td>2026-07-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54262" target=3D= "_blank" rel=3D"noopener">CVE-2026-54262</a></td>
</tr>

<td class=3D"vendor-product">wappointment--Appointment Bookings for Zoom Go= ogleMeet and more Wappointment</td>
<td>The Appointment Bookings for Zoom GoogleMeet and more - Wappointment pl= ugin for WordPress is vulnerable to Insecure Direct Object Reference in all=
versions up to and including 2.7.6 via the `appointmentkey` parameter due =
to the appointment `edit_key` - the sole authorization token consumed by `t= ryCancel()` - being generated as a predictable, unsalted MD5 hash of only `= client_id` (a sequential integer), `start_at` (a publicly observable appoin= tment timestamp), and `staff_id` (a small enumerable integer), with no secr=
et salt or random component, and the unauthenticated cancellation and resch= eduling REST endpoints performing no ownership or identity verification bey= ond matching this reconstructible key. This makes it possible for unauthent= icated attackers to compute valid `edit_key` values for appointments belong= ing to other users and cancel or reschedule those appointments arbitrarily.=
Exploitation requires the `allow_cancellation` or `allow_rescheduling` set= ting to be enabled on the site, both of which are common configurations for=
active booking deployments; an attacker can obtain the inputs needed to re= construct a victim's key by booking their own appointment to observe their = sequential `client_id` and correlating publicly visible appointment times a=
nd enumerable staff identifiers.</td>
<td>2026-07-02</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9188" target=3D"= _blank" rel=3D"noopener">CVE-2026-9188</a></td>
</tr>

<td class=3D"vendor-product">Wavlink--WL-NU516U1-A</td>
<td>A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. T=
he affected element is the function sub_401D68 of the file /cgi-bin/wireles= s.cgi of the component POST Parameter Handler. This manipulation of the arg= ument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote=
exploitation of the attack is possible. The exploit has been publicly disc= losed and may be utilized. The affected component should be upgraded. The v= endor was contacted early, responded in a very professional manner and quic= kly released a fixed version of the affected product.</td>
<td>2026-06-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13538" target=3D= "_blank" rel=3D"noopener">CVE-2026-13538</a></td>
</tr>

<td class=3D"vendor-product">Webba Plugins--Webba Booking</td>
<td>Missing Authorization vulnerability in Webba Plugins Webba Booking allo=
ws Exploiting Incorrectly Configured Access Control Security Levels. This i= ssue affects Webba Booking: from n/a through 6.4.13.</td>
<td>2026-07-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27409" target=3D= "_blank" rel=3D"noopener">CVE-2026-27409</a></td>
</tr>

<td class=3D"vendor-product">webpack-dev-server--webpack-dev-server</td> <td>webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.=
js process when an unauthenticated peer sends either a normal HTTP request = with a malformed Host header or a WebSocket upgrade to the default /ws endp= oint with a malformed Origin header. The malformed value causes an uncaught=
exception in the host-validation path and crashes the dev server. Impact i=
s limited to availability of the development server, no data disclosure, no=
code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds:=
keep the dev server bound to localhost (the default) and do not expose it =
to untrusted networks.</td>
<td>2026-07-03</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14631" target=3D= "_blank" rel=3D"noopener">CVE-2026-14631</a></td>
</tr>

<td class=3D"vendor-product">webpack-dev-server--webpack-dev-server</td> <td>webpack-dev-server versions 5.2.5 and earlier expose two internal devel= oper endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/inv= alidate, that perform state-changing actions on any GET request without ver= ifying that the request originated from the dev server's own page. Any webs= ite a developer visits while the dev server is running can trigger these en= dpoints cross-origin with no interaction beyond the visit. An attacker can = open an arbitrary existing local file in the developer's editor, including = files outside the project root, and repeated requests can spawn editor proc= esses and force recompilations that degrade the developer's machine. Patche=
s: upgrade to webpack-dev-server 5.2.6. Workarounds: none.</td> <td>2026-07-03</td>
<td>4.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14620" target=3D= "_blank" rel=3D"noopener">CVE-2026-14620</a></td>
</tr>

<td class=3D"vendor-product">wedevs--weDocs: AI Powered Knowledge Base, Doc=
s, Documentation, Wiki &amp; AI Chatbot</td>
<td>The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki &amp; =
AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scriptin=
g via 'sectionTitleTag' and 'articleTitleTag' Block Attributes in all versi= ons up to, and including, 2.3.0 due to insufficient input sanitization and = output escaping. This makes it possible for authenticated attackers, with c= ontributor-level access and above, to inject arbitrary web scripts in pages=
that will execute whenever a user accesses an injected page.</td> <td>2026-07-03</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12731" target=3D= "_blank" rel=3D"noopener">CVE-2026-12731</a></td>
</tr>

<td class=3D"vendor-product">wedevs--weDocs: AI Powered Knowledge Base, Doc=
s, Documentation, Wiki &amp; AI Chatbot</td>
<td>The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki &amp; =
AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scriptin=
g via 'connectorWidth' Block Attribute in all versions up to, and including=
, 2.3.0 due to insufficient input sanitization and output escaping. This ma= kes it possible for authenticated attackers, with contributor-level access = and above, to inject arbitrary web scripts in pages that will execute whene= ver a user accesses an injected page.</td>
<td>2026-07-03</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12734" target=3D= "_blank" rel=3D"noopener">CVE-2026-12734</a></td>
</tr>

<td class=3D"vendor-product">wedevs--weDocs: AI Powered Knowledge Base, Doc=
s, Documentation, Wiki &amp; AI Chatbot</td>
<td>The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki &amp; =
AI Chatbot plugin for WordPress is vulnerable to Missing Authorization in v= ersions up to and including 2.3.0. This is due to a missing capability chec=
k on the do_migration() function registered as the wedocs_migrate_betterdoc= s_to_wedocs AJAX action, which performs no nonce verification via check_aja= x_referer() and no capability check via current_user_can() before executing=
sensitive operations. This makes it possible for authenticated attackers, = with Subscriber-level access and above, to trigger a full BetterDocs-to-weD= ocs data migration, creating and modifying 'docs' custom post type entries = with attacker-controlled titles, updating site options, and deactivating th=
e BetterDocs and BetterDocs Pro plugins via deactivate_plugins().</td> <td>2026-07-03</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12729" target=3D= "_blank" rel=3D"noopener">CVE-2026-12729</a></td>
</tr>

<td class=3D"vendor-product">weDevs--WP User Frontend</td>
<td>Unauthenticated Broken Access Control in WP User Frontend &lt;=3D 4.3.7=
versions.</td>
<td>2026-06-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57334" target=3D= "_blank" rel=3D"noopener">CVE-2026-57334</a></td>
</tr>

<td class=3D"vendor-product">weng-xianhu--EyouCMS</td>
<td>A security vulnerability has been detected in weng-xianhu EyouCMS up to=
1.7.1. This issue affects some unknown processing of the file /index.php o=
f the component API. Such manipulation of the argument click_like leads to = sql injection. The attack can be executed remotely. The exploit has been di= sclosed publicly and may be used. The project was informed of the problem e= arly through an issue report but has not responded yet.</td> <td>2026-06-29</td>
<td>4.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13569" target=3D= "_blank" rel=3D"noopener">CVE-2026-13569</a></td>
</tr>

<td class=3D"vendor-product">WofficeIO--Woffice</td>
<td>Missing Authorization vulnerability in WofficeIO Woffice allows Exploit= ing Incorrectly Configured Access Control Security Levels. This issue affec=
ts Woffice: from n/a before 5.4.33.</td>
<td>2026-07-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27435" target=3D= "_blank" rel=3D"noopener">CVE-2026-27435</a></td>
</tr>

<td class=3D"vendor-product">WOOCOMMERCE DESIGNER PRO--WooCommerce Designer=
Pro</td>
<td>Subscriber Cross Site Scripting (XSS) in WooCommerce Designer Pro &lt;=
=3D 1.9.34 versions.</td>
<td>2026-06-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57329" target=3D= "_blank" rel=3D"noopener">CVE-2026-57329</a></td>
</tr>

<td class=3D"vendor-product">woodpecker-ci--woodpecker</td>
<td>Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name = endpoint without authentication middleware, and the LookupOrg handler uncon= ditionally dereferences the session user (user.ForgeID, via ForgeFromUser) = when selecting the forge to query. For an unauthenticated request session.U= ser returns nil, so any unauthenticated HTTP request triggers a NULL pointe=
r dereference in the handler. The panic is recovered by gin recovery middle= ware and the server continues serving (returning HTTP 500), but each reques=
t writes a multi-line panic stack trace to the error log. A low-bandwidth u= nauthenticated attacker can repeatedly probe the endpoint to flood the logs=
(about 37 lines per request), inflating disk usage and downstream log-inge= stion cost and burying legitimate log events.</td>
<td>2026-06-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58369" target=3D= "_blank" rel=3D"noopener">CVE-2026-58369</a></td>
</tr>

<td class=3D"vendor-product">WP Reloaded--ApplyOnline</td>
<td>Missing Authorization vulnerability in WP Reloaded ApplyOnline allows E= xploiting Incorrectly Configured Access Control Security Levels. This issue=
affects ApplyOnline: from n/a through 2.6.7.6.</td>
<td>2026-07-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57721" target=3D= "_blank" rel=3D"noopener">CVE-2026-57721</a></td>
</tr>

<td class=3D"vendor-product">wpchill--Kali Forms Contact Form &amp; Drag-an= d-Drop Builder</td>
<td>The Kali Forms - Contact Form &amp; Drag-and-Drop Builder plugin for Wo= rdPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliform= s_field_components]' parameter in all versions up to, and including, 2.4.13=
due to insufficient input sanitization and output escaping. This makes it = possible for authenticated attackers, with contributor-level access and abo= ve, to inject arbitrary web scripts in pages that will execute whenever a u= ser accesses an injected page.</td>
<td>2026-07-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9107" target=3D"= _blank" rel=3D"noopener">CVE-2026-9107</a></td>
</tr>

<td class=3D"vendor-product">wplegalpages--Cookie Banner for GDPR / CCPA WP=
LP Cookie Consent</td>
<td>The Cookie Banner for GDPR / CCPA - WPLP Cookie Consent plugin for Word= Press is vulnerable to generic SQL Injection via the 's' parameter in all v= ersions up to, and including, 4.3.5 due to insufficient escaping on the use=
r supplied parameter and lack of sufficient preparation on the existing SQL=
query. This makes it possible for authenticated attackers, with administra= tor-level access and above, to append additional SQL queries into already e= xisting queries that can be used to extract sensitive information from the = database.</td>
<td>2026-07-03</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12920" target=3D= "_blank" rel=3D"noopener">CVE-2026-12920</a></td>
</tr>

<td class=3D"vendor-product">wpmart--Team Members Multi Language Supported = Team Plugin</td>
<td>The Team Members - Multi Language Supported Team Plugin plugin for Word= Press is vulnerable to Stored Cross-Site Scripting via admin settings in al=
l versions up to, and including, 8.7 due to insufficient input sanitization=
and output escaping. This makes it possible for authenticated attackers, w= ith administrator-level permissions and above, to inject arbitrary web scri= pts in pages that will execute whenever a user accesses an injected page. T= his only affects multi-site installations and installations where unfiltere= d_html has been disabled.</td>
<td>2026-06-30</td>
<td>4.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12114" target=3D= "_blank" rel=3D"noopener">CVE-2026-12114</a></td>
</tr>

<td class=3D"vendor-product">wpqode--Editorial Rating Product Review &amp; = Rating System</td>
<td>The Editorial Rating - Product Review &amp; Rating System plugin for Wo= rdPress is vulnerable to Stored Cross-Site Scripting via 'Link URL' Field i=
n all versions up to, and including, 4.0.5 due to insufficient input saniti= zation and output escaping. This makes it possible for authenticated attack= ers, with administrator-level access and above, to inject arbitrary web scr= ipts in pages that will execute whenever a user accesses an injected page. = The WordPress unfiltered_html capability exemption does not apply here beca= use the payload is stored in post meta (_wpas_er_options via update_post_me= ta) rather than in post_content or post_excerpt, meaning the restriction af= fects all administrators regardless of their unfiltered_html status.</td> <td>2026-06-30</td>
<td>4.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12560" target=3D= "_blank" rel=3D"noopener">CVE-2026-12560</a></td>
</tr>

<td class=3D"vendor-product">WSO2--WSO2 API Manager</td>
<td>The silent Just-In-Time (JIT) provisioning feature in federated authent= ication implementations fails to properly segregate user roles during accou=
nt creation when a federated user shares a username with a local user. This=
allows the provisioning process to overwrite existing roles of local users=
with roles assigned to the federated user. Exploitation requires a federat=
ed identity provider (IDP) with silent JIT provisioning enabled and an atta= cker's knowledge of a local user's username. When these conditions are met,=
a malicious individual can leverage the JIT provisioning process to modify=
the roles of local users. The overwritten roles are limited to those defin=
ed within the federated IDP, typically granting minimal access rights unles=
s explicitly configured otherwise by the federated IDP administrator.</td> <td>2026-07-04</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2024-1248" target=3D"= _blank" rel=3D"noopener">CVE-2024-1248</a></td>
</tr>

<td class=3D"vendor-product">yahoo--elide</td>
<td>Elide through 7.1.17 fails to enforce @ReadPermission on client-supplie=
d sort expressions in SortingImpl.getValidSortingRules, allowing attackers =
to sort collections by forbidden fields. Attackers can infer hidden field v= alues through row ordering analysis, leaking relative field ordering across=
all rows via both JSON:API and GraphQL read paths.</td>
<td>2026-06-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57954" target=3D= "_blank" rel=3D"noopener">CVE-2026-57954</a></td>
</tr>

<td class=3D"vendor-product">Yunai--ruoyi-vue-pro</td>
<td>ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a miss= ing authorization vulnerability in the CRM module's GET /admin-api/crm/foll= ow-up-record/get endpoint that allows authenticated users to read any follo= w-up record by iterating sequential numeric IDs. Attackers can exploit this=
by sending requests with arbitrary ID parameters to access other users' fo= llow-up notes, file attachments, scheduling information, and business entit=
y references without proper authorization checks.</td>
<td>2026-06-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57949" target=3D= "_blank" rel=3D"noopener">CVE-2026-57949</a></td>
</tr>

<td class=3D"vendor-product">YunaiV--yudao-cloud</td>
<td>yudao-cloud before 2026.06 contains a broken access control vulnerabili=
ty in the BPM module that allows any authenticated user to access arbitrary=
process instance records by supplying a caller-controlled process-instance=
identifier to an unprotected endpoint lacking the @PreAuthorize annotation=
. Attackers can query any process-instance identifier through the unguarded=
GET endpoint to read sensitive workflow data including submitted form vari= ables, approver identities, approval and rejection comments, and process BP=
MN XML without ownership or tenant party verification.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58448" target=3D= "_blank" rel=3D"noopener">CVE-2026-58448</a></td>
</tr>

<td class=3D"vendor-product">YzmCMS--YzmCMS</td>
<td>A vulnerability was determined in YzmCMS up to 7.5. This affects an unk= nown function of the file /application/install/index.php. Executing a manip= ulation of the argument siteurl can lead to sql injection. The attack can b=
e executed remotely. A high complexity level is associated with this attack=
. The exploitability is reported as difficult. The exploit has been publicl=
y disclosed and may be utilized. The vendor was contacted early about this = disclosure but did not respond in any way.</td>
<td>2026-06-29</td>
<td>5.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13529" target=3D= "_blank" rel=3D"noopener">CVE-2026-13529</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td> <td>mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial= _util.c calls net_buf_reset() on the result of smp_packet_alloc() before ch= ecking it for NULL. smp_packet_alloc() uses net_buf_alloc(K_NO_WAIT) agains=
t the shared MCUmgr packet pool (CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT, defa= ult 4), which returns NULL when the pool is exhausted. In default builds th=
e __ASSERT_NO_MSG in net_buf_reset is a no-op, so net_buf_simple_reset writ=
es through the NULL pointer (buf-&gt;len =3D 0; buf-&gt;data =3D buf-&gt;__= buf), causing a fault/crash. The fragment data reaches this code from attac= ker-controlled bytes on the MCUmgr serial/UART/shell-console transports (sm= p_uart.c, smp_raw_uart.c, smp_shell.c), and a fresh buffer is allocated at = the start of essentially every new packet. An attacker on the serial/consol=
e link can flood the transport to drive the 4-entry buffer pool to exhausti=
on and induce the NULL dereference, crashing the device (denial of service)=
. The defect was introduced after the original MCUmgr rework and shipped in=
Zephyr v4.4.0. The fix moves the NULL check ahead of net_buf_reset.</td> <td>2026-06-29</td>
<td>6.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10648" target=3D= "_blank" rel=3D"noopener">CVE-2026-10648</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its = reference counts -- the per-header buf-&gt;ref and the per-data-block ref_c= ount at the start of each variable/heap data allocation -- with plain non-a= tomic C operators (buf-&gt;ref++, if (--buf-&gt;ref &gt; 0), if (--(*ref_co= unt))). The API is documented as self-synchronizing: callers may share one = buffer across threads (e.g. via k_fifo) and each holder independently calls=
net_buf_unref() with no surrounding lock. Under true concurrency (SMP, or = single-core preemption between the non-atomic load and store while another = context unrefs the same buffer), two holders can both observe the same prio=
r reference value and both conclude they are the last reference. For heap/v= ariable-data pools (mem_pool_data_unref/heap_data_unref, used by zbus messa=
ge subscribers, the IP stack RX/TX buffers when CONFIG_NET_BUF_FIXED_DATA_S= IZE=3Dn, capture, wireguard, ISO-TP and usbip) this produces a double k_hea= p_free()/k_free() of the same block -- heap-metadata corruption and a use-a= fter-free on the heap-hardening poison pattern. For the per-header refcount=
the buffer is returned to the pool free LIFO twice for any pool type (incl= uding fixed-data pools used by Bluetooth and networking), corrupting the fr=
ee list so a later allocation hands the same buffer to two owners. The fix = converts both refcounts to atomic_inc/atomic_dec (overlaying buf-&gt;ref in=
an atomic_t-sized union and changing the data-block refcount from uint8_t =
to atomic_t). Impact is gated on genuine concurrency and on an application = architecture that shares one buffer among multiple independent unref'ers; t=
he trigger is a refcount/timing race rather than packet content, so an exte= rnal attacker has at most weak indirect influence over the race window. Aff= ects all Zephyr releases through v4.4.0.</td>
<td>2026-06-30</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10653" target=3D= "_blank" rel=3D"noopener">CVE-2026-10653</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>The asynchronous SNTP client in Zephyr (subsys/net/lib/sntp/sntp.c, snt= p_close_async) closed the UDP socket file descriptor directly from the call= ing thread immediately after detaching it from the network socket service, = without synchronizing with the socket-service poll thread. The socket servi=
ce thread polls each socket via zvfs_poll, which (in zsock_poll_prepare_ctx=
) registers a k_poll_event pointing into the socket's net_context (&amp;ctx= -&gt;recv_q) and then blocks in k_poll without holding a reference or lock.=
net_context objects are allocated from a fixed pool (contexts[CONFIG_NET_M= AX_CONTEXTS]) and reused after close. When sntp_close_async is invoked from=
a different thread than the poll thread (in the in-tree consumer subsys/ne= t/lib/config/init_clock_sntp.c, the SNTP timeout handler runs on the system=
workqueue while the socket service thread is blocked in poll on the same f= d), the close frees and may reuse the net_context while the poll thread sti=
ll has a poller node linked into the freed object, resulting in a use-after= -free / object confusion of kernel poll structures. The SNTP timeout path i=
s the normal no-response failure mode, so a network peer or off-path attack=
er who drops or delays the SNTP/NTP response can drive the racing close rep= eatedly (and periodically with NET_CONFIG_SNTP_INIT_RESYNC). The most likel=
y consequence is a crash of the networking thread (denial of service), with=
potential memory corruption when the freed context slot is reallocated. Th=
e fix defers the close to the socket service thread itself via net_socket_s= ervice_close (NET_SOCKET_SERVICE_CLOSE_SOCKETS), so the same thread that po= lls performs the close, eliminating the race. Affected releases: v4.2.0 thr= ough v4.4.0.</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10655" target=3D= "_blank" rel=3D"noopener">CVE-2026-10655</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/= controller/ll_sw/isoal.c) fails to validate the length field of a framed IS=
O PDU start segment. Per the Bluetooth specification a start segment (sc=3D=
0) always carries a 3-byte time_offset, so its segment-header len must be a=
t least PDU_ISO_SEG_TIMEOFFSET_SIZE (3). isoal_check_seg_header() accepted = start segments with len &lt; 3 as valid, and isoal_rx_framed_consume() then=
computed length =3D seg_hdr-&gt;len - 3 in a uint8_t, underflowing to 253-= 255 when len is 0-2. That oversized length is passed to isoal_rx_append_to_= sdu(), whose copy is clamped only against the destination SDU buffer size, = not the source PDU length, so up to ~255 bytes of controller memory beyond = the received PDU are copied (via sink_sdu_write_hci()/net_buf_add_mem) into=
an HCI ISO data packet and delivered to the host. The PDU and its segment = headers are entirely attacker-controlled and arrive over the air, reachable=
through both the CIS and BIS-sync HCI data paths (hci_driver.c) and the ve= ndor data path (ull_iso.c), so a remote CIS peer or a broadcaster the devic=
e is synced to can trigger an out-of-bounds read causing information disclo= sure to the host and potential denial of service (faults or malformed overs= ized HCI ISO packets). The flaw affects all Zephyr releases since framed IS=
O reception was introduced in v3.0.0. The fix rejects sc=3D0 segments with = len &lt; 3 in isoal_check_seg_header() and adds a guard before the subtract= ion in isoal_rx_framed_consume().</td>
<td>2026-06-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9263" target=3D"= _blank" rel=3D"noopener">CVE-2026-9263</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm= .c) ignores the return value of usbd_ep_enqueue() in its ethernet transmit = callback cdc_ncm_send(). When the enqueue fails, the function still calls k= _sem_take(&amp;data-sync_sem, K_FOREVER), blocking on a completion semaphor=
e that is only ever signaled from the bulk-IN transfer-completion callback.=
Because nothing was enqueued, that callback never fires and the calling th= read - a shared network traffic-class TX thread - deadlocks permanently whi=
le holding the interface TX lock, halting transmission until reboot (and le= aking the transmit buffer). The enqueue fails under conditions controlled b=
y the attached USB host: usbd_ep_enqueue() returns -EPERM whenever the bus =
is suspended (a standard, persistent host operation), and the underlying ud= c_ep_enqueue() returns -EPERM/-ENODEV on disconnect, bus reset, or endpoint=
disable. The cdc_ncm_send() guard only checks the DATA_IFACE_ENABLED and I= FACE_UP flags, not the suspended state, so a packet transmitted while the h= ost holds the bus suspended reaches the failing enqueue and deadlocks the T=
X path. The realistic trigger is a bus suspend that occurs while the export=
ed network interface is active and has traffic to send - host sleep, USB se= lective/auto-suspend, or hub power management - after which any device-orig= inated packet deadlocks the path, recoverable only by reboot. The impact is=
a persistent loss of the virtual network connection between the host's NCM=
interface and the Zephyr device; because the deadlocked thread is a shared=
traffic-class TX thread, egress on other network interfaces can stall as w= ell. There is no memory corruption or information disclosure. The defect wa=
s introduced with the CDC-NCM driver and shipped in releases through v4.4.0=
; it is fixed by checking the usbd_ep_enqueue() return value and freeing th=
e buffer before the blocking wait.</td>
<td>2026-06-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10647" target=3D= "_blank" rel=3D"noopener">CVE-2026-10647</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>Zephyr's DNS resolver (subsys/net/lib/dns) parses resource records from=
DNS responses in dns_unpack_answer(), which validated only the fixed RR he= ader (type, class, TTL, rdlength) and accepted any attacker-declared rdleng= th, including one extending past the end of the received datagram. The TXT = and SRV consumers in dns_validate_record() (resolve.c) then read up to rdle= ngth bytes (clamped only to a record-type maximum such as DNS_MAX_TEXT_SIZE=
, default 64, not to the packet) from the receive buffer via memcpy without=
their own bounds check, and pass the result to the application's resolve c= allback. A malicious or spoofed DNS server, an on-path attacker forging UDP=
DNS replies, or (with mDNS/LLMNR enabled) any LAN node can craft a truncat=
ed TXT or SRV response that causes an out-of-bounds read of adjacent receiv= e-pool memory; the disclosed stale bytes (residual contents of prior DNS pa= ckets / uninitialized pool memory) are returned to the application as TXT/S=
RV record contents, an information leak, and may in some configurations cro=
ss the allocation boundary and fault, causing a denial of service. The read=
is bounded (~64 bytes for TXT, ~6 for SRV) and read-only (no write). The f=
ix rejects any record whose declared rdata extends past dns_msg-&gt;msg_siz=
e at the single chokepoint in dns_unpack_answer(). Affected: v4.3.0 and v4.= 4.0.</td>
<td>2026-06-30</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10652" target=3D= "_blank" rel=3D"noopener">CVE-2026-10652</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>The MAX32xxx USB device controller driver (drivers/usb/udc/udc_max32.c,=
compatible adi_max32_usbhs) dereferenced an endpoint buffer in its OUT and=
IN transfer-completion handlers without checking it for NULL. udc_event_xf= er_out_done() called net_buf_add(buf, ep_request-&gt;actlen) immediately af= ter buf =3D udc_buf_get(ep_cfg), where udc_buf_get() returns NULL when the = endpoint FIFO is empty. A transfer-completion event is queued from interrup=
t context and processed asynchronously by the driver thread; between queuin=
g and processing, the endpoint FIFO can be drained by host-controlled contr=
ol flow - in particular udc_setup_received() drains the EP0 OUT/IN FIFOs wh= enever a new SETUP packet arrives, and dequeue/disable/purge paths drain it=
likewise. A USB host that aborts an in-flight EP0 control transfer with a = new SETUP packet (legal USB behavior) can therefore cause a stale XFER_OUT_= DONE event to be processed against an empty FIFO, producing net_buf_add(NUL=
L, ...), a near-NULL pointer dereference that faults and crashes the device=
. No authentication is required; the attacker is the USB host the device is=
connected to (physical bus access). Impact is denial of service (device cr= ash). The defect was introduced when the MAX32 UDC driver was added and shi= pped in Zephyr v4.4.0. The fix adds NULL-buffer checks that return early wi=
th UDC_EVT_ERROR/-ENOBUFS in both the OUT-done and IN-done handlers.</td> <td>2026-07-05</td>
<td>4.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10656" target=3D= "_blank" rel=3D"noopener">CVE-2026-10656</a></td>
</tr>

<td class=3D"vendor-product">zhayujie--chatgpt-on-wechat CowAgent</td>
<td>A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2= .1.0. This issue affects the function verify_server of the file channel/wec= hatmp/common.py of the component wx Endpoint. This manipulation of the argu= ment wechatmp_token causes missing authentication. The attack may be initia= ted remotely. The exploit has been made available to the public and could b=
e used for attacks. Upgrading to version 2.1.1 is capable of addressing thi=
s issue. Patch name: 3d7c68bac6ee74fad63f43cf99e45c62e202ed55. It is sugges= ted to upgrade the affected component. The project confirms: "We've added a=
n explicit non-empty check for wechatmp_token in verify_server() so that th=
e /wx endpoint now fails closed with 403 Forbidden whenever the token is mi= ssing or left at the default empty value, instead of relying on a signature=
check that silently degenerates to a predictable hash."</td> <td>2026-07-05</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14714" target=3D= "_blank" rel=3D"noopener">CVE-2026-14714</a></td>
</tr>

<td class=3D"vendor-product">Zozothemes--Corpkit</td>
<td>Subscriber Sensitive Data Exposure in Corpkit &lt;=3D 1.0.5 versions.</=

<td>2026-07-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69132" target=3D= "_blank" rel=3D"noopener">CVE-2025-69132</a></td>
</tr>
</tbody>
</table>
<p><a href=3D"#top">Back to top</a></p>
</div>
<div id=3D"low_v">
<h2 id=3D"low_v_title">Low Vulnerabilities</h2>
<table class=3D"table no-tablesaw" style=3D"table-layout: fixed; width: 100= %;" border=3D"1" summary=3D"Low Vulnerabilities">
<thead>

<th class=3D"vendor-product" style=3D"width: 24%;" scope=3D"col">
<span class=3D"primary-vendor">Primary</span><br><span class=3D"primary-ven= dor">Vendor</span> -- Product</th>
<th style=3D"width: 44%;" scope=3D"col">Description</th>
<th style=3D"width: 10%;" scope=3D"col">Published</th>
<th style=3D"width: 8%;" scope=3D"col">CVSS Score</th>
<th style=3D"width: 7%;" scope=3D"col">Source Info</th>
</tr>
</thead>
<tbody>

<td class=3D"vendor-product">code-projects--Assessment Management</td>
<td>A weakness has been identified in code-projects Assessment Management 1= .0. Affected by this issue is some unknown functionality of the file admin/= view-users.php. Executing a manipulation of the argument User can lead to c= ross site scripting. The attack may be performed from remote. The exploit h=
as been made available to the public and could be used for attacks.</td> <td>2026-07-04</td>
<td>2.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14655" target=3D= "_blank" rel=3D"noopener">CVE-2026-14655</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Complaint Management System</td>
<td>A security flaw has been discovered in CodeAstro Complaint Management S= ystem 1.0. This issue affects some unknown processing of the file /report/a= ddreport of the component Report Handler. Performing a manipulation of the = argument Report Title results in cross site scripting. Remote exploitation =
of the attack is possible. The exploit has been released to the public and = may be used for attacks.</td>
<td>2026-06-29</td>
<td>3.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13558" target=3D= "_blank" rel=3D"noopener">CVE-2026-13558</a></td>
</tr>

<td class=3D"vendor-product">connorskees--grass</td>
<td>A flaw has been found in connorskees grass up to 0.13.4. The affected e= lement is the function grass_compiler::raw_to_parse_error of the component = UTF-8 Character Handler. Executing a manipulation can lead to denial of ser= vice. The attack is restricted to local execution. The exploit has been pub= lished and may be used. In Issue #117 with similar structure the project ma= intainer explains: "DoS vulnerabilities are generally fine in Sass compiler=
s -- they are trivially possible with recursive functions, infinite loops, = nested mixins, etc. The description here is wrong. Compile time is not expe= cted to be linear relative to the input, and the @extend algorithm is defin= itionally exponential."</td>
<td>2026-07-04</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14650" target=3D= "_blank" rel=3D"noopener">CVE-2026-14650</a></td>
</tr>

<td class=3D"vendor-product">connorskees--grass</td>
<td>A vulnerability has been found in connorskees grass up to 0.13.4. The i= mpacted element is the function grass_compiler::selector::extend/grass_comp= iler::evaluate::visitor. The manipulation leads to denial of service. The a= ttack must be carried out locally. The exploit has been disclosed to the pu= blic and may be used. The project maintainer explains: "DoS vulnerabilities=
are generally fine in Sass compilers -- they are trivially possible with r= ecursive functions, infinite loops, nested mixins, etc. The description her=
e is wrong. Compile time is not expected to be linear relative to the input=
, and the @extend algorithm is definitionally exponential."</td> <td>2026-07-04</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14651" target=3D= "_blank" rel=3D"noopener">CVE-2026-14651</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an use of uninitialized resource vulnerability. A low privileged attacker w= ith local access could potentially exploit this vulnerability, leading to i= nformation exposure.</td>
<td>2026-07-03</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56085" target=3D= "_blank" rel=3D"noopener">CVE-2026-56085</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an Improper limitation of a pathname to a restricted directory ('path trave= rsal') vulnerability. A high privileged attacker with local access could po= tentially exploit this vulnerability, leading to Information exposure.</td> <td>2026-07-03</td>
<td>2.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41124" target=3D= "_blank" rel=3D"noopener">CVE-2026-41124</a></td>
</tr>

<td class=3D"vendor-product">Dell--PowerProtect Data Domain</td>
<td>Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 re= lease version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 thr= ough 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain =
an use of less trusted source vulnerability. A high privileged attacker wit=
h remote access could potentially exploit this vulnerability, leading to in= formation tampering.</td>
<td>2026-07-03</td>
<td>2.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-46466" target=3D= "_blank" rel=3D"noopener">CVE-2026-46466</a></td>
</tr>

<td class=3D"vendor-product">exo-explore--exo</td>
<td>A security flaw has been discovered in exo-explore exo up to 1.0.71. Af= fected is the function _image_cache_key of the file src/exo/worker/engines/= mlx/vision.py of the component Vision Feature Cache. The manipulation resul=
ts in use of weak hash. It is possible to launch the attack remotely. A hig=
h complexity level is associated with this attack. The exploitability is to=
ld to be difficult. The exploit has been released to the public and may be = used for attacks. The pull request to fix this issue awaits acceptance.</td=

<td>2026-07-05</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14738" target=3D= "_blank" rel=3D"noopener">CVE-2026-14738</a></td>
</tr>

<td class=3D"vendor-product">FederatedAI--FATE</td>
<td>A vulnerability has been found in FederatedAI FATE up to 2.2.0. This af= fects the function QueuePushReqStreamObserver.initEggroll of the file java/= osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamOb= server.java of the component OSX Broker. Such manipulation of the argument = rollSiteSessionId/dstRole/dstPartyId leads to exposure of data element to w= rong session. The attack can be executed remotely. A high complexity level =
is associated with this attack. It is indicated that the exploitability is = difficult. The exploit has been disclosed to the public and may be used. Th=
e pull request to fix this issue awaits acceptance.</td>
<td>2026-07-04</td>
<td>3.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14621" target=3D= "_blank" rel=3D"noopener">CVE-2026-14621</a></td>
</tr>

<td class=3D"vendor-product">ForceInjection--AI-fundermentals</td>
<td>A vulnerability has been found in ForceInjection AI-fundermentals 2.0/3= .0. Affected by this vulnerability is the function get_conversation_history=
of the file 08_agentic_system/memory/langchain/code/smart_customer_service= .py of the component Memory Recall Handler. The manipulation leads to use o=
f weak hash. Remote exploitation of the attack is possible. A high degree o=
f complexity is needed for the attack. The exploitation appears to be diffi= cult. The exploit has been disclosed to the public and may be used. The ide= ntifier of the patch is f57277fdd9ba373ace72d83c272023ec67f720d6. It is sug= gested to install a patch to address this issue. The project confirms (tran= slated from Chinese): "We now require session ownership verification in met= hods such as `username`, `sessionowner`, etc., and we've chat()changed the = generation of `sessionowner` to include verified user identity and security=
context metadata."</td>
<td>2026-07-04</td>
<td>3.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14630" target=3D= "_blank" rel=3D"noopener">CVE-2026-14630</a></td>
</tr>

<td class=3D"vendor-product">GPAC--GPAC</td>
<td>A weakness has been identified in GPAC up to 26.02.0. This affects an u= nknown part of the file src/utils/base_encoding.c of the component ISOBMFF = Parser. Executing a manipulation can lead to highly compressed data. The at= tack needs to be launched locally. The exploit has been made available to t=
he public and could be used for attacks. This patch is called 297f2d8d1f493= d8b241330533cd47f7da758aeb3. A patch should be applied to remediate this is= sue. The vendor confirms: "We added a check on inflate output size, if it s= urpasses 32 times the input size we stop in error. This value could be adju= sted later."</td>
<td>2026-06-29</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13523" target=3D= "_blank" rel=3D"noopener">CVE-2026-13523</a></td>
</tr>

<td class=3D"vendor-product">HdrHistogram--HdrHistogram</td>
<td>A vulnerability was detected in HdrHistogram up to 2.2.2. Affected by t= his issue is the function org.HdrHistogram.AbstractHistogram.decodeFromComp= ressedByteBuffer of the file src/main/java/org/HdrHistogram/AbstractHistogr= am.java. The manipulation of the argument lengthOfCompressedContents result=
s in uncontrolled memory allocation. The attack needs to be approached loca= lly. The exploit is now public and may be used. The project was informed of=
the problem early through an issue report but has not responded yet.</td> <td>2026-07-04</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14683" target=3D= "_blank" rel=3D"noopener">CVE-2026-14683</a></td>
</tr>

<td class=3D"vendor-product">HdrHistogram--HdrHistogram</td>
<td>A flaw has been found in HdrHistogram up to 2.2.2. This affects the fun= ction org.HdrHistogram.AbstractHistogram.decodeFromByteBuffer of the file s= rc/main/java/org/HdrHistogram/AbstractHistogram.java. This manipulation of = the argument numberOfSignificantValueDigits causes uncontrolled memory allo= cation. The attack can only be executed locally. The exploit has been publi= shed and may be used. The project was informed of the problem early through=
an issue report but has not responded yet.</td>
<td>2026-07-04</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14684" target=3D= "_blank" rel=3D"noopener">CVE-2026-14684</a></td>
</tr>

<td class=3D"vendor-product">HdrHistogram--HdrHistogram</td>
<td>A vulnerability has been found in HdrHistogram up to 2.2.2. This vulner= ability affects the function recordValueWithCount of the file src/main/java= /org/HdrHistogram/AbstractHistogram.java of the component AbstractHistogram=
. Such manipulation of the argument Count leads to state issue. The attack = can only be performed from a local environment. The exploit has been disclo= sed to the public and may be used. The project was informed of the problem = early through an issue report but has not responded yet.</td> <td>2026-07-04</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14685" target=3D= "_blank" rel=3D"noopener">CVE-2026-14685</a></td>
</tr>

<td class=3D"vendor-product">HdrHistogram--HdrHistogram</td>
<td>A vulnerability was found in HdrHistogram up to 2.2.2. This issue affec=
ts the function org.HdrHistogram.DoubleHistogram.recordValue of the file sr= c/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Ch= eck. Performing a manipulation results in incorrect comparison. The attack =
is only possible with local access. The exploit has been made public and co= uld be used. The project was informed of the problem early through an issue=
report but has not responded yet.</td>
<td>2026-07-05</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14686" target=3D= "_blank" rel=3D"noopener">CVE-2026-14686</a></td>
</tr>

<td class=3D"vendor-product">Hitachi--Hitachi Virtual Storage Platform One = Block 23, 24, 26, 28</td>
<td>Lack of validation for firmware update=C2=A0in Hitachi Hitachi Virtual = Storage Platform One Block 23, 24, 26, 28. This issue affects Hitachi Virtu=
al Storage Platform One Block 23, 24, 26, 28: before DKCMAIN A3-04-21-40/00=
, ESM A3-04-21/00.</td>
<td>2026-06-29</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-0824" target=3D"= _blank" rel=3D"noopener">CVE-2025-0824</a></td>
</tr>

<td class=3D"vendor-product">IBM--InfoSphere Information Server</td>
<td>IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected=
by an information disclosure vulnerability.</td>
<td>2026-06-30</td>
<td>3.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9836" target=3D"= _blank" rel=3D"noopener">CVE-2026-9836</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick before 7.1.2-19 contains an off-by-one error in morphology = validation allowing out-of-bounds heap buffer reads. Attackers can trigger = heap buffer overflow by providing incorrect morphology parameters causing s= ingle pixel memory access violations.</td>
<td>2026-06-30</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56361" target=3D= "_blank" rel=3D"noopener">CVE-2026-56361</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick before 7.1.2-22 contains a division by zero vulnerability i=
n binomial kernel processing that allows attackers to cause denial of servi= ce. An attacker can supply a large binomial kernel value causing integer ov= erflow, resulting in division by zero and application crash.</td> <td>2026-06-30</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56363" target=3D= "_blank" rel=3D"noopener">CVE-2026-56363</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the=
PNG encoder when writing MNG images. Attackers can trigger the encoder fai= lure condition to exhaust memory resources and cause denial of service.</td=

<td>2026-06-30</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56365" target=3D= "_blank" rel=3D"noopener">CVE-2026-56365</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick before 7.1.2-22 contains an information disclosure vulnerab= ility in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attack= ers can exploit nonce reuse in the cipher implementation to recover plainte=
xt information from encrypted images.</td>
<td>2026-06-30</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56369" target=3D= "_blank" rel=3D"noopener">CVE-2026-56369</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick before 7.1.2-24 contains an incorrect policy check that all= ows attackers to create or truncate files disallowed by security policies. = Remote attackers can bypass path policy restrictions in sandboxed conversio=
n services to write arbitrary files outside intended boundaries.</td> <td>2026-06-30</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56377" target=3D= "_blank" rel=3D"noopener">CVE-2026-56377</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick before 7.1.2-13 contains a memory leak vulnerability in Loa= dOpenCLDeviceBenchmark() function when parsing malformed OpenCL device prof= ile XML files with unclosed device elements. Attackers with write access to=
the OpenCL cache directory can place malicious XML files to exhaust memory=
and cause denial of service.</td>
<td>2026-06-30</td>
<td>1.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56364" target=3D= "_blank" rel=3D"noopener">CVE-2026-56364</a></td>
</tr>

<td class=3D"vendor-product">iv-org--Invidious</td>
<td>Invidious before version 2.20260626.0 contains a broken access control = vulnerability that allows unauthenticated attackers to retrieve private pla= ylist contents by accessing the RSS feed playlist endpoint without authenti= cation. Attackers can supply a playlist ID to the feed endpoint to obtain t=
he full playlist contents, owner email address, and associated video entrie=
s without any authentication.</td>
<td>2026-06-29</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57946" target=3D= "_blank" rel=3D"noopener">CVE-2026-57946</a></td>
</tr>

<td class=3D"vendor-product">langchain-ai--langgraph</td>
<td>A vulnerability was determined in langchain-ai langgraph up to 1.2.4. T=
he affected element is the function _freeze of the file libs/langgraph/lang= graph/_internal/_cache.py of the component Task Result Cache. This manipula= tion of the argument default_cache_key causes use of weak hash. The attack =
is possible to be carried out remotely. The complexity of an attack is rath=
er high. The exploitability is described as difficult. The exploit has been=
publicly disclosed and may be utilized. The pull request to fix this issue=
awaits acceptance.</td>
<td>2026-07-05</td>
<td>3.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14742" target=3D= "_blank" rel=3D"noopener">CVE-2026-14742</a></td>
</tr>

<td class=3D"vendor-product">llvm--llvm-project</td>
<td>A vulnerability was found in llvm llvm-project up to 22.1.6. This affec=
ts the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolT= able.cpp of the component ValueSymbolTable Module. The manipulation results=
in stack-based buffer overflow. Attacking locally is a requirement. The ex= ploit has been made public and could be used. The project was informed of t=
he problem early through an issue report but has not responded yet.</td> <td>2026-06-29</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13573" target=3D= "_blank" rel=3D"noopener">CVE-2026-13573</a></td>
</tr>

<td class=3D"vendor-product">llvm--llvm-project</td>
<td>A vulnerability was determined in llvm llvm-project up to 22.1.6. This = impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/= IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation = causes heap-based buffer overflow. It is possible to launch the attack on t=
he local host. The exploit has been publicly disclosed and may be utilized.=
The project was informed of the problem early through an issue report but = has not responded yet.</td>
<td>2026-06-29</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13574" target=3D= "_blank" rel=3D"noopener">CVE-2026-13574</a></td>
</tr>

<td class=3D"vendor-product">mjperpinosa--stumasy</td>
<td>A security vulnerability has been detected in mjperpinosa stumasy up to=
327d1b0f2915ba79d7ef8ebb74553e987609d9be. This affects the function add_de= finition of the file application/PHP/objects/notes/add_into_dictionary.php.=
Such manipulation of the argument reference leads to cross site scripting.=
It is possible to launch the attack remotely. The exploit has been disclos=
ed publicly and may be used. This product takes the approach of rolling rel= eases to provide continious delivery. Therefore, version details for affect=
ed and updated releases are not available. The project was informed of the = problem early through an issue report but has not responded yet.</td> <td>2026-07-05</td>
<td>3.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14752" target=3D= "_blank" rel=3D"noopener">CVE-2026-14752</a></td>
</tr>

<td class=3D"vendor-product">NousResearch--hermes-agent</td>
<td>A security vulnerability has been detected in NousResearch hermes-agent=
up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_an= d_accumulate of the file gateway/stream_consumer.py of the component Stream= ing Reasoning Tag Filter. The manipulation leads to improper handling of ca=
se sensitivity. The attack may be initiated remotely. The attack's complexi=
ty is rated as high. The exploitability is told to be difficult. The exploi=
t has been disclosed publicly and may be used. The project decided to not i= mplement a dedicated fix: "[T]he analysis and the fix are both sound. It ju=
st lands below the bar for the maintenance cost of a duplicated scrub path.= "</td>
<td>2026-07-03</td>
<td>3.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14617" target=3D= "_blank" rel=3D"noopener">CVE-2026-14617</a></td>
</tr>

<td class=3D"vendor-product">opencontainers--runc</td>
<td>runc is a CLI tool for spawning and running containers according to the=
OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.= 5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx a=
nd setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join stri=
ng which allow an image with /dev as a symlink to trick runc into deleting = files called ptmx on the host or creating a hardcoded set of symlinks with = specific names and targets in an arbitrary pre-existing host directory. Thi=
s issue is not exploitable under Docker, because Docker creates a top-level=
read-only layer that masks any malicious /dev=C2=A0symlink present in the = container image - unlike some other Linux container tooling, whose higher-l= evel runtimes built on runc remain exposed to exploitation via a malicious = image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.</td> <td>2026-07-01</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41579" target=3D= "_blank" rel=3D"noopener">CVE-2026-41579</a></td>
</tr>

<td class=3D"vendor-product">radareorg--radare2</td>
<td>A vulnerability was identified in radareorg radare2 up to 6.1.6. This v= ulnerability affects the function cmd_anal_opcode of the file libr/core/cmd= _anal.inc.c of the component hexpairs Parser. Such manipulation leads to in= teger overflow. The attack needs to be performed locally. The exploit is pu= blicly available and might be used. The name of the patch is 84e773986e7e5b= b30453a9384f498ec0ccc9d0a9. A patch should be applied to remediate this iss= ue.</td>
<td>2026-07-05</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14758" target=3D= "_blank" rel=3D"noopener">CVE-2026-14758</a></td>
</tr>

<td class=3D"vendor-product">radareorg--radare2</td>
<td>A security flaw has been discovered in radareorg radare2 up to 6.1.6. T= his issue affects the function r_bin_java_inner_classes_attr_calc_size of t=
he file shlr/java/class.c of the component RBinJava Line Number Table Parse=
r. Performing a manipulation results in heap-based buffer overflow. The att= ack requires a local approach. The exploit has been released to the public = and may be used for attacks. The patch is named cd62d15a6cbecdc67fd03f3ebdb= bbeb741d18f87. To fix this issue, it is recommended to deploy a patch.</td> <td>2026-07-05</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14759" target=3D= "_blank" rel=3D"noopener">CVE-2026-14759</a></td>
</tr>

<td class=3D"vendor-product">radareorg--radare2</td>
<td>A weakness has been identified in radareorg radare2 up to 6.1.6. Impact=
ed is the function r_core_seek_arch_bits of the file libr/core/disasm.c of = the component regprofile Handler. Executing a manipulation can lead to use = after free. The attack requires local access. The exploit has been made ava= ilable to the public and could be used for attacks. This patch is called 8b= 25c773785d85cb0103410a0905089d286921c2. It is advisable to implement a patc=
h to correct this issue.</td>
<td>2026-07-05</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14760" target=3D= "_blank" rel=3D"noopener">CVE-2026-14760</a></td>
</tr>

<td class=3D"vendor-product">radareorg--radare2</td>
<td>A security vulnerability has been detected in radareorg radare2 up to 6= .1.6. The affected element is the function r_str_ndup/r_str_append of the f= ile libr/util/str.c. The manipulation leads to integer overflow. An attack = has to be approached locally. The exploit has been disclosed publicly and m=
ay be used. The identifier of the patch is a20a56917ae85d732e683f8d9078bdcf= ee92446c. Applying a patch is the recommended action to fix this issue.</td=

<td>2026-07-05</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14761" target=3D= "_blank" rel=3D"noopener">CVE-2026-14761</a></td>
</tr>

<td class=3D"vendor-product">ruby--json</td>
<td>Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.1= 9.8 are vulnerable to heap buffer overflow when the JSON generator is provi= ded with an oversized streamed object. When streaming to an IO JSON.dump(ob=
j, io) and JSON::State#generate(obj, io) can write past the internal JSON g= enerator buffer when a streamed object contains an attacker-controlled stri=
ng near 16 KB. Exploitation would result in a reliable process crash/denial=
of service. This issue has been fixed in version 2.19.9.</td> <td>2026-06-30</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54696" target=3D= "_blank" rel=3D"noopener">CVE-2026-54696</a></td>
</tr>

<td class=3D"vendor-product">seaweedfs--seaweedfs</td>
<td>SeaweedFS before 4.30 reflects the callback query parameter verbatim in=
to responses served with Content-Type application/javascript in the shared = writeJson helper (weed/server/common.go), with no callback-name validation,=
no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every J= SON endpoint that uses writeJson - including the unauthenticated master end= points /dir/status, /dir/lookup and /cluster/status, the volume server /sta= tus, and the filer directory listing, all reachable in the default configur= ation (no -whiteList, no security.toml, bound to 0.0.0.0) - can therefore b=
e loaded cross-origin via a script tag with a chosen callback, letting a th= ird-party web page read cluster topology, volume server URLs and gRPC ports=
, file identifiers, and directory listings. Because the callback string is = reflected at the start of the body and no nosniff header is sent, MIME-snif= fing clients may also interpret the reflected content as HTML.</td> <td>2026-06-30</td>
<td>3.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58371" target=3D= "_blank" rel=3D"noopener">CVE-2026-58371</a></td>
</tr>

<td class=3D"vendor-product">seladb--PcapPlusPlus</td>
<td>A vulnerability was found in seladb PcapPlusPlus 25.05. The affected el= ement is the function parse_by_block_type of the file light_pcapng.c of the=
component LightPcapNg Parser. Performing a manipulation of the argument ca= ptured_packet_length results in heap-based buffer overflow. It is possible =
to initiate the attack remotely. The attack's complexity is rated as high. = The exploitability is described as difficult. The exploit has been made pub= lic and could be used.</td>
<td>2026-06-29</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13587" target=3D= "_blank" rel=3D"noopener">CVE-2026-13587</a></td>
</tr>

<td class=3D"vendor-product">Snowflake--Snowflake CLI</td>
<td>Improper neutralization of local CLI parameters in Snowflake CLI versio=
ns prior to 3.19 allowed unintended SQL execution. A user could trigger thi=
s issue by supplying crafted values to vulnerable Cortex SQL or object list= ing command paths, causing Snowflake CLI to execute unintended SQL in the c= ontext of that user's Snowflake session. Successful exploitation is constra= ined to self-injection because the vulnerable parameters were supplied dire= ctly through local CLI arguments rather than through project files, reposit= ories, or other external input sources, and impact is limited to the privil= eges already available to the current session. The fix is available in Snow= flake CLI version 3.19, and users must manually upgrade.</td> <td>2026-06-29</td>
<td>3.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13746" target=3D= "_blank" rel=3D"noopener">CVE-2026-13746</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Inventory Management System</t=

<td>A vulnerability was detected in SourceCodester Inventory Management Sys= tem 1.0. Impacted is an unknown function of the file /api/users_handler.php=
of the component User Registration Endpoint. Performing a manipulation of = the argument full_name results in cross site scripting. The attack is possi= ble to be carried out remotely. The exploit is now public and may be used.<=

<td>2026-06-29</td>
<td>3.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13570" target=3D= "_blank" rel=3D"noopener">CVE-2026-13570</a></td>
</tr>

<td class=3D"vendor-product">TUBITAK BILGEM Software Technologies Research = Institute--Pardus Pen</td>
<td>Improper null termination vulnerability in TUBITAK BILGEM Software Tech= nologies Research Institute Pardus Pen allows Overflow Buffers. This issue = affects Pardus Pen: from &lt;=3D4.1.5 before 4.2.1.</td>
<td>2026-07-05</td>
<td>3.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12386" target=3D= "_blank" rel=3D"noopener">CVE-2026-12386</a></td>
</tr>

<td class=3D"vendor-product">uvnc--UltraVNC</td>
<td>UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the B= ase64 decode helper used for HTTP Basic authentication. In repeater/webgui/= webutils.c:817, the wi_uudecode() function checks whether the input length = exceeds the output buffer with a strict greater-than comparison (&gt;), whi=
le the correct check should be greater-than-or-equal (&gt;=3D). When strlen= (authdata) equals sizeof(decode), the decoded output length (approximately = 3/4 of input) does not overflow the buffer in current practice because the = outer HTTP request bounds constrain the Authorization header. However, the = defective check leaves a latent off-by-one condition that could become expl= oitable if the buffering constraints change. The current risk is limited to=
a one-byte write at the boundary of a 1024-byte stack buffer under constra= ined conditions.</td>
<td>2026-07-01</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44042" target=3D= "_blank" rel=3D"noopener">CVE-2026-44042</a></td>
</tr>

<td class=3D"vendor-product">WSO2--WSO2 Identity Server</td>
<td>In multi-tenanted deployments, the application consent management mecha= nism fails to correctly isolate consent scopes between tenants. Consent gra= nted by a user for a specific SaaS application within one tenant can be inc= orrectly applied to SaaS applications with the same name in other tenants, = leading to unintended cross-tenant consent sharing. This vulnerability may = result in the exposure of user data across tenants, enabling SaaS applicati= ons in different tenants to access and modify information without explicit = user authorization. This can lead to unauthorized data access and privacy v= iolations. This vulnerability has no impact if the deployment does not supp= ort multi-tenancy.</td>
<td>2026-07-04</td>
<td>3.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-13475" target=3D= "_blank" rel=3D"noopener">CVE-2025-13475</a></td>
</tr>

<td class=3D"vendor-product">zcaceres--markdownify-mcp</td>
<td>A weakness has been identified in zcaceres markdownify-mcp up to 1.1.0.=
The affected element is the function assertPathAllowed of the file src/Mar= kdownify.ts. Executing a manipulation can lead to symlink following. The at= tack can only be executed locally. The pull request to fix this issue await=
s acceptance.</td>
<td>2026-07-05</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14699" target=3D= "_blank" rel=3D"noopener">CVE-2026-14699</a></td>
</tr>

<td class=3D"vendor-product">zcaceres--markdownify-mcp</td>
<td>A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This imp= acts the function saveToTempFile of the file src/Markdownify.ts of the comp= onent webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. This=
manipulation causes insufficiently random values. The attack is restricted=
to local execution. A high degree of complexity is needed for the attack. = The exploitability is said to be difficult. The exploit has been published = and may be used. The pull request to fix this issue awaits acceptance.</td> <td>2026-07-05</td>
<td>2.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14702" target=3D= "_blank" rel=3D"noopener">CVE-2026-14702</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (sub= sys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectiona=
l session disconnect. When the local device has initiated a session teardow=
n (state BT_RFCOMM_STATE_DISCONNECTING, DISC sent, RTX timer armed) and the=
connected peer concurrently sends its own DISC frame for dlci 0, rfcomm_ha= ndle_disc() invokes rfcomm_session_disconnected(), which unconditionally fo= rced the session to BT_RFCOMM_STATE_DISCONNECTED without ever calling bt_l2= cap_chan_disconnect(). Because the recovery timer was also cancelled and a = later UA is ignored in the DISCONNECTED state, the session becomes permanen= tly wedged: the underlying L2CAP channel is never released and the session = slot in the fixed bt_rfcomm_pool[CONFIG_BT_MAX_CONN] array is never reclaim=
ed (its conn pointer stays set). Subsequent bt_rfcomm_dlc_connect() calls o=
n that connection fail with -EINVAL due to the invalid session state, so RF= COMM service is denied for that peer, and repeated occurrences can exhaust = the session pool. The DISC frame is peer-controlled over the air, but explo= itation requires the peer's DISC to collide with a local-initiated disconne=
ct (a high-complexity timing race). Impact is availability/resource-leak on= ly; there is no memory-safety, confidentiality, or integrity consequence. T=
he defect shipped in released versions (present in v4.4.0 and earlier). The=
fix only transitions to DISCONNECTED when the session is not already in DI= SCONNECTING, preserving the proper L2CAP teardown path.</td> <td>2026-06-30</td>
<td>3.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10654" target=3D= "_blank" rel=3D"noopener">CVE-2026-10654</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>Zephyr's DNS resolver detects mDNS (.local) queries in dns_resolve_name= _internal() (subsys/net/lib/dns/resolve.c) with memcmp(strrchr(query, '.'),=
".local", 7), which always reads a fixed 7 bytes from the suffix pointer. = When the resolved hostname's final label is shorter than 7 bytes (e.g. name=
s ending in .org, .com, .net, .io, or a trailing dot), the comparison reads=
1-2 bytes past the string's NUL terminator. The hostname (query) is the ca= ller-supplied name passed through the standard getaddrinfo()/dns_get_addr_i= nfo()/dns_resolve_name() path and is influenceable by operators or remote i= nputs (server names from configuration, parsed URLs, or app-facing interfac= es). On a tightly-sized buffer with no slack (for example a userspace getad= drinfo call where the hostname is copied with k_usermode_string_alloc_copy =
to exactly strlen+1 bytes), the over-read crosses the allocation boundary; =
if that boundary is unmapped (guard page, memory-domain boundary under MPU,=
or an address sanitizer) the over-read faults, causing a denial of service=
. The over-read bytes are never returned, so there is no information disclo= sure. The flaw is compiled only when CONFIG_MDNS_RESOLVER is enabled, exist=
s since v1.10.0, and is fixed by replacing the fixed-length memcmp with a N= UL-safe strcmp(ptr, ".local").</td>
<td>2026-07-05</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10657" target=3D= "_blank" rel=3D"noopener">CVE-2026-10657</a></td>
</tr>
</tbody>
</table>
<p><a href=3D"#top">Back to top</a></p>
</div>
<div id=3D"snya_v">
<h2 id=3D"snya_v_title">Severity Not Yet Assigned=C2=A0</h2>
<table id=3D"table_severity_not_yet_assigned" class=3D"table no-tablesaw" s= tyle=3D"table-layout: fixed; width: 100%;" border=3D"1" summary=3D"Severity=
Not Yet Assigned">
<thead>

<th class=3D"vendor-product" style=3D"width: 24%;" scope=3D"col">
<span class=3D"primary-vendor">Primary</span><br><span class=3D"primary-ven= dor">Vendor</span> -- Product</th>
<th style=3D"width: 44%;" scope=3D"col">Description</th>
<th style=3D"width: 10%;" scope=3D"col">Published</th>
<th style=3D"width: 8%;" scope=3D"col">CVSS Score</th>
<th style=3D"width: 7%;" scope=3D"col">Source Info</th>
</tr>
</thead>
<tbody>

<td class=3D"vendor-product">ail-project--ail-framework</td>
<td>AIL Framework contains a path traversal vulnerability in its PDF object=
handling. Prior to commit 14c618fce4d1df02358717c48ea903706abecdf2, the PD= F.get_filepath() function constructed a file path by joining the configured=
PDF storage directory with a path derived from a PDF object identifier, wi= thout verifying that the resolved path remained within the intended PDF_FOL= DER directory. An authenticated attacker able to invoke PDF object operatio=
ns with a crafted identifier could use relative traversal sequences or abso= lute path components to cause AIL Framework to open files located outside t=
he PDF storage directory. This could allow disclosure of files readable by = the AIL process, including application configuration, credentials, or other=
sensitive local data. This vulnerability is potential due to additional er= rors before being able to be executed. The fix canonicalises the resulting = path with os.path.realpath() and rejects paths whose common directory is ou= tside the configured PDF directory.</td>
<td>2026-07-05</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59510" target=3D= "_blank" rel=3D"noopener">CVE-2026-59510</a></td>
</tr>

<td class=3D"vendor-product">Aleksoid1978 MPC-BE--Aleksoid1978 MPC-BE</td> <td>A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId() function o=
f Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Den= ial of Service (DoS) via a crafted MP4 file.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-36909" target=3D= "_blank" rel=3D"noopener">CVE-2026-36909</a></td>
</tr>

<td class=3D"vendor-product">Aleksoid1978 MPC-BE--Aleksoid1978 MPC-BE</td> <td>An access violation in the BaseSplitterFile::Read function of Aleksoid1= 978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Serv= ice (DoS) via a crafted MP4 file.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-36910" target=3D= "_blank" rel=3D"noopener">CVE-2026-36910</a></td>
</tr>

<td class=3D"vendor-product">Aleksoid1978 MPC-BE--Aleksoid1978 MPC-BE</td> <td>A division-by-zero vulnerability in the CStreamSwitcherOutputPin::Decid= eBufferSize function of Aleksoid1978 MPC-BE before commit 4341cb3 allows at= tackers to cause a Denial of Service (DoS) via a crafted MP4 file.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-36911" target=3D= "_blank" rel=3D"noopener">CVE-2026-36911</a></td>
</tr>

<td class=3D"vendor-product">Aleksoid1978 MPC-BE--Aleksoid1978 MPC-BE</td> <td>A NULL pointer dereference in the AP4_AtomSampleTable::GetSample() func= tion of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause=
a Denial of Service (DoS) via a crafted MP4 file.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-36912" target=3D= "_blank" rel=3D"noopener">CVE-2026-36912</a></td>
</tr>

<td class=3D"vendor-product">Alexantr--filemanager v.1.0</td>
<td>An issue in Alexantr filemanager v.1.0 allows a remote attacker to exec= ute arbitrary code via the filemanager.php component</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-37637" target=3D= "_blank" rel=3D"noopener">CVE-2026-37637</a></td>
</tr>

<td class=3D"vendor-product">allegroai--allegroai/clearml</td>
<td>A vulnerability in allegroai/clearml versions up to and including 1.16.=
5 allows for relative path traversal when extracting `.zip` archives using = the `ZipFile.extractall()` method in `StorageManager._extract_to_cache()`. = This issue arises due to the lack of path traversal validation, enabling an=
attacker to write arbitrary files to the filesystem. Attack vectors includ=
e dataset downloads, artifact downloads, model downloads, and offline sessi=
on imports. The vulnerability can lead to remote code execution through met= hods such as cron job injection, SSH key overwrite, or web shell deployment=
. The issue is resolved in version 2.1.6.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8387" target=3D"= _blank" rel=3D"noopener">CVE-2026-8387</a></td>
</tr>

<td class=3D"vendor-product">Altium--Altium Enterprise Server</td>
<td>A path traversal vulnerability exists in the Git Service component shar=
ed by Altium Enterprise Server and Altium 365. The service accepts a sequen=
ce of post-clone file-manipulation operations that use user-supplied paths = without validation, allowing an authenticated user with basic git access to=
move arbitrary files outside the intended repository area. This file-move = primitive can be used to place attacker-controlled script content into dire= ctories where it is later executed by the service, resulting in remote code=
execution under the Git Service account. On multi-tenant Altium 365 deploy= ments, this could have allowed access to data belonging to other tenants on=
the same infrastructure node. Altium Enterprise Server is fixed in 8.1.1. = The issue has been remediated across Altium 365 shared multi-tenant deploym= ents at the service level; remediation is in progress on remaining Altium 3=
65 deployments.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14439" target=3D= "_blank" rel=3D"noopener">CVE-2026-14439</a></td>
</tr>

<td class=3D"vendor-product">anthropics--claude-code</td>
<td>Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the C= laude Code /copy command wrote responses to a hardcoded, predictable path (= /tmp/claude/response.md) without UID isolation, randomness, or symlink prot= ection. The file was created world-readable (0644) in a world-traversable d= irectory (0755), allowing any local user to read a privileged user's Claude=
response, which could contain secrets or credentials. Additionally, becaus=
e the path was static and predictable, a local attacker could pre-create th=
e directory and plant a symlink at the expected file path, causing the priv= ileged process to follow the symlink and overwrite an attacker-chosen file = with the response text. Exploiting this required a local unprivileged user =
on the same system and a privileged user to run the /copy command. This vul= nerability is fixed in 2.1.128.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-46406" target=3D= "_blank" rel=3D"noopener">CVE-2026-46406</a></td>
</tr>

<td class=3D"vendor-product">anthropics--claude-code</td>
<td>Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claud=
e Code's worktree handling allowed creation of worktrees named ".git" and n= avigation to worktrees outside the sandbox context, enabling git directory = confusion attacks. By exploiting symlink manipulation and git fsmonitor exe= cution during worktree operations, an attacker could overwrite files in the=
user's home directory (such as .zshenv), leading to code execution outside=
of seatbelt sandbox restrictions. Reliably exploiting this required the us=
er to clone a malicious repository containing prompt injection content and = run Claude Code against it. This vulnerability is fixed in 2.1.163.</td> <td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55607" target=3D= "_blank" rel=3D"noopener">CVE-2026-55607</a></td>
</tr>

<td class=3D"vendor-product">antonio-castellon--module-auth</td> <td>@acastellon/auth is an authentication control system for microservices.=
Versions prior to 2.3.0 appear to allow an unauthenticated authentication = bypass in validateToken() through spoofable auth-user and Host request head= ers. The validateToken middleware contains a service-to-service bypass for = auth-user: service-brother when req.get('host').startsWith(getHostName()). = Both values involved in the check can be influenced by an unauthenticated H= TTP client: auth-user is a request header, and Host is also client-controll= ed. As a result, a remote unauthenticated attacker can send a request with = crafted headers and bypass token validation before the normal legacy/JWT/OI=
DC validation logic runs. A fix has been implemented in v2.3.0.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58399" target=3D= "_blank" rel=3D"noopener">CVE-2026-58399</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache ActiveMQ</t=

<td>Improper Input Validation vulnerability in Apache ActiveMQ, Apache Acti= veMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can rea=
ch an exposed STOMP connector can trigger denial-of-service behavior by sen= ding a negative content-length. For the NIO STOMP transport, an attacker ca=
n keep streaming body bytes and grow the per-connection command buffer beyo=
nd configured limits to cause OOM. For the blocking STOMP protocol, an erro=
r will instead force abnormal transport exception handling for the affected=
connection and closure. This issue affects Apache ActiveMQ: before 5.19.8,=
from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 be= fore 6.2.7; Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7. = Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes th=
e issue.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49432" target=3D= "_blank" rel=3D"noopener">CVE-2026-49432</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache ActiveMQ</t=

<td>Improper Authorization vulnerability in Apache ActiveMQ. An authenticat=
ed low-privilege Web Console user by default can access /admin/* paths in t=
he Web Console. The default Jetty settings incorrectly did not limit those = paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, fr=
om 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or=
5.19.8, which fixes the issue.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49877" target=3D= "_blank" rel=3D"noopener">CVE-2026-49877</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache ActiveMQ</t=

<td>Improper Neutralization of Input During Web Page Generation ('Cross-sit=
e Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console=
. The browse page in the web console renders a message Id directly without = sanitization. This allows an authenticated producer to send a=C2=A0message = with a JMS message ID that has been=C2=A0crafted to contain HTML/JavaScript=
such that when=C2=A0an administrator browses the queue in the Web Console,=
the payload executes in their browser. This issue affects Apache ActiveMQ:=
before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: befor=
e 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to vers= ion 6.2.7 or 5.19.8, which fixes the issue.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52760" target=3D= "_blank" rel=3D"noopener">CVE-2026-52760</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache ActiveMQ</t=

<td>Memory Allocation with Excessive Size Value vulnerability in Apache Act= iveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated clien=
t that opens a STOMP NIO connection can send header bytes that never termin= ate which makes the broker buffer them without limit,=C2=A0exhausting=C2=A0= the JVM heap. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0=
before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7;=
Apache ActiveMQ Stomp: before 5.19.8, from 6.0.0 before 6.2.7. Users are r= ecommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.</t=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53916" target=3D= "_blank" rel=3D"noopener">CVE-2026-53916</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache ActiveMQ</t=

<td>Memory Allocation with Excessive Size Value vulnerability in Apache Act= iveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker.=
An authenticated user can cause a broker DoS by sending a crafted OpenWire=
Message with a large encoded size value for the map. OpenWire message prop= erty maps are unmarshaled without size validation=C2=A0which can trigger OO=
M and crash the broker. This issue affects Apache ActiveMQ: before 5.19.8, = from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 bef= ore 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; = Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7. Users are r= ecommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.</t=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53917" target=3D= "_blank" rel=3D"noopener">CVE-2026-53917</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache ActiveMQ Br= oker</td>
<td>Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apac=
he ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or=
modify entries in LDAP that match the configured searchBase and searchFilt=
er can instantiate denied transports inside the broker JVM. This can be use=
d to fetch an attacker URL and spawn a second BrokerService inside the same=
JVM. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 = before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apac=
he ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommen= ded to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49434" target=3D= "_blank" rel=3D"noopener">CVE-2026-49434</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache ActiveMQ Br= oker</td>
<td>Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Br= oker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-= 49270=C2=A0an unauthenticated attacker can now cause broker OOM by sending =
an repeated BrokerInfo commands without sending=C2=A0a ConnectionInfo, unti=
l the broker will crash with OOM. This issue affects Apache ActiveMQ Broker=
: from 5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ: from=
5.19.7 before 5.19.8, from 6.2.6 before 6.2.7; Apache ActiveMQ All: from 5= .19.7 before 5.19.8, from 6.2.6 before 6.2.7. Users are recommended to upgr= ade to version 6.2.7, which fixes the issue.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50750" target=3D= "_blank" rel=3D"noopener">CVE-2026-50750</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache ActiveMQ Br= oker</td>
<td>Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache A= ctiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destination=
s are expected to be isolated to the connection that created them. The isol= ation can be broken as this is only checked in the client, allowing a=C2=A0= different connection to consume from another connection's temporary destina= tion. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 = before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; = Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommen= ded to upgrade to version 6.2.7, which fixes the issue.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54475" target=3D= "_blank" rel=3D"noopener">CVE-2026-54475</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache ActiveMQ Cl= ient</td>
<td>Memory Allocation with Excessive Size Value vulnerability in Apache Act= iveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An unauthenticated netw= ork attacker can cause a broker DoS by sending a crafted WireFormatInfo fra=
me with a malicious large size value. The value is not validate and causes = the broker to attempt allocation during pre-auth negotiation which can trig= ger OOM and crash the broker. This issue affects Apache ActiveMQ Client: be= fore 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from = 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6= .2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fi= xes the issue.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50734" target=3D= "_blank" rel=3D"noopener">CVE-2026-50734</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Gravitino</=

<td>SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, = can allow a malicious user to read or truncate files. Users are recommended=
to upgrade to version 1.0.0, which fixes this issue.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-53648" target=3D= "_blank" rel=3D"noopener">CVE-2025-53648</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache HttpCompone= nts Core</td>
<td>Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message=
parser=C2=A0in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 an=
d earlier) allows=C2=A0an remote attacker to cause a denial of service thro= ugh memory exhaustion by sending messages with excessive number of headers =
/ excessive header length</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54399" target=3D= "_blank" rel=3D"noopener">CVE-2026-54399</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache HttpCompone= nts Core</td>
<td>Allocation of resources without limits or throttling in the HTTP/2 HPAC=
K decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and e= arlier) allows an remote attacker to cause a denial of service through memo=
ry exhaustion by sending oversized compressed header blocks before the HTTP=
/2 SETTINGS acknowledgement causes the configured header list size limit to=
be applied.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54428" target=3D= "_blank" rel=3D"noopener">CVE-2026-54428</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Lucene.Net<=

<td>Improper Limitation of a Pathname to a Restricted Directory ('Path Trav= ersal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library).=
This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 thro= ugh 4.8.0-beta00017. Users are recommended to upgrade to version 4.8.0-beta= 00018, which fixes the issue.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47896" target=3D= "_blank" rel=3D"noopener">CVE-2026-47896</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Lucene.Net<=

<td>Improper Limitation of a Pathname to a Restricted Directory ('Path Trav= ersal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library).=
This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 befo=
re 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta0= 0018, which fixes the issue.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47897" target=3D= "_blank" rel=3D"noopener">CVE-2026-47897</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Lucene.Net<=

<td>Improper Restriction of XML External Entity Reference vulnerability in = Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects = Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00= 018. Users are recommended to upgrade to version 4.8.0-beta00018, which fix=
es the issue.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47898" target=3D= "_blank" rel=3D"noopener">CVE-2026-47898</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Tomcat</td> <td>Improper Neutralization of Script-Related HTML Tags in a Web Page (Basi=
c XSS) vulnerability in the number guess example for Apache Tomcat. This is= sue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 t= hrough 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, = from 7.0.0 through 7.0.109. Other versions that have reached end of support=
may also be affected. Users are recommended to upgrade to version 11.0.23,=
10.1.56 or 9.0.119, which fix the issue.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50229" target=3D= "_blank" rel=3D"noopener">CVE-2026-50229</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Tomcat</td> <td>Always-Incorrect Control Flow Implementation vulnerability in Apache To= mcat's rewrite valve meant that if the first condition in an OR chain match= ed, subsequent non-OR conditions were skipped. This issue affects Apache To= mcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from = 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that h= ave reached end of support may also be affected. Users are recommended to u= pgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.</td> <td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53404" target=3D= "_blank" rel=3D"noopener">CVE-2026-53404</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Tomcat</td> <td>Detection of Error Condition Without Action vulnerability in Apache Tom= cat when configuring CRLs for a FFM based connector. This issue affects Apa= che Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55,=
from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 1= 1.0.23, 10.1.56 or 9.0.119, which fixes the issue.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53434" target=3D= "_blank" rel=3D"noopener">CVE-2026-53434</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Tomcat</td> <td>Always-Incorrect Control Flow Implementation vulnerability in Apache To= mcat meant that special roles and empty authorisation constraints were not = included when the effective web.xml was logged. This issue affects Apache T= omcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from=
9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100.=C2=A0Other versions = that have reached end of support may also be affected. Users are recommende=
d to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.<=

<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55276" target=3D= "_blank" rel=3D"noopener">CVE-2026-55276</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Tomcat</td> <td>Improper Authentication vulnerability in Apache Tomcat allowed a replay=
attack against the EncryptionInterceptor in the cluster component. This is= sue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 t= hrough 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, fr=
om 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.= 0.23, 10.1.56, 9.0.119, which fixes the issue.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55955" target=3D= "_blank" rel=3D"noopener">CVE-2026-55955</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Tomcat</td> <td>Improper Authorization vulnerability in Apache Tomcat leads to security=
constraints specified for the default servlet ignoring any method or metho=
d omission configured as part of the constraint. This issue affects Apache = Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, fro=
m 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through = 7.0.109. Other versions that have reached end of support may also be affect= ed. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119=
, which fix the issue.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55956" target=3D= "_blank" rel=3D"noopener">CVE-2026-55956</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Tomcat</td> <td>Missing Critical Step in Authentication vulnerability in Apache Tomcat = when the JNDIRealm was configured to authenticate binds using GSSAPI allowe=
d attackers to authenticate without provided the correct password. This iss=
ue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 thr= ough 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, fr=
om 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.=
5, 10.1.37 or 9.0.101, which fixes the issue.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55957" target=3D= "_blank" rel=3D"noopener">CVE-2026-55957</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>This issue was addressed with improved input validation. This issue is = fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be ab=
le to cause unexpected system termination or corrupt kernel memory.</td> <td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-39868" target=3D= "_blank" rel=3D"noopener">CVE-2026-39868</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing malicio= usly crafted web content may lead to an unexpected process crash.</td> <td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43703" target=3D= "_blank" rel=3D"noopener">CVE-2026-43703</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A double free issue was addressed with improved memory management. This=
issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Proces= sing maliciously crafted web content may lead to an unexpected process cras= h.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43706" target=3D= "_blank" rel=3D"noopener">CVE-2026-43706</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved input sanitization. This issue is=
fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be a= ble to leak sensitive kernel state.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43722" target=3D= "_blank" rel=3D"noopener">CVE-2026-43722</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved input sanitization. This issue is=
fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be a= ble to cause unexpected system termination or write kernel memory.</td> <td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43724" target=3D= "_blank" rel=3D"noopener">CVE-2026-43724</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A race condition was addressed with improved state handling. This issue=
is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may b=
e able to cause unexpected system termination.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43743" target=3D= "_blank" rel=3D"noopener">CVE-2026-43743</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>An out-of-bounds access issue was addressed with improved bounds checki= ng. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, mac=
OS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an = unexpected process crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28979" target=3D= "_blank" rel=3D"noopener">CVE-2026-28979</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Pro= cessing maliciously crafted web content may lead to an unexpected process c= rash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-39872" target=3D= "_blank" rel=3D"noopener">CVE-2026-39872</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Pro= cessing maliciously crafted web content may lead to an unexpected process c= rash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43663" target=3D= "_blank" rel=3D"noopener">CVE-2026-43663</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>An out-of-bounds access issue was addressed with improved bounds checki= ng. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, mac=
OS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an = unexpected Safari crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43676" target=3D= "_blank" rel=3D"noopener">CVE-2026-43676</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. Processing maliciously crafted web content may lead to an unexp= ected process crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43699" target=3D= "_blank" rel=3D"noopener">CVE-2026-43699</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A cross-origin issue was addressed with improved tracking of security o= rigins. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2,=
macOS Tahoe 26.5.2. Processing maliciously crafted web content may disclos=
e sensitive user information.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43700" target=3D= "_blank" rel=3D"noopener">CVE-2026-43700</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>The issue was addressed with improved checks. This issue is fixed in Sa= fari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious = website may be able to process restricted web content outside the sandbox.<=

<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43701" target=3D= "_blank" rel=3D"noopener">CVE-2026-43701</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. A malicious web extension may be able to cause an unexpected pr= ocess crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43704" target=3D= "_blank" rel=3D"noopener">CVE-2026-43704</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A type confusion issue was addressed with improved checks. This issue i=
s fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2.=
Processing maliciously crafted web content may lead to memory corruption.<=

<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43705" target=3D= "_blank" rel=3D"noopener">CVE-2026-43705</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A memory corruption issue was addressed with improved memory handling. = This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS T= ahoe 26.5.2. Processing maliciously crafted web content may lead to an unex= pected process crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43707" target=3D= "_blank" rel=3D"noopener">CVE-2026-43707</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>The issue was addressed with improved input validation. This issue is f= ixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A = malicious website may exfiltrate data cross-origin.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43708" target=3D= "_blank" rel=3D"noopener">CVE-2026-43708</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. Processing maliciously crafted web content may lead to an unexp= ected process crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43709" target=3D= "_blank" rel=3D"noopener">CVE-2026-43709</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Pro= cessing maliciously crafted web content may lead to an unexpected process c= rash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43712" target=3D= "_blank" rel=3D"noopener">CVE-2026-43712</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A permissions issue was addressed with additional restrictions. This is= sue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26= .5.2. Visiting a website may leak sensitive data.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43713" target=3D= "_blank" rel=3D"noopener">CVE-2026-43713</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. Processing maliciously crafted web content may lead to memory c= orruption.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43715" target=3D= "_blank" rel=3D"noopener">CVE-2026-43715</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Pro= cessing maliciously crafted web content may lead to an unexpected Safari cr= ash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43716" target=3D= "_blank" rel=3D"noopener">CVE-2026-43716</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. Processing maliciously crafted web content may lead to an unexp= ected Safari crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43717" target=3D= "_blank" rel=3D"noopener">CVE-2026-43717</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A stack overflow was addressed with improved input validation. This iss=
ue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.= 5.2. Processing maliciously crafted web content may lead to an unexpected S= afari crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43718" target=3D= "_blank" rel=3D"noopener">CVE-2026-43718</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. Processing maliciously crafted web content may lead to an unexp= ected Safari crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43720" target=3D= "_blank" rel=3D"noopener">CVE-2026-43720</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>This issue was addressed through improved state management. This issue =
is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2=
. A malicious website may be able to silently hijack clipboard data.</td> <td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43721" target=3D= "_blank" rel=3D"noopener">CVE-2026-43721</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>The issue was addressed with improved input validation. This issue is f= ixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A = malicious website may be able to process restricted web content outside the=
sandbox.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43725" target=3D= "_blank" rel=3D"noopener">CVE-2026-43725</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. Processing maliciously crafted web content may lead to an unexp= ected process crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43726" target=3D= "_blank" rel=3D"noopener">CVE-2026-43726</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. Processing maliciously crafted web content may lead to an unexp= ected Safari crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43727" target=3D= "_blank" rel=3D"noopener">CVE-2026-43727</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. Processing maliciously crafted web content may lead to memory c= orruption.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43731" target=3D= "_blank" rel=3D"noopener">CVE-2026-43731</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A path handling issue was addressed with improved validation. This issu=
e is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5= .2. Processing maliciously crafted web content may disclose sensitive user = information.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43732" target=3D= "_blank" rel=3D"noopener">CVE-2026-43732</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. Processing maliciously crafted web content may lead to an unexp= ected process crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43734" target=3D= "_blank" rel=3D"noopener">CVE-2026-43734</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>The issue was addressed with improved checks. This issue is fixed in Sa= fari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious = website may exfiltrate data cross-origin.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43735" target=3D= "_blank" rel=3D"noopener">CVE-2026-43735</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Pro= cessing maliciously crafted web content may result in the disclosure of pro= cess memory.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43740" target=3D= "_blank" rel=3D"noopener">CVE-2026-43740</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. Processing maliciously crafted web content may lead to an unexp= ected process crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43742" target=3D= "_blank" rel=3D"noopener">CVE-2026-43742</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>An out-of-bounds write issue was addressed with improved input validati= on. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, mac=
OS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an = unexpected Safari crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43745" target=3D= "_blank" rel=3D"noopener">CVE-2026-43745</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Ta= hoe 26.5.2. Processing maliciously crafted web content may lead to an unexp= ected Safari crash.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43746" target=3D= "_blank" rel=3D"noopener">CVE-2026-43746</a></td>
</tr>

<td class=3D"vendor-product">ardupilot--Plane-4.6.3</td>
<td>ardupilot through Plane-4.6.3 was found to contain an out-of-bounds rea=
d issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::han= dle_serial_control().</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-38971" target=3D= "_blank" rel=3D"noopener">CVE-2026-38971</a></td>
</tr>

<td class=3D"vendor-product">ASUS--ASUS Business Manager</td>
<td>External Control of File Name or Path vulnerability in ASUS Business Ma= nager allows a local user to execute arbitrary code with SYSTEM privileges = via a tampered IPC message. Refer to the ' Security Update for ASUS Busines=
s Manager=C2=A0' section on the ASUS Security Advisory for more information= .</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8921" target=3D"= _blank" rel=3D"noopener">CVE-2026-8921</a></td>
</tr>

<td class=3D"vendor-product">ASUS--Router app</td>
<td>An Improper Export of Android Application Components vulnerability in A= SUS Router App allows a third-party application on the same device to send =
a crafted Intent that causes ASUS Router App to open an specified URL. Refe=
r to the ' Security Update for ASUS Router Android App=C2=A0' section on th=
e ASUS Security Advisory for more information.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12960" target=3D= "_blank" rel=3D"noopener">CVE-2026-12960</a></td>
</tr>

<td class=3D"vendor-product">AVTECH Security Corporation--DGM3103SCT</td> <td>DGM3103SCT provided by AVTECH Security Corporation contains an OS comma=
nd injection vulnerability, which may lead to arbitrary command execution w= ith the root privilege by a user who can log in to the web management conso=
le of the affected product.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56808" target=3D= "_blank" rel=3D"noopener">CVE-2026-56808</a></td>
</tr>

<td class=3D"vendor-product">BIAFRA--Dancer2::Plugin::Auth::OAuth::Provider= </td>
<td>Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do=
not support the OAuth 2.0 state parameter. The authentication_url method b= uilds the provider authorization redirect without issuing a state value, an=
d the callback method exchanges the callback code and registers the resulti=
ng token into the session without verifying that the callback corresponds t=
o an authorization request this session initiated. Any application that use=
s this plugin for OAuth 2.0 login is exposed to login cross-site request fo= rgery: because the callback is not bound to the session that began the flow=
, an attacker who starts an authorization with their own provider account c=
an deliver the resulting callback to a victim, causing the victim's session=
to complete the attacker's authorization and associating the attacker's pr= ovider identity and access token with that session. Where the application p= ersists this as an account link, the attacker may retain access to the vict= im's account through their own provider credentials.</td>
<td>2026-07-04</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12746" target=3D= "_blank" rel=3D"noopener">CVE-2026-12746</a></td>
</tr>

<td class=3D"vendor-product">BPS--HTML::Gumbo</td>
<td>HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type=
confusion. Support for the &lt;template&gt; element was added to libgumbo = 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not upd= ated to support it. The element was treated as a text-node, where strlen() = over-reads the heap block that the pointer addresses. Any caller that runs = parse() with the default format =3D&gt; 'string', or with format =3D&gt; 't= ree', on input containing a &lt;template&gt; element serializes the over-re=
ad bytes into the returned result, disclosing bounded heap contents. format=
=3D&gt; 'callback' reaches a croak on the unhandled node type and is unaff= ected.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-15646" target=3D= "_blank" rel=3D"noopener">CVE-2025-15646</a></td>
</tr>

<td class=3D"vendor-product">bytecodealliance--wasmtime</td>
<td>Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; v= ersions 25.0.0 through those before 36.0.11; versions 37.0.0 through those = before 44.0.3; and versions 45.0.0 and 45.0.1 contain a native implementati=
on of WASIp1 which suffers from a leak in the fd_renumber function where th=
e file descriptor being renumbered to is not properly closed. Wasmtime's im= plementation erroneously only updated the table of descriptors for WASIp1 a=
nd didn't update the underlying table of descriptors used by the host. This=
behavior means that while fd_renumber works correctly from a guest's persp= ective it ends up leaking resources in the host that aren't cleaned up unti=
l the corresponding Store is destroyed. In a loop, guests can use fd_renumb=
er to cause hosts to exhaust both resources and file descriptors. This bug = only affects the native implementation of WASIp1, meaning that only runtime=
s which load core wasm modules and expose fd_renumber are affected. Runtime=
s are additionally only affected if they expose the ability to acquire a fi=
le descriptor, such as opening a file. For runtimes that deny access to fil=
es they are unaffected. This issue has been fixed in versions 24.0.10, 36.0= .11, 44.0.3, and 45.0.2.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54786" target=3D= "_blank" rel=3D"noopener">CVE-2026-54786</a></td>
</tr>

<td class=3D"vendor-product">Cato Networks--SDP Client</td>
<td>Improper certificate validation and a time-of-check time-of-use (TOCTOU=
) race condition in the PrivilegedHelperTool XPC service in Cato Client bef= ore v.5.13.1 on macOS allows a local authenticated attacker to escalate pri= vileges to root via a self-signed certificate that bypasses the XPC caller = verification and a symlink swap during package installation.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12374" target=3D= "_blank" rel=3D"noopener">CVE-2026-12374</a></td>
</tr>

<td class=3D"vendor-product">Cloudflare--Universal SSL</td>
<td>Description: To issue and renew TLS certificates on behalf of customers=
, Cloudflare's Universal SSL feature automatically manages the CAA RRset fo=
r the customer's zone. This auto-managed RRset is permissive by design (e.g=
. 'issue "letsencrypt.org"' without parameters). On Universal SSL zones, Cl= oudflare's authoritative DNS serves this auto-managed RRset at query time, = superseding any customer-configured CAA records on the zone. When a custome=
r publishes a stricter CAA record using the RFC 8657 accounturi or validati= onmethods parameters, the Certificate Authority does not observe those para= meters when evaluating the served RRset under RFC 8659. As a result, the RF=
C 8657 account-binding and validation-method-binding protections are not en= forced end-to-end on Universal SSL zones. Successful exploitation could res= ult in issuance of a browser-trusted TLS certificate to an attacker, enabli=
ng MITM against the affected domain. Exploitation is non-trivial in practic=
e: an attacker would need to hold an ACME account at one of the Certificate=
Authorities in the served CAA RRset and to simultaneously satisfy domain c= ontrol validation across the multiple geographically distinct Network Persp= ectives the CA relies on for Multi-Perspective Issuance Corroboration. Clou= dflare prefixes are anycast-announced from hundreds of locations globally, = raising the bar against single-vantage-point BGP hijacks. Any resulting mis= issuance of a browser-trusted certificate is subject to Certificate Transpa= rency logging required by major browsers, and would be visible to CT monito= ring. Mitigation:=C2=A0 Customers requiring strict RFC 8657 enforcement nee=
d to disable Universal SSL on the affected zone. Universal SSL's automatic = CAA management and customer-set RFC 8657 accounturi and validationmethods e= nforcement are mutually exclusive by the nature of the issue, so there is n=
o in-product workaround that preserves both.=C2=A0 Certificate Transparency=
monitoring is recommended for all customers as a general detection control=
. Credits: David Osipov (ORCID: https://orcid.org/0009-0005-2713-9242), ind= ependent researcher</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14440" target=3D= "_blank" rel=3D"noopener">CVE-2026-14440</a></td>
</tr>

<td class=3D"vendor-product">containerd--containerd</td>
<td>containerd is an open-source container runtime. In versions prior to 1.= 7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User direc= tive that cannot be parsed as a 32-bit integer are incorrectly treated as a=
username, leading to runAsNonRoot evasion. If a crafted image provides an = /etc/passwd file mapping this large numeric string to root, the container u= ltimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot res= triction to be bypassed, causing unexpected behavior for environments that = require containers to run as a non-root user. This issue has been fixed in = versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-46680" target=3D= "_blank" rel=3D"noopener">CVE-2026-46680</a></td>
</tr>

<td class=3D"vendor-product">containerd--containerd</td>
<td>containerd is an open-source container runtime. Versions prior to 1.7.3=
3, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a ma= liciously crafted image to cause a Denial of Service (DoS) condition. When = creating a container from this image, memory exhaustion occurs, leading to =
an Out Of Memory (OOM) kill of the containerd process. This renders the con= tainer runtime API unavailable and can disrupt clients such as the Docker E= ngine or Kubernetes control-plane components. This issue has been fixed in = versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47262" target=3D= "_blank" rel=3D"noopener">CVE-2026-47262</a></td>
</tr>

<td class=3D"vendor-product">containerd--containerd</td>
<td>containerd is an open-source container runtime. Versions prior to 2.3.2=
, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import proc= ess where it fails to validate the image references specified within a chec= kpoint image's configuration. An attacker with permissions to create pods c=
an use a crafted checkpoint image to force containerd to pull a malicious i= mage and assign it an arbitrary local tag, thereby poisoning the node's loc=
al image cache. Subsequently, if other pods on the same node attempt to use=
the poisoned tag with an IfNotPresent (or Never) pull policy, they will un= knowingly execute the attacker's malicious image instead of the legitimate = one. This can lead to a compromise of the affected pods, allowing the attac= ker to execute arbitrary code under the victim pod's identity. This issue h=
as been fixed in versions 2.3.2, 2.2.5 and 2.1.9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50195" target=3D= "_blank" rel=3D"noopener">CVE-2026-50195</a></td>
</tr>

<td class=3D"vendor-product">containerd--containerd</td>
<td>containerd is an open-source container runtime. In versions prior to 1.= 7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from=
an image config (LABEL instruction in Dockerfile) to a container without v= alidation. This may result in executing an arbitrary command on the host, v=
ia a plugin that consumes container labels for some operations. This issue = has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53488" target=3D= "_blank" rel=3D"noopener">CVE-2026-53488</a></td>
</tr>

<td class=3D"vendor-product">containerd--containerd</td>
<td>containerd is an open-source container runtime. Versions prior to 2.3.2=
, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log=
from a checkpoint image without validating a symlinked path. This could re= sult in reading an arbitrary file on the host via kubectl logs. This issue = has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53489" target=3D= "_blank" rel=3D"noopener">CVE-2026-53489</a></td>
</tr>

<td class=3D"vendor-product">containerd--containerd</td>
<td>containerd is an open-source container runtime. In Versions prior to 2.= 3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container De= vice Interface (CDI) annotations found within untrusted checkpoint image me= tadata during container restoration. When restoring a container from a chec= kpoint, containerd preserves CDI-related annotations from the checkpoint ar= chive rather than relying solely on the pod's create-time specification. Th=
is allows a user with pod creation permissions to bypass standard Kubernete=
s resource allocation and device plugin enforcement, injecting arbitrary CD=
I edits (such as device nodes and host mounts) into the restored container.=
Successful exploitation requires that the node has CDI enabled and contain=
s a matching host CDI specification for the requested device; environments = where CDI is disabled or lacking sensitive device specifications are not af= fected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53492" target=3D= "_blank" rel=3D"noopener">CVE-2026-53492</a></td>
</tr>

<td class=3D"vendor-product">CORNELIUS--Plack::Middleware::OAuth</td> <td>Plack::Middleware::OAuth versions through 0.10 for Perl do not support = the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authoriza= tion redirect without issuing a state value, and AccessTokenV2 exchanges th=
e callback code and registers the resulting token into the session (registe= r_session) without verifying that the callback corresponds to an authorizat= ion request this session initiated. Any application that uses this middlewa=
re for OAuth 2.0 login is exposed to login cross-site request forgery: beca= use the callback is not bound to the session that began the flow, an attack=
er who starts an authorization with their own provider account can deliver = the resulting callback to a victim, causing the victim's session to complet=
e the attacker's authorization and associating the attacker's provider iden= tity and access token with that session. Where the application persists thi=
s as an account link, the attacker may retain access to the victim's accoun=
t through their own provider credentials.</td>
<td>2026-07-04</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12740" target=3D= "_blank" rel=3D"noopener">CVE-2026-12740</a></td>
</tr>

<td class=3D"vendor-product">craftcms--cms</td>
<td>Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 a=
nd above prior to 5.9.21, theEntriesController::actionSaveEntry() performs = entry-edit permission checks before request-controlled author changes are a= pplied to the model, allowing for authorship spoofing. The subsequent autho=
r mutation path accepts attacker-supplied authors / author parameters and a= llows the change when the current user is one of the old authors. Because t=
he controller does not re-run authorization after mutating the author list,=
a low-privileged user can reassign an entry's authorship to another user w= ithout holding the dedicated peer-author-change permission. This issue has = been fixed in version 5.9.21.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50279" target=3D= "_blank" rel=3D"noopener">CVE-2026-50279</a></td>
</tr>

<td class=3D"vendor-product">craftcms--cms</td>
<td>Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 a=
nd above prior to 5.9.21, the EntriesController::actionMoveToSection() endp= oint gates the destination section only by viewEntries:$section-&gt;uid rat= her than requiring saveEntries permission (the source entry is separately c= hecked via Entry::canMove()). As a result, a low-privileged authenticated c= ontrol-panel user who can move an entry out of its current section can call=
moveEntryToSection() to rewrite the entry's sectionId and save it into a s= ection where they have read access but no write access. This breaks the sec= tion-level authorization model, letting a user with limited permissions inj= ect content into a protected section and interfere with editorial boundarie=
s, approval workflows, and section-specific business logic. This issue has = been fixed in version 5.9.21.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50280" target=3D= "_blank" rel=3D"noopener">CVE-2026-50280</a></td>
</tr>

<td class=3D"vendor-product">craftcms--cms</td>
<td>Craft CMS is a content management system (CMS). Versions 5.7.0 and abov=
e, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate ele= ment action. An attacker who is only able to duplicate their own entires ca=
n submit an arbitrary id through the newAttributes request parameter. The d= uplication routine overrides its own id =3D null reset with that value and = writes the attacker's attributes into the victim's existing entry row. Elem= entsController::beforeAction() pulls the request body into $this-&gt;_attri= butes and rejects requests that ship an id or canonicalId key at the top le= vel, actionBulkDuplicate(), reads a separate newAttributes array and passes=
it straight through to the service layer. Elements::duplicateElement() clo= nes the source element, sets id to null, and then hands the attacker's arra=
y to Craft::configure(), which overwrites the reset id with any numeric val=
ue inside $newAttributes. PHP Yii's saveElement() then performs an UPDATE a= gainst the row with that primary key instead of an INSERT. The attackers's = title, slug, authorId, postDate, and UID land on the victim's entry. safeAt= tributes() on Entry includes id because the base element model exposes it, =
so the Collection::only() filter does not strip it. This issue has been fix=
ed in version 5.9.21.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50281" target=3D= "_blank" rel=3D"noopener">CVE-2026-50281</a></td>
</tr>

<td class=3D"vendor-product">craftcms--cms</td>
<td>Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and = above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 co= ntain an authorization issue where a forced folder move can delete a confli= cting destination folder without destination delete permission. Function cr= aft\controllers\AssetsController::actionMoveFolder() supports moving an ass=
et folder into a destination parent folder. If a folder with the same name = already exists at the destination, the action can be called with force=3Dtr=
ue to overwrite the destination. This issue has been resolved in versions 5= .9.21 and 4.17.14.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50282" target=3D= "_blank" rel=3D"noopener">CVE-2026-50282</a></td>
</tr>

<td class=3D"vendor-product">craftcms--cms</td>
<td>Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 thro= ugh 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in=
the AssetsController::actionReplaceFile that can delete a source asset wit= hout source delete permission by supplying both assetId and sourceAssetId. = AssetsController::actionReplaceFile() supports replacing a target asset fil=
e using another existing asset as the source. The action loads: assetId -&g=
t; $assetToReplace and sourceAssetId -&gt; $sourceAsset, then enforces repl= ace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are = provided, this expression resolves to the target asset so no permission che=
ck is performed against the source asset volume. When both assets are prese= nt, Craft copies the source file into the target and then deletes the sourc=
e asset. There is no deletion check for for the source asset. An authentica= ted user who can replace files in one volume can delete assets in another v= olume where they do not have delete permission, as long as they can obtain =
a sourceAssetId, leading to broken content references and data loss. This i= ssue has been fixed in versions 4.17.14 and 5.9.21.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50283" target=3D= "_blank" rel=3D"noopener">CVE-2026-50283</a></td>
</tr>

<td class=3D"vendor-product">craftcms--cms</td>
<td>Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 t= hrough 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDel= eteFolder() only requires the deleteAssets:&lt;volume-uid&gt; permission fo=
r the target folder. It never enforces deletePeerAssets:&lt;volume-uid&gt;,=
even though Assets::deleteFoldersByIds() cascades deletion to every descen= dant folder and every asset inside, regardless of the uploader's assigned p= rivileges. A low-privilege user who has been granted folder-management righ=
ts on a shared volume can therefore destroy assets uploaded by other users = (peer assets), bypassing the per-asset peer-permission check that the sibli=
ng actionDeleteAsset endpoint correctly applies. This issue has been fixed =
in versions 4.17.15 and 5.9.22.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50284" target=3D= "_blank" rel=3D"noopener">CVE-2026-50284</a></td>
</tr>

<td class=3D"vendor-product">craftcms--cms</td>
<td>Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 t= hrough 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub=
account can plant a JavaScript payload in a craftcms/cms issue title. When=
a Craft admin uses the CraftSupport widget's "Give feedback" screen and ty= pes a search term that returns the poisoned issue, the payload executes in = the admin's control panel session. No control panel account or elevated pri= vileges are required on the attacker's side. This issue has been fixed in v= ersions 4.17.16 and 5.9.23.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55790" target=3D= "_blank" rel=3D"noopener">CVE-2026-55790</a></td>
</tr>

<td class=3D"vendor-product">craftcms--cms</td>
<td>Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and = above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulne= rable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Inject= ion through the /actions/app/resource-js endpoint. By exploiting the defaul=
t permissive trustedHosts configuration, an attacker can poison the Host or=
X-Forwarded-Host header to manipulate the application's $baseUrl. This byp= asses the endpoint's internal URL validation, forcing the backend Guzzle cl= ient to fetch a malicious payload from an attacker-controlled server and re= flect it to the client with a Content-Type: application/javascript header. = The vulnerability manifests when assetManager.cacheSourcePaths is set to fa= lse. This issue has been fixed in versions 4.18.0 and 5.10.0.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55791" target=3D= "_blank" rel=3D"noopener">CVE-2026-55791</a></td>
</tr>

<td class=3D"vendor-product">craftcms--cms</td>
<td>Craft CMS is a content management system (CMS). In versions starting fr=
om 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0,=
the dataUrl() Twig function is included in Craft's Twig sandbox allowlist,=
allowing any control panel user granted the utility:system-messages permis= sion to embed a file-reading payload into system email templates. When thos=
e emails are sent, the server reads the target file and returns its content=
s as a base64-encoded data URL embedded in the email body. The .env file, w= hich typically contains the database password, CRAFT_SECURITY_KEY, and thir= d-party API keys, passes all of Craft's existing dataUrl() protection check=
s and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacke=
r to forge session tokens and escalate to full admin account takeover. This=
issue has been fixed in versions 4.18.0 and 5.10.0.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55792" target=3D= "_blank" rel=3D"noopener">CVE-2026-55792</a></td>
</tr>

<td class=3D"vendor-product">craftcms--cms</td>
<td>Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 t= hrough 5.9.22, an author-level control panel user can store a malicious Jav= aScript payload in an entry title. When an admin, or any control panel user=
with saveEntries for the same Structure section, drags another entry under=
the poisoned entry in table view, the payload executes in the victim's ses= sion. The issue is exploitable because the title is escaped into data-title=
by the server, decoded again by the browser, read with jQuery .data('title= '), and then concatenated into a new HTML string without attribute escaping=
. To exploit, an attacker must have an existing control panel account (Auth=
or role minimum), the victim must perform a drag operation (not just visit = the page), and the victim's session needs to be elevated at trigger time. T= his issue has been fixed in version 5.9.23.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55793" target=3D= "_blank" rel=3D"noopener">CVE-2026-55793</a></td>
</tr>

<td class=3D"vendor-product">craftcms--cms</td>
<td>Craft CMS is a content management system (CMS). In versions 5.9.0 and a= bove prior to 5.10.0, control panel users with the ability to edit entries = can execute unsandboxed Twig code via the HTTP Referrer header, potentially=
leading to authenticated RCE. The issue happens when a user is saving entr= ies. Strings for a signed redirect URL are being compiled as a Twig templat=
e via renderObjectTemplate(), and while a sandboxed alternative already exi= sts (renderSandboxedObjectTemplate()), it is not used in this case. This si= gned URL can be specified by users, as it is reflected in the "Referer" HTT=
P request header, which is under attacker control. This issue has been fixe=
d in version 5.10.0.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55794" target=3D= "_blank" rel=3D"noopener">CVE-2026-55794</a></td>
</tr>

<td class=3D"vendor-product">CubeSpace--CW0057 Reaction Wheel</td> <td>CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are v= ulnerable to an Improper Verification of Cryptographic Signature vulnerabil= ity. This could allow an attacker with physical access to the product to up= load arbitrary malicious firmware to the device without authentication.</td=

<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13743" target=3D= "_blank" rel=3D"noopener">CVE-2026-13743</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>A use-after-free vulnerability exists in libcurl when an application co= nfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `= CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and fi= nally terminates the handle with `curl_easy_cleanup()`. During this final c= leanup phase, libcurl attempts to access and modify an internal structure t= hat was already freed during the reset operation.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10536" target=3D= "_blank" rel=3D"noopener">CVE-2026-10536</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>An issue in curl's QUIC UDP receive function allows a malicious HTTP/3 = server to trigger a remote denial of service against a curl or libcurl clie= nt. Because the helper function discards zero-length UDP datagrams before c= ounting them toward the per-call packet budget, a connected QUIC peer can c= ontinuously stream empty datagrams to indefinitely stall the client.</td> <td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11352" target=3D= "_blank" rel=3D"noopener">CVE-2026-11352</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>libcurl keeps previously used connections in a connection pool for subs= equent transfers to reuse if one of them matches the setup. An easy handle = that first uses default native CA trust can continue trusting the native pl= atform store after the application switches that same handle to custom CA m= aterial for a later transfer.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11564" target=3D= "_blank" rel=3D"noopener">CVE-2026-11564</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>By default, curl automatically responds to WebSocket PING frames. Becau=
se curl lacks an upper bound on memory allocation for unacknowledged frames=
, a malicious server can exhaust all available memory by flooding curl with=
rapid, sequential PING messages.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11586" target=3D= "_blank" rel=3D"noopener">CVE-2026-11586</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>Successfully using libcurl to do a transfer to a specific HTTP origin (= `hostA`) with **Digest** authentication and then changing the origin to a d= ifferent one (`hostB`) for a second transfer, reusing the same handle, make=
s libcurl wrongly pass on the `Authorization:` header field meant for `host= A`, to `hostB`.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11856" target=3D= "_blank" rel=3D"noopener">CVE-2026-11856</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>When a user invokes curl using a schemeless URL combined with `--proto-= default` sftp (or scp), a disconnect occurs between the tool layer and libc= url. The tool layer incorrectly infers the URL scheme, which erroneously by= passes the initialization of critical SSH security options like CURLOPT_SSH= _HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl=
runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the c= onnection via SFTP/SCP as specified. Because the tool layer skipped the sec= urity configuration, these SSH host verification options are silently omitt= ed, causing curl to connect to an unverified SSH remote host without throwi=
ng an error.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12064" target=3D= "_blank" rel=3D"noopener">CVE-2026-12064</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>A vulnerability exists where a new transfer that uses STARTTLS to upgra=
de the connection might reuse an existing live connection even though the T=
LS configuration mismatches so it should not.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8286" target=3D"= _blank" rel=3D"noopener">CVE-2026-8286</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>libcurl might in some circumstances reuse the wrong connection when ask=
ed to do Negotiate-authenticated ones, even when they are set to use differ= ent 'services'. libcurl features a pool of recent connections so that subse= quent requests can reuse an existing connection to avoid overhead. When reu= sing a connection a range of criteria must be met. Due to a logical error i=
n the code, a request that was issued by an application could wrongfully re= use an existing connection to the same server that was authenticated using = different services.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8458" target=3D"= _blank" rel=3D"noopener">CVE-2026-8458</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>A flaw in curl's cookie parsing logic allows a malicious HTTP server to=
set 'super cookies' that bypass the Public Suffix List check. This enables=
an attacker-controlled origin to inject cookies that curl subsequently sco= pes and transmits to unrelated third-party domains.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8924" target=3D"= _blank" rel=3D"noopener">CVE-2026-8924</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>The curl logic that works with SASL authentication could end up cleanin=
g up the GSASL context *twice* without clearing the pointer in between, mak= ing it `free()` the same pointer twice.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8925" target=3D"= _blank" rel=3D"noopener">CVE-2026-8925</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>When asking curl to use a `.netrc` file to find credentials and at the = same time specifying a URL with a username(without a password), like `https= ://user@example.com/`, curl could wrongly get and use the password for *ano= ther* user set in the `.netrc` file for that host if such a one exists and = there is no match for the specified user.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8926" target=3D"= _blank" rel=3D"noopener">CVE-2026-8926</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>When reusing a libcurl handle for sequential transfers driven by enviro= nment-variable proxy configuration, libcurl fails to clear the proxy authen= tication state between requests. Specifically, if the initial transfer auth= enticates against `proxyA` using Digest auth, a subsequent transfer routed = through `proxyB` erroneously leaks the `Proxy-Authorization:` header intend=
ed solely for `proxyA`.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8927" target=3D"= _blank" rel=3D"noopener">CVE-2026-8927</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>libcurl would reuse a previously created connection even when some mTLS=
config related option had been changed that should have prohibited reuse. = libcurl keeps previously used connections in a connection pool for subseque=
nt transfers to reuse if one of them matches the setup. However, some TLS s= ettings related to client certificates were left out from the configuration=
match checks, making them match too easily. In particular options related =
to the private key.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8932" target=3D"= _blank" rel=3D"noopener">CVE-2026-8932</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>libcurl had a flaw that when instructed to clear proxy authentication c= redentials which made it not do so, leaving the old credentials around to g=
et used for subsequent transfers that should not know nor use them.</td> <td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9079" target=3D"= _blank" rel=3D"noopener">CVE-2026-9079</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNC= TION` callback triggers a use-after-free vulnerability, where libcurl attem= pts to store a flag using a dangling struct pointer immediately after that = pointer's memory has been freed.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9080" target=3D"= _blank" rel=3D"noopener">CVE-2026-9080</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>In this scenario, libcurl first uses a proper HTTP/3 server for the ini= tial transfers, and when it makes a second transfer to the same site it has=
been replaced by the attacker's impostor machine - without a valid certifi= cate. When libcurl returns to the hostname the second time with a cached SS=
L session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data en= abled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), lib= curl might send off the second request's bytes on that new connection *befo= re* enforcing the certificate verification failure. Potentially leaking sen= sitive information.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9545" target=3D"= _blank" rel=3D"noopener">CVE-2026-9545</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>A vulnerability in libcurl caused the HTTP `Referer:` header to persist=
even when explicitly cleared. While the documentation states that passing = NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear=
the internal state. As a result the previous referrer string was erroneous=
ly reused and sent in subsequent requests, potentially leaking sensitive in= formation to unintended servers.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9546" target=3D"= _blank" rel=3D"noopener">CVE-2026-9546</a></td>
</tr>

<td class=3D"vendor-product">curl--curl</td>
<td>When a libcurl-based application performs transfers via `SCP://` or `SF= TP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently=
accept an untrusted server. This vulnerability occurs when a server presen=
ts a host key type that does not match the specific key type already record=
ed for that host in the `known_hosts` file. Instead of rejecting the mismat= ch, the callback mechanism fails to properly enforce the restriction, allow= ing the connection to succeed without warning and risking a potential man-i= n-the-middle attack.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9547" target=3D"= _blank" rel=3D"noopener">CVE-2026-9547</a></td>
</tr>

<td class=3D"vendor-product">cve-search--cve-search</td>
<td>An unauthenticated improper input validation vulnerability in the POST = /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate re= quest parameters controlling the MongoDB collection, projected fields, and = regular-expression filters to read arbitrary application MongoDB collection=
s. This can expose administrative usernames and password hashes from the mg= mt_users collection, enabling offline password cracking and potential admin= istrative account compromise.</td>
<td>2026-07-05</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59509" target=3D= "_blank" rel=3D"noopener">CVE-2026-59509</a></td>
</tr>

<td class=3D"vendor-product">deltaww--DTMSoft</td>
<td>The affected product is vulnerable to a deserialization of untrusted da= ta, which may allow an attacker to execute arbitrary code.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12578" target=3D= "_blank" rel=3D"noopener">CVE-2026-12578</a></td>
</tr>

<td class=3D"vendor-product">deltaww--DVP-12SE</td>
<td>Delta Electronics DVP12SE PLCs are susceptible to a resource allocation=
vulnerability without limits or throttling (CWE-770) within their Modbus T=
CP service.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12818" target=3D= "_blank" rel=3D"noopener">CVE-2026-12818</a></td>
</tr>

<td class=3D"vendor-product">deltaww--DVP-12SE</td>
<td>Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a speci= fied port without authentication or access control, permitting unauthentica= ted interaction with security-sensitive PLC functions.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12819" target=3D= "_blank" rel=3D"noopener">CVE-2026-12819</a></td>
</tr>

<td class=3D"vendor-product">deltaww--DVP80ES3</td>
<td>DVP80ES3 with Improperly Implemented Security Check for Standard vulner= ability.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12577" target=3D= "_blank" rel=3D"noopener">CVE-2026-12577</a></td>
</tr>

<td class=3D"vendor-product">Devolutions--PowerShell Universal</td> <td>Insertion of sensitive information into sent data in the AI Agent job A=
PI in Devolutions PowerShell Universal 2026.2.0 allows an authenticated use=
r with AI Agent read access to obtain reusable, potentially higher-privileg=
ed authentication tokens via App Tokens serialized in plaintext in job API = responses.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13437" target=3D= "_blank" rel=3D"noopener">CVE-2026-13437</a></td>
</tr>

<td class=3D"vendor-product">DokuWiki--Librarian 56.2</td>
<td>An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attac= ker to create an account via the register function in inc/auth.php. NOTE: t= his is disputed by the Supplier because this is the intentional behavior wh=
en the product is configured for self-registration (a non-default feature).= </td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-37106" target=3D= "_blank" rel=3D"noopener">CVE-2026-37106</a></td>
</tr>

<td class=3D"vendor-product">Eclipse Foundation--Eclipse CSI - PIA</td>
<td>The /v1/upload/sbom endpoint extracts the iss claim from the attacker-s= upplied JWT with signature verification disabled, then interpolates that st= ring into three log statements before any validation gate. Because the conf= igured log format ("%(asctime)s - %(name)s - %(levelname)s - %(message)s") = renders newlines literally, an unauthenticated attacker can forge log recor=
ds that are byte-for-byte indistinguishable from PIA's genuine "Successfull=
y authenticated project" message. PIA is an authentication broker whose log=
s are explicitly relied upon for incident response (DESIGN.md =C3=82=C2=A75=
.4 lists "Token verifications" and "Errors" as events to log), so the abili=
ty to plant fake auth-success entries directly undermines the audit trail t=
he service exists to produce.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12616" target=3D= "_blank" rel=3D"noopener">CVE-2026-12616</a></td>
</tr>

<td class=3D"vendor-product">Eclipse Foundation--Eclipse tinydtls</td> <td>Eclipse tinydtls before commit=C2=A0b3efd41ad111a4920f599f51ffa4f5e9f1e= 72221 contains an out-of-bounds read vulnerability in the check_server_cert= ificate() function that allows unauthenticated attackers to trigger reads b= eyond valid buffer boundaries by crafting a Certificate handshake message w= ith a specific fragment_length value. Attackers can exploit missing buffer = length validation before uint24 reads, memcmp, and memcpy operations during=
DTLS epoch 0 on both client and server paths to cause denial of service on=
memory-constrained devices.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9267" target=3D"= _blank" rel=3D"noopener">CVE-2026-9267</a></td>
</tr>

<td class=3D"vendor-product">EIPStackGroup--OpENer</td>
<td>A buffer overflow in the Get_Attribute_List function of EIPStackGroup O= pENer commit 76b95c allows attackers to cause a Denial of Service (DoS) via=
supplying a crafted Common Packet Format (CPF) packet.</td> <td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-51221" target=3D= "_blank" rel=3D"noopener">CVE-2026-51221</a></td>
</tr>

<td class=3D"vendor-product">electron-userland--electron-builder</td> <td>electron-updater allows for automatic updates for Electron apps. Prior =
to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions=
) only stripped a credential header whose key string matched exactly lowerc= ase "authorization", exposing credentials. Other credential-bearing headers=
- most notably PRIVATE-TOKEN (used by GitLab's personal access token flow)=
and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) - were n=
ot stripped and could be forwarded to an attacker-controlled cross-origin r= edirect destination. This issue has been fixed in version 9.7.0.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54673" target=3D= "_blank" rel=3D"noopener">CVE-2026-54673</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sf= tpd module) allows an authenticated SFTP user to enumerate the existence of=
files and directories outside the configured root directory. The SSH_FXP_R= EALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=3Df= alse, unlike every other SFTP operation handler. This allows .. components =
in the requested path to bypass the is_within_root/2 check without being re= solved. The un-canonicalized path then enters resolve_symlinks/2, which wal=
ks up the directory tree above the configured root and issues read_link() s= yscalls on arbitrary filesystem paths. An authenticated SFTP client can exp= loit this by sending a REALPATH request with a crafted traversal path. The = server response differs depending on whether the target path exists on the = host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_N= O_SUCH_FILE when it does not). This creates a path-existence oracle that an=
attacker can use to enumerate the filesystem structure outside the configu= red root, including the existence of sensitive files, directories, and moun=
t points. The vulnerability leaks only the existence of paths. No file cont= ents, credentials, or write access are obtainable through this issue alone.=
The information gained may assist further attacks when combined with other=
vulnerabilities. This vulnerability is associated with program files lib/s= sh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4. This issue = affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresp= onding to ssh from 3.0.1 until 6.0.2, 5.5.2.2, and 5.2.11.9.</td> <td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53422" target=3D= "_blank" rel=3D"noopener">CVE-2026-53422</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in=
Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to ren= der an SFTP channel permanently unresponsive. The handle_data/4 function in=
ssh_sftpd contains a catch-all clause that accepts channel data of any typ=
e. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DA= TA) arrives with an empty pending buffer and a payload at or below the SFTP=
packet size limit, the clause tail-calls itself with identical arguments, = creating an infinite loop. The SFTP protocol operates exclusively on normal=
channel data (type 0). Extended data (non-zero type) is meaningless for SF=
TP and is never sent by conforming clients. However, the SSH protocol permi=
ts any channel participant to send extended data on an open channel, so an = authenticated SFTP client can trigger the loop by sending SSH_MSG_CHANNEL_E= XTENDED_DATA with any data_type_code and any non-empty payload at or below = the size limit. The targeted ssh_sftpd process enters an infinite tail-recu= rsive loop. It never processes another message, its message queue grows wit= hout bound, and it can only be stopped by killing the process. BEAM's reduc= tion-based scheduler preemption continues to function, so other processes o=
n the node are not starved, but each stuck channel process consumes its ful=
l CPU time share continuously and accumulates unbounded message queue memor=
y. Opening many channels amplifies the CPU and memory impact. Erlang/OTP SS=
H configurations using the default max_channels setting (infinity) allow an=
authenticated user to open unlimited channels per connection, amplifying t=
he attack without requiring multiple TCP connections or authentications. No=
file contents, credentials, or write access are obtainable through this is= sue. The impact is limited to denial of service on targeted SFTP channels, = with secondary CPU degradation and memory growth. This vulnerability is ass= ociated with program file lib/ssh/src/ssh_sftpd.erl and program routine ssh= _sftpd:handle_data/4. This issue affects OTP from OTP 17.0 until OTP 29.0.3=
, 28.5.0.3, and 27.3.4.14 corresponding to ssh from 3.0.1 until 6.0.2, 5.5.= 2.2, and 5.2.11.9.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54886" target=3D= "_blank" rel=3D"noopener">CVE-2026-54886</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS = server) allows predictable DTLS cookie computation during the startup windo=
w, enabling source address verification bypass. On DTLS server startup, dtl= s_server_connection:initial_hello/3 initializes previous_cookie_secret to t=
he empty binary (&lt;&lt;&gt;&gt;) instead of a random value. Because HMAC = with an empty key is deterministic, anyone who observes the plaintext Clien= tHello can compute dtls_handshake:cookie(&lt;&lt;&gt;&gt;, IP, Port, Hello)=
and forge a valid DTLS cookie before the first rotation of the cookie secr= et. The DTLS cookie (RFC 6347 =C3=82=C2=A74.2.1) is a denial-of-service mit= igation that prevents spoofed source IPs from forcing the server to allocat=
e state and perform expensive cryptographic operations; it is not an authen= tication mechanism. During the window from server startup until the first s= ecret rotation (0 to 15 seconds), an attacker who can observe the plaintext=
ClientHello can bypass the source address verification, enabling DTLS hand= shake amplification with spoofed source addresses. This vulnerability is as= sociated with program file lib/ssl/src/dtls_server_connection.erl and progr=
am routine dtls_server_connection:initial_hello/3. This issue affects OTP f= rom OTP 20.0 before 29.0.3, 28.5.0.3 and 27.3.4.14 corresponding to ssl fro=
m 8.2 before 11.7.3, 11.6.0.3 and 11.2.12.10.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54887" target=3D= "_blank" rel=3D"noopener">CVE-2026-54887</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>Improper Enforcement of Message Integrity During Transmission in a Comm= unication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection modul=
e) allows a network-positioned attacker to inject unauthenticated plaintext=
that the TLS client application later treats as authenticated server data.=
The function tls_gen_connection:handle_protocol_record/3 rejects APPLICATI= ON_DATA records that arrive in pre-handshake states when the TLS endpoint a= cts as a server, but does not apply the same check when the endpoint acts a=
s a client. A network-positioned attacker can send plaintext APPLICATION_DA=
TA records to the client during the handshake. The records are buffered and=
, once the handshake completes successfully, delivered to the application a=
s if they were authenticated post-handshake data. The attacker cannot obser=
ve the client's response or steer the connection, so the impact is limited =
to blind injection of unauthenticated bytes. The injection window is wider = for TLS versions prior to TLS 1.3 than for TLS 1.3. This vulnerability is a= ssociated with program file lib/ssl/src/tls_gen_connection.erl. This issue = affects OTP from OTP 17.0 before 29.0.3, 28.5.0.3 and 27.3.4.14 correspondi=
ng to ssl from 5.3.4 before 11.7.3, 11.6.0.3 and 11.2.12.10. TLS 1.3 is aff= ected starting with OTP 22.0, when TLS 1.3 support was added.</td> <td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54891" target=3D= "_blank" rel=3D"noopener">CVE-2026-54891</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erla= ng/OTP ssl (dtls_packet_demux module) allows an unauthenticated remote atta= cker to crash all active DTLS sessions on a listener. A DTLS server listene=
r uses a single shared dtls_packet_demux gen_server process to route incomi=
ng UDP datagrams to the correct connection handler. When a DTLS client reco= nnects rapidly from the same source address and port (sending multiple Clie= ntHello messages in quick succession), a race condition in the demux's inte= rnal gb_trees key-value store causes a {key_exists, {old, Client}} crash, t= erminating the demux process. Because the demux is shared across all DTLS a= ssociations on that listener, its crash immediately kills every active DTLS=
session, not just the attacker's. The attack is pre-authentication: the at= tacker only needs to send UDP datagrams containing valid ClientHello messag=
es from the same source IP and port before the intermediate DOWN monitor me= ssage is processed by the gen_server. No credentials, no completed handshak=
e, and no special configuration are required, and the crash can be repeated=
indefinitely to create a persistent denial of service for all clients of t= hat listener. This vulnerability is associated with program file lib/ssl/sr= c/dtls_packet_demux.erl. This issue affects OTP from OTP 25.3 before 29.0.3=
, 28.5.0.3, and 27.3.4.14 corresponding to ssl from 10.9 before 11.7.3, 11.= 6.0.3, and 11.2.12.10.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55950" target=3D= "_blank" rel=3D"noopener">CVE-2026-55950</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>The Erlang/OTP ssl application does not validate that the PSK identity = list and binder list carried in a TLS 1.3 ClientHello pre-shared key extens= ion have equal length before passing them to the session ticket handler. In=
tls_handshake_1_3:handle_pre_shared_key/3, an OfferedPreSharedKeys record = with a mismatched number of identities and binders is forwarded directly to=
tls_server_session_ticket:use/4, which crashes the session ticket handler = process. An unauthenticated remote attacker can send a single crafted Clien= tHello to a TLS 1.3 server with session tickets enabled (stateful or statel= ess mode) and permanently disrupt session ticket handling on that listener.=
New TLS 1.3 handshakes complete but subsequently crash when the server att= empts to issue a session ticket, effectively making TLS 1.3 unusable on the=
affected listener until the ssl application is restarted. TLS 1.2 connecti= ons are not affected. This issue affects OTP from 22.2 before 29.0.3, 28.5.= 0.3 and 27.3.4.14 corresponding to ssl from 9.5 before 11.7.3, 11.6.0.3 and=
11.2.12.10.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55952" target=3D= "_blank" rel=3D"noopener">CVE-2026-55952</a></td>
</tr>

<td class=3D"vendor-product">EXODIST--DBIx::QuickORM</td>
<td>DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection vi=
a unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subcla= ss, sets bindtype in its constructor but never quote_char, so SQL::Abstract=
emits identifiers verbatim. Caller-supplied identifiers (order_by, where-c= lause column keys, field and returning lists, upsert columns, and join alia= ses) reach the SQL string raw, while values are placeholder-bound and unaff= ected. A caller that forwards untrusted input to an affected identifier pos= ition, such as a user-controlled order_by value, enables SQL injection: the=
row order can be made to depend on a sub-select over columns the query nev=
er selected, and the where and update identifier positions permit further d= ata disclosure and tampering.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13766" target=3D= "_blank" rel=3D"noopener">CVE-2026-13766</a></td>
</tr>

<td class=3D"vendor-product">Flowise--Flowise</td>
<td>Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wi= ldcard (*) on its text-to-speech (TTS) generation endpoint (packages/server= /src/controllers/text-to-speech/index.ts), independent of the server's conf= igured CORS policy. This bypasses the server's otherwise restrictive defaul=
t CORS configuration (getCorsOptions()) and allows any webpage to make cros= s-origin requests that trigger TTS generation using stored credentials, ena= bling drive-by cross-origin credential abuse.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56277" target=3D= "_blank" rel=3D"noopener">CVE-2026-56277</a></td>
</tr>

<td class=3D"vendor-product">fzf--fzf</td>
<td>fzf is vulnerable to=C2=A0Integer Overflow leading to crash in FuzzyMat= chV2 function. When input line length is=C2=A0approximately 2,200,000 bytes=
and pattern length is 999 bytes, the product=C2=A0overflows.=C2=A0The Go r= untime detects the invalid slice bounds and terminates the=C2=A0process imm= ediately with a non-recoverable panic. This issue was fixed in version 0.73= .1.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53432" target=3D= "_blank" rel=3D"noopener">CVE-2026-53432</a></td>
</tr>

<td class=3D"vendor-product">fzf--fzf</td>
<td>fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP = body processing in the --listen mode due to inefficient HTTP body processin=
g using repeated string concatenation, resulting in quadratic time complexi=
ty (O(n=C3=82=C2=B2)). A crafted POST request with many small segments can = trigger excessive CPU usage during request handling.This allows a single ma= licious request to monopolize the single-threaded HTTP server, blocking all=
other clients and resulting in denial of service. This issue was fixed in = version 0.73.1.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53433" target=3D= "_blank" rel=3D"noopener">CVE-2026-53433</a></td>
</tr>

<td class=3D"vendor-product">gazebo--gazebo_plugins v3.9.0</td>
<td>An improper input validation in the gazebo_ros_diff_drive.cpp component=
of gazebo_plugins v3.9.0 allows attackers to cause a Denial of Service (Do=
S) via supplying a crafted geometry_msgs::Twist message.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-38891" target=3D= "_blank" rel=3D"noopener">CVE-2026-38891</a></td>
</tr>

<td class=3D"vendor-product">Gigamon--GVOS v.5.16.1</td>
<td>Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in = the GVOS H-VUE subsystem.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-36848" target=3D= "_blank" rel=3D"noopener">CVE-2026-36848</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions up to and including 1.26.1 allow repository archive down= loads to bypass token scope checks on the web archive download endpoint.</t=

<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20706" target=3D= "_blank" rel=3D"noopener">CVE-2026-20706</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 have insufficient permission checks when l= isting tracked time entries.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20909" target=3D= "_blank" rel=3D"noopener">CVE-2026-20909</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 lack validation constraints for repository=
creation fields, including length-limited template fields and trust model =
or object format values.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-22547" target=3D= "_blank" rel=3D"noopener">CVE-2026-22547</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea 1.26.2 allows fork synchronization to continue after a parent rep= ository changes from public to private, exposing data to a fork that should=
no longer be authorized.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24451" target=3D= "_blank" rel=3D"noopener">CVE-2026-24451</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 have insufficient permission checks for up= dating or rebasing pull request branches.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24690" target=3D= "_blank" rel=3D"noopener">CVE-2026-24690</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea 1.26.2 allows unauthorized users to access labels of private orga= nizations.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-25038" target=3D= "_blank" rel=3D"noopener">CVE-2026-25038</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 have insufficient visibility checks in org= anization permission APIs for hidden members and private organizations.</td=

<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-25712" target=3D= "_blank" rel=3D"noopener">CVE-2026-25712</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 mishandle path resolution during template = repository generation, allowing template processing to read or write throug=
h symlinked or otherwise non-regular paths.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-25718" target=3D= "_blank" rel=3D"noopener">CVE-2026-25718</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions up to and including 1.25.4 allow redirect bypasses throu=
gh raw or percent-encoded backslashes in redirect_to values.</td> <td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-25779" target=3D= "_blank" rel=3D"noopener">CVE-2026-25779</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 look up tracked-time entries by time ID wi= thout scoping the lookup to the issue in the request URL, allowing deletion=
attempts to target entries from another issue.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-25782" target=3D= "_blank" rel=3D"noopener">CVE-2026-25782</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 do not consistently enforce OAuth2 authori= zation code expiry and single-use behavior during token exchange.</td> <td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-26232" target=3D= "_blank" rel=3D"noopener">CVE-2026-26232</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challe= nge method correctly during authorization, allowing token exchange without = the expected verifier check.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-26247" target=3D= "_blank" rel=3D"noopener">CVE-2026-26247</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 do not use the migration HTTP transport fo=
r LFS push and sync mirror operations, bypassing the configured migration t= ransport protections for those LFS requests.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-26292" target=3D= "_blank" rel=3D"noopener">CVE-2026-26292</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 do not enforce a timeout on git grep searc= hes, allowing expensive searches to consume server resources.</td> <td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-26307" target=3D= "_blank" rel=3D"noopener">CVE-2026-26307</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 allow a user to change another user's prim= ary email address.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27657" target=3D= "_blank" rel=3D"noopener">CVE-2026-27657</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 allow draft release data or attachments to=
be accessed without the required write permission.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27660" target=3D= "_blank" rel=3D"noopener">CVE-2026-27660</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions up to and including 1.26.1 have insufficient permission = checks for Composer package source links, which can expose private or inter= nal package source information.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27771" target=3D= "_blank" rel=3D"noopener">CVE-2026-27771</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea 1.25.5 caches a branch-specific write-permission result across mu= ltiple refs in one pre-receive hook session, allowing a per-branch maintain= er-edit grant to be reused for other refs and escalate to full repository w= rite access.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27775" target=3D= "_blank" rel=3D"noopener">CVE-2026-27775</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 accept malformed or injected forwarded-pro=
to values when detecting public URLs, allowing spoofed canonical URL genera= tion.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27779" target=3D= "_blank" rel=3D"noopener">CVE-2026-27779</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors=
while processing pre-receive hook input, allowing oversized input to bypas=
s branch-protection checks.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-27780" target=3D= "_blank" rel=3D"noopener">CVE-2026-27780</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td>
<td>Gitea versions before 1.25.5 use release tag names and asset names as f= ilesystem path components when dumping release assets, allowing specially c= rafted names to affect dump output paths.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28705" target=3D= "_blank" rel=3D"noopener">CVE-2026-28705</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td> <td>Notification API leaks private issue metadata after access revocation</=

<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58419" target=3D= "_blank" rel=3D"noopener">CVE-2026-58419</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td> <td>Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of = service</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58421" target=3D= "_blank" rel=3D"noopener">CVE-2026-58421</a></td>
</tr>

<td class=3D"vendor-product">Gitea--Gitea Open Source Git Server</td> <td>Improper authorization on OAuth sign-in callback silently re-enables ad= ministrator-disabled accounts</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58422" target=3D= "_blank" rel=3D"noopener">CVE-2026-58422</a></td>
</tr>

<td class=3D"vendor-product">GitHub--Enterprise Server</td>
<td>A stored cross-site scripting vulnerability was identified in GitHub En= terprise Server that allowed an authenticated attacker to execute arbitrary=
JavaScript in another user's browser by injecting a crafted payload into t=
he title of a Discussion in the Q&amp;A category. The AnsweredQuestionStruc= turedDataComponent did not escape user-controlled Discussion titles before = embedding them in a &lt;script type=3D"application/ld+json"&gt; block, allo= wing the title to break out of the script context. The injection was escala= ted to a full cross-site scripting attack on GitHub Enterprise Server by le= veraging JSONP callback support in the REST API to bypass the Content Secur= ity Policy. This vulnerability affected all versions of GitHub Enterprise S= erver prior to 3.21 and was fixed in versions 3.20.4, 3.19.8, 3.18.11, 3.17= .17, 3.16.20. This vulnerability was reported via the GitHub Bug Bounty pro= gram.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10585" target=3D= "_blank" rel=3D"noopener">CVE-2026-10585</a></td>
</tr>

<td class=3D"vendor-product">GitHub--Enterprise Server</td>
<td>An incorrect authorization vulnerability was identified in GitHub Enter= prise Server that allowed a user-to-server token scoped to a GitHub App ins= tallation to perform certain write operations on public repositories outsid=
e the token's intended scope. This was possible because the authorization c= heck only verified that the installation had read permissions on the target=
repository rather than verifying that the token's installation was explici= tly granted access to that repository. An attacker who obtained a victim's = user-to-server token could create issues, issue comments, commit comments, = and private vulnerability reports on any public repository, appearing as th=
e victim user with no indication of the app involvement. This vulnerability=
was fixed by adding a repository scope check for user-to-server tokens iss= ued by global apps. This vulnerability affected all versions of GitHub Ente= rprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4, 3.19.=
8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the GitHu=
b Bug Bounty program.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14340" target=3D= "_blank" rel=3D"noopener">CVE-2026-14340</a></td>
</tr>

<td class=3D"vendor-product">GitHub--Enterprise Server</td>
<td>A UI misrepresentation vulnerability was identified in GitHub Enterpris=
e Server that allowed an OAuth application to gain unintended access to an = organization's runner management. An attacker could exploit this by creatin=
g an OAuth application requesting the manage_runners:org scope and directin=
g a victim user to authorize it, as the scope was not displayed on the auth= orization consent screen. This vulnerability affected all versions of GitHu=
b Enterprise Server prior to 3.22 and was fixed in versions 3.21.2, 3.20.4,=
3.19.8, 3.18.11, 3.17.17, 3.16.20. This vulnerability was reported via the=
GitHub Bug Bounty program.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9106" target=3D"= _blank" rel=3D"noopener">CVE-2026-9106</a></td>
</tr>

<td class=3D"vendor-product">GitHub--Enterprise Server</td>
<td>A missing authorization vulnerability was identified in GitHub Enterpri=
se Server that allowed an authenticated user to read source code from priva=
te repositories they did not have access to. The Copilot pull request descr= iption diff summary endpoint accepted a cross-repository comparison range a=
nd rendered the resulting diff without verifying that the requesting user w=
as authorized to view the target repository. Exploitation required an authe= nticated account on the instance with read access to at least one repositor=
y to use as the comparison base. This vulnerability affected all versions o=
f GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17,=
3.18.11, 3.19.8, and 3.20.4. This vulnerability was reported via the GitHu=
b Bug Bounty program.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9132" target=3D"= _blank" rel=3D"noopener">CVE-2026-9132</a></td>
</tr>

<td class=3D"vendor-product">GNU--gzip</td>
<td>GNU gzip contains a vulnerability in the gzexe utility related to insec= ure temporary file handling. When the mktemp utility is not available in th=
e user's PATH, gzexe falls back to constructing a temporary file path based=
solely on the process ID (PID). This predictable filename is created witho=
ut exclusive access or existence checks. A local attacker can pre-create th=
e predicted temporary file path as a symbolic link pointing to an arbitrary=
file writable by the victim. When gzexe runs, it follows the symlink and o= verwrites the target file, resulting in a time-of-check to time-of-use (TOC= TOU) condition that allows arbitrary file overwrite. This issue has been fi= xed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269</td> <td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41991" target=3D= "_blank" rel=3D"noopener">CVE-2026-41991</a></td>
</tr>

<td class=3D"vendor-product">GNU--gzip</td>
<td>GNU gzip contains a global buffer overflow vulnerability in the LZH dec= ompression logic caused by improper reuse of shared global state between di= fferent decompression formats within a single execution. GNU gzip maintains=
a global array that is shared across the LZ77, LZW, and LZH decompression = routines and is not reinitialized between files processed in the same invoc= ation. By decompressing a specially crafted LZW file followed by a speciall=
y crafted LZH file in a single gzip -d command, an attacker can poison the = shared global state and subsequently trigger an out-of-bounds read in the L=
ZH decoder. The LZH decompression logic follows stale values left in the sh= ared array, causing reads past the end of the allocated global buffer. This=
issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e2396968= 1</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41992" target=3D= "_blank" rel=3D"noopener">CVE-2026-41992</a></td>
</tr>

<td class=3D"vendor-product">GoAdminGroup--GoAdmin</td>
<td>SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.= 26) allows a remote attacker to execute arbitrary code and obtain sensitive=
information via the the __sort_type URL parameter on all /admin/info/{tabl=
e} endpoints</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-51946" target=3D= "_blank" rel=3D"noopener">CVE-2026-51946</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Extensions in Google Chrome prior to 150.0.7871.47 al= lowed an attacker who convinced a user to install a malicious extension to = execute arbitrary code via a crafted Chrome Extension. (Chromium security s= everity: Critical)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13774" target=3D= "_blank" rel=3D"noopener">CVE-2026-13774</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a=
remote attacker who had compromised the renderer process to potentially pe= rform a sandbox escape via a crafted HTML page. (Chromium security severity=
: Critical)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13775" target=3D= "_blank" rel=3D"noopener">CVE-2026-13775</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed =
a remote attacker who had compromised the renderer process to potentially p= erform a sandbox escape via a crafted HTML page. (Chromium security severit=
y: Critical)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13776" target=3D= "_blank" rel=3D"noopener">CVE-2026-13776</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in iOSWeb in Google Chrome o=
n iOS prior to 150.0.7871.47 allowed a remote attacker to potentially explo=
it heap corruption via a crafted HTML page. (Chromium security severity: Cr= itical)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13777" target=3D= "_blank" rel=3D"noopener">CVE-2026-13777</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47=
allowed a local attacker to execute arbitrary code via a malicious periphe= ral. (Chromium security severity: Critical)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13778" target=3D= "_blank" rel=3D"noopener">CVE-2026-13778</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.= 0.7871.47 allowed a remote attacker to execute arbitrary code via malicious=
network traffic. (Chromium security severity: Critical)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13779" target=3D= "_blank" rel=3D"noopener">CVE-2026-13779</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in ANGLE in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker who had compromised the rend= erer process to potentially perform a sandbox escape via a crafted HTML pag=
e. (Chromium security severity: Critical)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13780" target=3D= "_blank" rel=3D"noopener">CVE-2026-13780</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Skia in Google Chrome pri=
or to 150.0.7871.47 allowed a remote attacker who had compromised the rende= rer process to potentially perform a sandbox escape via a crafted HTML page=
. (Chromium security severity: Critical)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13781" target=3D= "_blank" rel=3D"noopener">CVE-2026-13781</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Browser in Google Chrome prior to 150.0.7871.47 allow=
ed a remote attacker who had compromised the renderer process to potentiall=
y perform a sandbox escape via a crafted HTML page. (Chromium security seve= rity: Critical)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13782" target=3D= "_blank" rel=3D"noopener">CVE-2026-13782</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed=
a remote attacker who convinced a user to engage in specific UI gestures t=
o potentially exploit heap corruption via a crafted HTML page. (Chromium se= curity severity: Critical)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13783" target=3D= "_blank" rel=3D"noopener">CVE-2026-13783</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed=
a remote attacker who convinced a user to engage in specific UI gestures t=
o potentially exploit heap corruption via a crafted HTML page. (Chromium se= curity severity: Critical)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13784" target=3D= "_blank" rel=3D"noopener">CVE-2026-13784</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871= .47 allowed a remote attacker who convinced a user to engage in specific UI=
gestures to potentially perform a sandbox escape via a crafted HTML page. = (Chromium security severity: Critical)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13785" target=3D= "_blank" rel=3D"noopener">CVE-2026-13785</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed=
a remote attacker to execute arbitrary code via a crafted HTML page. (Chro= mium security severity: Critical)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13786" target=3D= "_blank" rel=3D"noopener">CVE-2026-13786</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Chromoting in Google Chrome on Windows prior to 150.0= .7871.47 allowed a remote attacker to execute arbitrary code via malicious = network traffic. (Chromium security severity: Critical)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13787" target=3D= "_blank" rel=3D"noopener">CVE-2026-13787</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Fullscreen in Google Chrome on Android prior to 150.0= .7871.47 allowed a remote attacker to execute arbitrary code via a crafted = HTML page. (Chromium security severity: Critical)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13788" target=3D= "_blank" rel=3D"noopener">CVE-2026-13788</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a=
remote attacker who had compromised the renderer process to potentially pe= rform a sandbox escape via a crafted HTML page. (Chromium security severity=
: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13789" target=3D= "_blank" rel=3D"noopener">CVE-2026-13789</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in Scroll in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker to leak cross-origin data via a craft=
ed HTML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13790" target=3D= "_blank" rel=3D"noopener">CVE-2026-13790</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Downloads in Google Chrom=
e prior to 150.0.7871.47 allowed an attacker who convinced a user to instal=
l a malicious extension to execute arbitrary code via a crafted Chrome Exte= nsion. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13791" target=3D= "_blank" rel=3D"noopener">CVE-2026-13791</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.=
47 allowed a remote attacker to potentially perform a sandbox escape via a = crafted HTML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13792" target=3D= "_blank" rel=3D"noopener">CVE-2026-13792</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in SVG in Google Chrome prior to 150.0.= 7871.47 allowed a remote attacker to leak cross-origin data via a crafted H= TML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13793" target=3D= "_blank" rel=3D"noopener">CVE-2026-13793</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebAppInstalls in Google = Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who conv= inced a user to engage in specific UI gestures to execute arbitrary code vi=
a a crafted HTML page. (Chromium security severity: High)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13794" target=3D= "_blank" rel=3D"noopener">CVE-2026-13794</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Chrome for iOS in Google Chrome on i=
OS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation re= strictions via a crafted HTML page. (Chromium security severity: High)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13795" target=3D= "_blank" rel=3D"noopener">CVE-2026-13795</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 = allowed a remote attacker who had compromised the renderer process to poten= tially perform a sandbox escape via a crafted HTML page. (Chromium security=
severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13796" target=3D= "_blank" rel=3D"noopener">CVE-2026-13796</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chromecast in Google Chro=
me prior to 150.0.7871.47 allowed a remote attacker who had compromised the=
renderer process to potentially perform a sandbox escape via a crafted HTM=
L page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13797" target=3D= "_blank" rel=3D"noopener">CVE-2026-13797</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871= .47 allowed a remote attacker who had compromised the renderer process to p= otentially perform a sandbox escape via a crafted HTML page. (Chromium secu= rity severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13798" target=3D= "_blank" rel=3D"noopener">CVE-2026-13798</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed =
a remote attacker to potentially exploit heap corruption via malicious netw= ork traffic. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13799" target=3D= "_blank" rel=3D"noopener">CVE-2026-13799</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Updater in Google Chrome on Windows pri=
or to 150.0.7871.47 allowed a local attacker to perform OS-level privilege = escalation via a malicious file. (Chromium security severity: High)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13800" target=3D= "_blank" rel=3D"noopener">CVE-2026-13800</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 = allowed a remote attacker who had compromised the renderer process to poten= tially perform a sandbox escape via a crafted HTML page. (Chromium security=
severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13801" target=3D= "_blank" rel=3D"noopener">CVE-2026-13801</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed=
a remote attacker who convinced a user to engage in specific UI gestures t=
o execute arbitrary code via a crafted HTML page. (Chromium security severi= ty: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13802" target=3D= "_blank" rel=3D"noopener">CVE-2026-13802</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Type Confusion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 a= llowed a remote attacker who had compromised the renderer process to potent= ially perform a sandbox escape via a crafted HTML page. (Chromium security = severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13803" target=3D= "_blank" rel=3D"noopener">CVE-2026-13803</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 al= lowed a remote attacker who had compromised the renderer process to potenti= ally perform a sandbox escape via a crafted HTML page. (Chromium security s= everity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13804" target=3D= "_blank" rel=3D"noopener">CVE-2026-13804</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 al= lowed a remote attacker to execute arbitrary code via a crafted HTML page. = (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13805" target=3D= "_blank" rel=3D"noopener">CVE-2026-13805</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Accessibility in Google C= hrome prior to 150.0.7871.47 allowed a remote attacker who had compromised = the renderer process to bypass site isolation via a crafted HTML page. (Chr= omium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13806" target=3D= "_blank" rel=3D"noopener">CVE-2026-13806</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47=
allowed a remote attacker who convinced a user to engage in specific UI ge= stures to execute arbitrary code via a malicious file. (Chromium security s= everity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13807" target=3D= "_blank" rel=3D"noopener">CVE-2026-13807</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient data validation in Chrome for iOS in Google Chrome on iOS = prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensi= tive information from process memory via physical access to the device. (Ch= romium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13808" target=3D= "_blank" rel=3D"noopener">CVE-2026-13808</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in Safe Browsing in Google Chrome on i=
OS prior to 150.0.7871.47 allowed a remote attacker who had compromised the=
renderer process to leak cross-origin data via a crafted HTML page. (Chrom= ium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13809" target=3D= "_blank" rel=3D"noopener">CVE-2026-13809</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Input in Google Chrome on Linux prior t=
o 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive i= nformation from process memory via a crafted HTML page. (Chromium security = severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13810" target=3D= "_blank" rel=3D"noopener">CVE-2026-13810</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in IME in Google Chrome prior to 150.0.7871.47 allowed a=
remote attacker to execute arbitrary code inside a sandbox via a crafted H= TML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13811" target=3D= "_blank" rel=3D"noopener">CVE-2026-13811</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chrome for iOS in Google = Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convince=
d a user to engage in specific UI gestures to inject arbitrary scripts or H= TML (UXSS) via a crafted HTML page. (Chromium security severity: High)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13812" target=3D= "_blank" rel=3D"noopener">CVE-2026-13812</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Chrome for iOS in Google Chrome on i=
OS prior to 150.0.7871.47 allowed a remote attacker who had compromised the=
renderer process to potentially perform a sandbox escape via a crafted HTM=
L page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13813" target=3D= "_blank" rel=3D"noopener">CVE-2026-13813</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed=
a remote attacker who convinced a user to engage in specific UI gestures t=
o potentially exploit heap corruption via a crafted HTML page. (Chromium se= curity severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13814" target=3D= "_blank" rel=3D"noopener">CVE-2026-13814</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Blink in Google Chrome prior to 150.0.7871.47 allowed=
a remote attacker to execute arbitrary code inside a sandbox via a crafted=
HTML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13815" target=3D= "_blank" rel=3D"noopener">CVE-2026-13815</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in File Input in Google Chro=
me on Android prior to 150.0.7871.47 allowed a remote attacker to leak cros= s-origin data via a crafted HTML page. (Chromium security severity: High)</=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13816" target=3D= "_blank" rel=3D"noopener">CVE-2026-13816</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Glic in Google Chrome pri=
or to 150.0.7871.47 allowed a remote attacker to potentially perform a sand= box escape via a crafted HTML page. (Chromium security severity: High)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13817" target=3D= "_blank" rel=3D"noopener">CVE-2026-13817</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Passwords in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker to bypass navigation restrictions via =
a crafted HTML page. (Chromium security severity: High)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13818" target=3D= "_blank" rel=3D"noopener">CVE-2026-13818</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871= .47 allowed a remote attacker who had compromised the renderer process to p= erform an out of bounds memory read via a crafted HTML page. (Chromium secu= rity severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13819" target=3D= "_blank" rel=3D"noopener">CVE-2026-13819</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in Skia in Google Chrome on Mac prior to 150.0.7871.=
47 allowed a remote attacker who had compromised the renderer process to le=
ak cross-origin data via a crafted HTML page. (Chromium security severity: = High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13820" target=3D= "_blank" rel=3D"noopener">CVE-2026-13820</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowe=
d a remote attacker to execute arbitrary code inside a sandbox via a crafte=
d HTML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13821" target=3D= "_blank" rel=3D"noopener">CVE-2026-13821</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Extensions in Google Chrome on Android = prior to 150.0.7871.47 allowed an attacker who convinced a user to install =
a malicious extension to bypass same origin policy via a crafted Chrome Ext= ension. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13822" target=3D= "_blank" rel=3D"noopener">CVE-2026-13822</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Glic in Google Chrome prior to 150.0.7871.47 allowed =
a remote attacker who had compromised the renderer process to potentially p= erform a sandbox escape via a crafted HTML page. (Chromium security severit=
y: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13823" target=3D= "_blank" rel=3D"noopener">CVE-2026-13823</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Extensions in Google Chrome prior to=
150.0.7871.47 allowed a remote attacker who had compromised the renderer p= rocess to perform privilege escalation via a crafted HTML page. (Chromium s= ecurity severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13824" target=3D= "_blank" rel=3D"noopener">CVE-2026-13824</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allow=
ed a remote attacker to potentially exploit heap corruption via a crafted H= TML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13825" target=3D= "_blank" rel=3D"noopener">CVE-2026-13825</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Autofill in Google Chrome on Android pr= ior to 150.0.7871.47 allowed a remote attacker who had compromised the rend= erer process to leak cross-origin data via a crafted HTML page. (Chromium s= ecurity severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13826" target=3D= "_blank" rel=3D"noopener">CVE-2026-13826</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Updater in Google Chrome on Mac prior to 150.0.7871.4=
7 allowed a local attacker to perform privilege escalation via a malicious = file. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13827" target=3D= "_blank" rel=3D"noopener">CVE-2026-13827</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Enterprise in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker to obtain potentially sensitive infor= mation from process memory via a crafted HTML page. (Chromium security seve= rity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13828" target=3D= "_blank" rel=3D"noopener">CVE-2026-13828</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Settings in Google Chrome=
on Windows prior to 150.0.7871.47 allowed a remote attacker who had compro= mised the renderer process to potentially perform a sandbox escape via a cr= afted HTML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13829" target=3D= "_blank" rel=3D"noopener">CVE-2026-13829</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7= 871.47 allowed a remote attacker to execute arbitrary code via malicious ne= twork traffic. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13830" target=3D= "_blank" rel=3D"noopener">CVE-2026-13830</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read and write in GPU in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker who had compromised the renderer process to = execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium = security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13831" target=3D= "_blank" rel=3D"noopener">CVE-2026-13831</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Headless in Google Chrome prior to 150.0.7871.47 allo= wed a remote attacker who had compromised the renderer process to potential=
ly perform a sandbox escape via a crafted HTML page. (Chromium security sev= erity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13832" target=3D= "_blank" rel=3D"noopener">CVE-2026-13832</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in ANGLE in Google Chrome on Mac prior to 150.0.7871.=
47 allowed a remote attacker to leak cross-origin data via a crafted HTML p= age. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13833" target=3D= "_blank" rel=3D"noopener">CVE-2026-13833</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in ANGLE in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker who had compromised the rend= erer process to potentially perform a sandbox escape via a crafted HTML pag=
e. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13834" target=3D= "_blank" rel=3D"noopener">CVE-2026-13834</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in XML in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to potentially exploit heap corruption via a=
crafted HTML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13835" target=3D= "_blank" rel=3D"noopener">CVE-2026-13835</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) v=
ia a crafted HTML page. (Chromium security severity: High)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13836" target=3D= "_blank" rel=3D"noopener">CVE-2026-13836</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to perform UI spoofing via a crafted HTML pa= ge. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13837" target=3D= "_blank" rel=3D"noopener">CVE-2026-13837</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to bypass same origin policy via a crafted H= TML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13838" target=3D= "_blank" rel=3D"noopener">CVE-2026-13838</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to bypass same origin policy via a crafted H= TML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13839" target=3D= "_blank" rel=3D"noopener">CVE-2026-13839</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Canvas in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker to leak cross-origin data via a crafte=
d HTML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13840" target=3D= "_blank" rel=3D"noopener">CVE-2026-13840</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allowe=
d a remote attacker who had compromised the renderer process to potentially=
perform a sandbox escape via a crafted HTML page. (Chromium security sever= ity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13841" target=3D= "_blank" rel=3D"noopener">CVE-2026-13841</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of t=
he Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: = High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13842" target=3D= "_blank" rel=3D"noopener">CVE-2026-13842</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chrome for iOS in Google = Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had comp= romised the renderer process to potentially perform a sandbox escape via a = crafted HTML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13843" target=3D= "_blank" rel=3D"noopener">CVE-2026-13843</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Updater in Google Chrome on Windows prior to 150.0.78= 71.47 allowed a local attacker to perform OS-level privilege escalation via=
a malicious file. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13844" target=3D= "_blank" rel=3D"noopener">CVE-2026-13844</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in DOM in Google Chrome prior to 150.0.7871.47 allowed a=
remote attacker to execute arbitrary code inside a sandbox via a crafted H= TML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13845" target=3D= "_blank" rel=3D"noopener">CVE-2026-13845</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 al= lowed a remote attacker who had compromised the renderer process to potenti= ally perform a sandbox escape via a crafted HTML page. (Chromium security s= everity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13846" target=3D= "_blank" rel=3D"noopener">CVE-2026-13846</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chrome for iOS in Google = Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cros= s-origin data via a crafted HTML page. (Chromium security severity: High)</=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13847" target=3D= "_blank" rel=3D"noopener">CVE-2026-13847</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed=
a remote attacker to execute arbitrary code inside a sandbox via a crafted=
HTML page. (Chromium security severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13848" target=3D= "_blank" rel=3D"noopener">CVE-2026-13848</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chromoting in Google Chro=
me on Windows prior to 150.0.7871.47 allowed a local attacker to potentiall=
y perform a sandbox escape via a malicious file. (Chromium security severit=
y: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13849" target=3D= "_blank" rel=3D"noopener">CVE-2026-13849</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chrome for iOS in Google = Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to execute ar= bitrary code inside a sandbox via a malicious file. (Chromium security seve= rity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13850" target=3D= "_blank" rel=3D"noopener">CVE-2026-13850</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebAppInstalls in Google = Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass=
discretionary access control via a crafted HTML page. (Chromium security s= everity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13851" target=3D= "_blank" rel=3D"noopener">CVE-2026-13851</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebAppInstalls in Google = Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass=
discretionary access control via a crafted HTML page. (Chromium security s= everity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13852" target=3D= "_blank" rel=3D"noopener">CVE-2026-13852</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allo= wed a remote attacker who had compromised the renderer process to potential=
ly perform a sandbox escape via a crafted HTML page. (Chromium security sev= erity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13853" target=3D= "_blank" rel=3D"noopener">CVE-2026-13853</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.4=
7 allowed a remote attacker who had compromised the renderer process to pot= entially perform a sandbox escape via a crafted HTML page. (Chromium securi=
ty severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13854" target=3D= "_blank" rel=3D"noopener">CVE-2026-13854</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.4=
7 allowed a remote attacker who convinced a user to engage in specific UI g= estures to execute arbitrary code via a crafted HTML page. (Chromium securi=
ty severity: High)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13855" target=3D= "_blank" rel=3D"noopener">CVE-2026-13855</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Speech in Google Chrome o=
n Android prior to 150.0.7871.47 allowed a remote attacker who had compromi= sed the renderer process to perform privilege escalation via a crafted HTML=
page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13856" target=3D= "_blank" rel=3D"noopener">CVE-2026-13856</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Geometry in Google Chrome prior to 150.= 0.7871.47 allowed a remote attacker who convinced a user to engage in speci= fic UI gestures to perform UI spoofing via a crafted HTML page. (Chromium s= ecurity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13857" target=3D= "_blank" rel=3D"noopener">CVE-2026-13857</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 al= lowed a remote attacker to obtain potentially sensitive information from pr= ocess memory via a crafted video file. (Chromium security severity: Medium)= </td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13858" target=3D= "_blank" rel=3D"noopener">CVE-2026-13858</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7= 871.47 allowed a remote attacker to potentially perform a sandbox escape vi=
a a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13859" target=3D= "_blank" rel=3D"noopener">CVE-2026-13859</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Autofill in Google Chrome on Windows prior to = 150.0.7871.47 allowed a remote attacker who convinced a user to engage in s= pecific UI gestures to perform UI spoofing via a crafted HTML page. (Chromi=
um security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13860" target=3D= "_blank" rel=3D"noopener">CVE-2026-13860</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Core in Google Chrome prior to 150.0.7871.47 allowed =
a remote attacker who had compromised the renderer process to potentially p= erform a sandbox escape via a crafted HTML page. (Chromium security severit=
y: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13861" target=3D= "_blank" rel=3D"noopener">CVE-2026-13861</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Web Authentication (Passkeys &amp; S= ecurity Keys) in Google Chrome on iOS prior to 150.0.7871.47 allowed an att= acker in a privileged network position to leak cross-origin data via a craf= ted HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13862" target=3D= "_blank" rel=3D"noopener">CVE-2026-13862</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in CustomTabs in Google Chro=
me on Android prior to 150.0.7871.47 allowed a local attacker to perform pr= ivilege escalation via a malicious file. (Chromium security severity: Mediu= m)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13863" target=3D= "_blank" rel=3D"noopener">CVE-2026-13863</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in WebHID in Google Chrome prior to 150= .0.7871.47 allowed an attacker who convinced a user to install a malicious = extension to perform privilege escalation via a crafted Chrome Extension. (= Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13864" target=3D= "_blank" rel=3D"noopener">CVE-2026-13864</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Enterprise in Google Chro=
me prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing = via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13865" target=3D= "_blank" rel=3D"noopener">CVE-2026-13865</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Input in Google Chrome on Android prior=
to 150.0.7871.47 allowed a remote attacker who had compromised the rendere=
r process to bypass site isolation via a crafted HTML page. (Chromium secur= ity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13866" target=3D= "_blank" rel=3D"noopener">CVE-2026-13866</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Geolocation in Google Chrome prior to 1= 50.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13867" target=3D= "_blank" rel=3D"noopener">CVE-2026-13867</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Network in Google Chrome on Android pri=
or to 150.0.7871.47 allowed a remote attacker who had compromised the rende= rer process to bypass site isolation via a crafted HTML page. (Chromium sec= urity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13868" target=3D= "_blank" rel=3D"noopener">CVE-2026-13868</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Device in Google Chrome on Windows prior to 150.0.787= 1.47 allowed a remote attacker who had compromised the renderer process to = potentially perform a sandbox escape via a crafted HTML page. (Chromium sec= urity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13869" target=3D= "_blank" rel=3D"noopener">CVE-2026-13869</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in WebView in Google Chrome on Android prior to 150.0.78= 71.47 allowed a remote attacker to execute arbitrary code inside a sandbox = via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13870" target=3D= "_blank" rel=3D"noopener">CVE-2026-13870</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in GuestView in Google Chrome prior to = 150.0.7871.47 allowed a remote attacker who had compromised the renderer pr= ocess to bypass site isolation via a crafted HTML page. (Chromium security = severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13871" target=3D= "_blank" rel=3D"noopener">CVE-2026-13871</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebAppInstalls in Google = Chrome on Android prior to 150.0.7871.47 allowed a local attacker to potent= ially perform a sandbox escape via a malicious file. (Chromium security sev= erity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13872" target=3D= "_blank" rel=3D"noopener">CVE-2026-13872</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in Layout in Google Chrome prior to 150.0.7871.47 al= lowed a remote attacker to obtain potentially sensitive information from pr= ocess memory via a crafted HTML page. (Chromium security severity: Medium)<=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13873" target=3D= "_blank" rel=3D"noopener">CVE-2026-13873</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in DataTransfer in Google Chrome prior to 150.0.7871.47 allowed a = remote attacker to obtain potentially sensitive information from process me= mory via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13874" target=3D= "_blank" rel=3D"noopener">CVE-2026-13874</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in GPU in Google Chrome on W= indows prior to 150.0.7871.47 allowed a remote attacker who had compromised=
the renderer process to obtain potentially sensitive information from proc= ess memory via a crafted HTML page. (Chromium security severity: Medium)</t=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13875" target=3D= "_blank" rel=3D"noopener">CVE-2026-13875</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Network in Google Chrome prior to 150.0= .7871.47 allowed an attacker in a privileged network position to bypass con= tent security policy via malicious network traffic. (Chromium security seve= rity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13876" target=3D= "_blank" rel=3D"noopener">CVE-2026-13876</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in ANGLE in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker who had compromised the rend= erer process to obtain potentially sensitive information from process memor=
y via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13877" target=3D= "_blank" rel=3D"noopener">CVE-2026-13877</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871= .47 allowed a remote attacker who had compromised the renderer process to p= otentially perform a sandbox escape via a crafted HTML page. (Chromium secu= rity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13878" target=3D= "_blank" rel=3D"noopener">CVE-2026-13878</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Bluetooth in Google Chrome prior to 150.0.7871.47 all= owed an attacker on the local network segment to obtain potentially sensiti=
ve information from process memory via a malicious peripheral. (Chromium se= curity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13879" target=3D= "_blank" rel=3D"noopener">CVE-2026-13879</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 al= lowed a remote attacker who had compromised the renderer process to potenti= ally perform a sandbox escape via a crafted HTML page. (Chromium security s= everity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13880" target=3D= "_blank" rel=3D"noopener">CVE-2026-13880</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in WebAppInstalls in Google Chrome prior t=
o 150.0.7871.47 allowed a remote attacker to bypass same origin policy via =
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13881" target=3D= "_blank" rel=3D"noopener">CVE-2026-13881</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in USB in Google Chrome prior to 150.0.7871.47 allowed a remote at= tacker who had compromised the renderer process to potentially perform a sa= ndbox escape via a crafted HTML page. (Chromium security severity: Medium)<=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13882" target=3D= "_blank" rel=3D"noopener">CVE-2026-13882</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed=
a remote attacker to potentially perform a sandbox escape via a crafted HT=
ML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13883" target=3D= "_blank" rel=3D"noopener">CVE-2026-13883</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 = allowed a local attacker to execute arbitrary code via malicious network tr= affic. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13884" target=3D= "_blank" rel=3D"noopener">CVE-2026-13884</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Skia in Google Chrome on Android prior to 150.0.7871.=
47 allowed a remote attacker to execute arbitrary code inside a sandbox via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13885" target=3D= "_blank" rel=3D"noopener">CVE-2026-13885</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Isolated Web Apps in Google Chrome p= rior to 150.0.7871.47 allowed a remote attacker to bypass content security = policy via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13886" target=3D= "_blank" rel=3D"noopener">CVE-2026-13886</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in NFC in Google Chrome on Android prior t=
o 150.0.7871.47 allowed a remote attacker who had compromised the renderer = process to leak cross-origin data via a crafted HTML page. (Chromium securi=
ty severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13887" target=3D= "_blank" rel=3D"noopener">CVE-2026-13887</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Extensions in Google Chrome prior to 150.0.7871.47 al= lowed a remote attacker to execute arbitrary code inside a sandbox via a cr= afted HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13888" target=3D= "_blank" rel=3D"noopener">CVE-2026-13888</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in WebAuthentication in Google Chrome =
on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origi=
n data via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13889" target=3D= "_blank" rel=3D"noopener">CVE-2026-13889</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.4=
7 allowed a remote attacker who had compromised the renderer process to obt= ain potentially sensitive information from process memory via a crafted HTM=
L page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13890" target=3D= "_blank" rel=3D"noopener">CVE-2026-13890</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Extensions in Google Chro=
me prior to 150.0.7871.47 allowed a remote attacker who had compromised the=
renderer process to perform privilege escalation via a crafted HTML page. = (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13891" target=3D= "_blank" rel=3D"noopener">CVE-2026-13891</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 150.0.7871.47 allowed a remote attacker who convinced a user to en= gage in specific UI gestures to leak cross-origin data via a crafted HTML p= age. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13892" target=3D= "_blank" rel=3D"noopener">CVE-2026-13892</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebUI in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data vi=
a malicious network traffic. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13893" target=3D= "_blank" rel=3D"noopener">CVE-2026-13893</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Network in Google Chrome prior to 15= 0.0.7871.47 allowed an attacker in a privileged network position to bypass = navigation restrictions via a crafted HTML page. (Chromium security severit=
y: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13894" target=3D= "_blank" rel=3D"noopener">CVE-2026-13894</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Autofill in Google Chrome prior to 150.= 0.7871.47 allowed a remote attacker who convinced a user to engage in speci= fic UI gestures to perform UI spoofing via a crafted HTML page. (Chromium s= ecurity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13895" target=3D= "_blank" rel=3D"noopener">CVE-2026-13895</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Glic in Google Chrome prior to 150.0= .7871.47 allowed a remote attacker to bypass navigation restrictions via a = crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13896" target=3D= "_blank" rel=3D"noopener">CVE-2026-13896</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Chromecast in Google Chrome prior to=
150.0.7871.47 allowed a remote attacker to perform privilege escalation vi=
a a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13897" target=3D= "_blank" rel=3D"noopener">CVE-2026-13897</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Cast Receiver in Google Chrome prior to 150.0.7871.47=
allowed a remote attacker to execute arbitrary code inside a sandbox via a=
crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13898" target=3D= "_blank" rel=3D"noopener">CVE-2026-13898</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in HTML in Google Chrome prior to 150.0.7871.47 allowed =
a remote attacker to execute arbitrary code inside a sandbox via a crafted = HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13899" target=3D= "_blank" rel=3D"noopener">CVE-2026-13899</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chromecast in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker who had compromised the renderer proc= ess to bypass navigation restrictions via a crafted HTML page. (Chromium se= curity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13900" target=3D= "_blank" rel=3D"noopener">CVE-2026-13900</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Serial in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker who had compromised the renderer proce=
ss to potentially perform a sandbox escape via a crafted HTML page. (Chromi=
um security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13901" target=3D= "_blank" rel=3D"noopener">CVE-2026-13901</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13902" target=3D= "_blank" rel=3D"noopener">CVE-2026-13902</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Bluetooth in Google Chrome prior to = 150.0.7871.47 allowed a remote attacker to perform privilege escalation via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13903" target=3D= "_blank" rel=3D"noopener">CVE-2026-13903</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Safe Browsing in Google Chrome on iOS p= rior to 150.0.7871.47 allowed a remote attacker to bypass navigation restri= ctions via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13904" target=3D= "_blank" rel=3D"noopener">CVE-2026-13904</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 a= llowed a local attacker to obtain potentially sensitive information from pr= ocess memory via physical access to the device. (Chromium security severity=
: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13905" target=3D= "_blank" rel=3D"noopener">CVE-2026-13905</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in Codecs in Google Chrome prior to 150.0.7871.47 al= lowed a remote attacker to obtain potentially sensitive information from pr= ocess memory via a crafted HTML page. (Chromium security severity: Medium)<=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13906" target=3D= "_blank" rel=3D"noopener">CVE-2026-13906</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in iOSWeb in Google Chrome on iOS prior to=
150.0.7871.47 allowed a remote attacker who convinced a user to engage in = specific UI gestures to perform UI spoofing via a crafted HTML page. (Chrom= ium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13907" target=3D= "_blank" rel=3D"noopener">CVE-2026-13907</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Omnibox in Google Chrome =
on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a use=
r to engage in specific UI gestures to bypass navigation restrictions via m= alicious network traffic. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13908" target=3D= "_blank" rel=3D"noopener">CVE-2026-13908</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in DevTools in Google Chrome prior to 1= 50.0.7871.47 allowed a remote attacker who had compromised the renderer pro= cess to potentially perform a sandbox escape via a crafted HTML page. (Chro= mium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13909" target=3D= "_blank" rel=3D"noopener">CVE-2026-13909</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in WebXR in Google Chrome on Android pr= ior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data vi=
a a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13910" target=3D= "_blank" rel=3D"noopener">CVE-2026-13910</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Spellcheck in Google Chrome prior to=
150.0.7871.47 allowed a remote attacker who had compromised the renderer p= rocess to obtain potentially sensitive information from process memory via =
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13911" target=3D= "_blank" rel=3D"noopener">CVE-2026-13911</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Safe Browsing in Google Chrome on iOS p= rior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via =
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13912" target=3D= "_blank" rel=3D"noopener">CVE-2026-13912</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Autofill in Google Chrome on iOS pri=
or to 150.0.7871.47 allowed a remote attacker who convinced a user to engag=
e in specific UI gestures to leak cross-origin data via a crafted HTML page=
. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13913" target=3D= "_blank" rel=3D"noopener">CVE-2026-13913</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Passwords in Google Chrome on Mac prior=
to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive = information from process memory via a malicious file. (Chromium security se= verity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13914" target=3D= "_blank" rel=3D"noopener">CVE-2026-13914</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0= .7871.47 allowed a remote attacker who convinced a user to engage in specif=
ic UI gestures to potentially exploit heap corruption via a crafted HTML pa= ge. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13915" target=3D= "_blank" rel=3D"noopener">CVE-2026-13915</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13916" target=3D= "_blank" rel=3D"noopener">CVE-2026-13916</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chrome for iOS in Google = Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convince=
d a user to engage in specific UI gestures to bypass navigation restriction=
s via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13917" target=3D= "_blank" rel=3D"noopener">CVE-2026-13917</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0= .7871.47 allowed a remote attacker to potentially exploit heap corruption v=
ia a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13918" target=3D= "_blank" rel=3D"noopener">CVE-2026-13918</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Extensions in Google Chrome prior to=
150.0.7871.47 allowed a remote attacker who had compromised the renderer p= rocess to bypass site isolation via a crafted HTML page. (Chromium security=
severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13919" target=3D= "_blank" rel=3D"noopener">CVE-2026-13919</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Media in Google Chrome on=
Windows prior to 150.0.7871.47 allowed a remote attacker who had compromis=
ed the renderer process to potentially perform a sandbox escape via a craft=
ed HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13920" target=3D= "_blank" rel=3D"noopener">CVE-2026-13920</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DeviceBoundSessionCredent= ials in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to b= ypass same origin policy via a crafted HTML page. (Chromium security severi= ty: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13921" target=3D= "_blank" rel=3D"noopener">CVE-2026-13921</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in Paint in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker to leak cross-origin data via a crafte=
d HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13922" target=3D= "_blank" rel=3D"noopener">CVE-2026-13922</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in GPU in Google Chrome on Android prior to 150.0.787= 1.47 allowed a remote attacker to obtain potentially sensitive information = from process memory via a crafted HTML page. (Chromium security severity: M= edium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13923" target=3D= "_blank" rel=3D"noopener">CVE-2026-13923</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebView in Google Chrome =
on Android prior to 150.0.7871.47 allowed a remote attacker who had comprom= ised the renderer process to bypass same origin policy via a crafted HTML p= age. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13924" target=3D= "_blank" rel=3D"noopener">CVE-2026-13924</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Downloads in Google Chrome on Windows p= rior to 150.0.7871.47 allowed a remote attacker who convinced a user to eng= age in specific UI gestures to execute arbitrary code via a crafted HTML pa= ge. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13925" target=3D= "_blank" rel=3D"noopener">CVE-2026-13925</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Network in Google Chrome = prior to 150.0.7871.47 allowed a remote attacker who had compromised the re= nderer process to bypass navigation restrictions via a crafted HTML page. (= Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13926" target=3D= "_blank" rel=3D"noopener">CVE-2026-13926</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in UI in Google Chrome on An= droid prior to 150.0.7871.47 allowed a local attacker to perform privilege = escalation via a malicious file. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13927" target=3D= "_blank" rel=3D"noopener">CVE-2026-13927</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Enterprise in Google Chro=
me prior to 150.0.7871.47 allowed a remote attacker to perform privilege es= calation via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13928" target=3D= "_blank" rel=3D"noopener">CVE-2026-13928</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in DevTools in Google Chrome on Android=
prior to 150.0.7871.47 allowed a local attacker to bypass navigation restr= ictions via a malicious file. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13929" target=3D= "_blank" rel=3D"noopener">CVE-2026-13929</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Actor in Google Chrome prior to 150.= 0.7871.47 allowed a remote attacker to bypass navigation restrictions via a=
crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13930" target=3D= "_blank" rel=3D"noopener">CVE-2026-13930</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Media in Google Chrome on Windows prior=
to 150.0.7871.47 allowed a remote attacker who had compromised the rendere=
r process to perform UI spoofing via a crafted HTML page. (Chromium securit=
y severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13931" target=3D= "_blank" rel=3D"noopener">CVE-2026-13931</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Sharing in Google Chrome on Android pri=
or to 150.0.7871.47 allowed a remote attacker who had compromised the rende= rer process to leak cross-origin data via a crafted HTML page. (Chromium se= curity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13932" target=3D= "_blank" rel=3D"noopener">CVE-2026-13932</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Passwords in Google Chrome prior to = 150.0.7871.47 allowed a remote attacker who had compromised the renderer pr= ocess to obtain potentially sensitive information from process memory via a=
crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13933" target=3D= "_blank" rel=3D"noopener">CVE-2026-13933</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Dawn in Google Chrome on = Android prior to 150.0.7871.47 allowed a remote attacker who had compromise=
d the renderer process to potentially perform a sandbox escape via a crafte=
d HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13934" target=3D= "_blank" rel=3D"noopener">CVE-2026-13934</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in ComputePressure in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data vi=
a a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13935" target=3D= "_blank" rel=3D"noopener">CVE-2026-13935</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Passwords in Google Chrome on Android p= rior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensi= tive information from process memory via a crafted HTML page. (Chromium sec= urity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13936" target=3D= "_blank" rel=3D"noopener">CVE-2026-13936</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Passwords in Google Chrome prior to = 150.0.7871.47 allowed a remote attacker who had compromised the renderer pr= ocess to leak cross-origin data via a crafted HTML page. (Chromium security=
severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13937" target=3D= "_blank" rel=3D"noopener">CVE-2026-13937</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in Fonts in Google Chrome prior to 150.0.7871.47 allow=
ed a remote attacker to perform an out of bounds memory write via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13938" target=3D= "_blank" rel=3D"noopener">CVE-2026-13938</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebShare in Google Chrome=
on Android prior to 150.0.7871.47 allowed a remote attacker who had compro= mised the renderer process to perform UI spoofing via a crafted HTML page. = (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13939" target=3D= "_blank" rel=3D"noopener">CVE-2026-13939</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Cast in Google Chrome prior to 150.0.7871.47 allow=
ed an attacker on the local network segment to obtain potentially sensitive=
information from process memory via malicious network traffic. (Chromium s= ecurity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13940" target=3D= "_blank" rel=3D"noopener">CVE-2026-13940</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in SiteSettings in Google Chrome on Androi=
d prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing v=
ia a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13941" target=3D= "_blank" rel=3D"noopener">CVE-2026-13941</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Video Capture in Google Chrome on Chrom= eOS prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing = via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13942" target=3D= "_blank" rel=3D"noopener">CVE-2026-13942</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in CSS in Google Chrome on Android prior to 150.0.787= 1.47 allowed a remote attacker to obtain potentially sensitive information = from process memory via a crafted HTML page. (Chromium security severity: M= edium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13943" target=3D= "_blank" rel=3D"noopener">CVE-2026-13943</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in DataTransfer in Google Chrome on Mac pr= ior to 150.0.7871.47 allowed a remote attacker who convinced a user to enga=
ge in specific UI gestures to leak cross-origin data via a crafted HTML pag=
e. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13944" target=3D= "_blank" rel=3D"noopener">CVE-2026-13944</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Extensions in Google Chrome on Linux=
prior to 150.0.7871.47 allowed an attacker who convinced a user to install=
a malicious extension to perform UI spoofing via a crafted Chrome Extensio=
n. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13945" target=3D= "_blank" rel=3D"noopener">CVE-2026-13945</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in ScriptInjections in Google Chrome on iO=
S prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin dat=
a via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13946" target=3D= "_blank" rel=3D"noopener">CVE-2026-13946</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in XR in Google Chrome prior to 150.0.7871.47 allowed=
a remote attacker who had compromised the renderer process to obtain poten= tially sensitive information from process memory via a crafted HTML page. (= Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13947" target=3D= "_blank" rel=3D"noopener">CVE-2026-13947</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Extensions in Google Chrome prior to=
150.0.7871.47 allowed an attacker who convinced a user to install a malici= ous extension to perform UI spoofing via a crafted Chrome Extension. (Chrom= ium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13948" target=3D= "_blank" rel=3D"noopener">CVE-2026-13948</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Payments in Google Chrome on Android=
prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sen= sitive information from process memory via a crafted HTML page. (Chromium s= ecurity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13949" target=3D= "_blank" rel=3D"noopener">CVE-2026-13949</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in GPU in Google Chrome prior to 150.0.7871.47 allowe=
d a remote attacker who had compromised the renderer process to obtain pote= ntially sensitive information from process memory via a crafted HTML page. = (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13950" target=3D= "_blank" rel=3D"noopener">CVE-2026-13950</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in USB in Google Chrome prior to 150.0.= 7871.47 allowed a remote attacker who had compromised the renderer process =
to potentially perform a sandbox escape via a crafted HTML page. (Chromium = security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13951" target=3D= "_blank" rel=3D"noopener">CVE-2026-13951</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in PerformanceAPIs in Google Chrome prior =
to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a = crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13952" target=3D= "_blank" rel=3D"noopener">CVE-2026-13952</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in SplitView in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker who had compromised the renderer proce=
ss to bypass navigation restrictions via a crafted HTML page. (Chromium sec= urity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13953" target=3D= "_blank" rel=3D"noopener">CVE-2026-13953</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in XML in Google Chrome on Android prio=
r to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitiv=
e information from process memory via a crafted HTML page. (Chromium securi=
ty severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13954" target=3D= "_blank" rel=3D"noopener">CVE-2026-13954</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in CustomTabs in Google Chro=
me on Android prior to 150.0.7871.47 allowed a local attacker to perform UI=
spoofing via a malicious file. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13955" target=3D= "_blank" rel=3D"noopener">CVE-2026-13955</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in PageInfo in Google Chrome prior to 150.0.7871.=
47 allowed a remote attacker who convinced a user to engage in specific UI = gestures to perform UI spoofing via a crafted HTML page. (Chromium security=
severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13956" target=3D= "_blank" rel=3D"noopener">CVE-2026-13956</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Extensions in Google Chrome prior to 150.0.787= 1.47 allowed an attacker who convinced a user to install a malicious extens= ion to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Ch= romium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13957" target=3D= "_blank" rel=3D"noopener">CVE-2026-13957</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.= 7871.47 allowed a remote attacker to obtain potentially sensitive informati=
on from process memory via a crafted HTML page. (Chromium security severity=
: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13958" target=3D= "_blank" rel=3D"noopener">CVE-2026-13958</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Blink in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy=
via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13959" target=3D= "_blank" rel=3D"noopener">CVE-2026-13959</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Passwords in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted H= TML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13960" target=3D= "_blank" rel=3D"noopener">CVE-2026-13960</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DevTools in Google Chrome=
on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced =
a user to engage in specific UI gestures to obtain potentially sensitive in= formation from process memory via a crafted HTML page. (Chromium security s= everity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13961" target=3D= "_blank" rel=3D"noopener">CVE-2026-13961</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient data validation in PDF in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker who had compromised the renderer process to = bypass navigation restrictions via a crafted HTML page. (Chromium security = severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13962" target=3D= "_blank" rel=3D"noopener">CVE-2026-13962</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in DevTools in Google Chrome prior to 150.= 0.7871.47 allowed a remote attacker who convinced a user to engage in speci= fic UI gestures to leak cross-origin data via a crafted HTML page. (Chromiu=
m security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13963" target=3D= "_blank" rel=3D"noopener">CVE-2026-13963</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in WebView in Google Chrome on Android = prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restr= ictions via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13964" target=3D= "_blank" rel=3D"noopener">CVE-2026-13964</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Oilpan in Google Chrome prior to 150.0.7871.47 allowe=
d a remote attacker to execute arbitrary code inside a sandbox via a crafte=
d HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13965" target=3D= "_blank" rel=3D"noopener">CVE-2026-13965</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in History in Google Chrome prior to 150.0= .7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTM=
L page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13966" target=3D= "_blank" rel=3D"noopener">CVE-2026-13966</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allo= wed a remote attacker to execute arbitrary code inside a sandbox via a craf= ted HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13967" target=3D= "_blank" rel=3D"noopener">CVE-2026-13967</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DevTools in Google Chrome=
prior to 150.0.7871.47 allowed a remote attacker who convinced a user to e= ngage in specific UI gestures to execute arbitrary code inside a sandbox vi=
a a malicious file. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13968" target=3D= "_blank" rel=3D"noopener">CVE-2026-13968</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in UI in Google Chrome on Android prior to 150.0.7871= .47 allowed a remote attacker who had compromised the renderer process to o= btain potentially sensitive information from process memory via a crafted H= TML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13969" target=3D= "_blank" rel=3D"noopener">CVE-2026-13969</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Media in Google Chrome prior to 150.0.7871.47 allo= wed a remote attacker who had compromised the renderer process to obtain po= tentially sensitive information from process memory via a crafted HTML page=
. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13970" target=3D= "_blank" rel=3D"noopener">CVE-2026-13970</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.47 allow=
ed a remote attacker who had compromised the renderer process to obtain pot= entially sensitive information from process memory via a crafted HTML page.=
(Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13971" target=3D= "_blank" rel=3D"noopener">CVE-2026-13971</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Paint in Google Chrome prior to 150.0.7= 871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML = page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13972" target=3D= "_blank" rel=3D"noopener">CVE-2026-13972</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in UI in Google Chrome prior to 150.0.7871= .47 allowed a remote attacker who convinced a user to engage in specific UI=
gestures to perform UI spoofing via a crafted HTML page. (Chromium securit=
y severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13973" target=3D= "_blank" rel=3D"noopener">CVE-2026-13973</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.= 0.7871.47 allowed a remote attacker to bypass navigation restrictions via a=
malicious file. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13974" target=3D= "_blank" rel=3D"noopener">CVE-2026-13974</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871= .47 allowed a remote attacker who had compromised the renderer process to o= btain potentially sensitive information from process memory via a crafted H= TML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13975" target=3D= "_blank" rel=3D"noopener">CVE-2026-13975</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient data validation in Storage in Google Chrome prior to 150.0= .7871.47 allowed a remote attacker who had compromised the renderer process=
to potentially perform a sandbox escape via a crafted HTML page. (Chromium=
security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13976" target=3D= "_blank" rel=3D"noopener">CVE-2026-13976</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in HTMLParser in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (= UXSS) via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13977" target=3D= "_blank" rel=3D"noopener">CVE-2026-13977</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in PageInfo in Google Chrome prior to 1= 50.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13978" target=3D= "_blank" rel=3D"noopener">CVE-2026-13978</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Paint in Google Chrome prior to 150.0.7= 871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML = page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13979" target=3D= "_blank" rel=3D"noopener">CVE-2026-13979</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13980" target=3D= "_blank" rel=3D"noopener">CVE-2026-13980</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13981" target=3D= "_blank" rel=3D"noopener">CVE-2026-13981</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Passwords in Google Chrome prior to 150.0.7871= .47 allowed a remote attacker who had compromised the renderer process to p= erform UI spoofing via a crafted HTML page. (Chromium security severity: Me= dium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13982" target=3D= "_blank" rel=3D"noopener">CVE-2026-13982</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 150.0.7871.47 allowed a remote attacker who convinced a user to en= gage in specific UI gestures to spoof the contents of the Omnibox (URL bar)=
via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13983" target=3D= "_blank" rel=3D"noopener">CVE-2026-13983</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in TabStrip in Google Chrome prior to 150.0.7871.=
47 allowed a remote attacker to perform UI spoofing via a crafted HTML page=
. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13984" target=3D= "_blank" rel=3D"noopener">CVE-2026-13984</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in MediaCapture in Google Chrome prior to = 150.0.7871.47 allowed a remote attacker who had compromised the renderer pr= ocess to perform UI spoofing via a crafted HTML page. (Chromium security se= verity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13985" target=3D= "_blank" rel=3D"noopener">CVE-2026-13985</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Media UI in Google Chrome on ChromeOS p= rior to 150.0.7871.47 allowed a remote attacker who convinced a user to eng= age in specific UI gestures to perform UI spoofing via a crafted HTML page.=
(Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13986" target=3D= "_blank" rel=3D"noopener">CVE-2026-13986</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Mobile in Google Chrome on Android prior to 15= 0.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted = HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13987" target=3D= "_blank" rel=3D"noopener">CVE-2026-13987</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Paint in Google Chrome prior to 150.0.7= 871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML = page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13988" target=3D= "_blank" rel=3D"noopener">CVE-2026-13988</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in PageInfo in Google Chrome prior to 150.= 0.7871.47 allowed a remote attacker who had compromised the renderer proces=
s to perform UI spoofing via a crafted HTML page. (Chromium security severi= ty: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13989" target=3D= "_blank" rel=3D"noopener">CVE-2026-13989</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DataTransfer in Google Ch= rome on Windows prior to 150.0.7871.47 allowed a remote attacker who had co= mpromised the renderer process to perform UI spoofing via a crafted HTML pa= ge. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13990" target=3D= "_blank" rel=3D"noopener">CVE-2026-13990</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chrome for iOS in Google = Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform U=
I spoofing via a crafted HTML page. (Chromium security severity: Medium)</t=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13991" target=3D= "_blank" rel=3D"noopener">CVE-2026-13991</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in UI in Google Chrome on Mac prior to 150= .0.7871.47 allowed a remote attacker who convinced a user to engage in spec= ific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium = security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13992" target=3D= "_blank" rel=3D"noopener">CVE-2026-13992</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0= .7871.47 allowed a remote attacker who convinced a user to engage in specif=
ic UI gestures to perform domain spoofing via a crafted HTML page. (Chromiu=
m security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13993" target=3D= "_blank" rel=3D"noopener">CVE-2026-13993</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Credential Management in Google Chrome =
on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI s= poofing via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13994" target=3D= "_blank" rel=3D"noopener">CVE-2026-13994</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Autofill in Google Chrome=
on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI = spoofing via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13995" target=3D= "_blank" rel=3D"noopener">CVE-2026-13995</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Permissions in Google Chrome prior to 1= 50.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13996" target=3D= "_blank" rel=3D"noopener">CVE-2026-13996</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Extensions in Google Chrome on Android prior t=
o 150.0.7871.47 allowed a remote attacker who convinced a user to engage in=
specific UI gestures to perform UI spoofing via a crafted HTML page. (Chro= mium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13997" target=3D= "_blank" rel=3D"noopener">CVE-2026-13997</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in File Input in Google Chrome on Mac prior to 15= 0.0.7871.47 allowed a remote attacker who convinced a user to engage in spe= cific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium=
security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13998" target=3D= "_blank" rel=3D"noopener">CVE-2026-13998</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Extensions in Google Chro=
me prior to 150.0.7871.47 allowed an attacker who convinced a user to insta=
ll a malicious extension to perform UI spoofing via a crafted Chrome Extens= ion. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13999" target=3D= "_blank" rel=3D"noopener">CVE-2026-13999</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in XML in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) v=
ia a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14000" target=3D= "_blank" rel=3D"noopener">CVE-2026-14000</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Network in Google Chrome prior to 150.0= .7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXS=
S) via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14001" target=3D= "_blank" rel=3D"noopener">CVE-2026-14001</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Geolocation in Google Chrome prior to 1= 50.0.7871.47 allowed a remote attacker who had compromised the renderer pro= cess to perform UI spoofing via a crafted HTML page. (Chromium security sev= erity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14002" target=3D= "_blank" rel=3D"noopener">CVE-2026-14002</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Extensions in Google Chrome prior to=
150.0.7871.47 allowed an attacker who convinced a user to install a malici= ous extension to leak cross-origin data via a crafted Chrome Extension. (Ch= romium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14003" target=3D= "_blank" rel=3D"noopener">CVE-2026-14003</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to leak cross-origin data via a crafted HTML=
page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14004" target=3D= "_blank" rel=3D"noopener">CVE-2026-14004</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Omnibox in Google Chrome on Android prior to 150.0.78= 71.47 allowed a remote attacker who convinced a user to engage in specific =
UI gestures to potentially exploit heap corruption via a crafted HTML page.=
(Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14005" target=3D= "_blank" rel=3D"noopener">CVE-2026-14005</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Navigation in Google Chrome prior to 150.0.7871.47 al= lowed a remote attacker to execute arbitrary code via a crafted HTML page. = (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14006" target=3D= "_blank" rel=3D"noopener">CVE-2026-14006</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in PermissionsPolicy in Google Chrome p= rior to 150.0.7871.47 allowed a remote attacker to bypass navigation restri= ctions via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14007" target=3D= "_blank" rel=3D"noopener">CVE-2026-14007</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in WebXR in Google Chrome on Android prior to 150.0.7= 871.47 allowed a remote attacker to obtain potentially sensitive informatio=
n from process memory via a crafted HTML page. (Chromium security severity:=
Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14008" target=3D= "_blank" rel=3D"noopener">CVE-2026-14008</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Passwords in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker to potentially exploit heap corruption=
via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14009" target=3D= "_blank" rel=3D"noopener">CVE-2026-14009</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.= 7871.47 allowed a remote attacker to obtain potentially sensitive informati=
on from process memory via a crafted HTML page. (Chromium security severity=
: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14010" target=3D= "_blank" rel=3D"noopener">CVE-2026-14010</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in SurfaceCapture in Google Chrome prior to 150.0.78= 71.47 allowed a remote attacker to perform an out of bounds memory read via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14011" target=3D= "_blank" rel=3D"noopener">CVE-2026-14011</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in CSS in Google Chrome prior to 150.0= .7871.47 allowed a remote attacker to obtain potentially sensitive informat= ion from process memory via a crafted HTML page. (Chromium security severit=
y: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14012" target=3D= "_blank" rel=3D"noopener">CVE-2026-14012</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in SVG in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to perform UI spoofing via a crafted HTML pa= ge. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14013" target=3D= "_blank" rel=3D"noopener">CVE-2026-14013</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Paint in Google Chrome prior to 150.0.7= 871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML = page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14014" target=3D= "_blank" rel=3D"noopener">CVE-2026-14014</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allow=
ed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch= romium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14015" target=3D= "_blank" rel=3D"noopener">CVE-2026-14015</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in SVG in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to leak cross-origin data via a crafted HTML=
page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14016" target=3D= "_blank" rel=3D"noopener">CVE-2026-14016</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Navigation in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker who had compromised the renderer proc= ess to potentially perform a sandbox escape via a crafted HTML page. (Chrom= ium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14017" target=3D= "_blank" rel=3D"noopener">CVE-2026-14017</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Updater in Google Chrome on Windows prior to 150.0.78= 71.47 allowed a local attacker to perform OS-level privilege escalation via=
a malicious file. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14018" target=3D= "_blank" rel=3D"noopener">CVE-2026-14018</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Passwords in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker to leak cross-origin data via a crafte=
d HTML page. (Chromium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14019" target=3D= "_blank" rel=3D"noopener">CVE-2026-14019</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebXR in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker who had compromised the rend= erer process to perform UI spoofing via a crafted HTML page. (Chromium secu= rity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14020" target=3D= "_blank" rel=3D"noopener">CVE-2026-14020</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in StorageAccessAPI in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker who had compromised the rend= erer process to leak cross-origin data via a crafted HTML page. (Chromium s= ecurity severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14021" target=3D= "_blank" rel=3D"noopener">CVE-2026-14021</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Network in Google Chrome = prior to 150.0.7871.47 allowed a remote attacker who had compromised the re= nderer process to leak cross-origin data via a crafted HTML page. (Chromium=
security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14022" target=3D= "_blank" rel=3D"noopener">CVE-2026-14022</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in SanitizerAPI in Google Ch= rome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin=
policy via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14023" target=3D= "_blank" rel=3D"noopener">CVE-2026-14023</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.4=
7 allowed a remote attacker who convinced a user to engage in specific UI g= estures to potentially exploit heap corruption via a crafted HTML page. (Ch= romium security severity: Medium)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14024" target=3D= "_blank" rel=3D"noopener">CVE-2026-14024</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 = allowed a remote attacker who convinced a user to engage in specific UI ges= tures to potentially exploit heap corruption via a crafted HTML page. (Chro= mium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14025" target=3D= "_blank" rel=3D"noopener">CVE-2026-14025</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in SplitView in Google Chrome prior to 150.0.7871= .47 allowed a remote attacker who convinced a user to engage in specific UI=
gestures to perform UI spoofing via a crafted HTML page. (Chromium securit=
y severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14026" target=3D= "_blank" rel=3D"noopener">CVE-2026-14026</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in SignIn in Google Chrome prior to 150.0.7871.47 allowe=
d a remote attacker who convinced a user to engage in specific UI gestures =
to potentially exploit heap corruption via a crafted HTML page. (Chromium s= ecurity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14027" target=3D= "_blank" rel=3D"noopener">CVE-2026-14027</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior t=
o 150.0.7871.47 allowed a remote attacker who convinced a user to engage in=
specific UI gestures to perform UI spoofing via a crafted HTML page. (Chro= mium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14028" target=3D= "_blank" rel=3D"noopener">CVE-2026-14028</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in SplitView in Google Chrome on Linux pri=
or to 150.0.7871.47 allowed a remote attacker who convinced a user to engag=
e in specific UI gestures to spoof the contents of the Omnibox (URL bar) vi=
a a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14030" target=3D= "_blank" rel=3D"noopener">CVE-2026-14030</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in File Input in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted = HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14031" target=3D= "_blank" rel=3D"noopener">CVE-2026-14031</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871= .47 allowed an attacker who convinced a user to install a malicious extensi=
on to execute arbitrary code via a crafted Chrome Extension. (Chromium secu= rity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14032" target=3D= "_blank" rel=3D"noopener">CVE-2026-14032</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Media in Google Chrome on Windows pr= ior to 150.0.7871.47 allowed a remote attacker to bypass site isolation via=
a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14033" target=3D= "_blank" rel=3D"noopener">CVE-2026-14033</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in WebXR in Google Chrome on Android prior=
to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictio=
ns via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14034" target=3D= "_blank" rel=3D"noopener">CVE-2026-14034</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Bluetooth in Google Chrome prior to = 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive inf= ormation from process memory via a crafted HTML page. (Chromium security se= verity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14035" target=3D= "_blank" rel=3D"noopener">CVE-2026-14035</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Bluetooth in Google Chrome prior to = 150.0.7871.47 allowed a remote attacker to perform privilege escalation via=
a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14036" target=3D= "_blank" rel=3D"noopener">CVE-2026-14036</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.= 7871.47 allowed a remote attacker who had compromised the renderer process =
to potentially perform a sandbox escape via a crafted HTML page. (Chromium = security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14037" target=3D= "_blank" rel=3D"noopener">CVE-2026-14037</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in New Tab Page in Google Ch= rome prior to 150.0.7871.47 allowed a remote attacker who had compromised t=
he renderer process to potentially perform a sandbox escape via a crafted H= TML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14038" target=3D= "_blank" rel=3D"noopener">CVE-2026-14038</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in GetUserMedia in Google Chrome prior =
to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via=
a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14039" target=3D= "_blank" rel=3D"noopener">CVE-2026-14039</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in BrowserTag in Google Chrome prior to 150.0.7871.47 al= lowed an attacker who convinced a user to install a malicious extension to = potentially exploit heap corruption via a crafted Chrome Extension. (Chromi=
um security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14040" target=3D= "_blank" rel=3D"noopener">CVE-2026-14040</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Serial in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker to perform privilege escalation via a = crafted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14041" target=3D= "_blank" rel=3D"noopener">CVE-2026-14041</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Isolated Web Apps in Google Chrome prio=
r to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a c= rafted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14042" target=3D= "_blank" rel=3D"noopener">CVE-2026-14042</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in GetUserMedia in Google Chrome prior to 150.0.7871.47 = allowed a remote attacker who had compromised the renderer process to poten= tially perform a sandbox escape via a crafted HTML page. (Chromium security=
severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14043" target=3D= "_blank" rel=3D"noopener">CVE-2026-14043</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in ANGLE in Google Chrome prior to 150.0.7871.47 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14044" target=3D= "_blank" rel=3D"noopener">CVE-2026-14044</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Network in Google Chrome = prior to 150.0.7871.47 allowed a remote attacker who had compromised the re= nderer process to leak cross-origin data via a crafted HTML page. (Chromium=
security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14045" target=3D= "_blank" rel=3D"noopener">CVE-2026-14045</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CustomTabs in Google Chrome on Android = prior to 150.0.7871.47 allowed a remote attacker to bypass same origin poli=
cy via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14046" target=3D= "_blank" rel=3D"noopener">CVE-2026-14046</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Extensions in Google Chrome prior to=
150.0.7871.47 allowed an attacker who convinced a user to install a malici= ous extension to bypass content security policy via a crafted Chrome Extens= ion. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14047" target=3D= "_blank" rel=3D"noopener">CVE-2026-14047</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 al= lowed an attacker on the local network segment to obtain potentially sensit= ive information from process memory via a malicious peripheral. (Chromium s= ecurity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14048" target=3D= "_blank" rel=3D"noopener">CVE-2026-14048</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in GPU in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker who had compromised the renderer process to = obtain potentially sensitive information from process memory via a crafted = HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14049" target=3D= "_blank" rel=3D"noopener">CVE-2026-14049</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Passwords in Google Chrome prior to = 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a cra= fted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14050" target=3D= "_blank" rel=3D"noopener">CVE-2026-14050</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in GamepadAPI in Google Chrome prior to 150.0.7871.47=
allowed a remote attacker who had compromised the renderer process to obta=
in potentially sensitive information from process memory via a crafted HTML=
page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14051" target=3D= "_blank" rel=3D"noopener">CVE-2026-14051</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in FileSystem in Google Chrome prior to=
150.0.7871.47 allowed a remote attacker to bypass discretionary access con= trol via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14052" target=3D= "_blank" rel=3D"noopener">CVE-2026-14052</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Extensions in Google Chrome prior to=
150.0.7871.47 allowed a remote attacker who had compromised the renderer p= rocess to leak cross-origin data via a crafted HTML page. (Chromium securit=
y severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14053" target=3D= "_blank" rel=3D"noopener">CVE-2026-14053</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Network in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker to bypass navigation restrictions via=
a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14054" target=3D= "_blank" rel=3D"noopener">CVE-2026-14054</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Device Trust in Google Ch= rome on Windows prior to 150.0.7871.47 allowed a remote attacker who had co= mpromised the renderer process to potentially perform a sandbox escape via =
a crafted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14055" target=3D= "_blank" rel=3D"noopener">CVE-2026-14055</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Media in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker who had compromised the rend= erer process to potentially perform a sandbox escape via a crafted video fi= le. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14056" target=3D= "_blank" rel=3D"noopener">CVE-2026-14056</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in FedCM in Google Chrome prior to 150.0.7= 871.47 allowed a remote attacker to bypass same origin policy via a crafted=
HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14057" target=3D= "_blank" rel=3D"noopener">CVE-2026-14057</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Parser in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker to bypass content security policy via =
a crafted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14058" target=3D= "_blank" rel=3D"noopener">CVE-2026-14058</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Related-Website-Sets in Google Chrom=
e prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin dat=
a via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14059" target=3D= "_blank" rel=3D"noopener">CVE-2026-14059</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chromoting in Google Chro=
me on Windows prior to 150.0.7871.47 allowed a local attacker to perform pr= ivilege escalation via a malicious file. (Chromium security severity: Low)<=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14060" target=3D= "_blank" rel=3D"noopener">CVE-2026-14060</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Dawn in Google Chrome prior to 150.0.78= 71.47 allowed a remote attacker to obtain potentially sensitive information=
from process memory via a crafted HTML page. (Chromium security severity: = Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14061" target=3D= "_blank" rel=3D"noopener">CVE-2026-14061</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Views in Google Chrome on ChromeOS prio=
r to 150.0.7871.47 allowed an attacker who convinced a user to install a ma= licious extension to obtain potentially sensitive information from process = memory via a crafted Chrome Extension. (Chromium security severity: Low)</t=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14062" target=3D= "_blank" rel=3D"noopener">CVE-2026-14062</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.4=
7 allowed a local attacker to obtain potentially sensitive information from=
process memory via malicious network traffic. (Chromium security severity:=
Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14063" target=3D= "_blank" rel=3D"noopener">CVE-2026-14063</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in PageInfo in Google Chrome on Android prior to 150.0.7= 871.47 allowed a remote attacker who convinced a user to engage in specific=
UI gestures to execute arbitrary code via a crafted HTML page. (Chromium s= ecurity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14064" target=3D= "_blank" rel=3D"noopener">CVE-2026-14064</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in PageInfo in Google Chrome=
prior to 150.0.7871.47 allowed a remote attacker who had compromised the r= enderer process to bypass navigation restrictions via a crafted HTML page. = (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14065" target=3D= "_blank" rel=3D"noopener">CVE-2026-14065</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chrome for iOS in Google = Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass na= vigation restrictions via a crafted HTML page. (Chromium security severity:=
Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14066" target=3D= "_blank" rel=3D"noopener">CVE-2026-14066</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0= .7871.47 allowed a remote attacker to execute arbitrary code via a crafted = HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14067" target=3D= "_blank" rel=3D"noopener">CVE-2026-14067</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Omnibox in Google Chrome on iOS prior t=
o 150.0.7871.47 allowed a remote attacker who convinced a user to engage in=
specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a craf= ted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14068" target=3D= "_blank" rel=3D"noopener">CVE-2026-14068</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in WebNN in Google Chrome prior to 150.0.7871.47 allow=
ed a remote attacker to obtain potentially sensitive information from proce=
ss memory via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14069" target=3D= "_blank" rel=3D"noopener">CVE-2026-14069</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in WebNN in Google Chrome prior to 150.0.7871.47 allow=
ed a remote attacker to obtain potentially sensitive information from proce=
ss memory via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14070" target=3D= "_blank" rel=3D"noopener">CVE-2026-14070</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in WebAudio in Google Chrome prior to = 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a cra= fted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14071" target=3D= "_blank" rel=3D"noopener">CVE-2026-14071</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in SplitView in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted H= TML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14072" target=3D= "_blank" rel=3D"noopener">CVE-2026-14072</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebXR in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker to bypass navigation restric= tions via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14073" target=3D= "_blank" rel=3D"noopener">CVE-2026-14073</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in WebAuthentication in Google Chrome =
on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origi=
n data via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14074" target=3D= "_blank" rel=3D"noopener">CVE-2026-14074</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Chrome for iOS in Google Chrome on i=
OS prior to 150.0.7871.47 allowed a remote attacker to bypass no-referrer p= olicy via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14075" target=3D= "_blank" rel=3D"noopener">CVE-2026-14075</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Network in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker to bypass content security policy via=
a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14076" target=3D= "_blank" rel=3D"noopener">CVE-2026-14076</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Select in Google Chrome on Mac prior to=
150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnib=
ox (URL bar) via a crafted HTML page. (Chromium security severity: Low)</td=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14077" target=3D= "_blank" rel=3D"noopener">CVE-2026-14077</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebRTC in Google Chrome p= rior to 150.0.7871.47 allowed a remote attacker to perform privilege escala= tion via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14078" target=3D= "_blank" rel=3D"noopener">CVE-2026-14078</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Network in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker to bypass same origin policy via a cr= afted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14079" target=3D= "_blank" rel=3D"noopener">CVE-2026-14079</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in TabSwitcher in Google Chr= ome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass n= avigation restrictions via malicious network traffic. (Chromium security se= verity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14080" target=3D= "_blank" rel=3D"noopener">CVE-2026-14080</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in DevTools in Google Chrome prior to 1= 50.0.7871.47 allowed an attacker who convinced a user to install a maliciou=
s extension to obtain potentially sensitive information from process memory=
via a crafted Chrome Extension. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14081" target=3D= "_blank" rel=3D"noopener">CVE-2026-14081</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in Storage in Google Chrome prior to 150.0.7871.47 allowed a remot=
e attacker to leak cross-origin data via a crafted HTML page. (Chromium sec= urity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14082" target=3D= "_blank" rel=3D"noopener">CVE-2026-14082</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in HTML in Google Chrome pri=
or to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts o=
r HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)</t=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14083" target=3D= "_blank" rel=3D"noopener">CVE-2026-14083</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chromoting in Google Chro=
me prior to 150.0.7871.47 allowed a remote attacker to potentially exploit = heap corruption via malicious network traffic. (Chromium security severity:=
Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14084" target=3D= "_blank" rel=3D"noopener">CVE-2026-14084</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in CSS in Google Chrome prior to 150.0= .7871.47 allowed a remote attacker to leak cross-origin data via a crafted = HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14085" target=3D= "_blank" rel=3D"noopener">CVE-2026-14085</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in HID in Google Chrome prior to 150.0.= 7871.47 allowed a remote attacker to execute arbitrary code via a crafted H= TML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14086" target=3D= "_blank" rel=3D"noopener">CVE-2026-14086</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Heap buffer overflow in WebNN in Google Chrome on Windows prior to 150.= 0.7871.47 allowed a remote attacker who had compromised the renderer proces=
s to potentially exploit heap corruption via a crafted HTML page. (Chromium=
security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14087" target=3D= "_blank" rel=3D"noopener">CVE-2026-14087</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Canvas in Google Chrome on Android prior to 150.0.= 7871.47 allowed a remote attacker to obtain potentially sensitive informati=
on from process memory via a crafted HTML page. (Chromium security severity=
: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14088" target=3D= "_blank" rel=3D"noopener">CVE-2026-14088</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in PopupBlocker in Google Ch= rome prior to 150.0.7871.47 allowed a remote attacker who had compromised t=
he renderer process to perform UI spoofing via a crafted HTML page. (Chromi=
um security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14089" target=3D= "_blank" rel=3D"noopener">CVE-2026-14089</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in CameraCapture in Google C= hrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to perfo=
rm an out of bounds memory read via a crafted HTML page. (Chromium security=
severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14090" target=3D= "_blank" rel=3D"noopener">CVE-2026-14090</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in DevTools in Google Chrome prior to 150.0.7871.47 allo= wed a remote attacker to execute arbitrary code inside a sandbox via a craf= ted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14091" target=3D= "_blank" rel=3D"noopener">CVE-2026-14091</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Privacy in Google Chrome prior to 15= 0.0.7871.47 allowed an attacker in a privileged network position to leak cr= oss-origin data via malicious network traffic. (Chromium security severity:=
Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14092" target=3D= "_blank" rel=3D"noopener">CVE-2026-14092</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Cast in Google Chrome prior to 150.0.7871.47 allowed =
a remote attacker who had compromised the renderer process to potentially p= erform a sandbox escape via a crafted HTML page. (Chromium security severit=
y: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14093" target=3D= "_blank" rel=3D"noopener">CVE-2026-14093</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Installer in Google Chrome on Windows prior to 150.0.= 7871.47 allowed a local attacker to perform OS-level privilege escalation v=
ia a malicious file. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14094" target=3D= "_blank" rel=3D"noopener">CVE-2026-14094</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Browser in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker who had compromised the renderer proc= ess to potentially perform a sandbox escape via a crafted HTML page. (Chrom= ium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14095" target=3D= "_blank" rel=3D"noopener">CVE-2026-14095</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Input in Google Chrome on Android prior=
to 150.0.7871.47 allowed a remote attacker who had compromised the rendere=
r process to leak cross-origin data via a crafted HTML page. (Chromium secu= rity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14096" target=3D= "_blank" rel=3D"noopener">CVE-2026-14096</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in WebAppInstalls in Google Chrome on Mac = prior to 150.0.7871.47 allowed a remote attacker who had compromised the re= nderer process to potentially perform a sandbox escape via a crafted HTML p= age. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14097" target=3D= "_blank" rel=3D"noopener">CVE-2026-14097</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to leak cross-origin data via a crafted HTML=
page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14098" target=3D= "_blank" rel=3D"noopener">CVE-2026-14098</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0= .7871.47 allowed a remote attacker who convinced a user to engage in specif=
ic UI gestures to potentially exploit heap corruption via a crafted HTML pa= ge. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14099" target=3D= "_blank" rel=3D"noopener">CVE-2026-14099</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient data validation in NetworkCache in Google Chrome prior to = 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a cra= fted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14100" target=3D= "_blank" rel=3D"noopener">CVE-2026-14100</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Sandbox in Google Chrome on Mac prio=
r to 150.0.7871.47 allowed a remote attacker who had compromised the render=
er process to potentially perform a sandbox escape via a crafted HTML page.=
(Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14101" target=3D= "_blank" rel=3D"noopener">CVE-2026-14101</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Passwords in Google Chrome prior to 150.0.7871.47 all= owed a remote attacker to potentially exploit heap corruption via a crafted=
HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14102" target=3D= "_blank" rel=3D"noopener">CVE-2026-14102</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in SSL in Google Chrome on ChromeOS prior to 150.0.7871.=
47 allowed a remote attacker to obtain potentially sensitive information fr=
om process memory via a crafted HTML page. (Chromium security severity: Low= )</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14103" target=3D= "_blank" rel=3D"noopener">CVE-2026-14103</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebAppInstalls in Google = Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrar=
y code inside a sandbox via a crafted HTML page. (Chromium security severit=
y: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14104" target=3D= "_blank" rel=3D"noopener">CVE-2026-14104</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Speech in Google Chrome prior to 150= .0.7871.47 allowed a remote attacker to bypass same origin policy via a cra= fted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14105" target=3D= "_blank" rel=3D"noopener">CVE-2026-14105</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Text in Google Chrome on = Android prior to 150.0.7871.47 allowed a remote attacker who had compromise=
d the renderer process to potentially perform a sandbox escape via a crafte=
d HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14106" target=3D= "_blank" rel=3D"noopener">CVE-2026-14106</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Scheduling in Google Chrome prior to 150.0.7871.47 al= lowed a remote attacker to execute arbitrary code inside a sandbox via a cr= afted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14107" target=3D= "_blank" rel=3D"noopener">CVE-2026-14107</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in PDFium in Google Chrome prior to 150.0.7871.47 allowe=
d a remote attacker to execute arbitrary code inside a sandbox via a crafte=
d PDF file. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14108" target=3D= "_blank" rel=3D"noopener">CVE-2026-14108</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0= .7871.47 allowed a remote attacker who had compromised the renderer process=
to potentially perform a sandbox escape via a crafted HTML page. (Chromium=
security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14109" target=3D= "_blank" rel=3D"noopener">CVE-2026-14109</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in DarkMode in Google Chrome prior to 150.= 0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HT=
ML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14110" target=3D= "_blank" rel=3D"noopener">CVE-2026-14110</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 al= lowed an attacker who convinced a user to install a malicious extension to = execute arbitrary code via a crafted Chrome Extension. (Chromium security s= everity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14111" target=3D= "_blank" rel=3D"noopener">CVE-2026-14111</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Enterprise in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker who convinced a user to engage in spe= cific UI gestures to obtain potentially sensitive information from process = memory via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14112" target=3D= "_blank" rel=3D"noopener">CVE-2026-14112</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Updater in Google Chrome on Windows prior to 150.0.78= 71.47 allowed a remote attacker who had compromised the renderer process to=
potentially perform a sandbox escape via a crafted HTML page. (Chromium se= curity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14113" target=3D= "_blank" rel=3D"noopener">CVE-2026-14113</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in WebAppInstalls in Google Chrome on Andr= oid prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing = via a malicious file. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14114" target=3D= "_blank" rel=3D"noopener">CVE-2026-14114</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Cast in Google Chrome pri=
or to 150.0.7871.47 allowed a remote attacker who had compromised the rende= rer process to perform privilege escalation via a crafted HTML page. (Chrom= ium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14115" target=3D= "_blank" rel=3D"noopener">CVE-2026-14115</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DevTools in Google Chrome=
prior to 150.0.7871.47 allowed a remote attacker who convinced a user to e= ngage in specific UI gestures to leak cross-origin data via a crafted HTML = page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14116" target=3D= "_blank" rel=3D"noopener">CVE-2026-14116</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DevTools in Google Chrome=
on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced =
a user to engage in specific UI gestures to obtain potentially sensitive in= formation from process memory via a crafted HTML page. (Chromium security s= everity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14117" target=3D= "_blank" rel=3D"noopener">CVE-2026-14117</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient data validation in DevTools in Google Chrome prior to 150.= 0.7871.47 allowed a remote attacker who convinced a user to engage in speci= fic UI gestures to leak cross-origin data via a crafted HTML page. (Chromiu=
m security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14118" target=3D= "_blank" rel=3D"noopener">CVE-2026-14118</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Type Confusion in Bluetooth in Google Chrome on Windows prior to 150.0.= 7871.47 allowed an attacker on the local network segment to obtain potentia= lly sensitive information from process memory via a malicious peripheral. (= Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14119" target=3D= "_blank" rel=3D"noopener">CVE-2026-14119</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in DevTools in Google Chrome prior to 150.= 0.7871.47 allowed a remote attacker who had compromised the renderer proces=
s to potentially perform a sandbox escape via a crafted HTML page. (Chromiu=
m security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14120" target=3D= "_blank" rel=3D"noopener">CVE-2026-14120</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7= 871.47 allowed a remote attacker to execute arbitrary code via malicious ne= twork traffic. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14121" target=3D= "_blank" rel=3D"noopener">CVE-2026-14121</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebAppInstalls in Google = Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to perfo=
rm arbitrary read/write via a crafted HTML page. (Chromium security severit=
y: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14122" target=3D= "_blank" rel=3D"noopener">CVE-2026-14122</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior t=
o 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omni= box (URL bar) via a crafted HTML page. (Chromium security severity: Low)</t=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14123" target=3D= "_blank" rel=3D"noopener">CVE-2026-14123</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CredentialProvider in Google Chrome on = Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level=
privilege escalation via a malicious file. (Chromium security severity: Lo= w)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14124" target=3D= "_blank" rel=3D"noopener">CVE-2026-14124</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.47 allo= wed a remote attacker to obtain potentially sensitive information from proc= ess memory via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14125" target=3D= "_blank" rel=3D"noopener">CVE-2026-14125</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in UI in Google Chrome on Android prior to 150.0.= 7871.47 allowed a remote attacker to perform domain spoofing via a crafted = HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14126" target=3D= "_blank" rel=3D"noopener">CVE-2026-14126</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Printing in Google Chrome prior to 150.= 0.7871.47 allowed a remote attacker who had compromised the renderer proces=
s to perform UI spoofing via a crafted HTML page. (Chromium security severi= ty: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14127" target=3D= "_blank" rel=3D"noopener">CVE-2026-14127</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of t=
he Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: = Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14128" target=3D= "_blank" rel=3D"noopener">CVE-2026-14128</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in PreviewTab in Google Chrome on Android = prior to 150.0.7871.47 allowed a remote attacker who convinced a user to en= gage in specific UI gestures to perform UI spoofing via a crafted HTML page=
. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14129" target=3D= "_blank" rel=3D"noopener">CVE-2026-14129</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Omnibox in Google Chrome prior to 150.0.7871.4=
7 allowed a remote attacker to perform UI spoofing via a crafted HTML page.=
(Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14130" target=3D= "_blank" rel=3D"noopener">CVE-2026-14130</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebAppInstalls in Google = Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised=
the renderer process to perform UI spoofing via a crafted HTML page. (Chro= mium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14131" target=3D= "_blank" rel=3D"noopener">CVE-2026-14131</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in WebXR in Google Chrome prior to 150.0.7= 871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML = page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14132" target=3D= "_blank" rel=3D"noopener">CVE-2026-14132</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in History Embeddings in Google Chrome prior to 150.0.7871.47 allo= wed a remote attacker to perform UI spoofing via a crafted HTML page. (Chro= mium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14133" target=3D= "_blank" rel=3D"noopener">CVE-2026-14133</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Autofill in Google Chrome on Android pr= ior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a=
crafted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14134" target=3D= "_blank" rel=3D"noopener">CVE-2026-14134</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Network in Google Chrome = prior to 150.0.7871.47 allowed a remote attacker who had compromised the re= nderer process to perform UI spoofing via a crafted HTML page. (Chromium se= curity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14135" target=3D= "_blank" rel=3D"noopener">CVE-2026-14135</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chrome for iOS in Google = Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform U=
I spoofing via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14136" target=3D= "_blank" rel=3D"noopener">CVE-2026-14136</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chrome for iOS in Google = Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convince=
d a user to engage in specific UI gestures to perform UI spoofing via a cra= fted HTML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14137" target=3D= "_blank" rel=3D"noopener">CVE-2026-14137</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in WebAppInstalls in Google Chrome on Wind= ows prior to 150.0.7871.47 allowed a remote attacker who convinced a user t=
o engage in specific UI gestures to perform UI spoofing via a crafted HTML = page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14138" target=3D= "_blank" rel=3D"noopener">CVE-2026-14138</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in TabStrip in Google Chrome prior to 150.= 0.7871.47 allowed a remote attacker who convinced a user to engage in speci= fic UI gestures to perform UI spoofing via a crafted HTML page. (Chromium s= ecurity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14139" target=3D= "_blank" rel=3D"noopener">CVE-2026-14139</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Input in Google Chrome on=
Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spo= ofing via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14140" target=3D= "_blank" rel=3D"noopener">CVE-2026-14140</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Document Picture-in-Picture in Google Chrome o=
n Android prior to 150.0.7871.47 allowed a remote attacker to perform domai=
n spoofing via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14141" target=3D= "_blank" rel=3D"noopener">CVE-2026-14141</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Extensions in Google Chrome prior to 15= 0.0.7871.47 allowed a remote attacker who had compromised the renderer proc= ess to perform UI spoofing via a crafted HTML page. (Chromium security seve= rity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14142" target=3D= "_blank" rel=3D"noopener">CVE-2026-14142</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Passwords in Google Chrome on iOS prior to 150= .0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted H= TML page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14143" target=3D= "_blank" rel=3D"noopener">CVE-2026-14143</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Views in Google Chrome prior to 150.0.7871.47 = allowed a remote attacker who convinced a user to engage in specific UI ges= tures to perform UI spoofing via a crafted HTML page. (Chromium security se= verity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14144" target=3D= "_blank" rel=3D"noopener">CVE-2026-14144</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) v=
ia a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14145" target=3D= "_blank" rel=3D"noopener">CVE-2026-14145</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to leak cross-origin data via a crafted HTML=
page. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14146" target=3D= "_blank" rel=3D"noopener">CVE-2026-14146</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 150.0.787= 1.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) v=
ia a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14147" target=3D= "_blank" rel=3D"noopener">CVE-2026-14147</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Type Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a=
remote attacker to obtain potentially sensitive information from process m= emory via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14148" target=3D= "_blank" rel=3D"noopener">CVE-2026-14148</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Audio in Google Chrome on Linux prior to 150.0.7871.4=
7 allowed a remote attacker to execute arbitrary code via a crafted HTML pa= ge. (Chromium security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14149" target=3D= "_blank" rel=3D"noopener">CVE-2026-14149</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Speech in Google Chrome p= rior to 150.0.7871.47 allowed a remote attacker who had compromised the ren= derer process to perform UI spoofing via a crafted HTML page. (Chromium sec= urity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14150" target=3D= "_blank" rel=3D"noopener">CVE-2026-14150</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in AI in Google Chrome prior to 150.0.7871= .47 allowed a remote attacker who had compromised the renderer process to p= otentially perform a sandbox escape via a crafted HTML page. (Chromium secu= rity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14151" target=3D= "_blank" rel=3D"noopener">CVE-2026-14151</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7= 871.47 allowed a remote attacker who had compromised the renderer process t=
o potentially perform a sandbox escape via a crafted HTML page. (Chromium s= ecurity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14152" target=3D= "_blank" rel=3D"noopener">CVE-2026-14152</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Glic in Google Chrome prior to 150.0.78= 71.47 allowed a remote attacker who convinced a user to engage in specific =
UI gestures to perform UI spoofing via a crafted HTML page. (Chromium secur= ity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14153" target=3D= "_blank" rel=3D"noopener">CVE-2026-14153</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in DevTools in Google Chrome prior to 150.= 0.7871.47 allowed an attacker who convinced a user to install a malicious e= xtension to perform UI spoofing via a crafted Chrome Extension. (Chromium s= ecurity severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14154" target=3D= "_blank" rel=3D"noopener">CVE-2026-14154</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in StorageAccessAPI in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data vi=
a a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14155" target=3D= "_blank" rel=3D"noopener">CVE-2026-14155</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in StorageAccessAPI in Google Chrome pr= ior to 150.0.7871.47 allowed a remote attacker who had compromised the rend= erer process to bypass same origin policy via a crafted HTML page. (Chromiu=
m security severity: Low)</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14156" target=3D= "_blank" rel=3D"noopener">CVE-2026-14156</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0= .7871.46 allowed a remote attacker to perform UI spoofing via a crafted HTM=
L page. (Chromium security severity: Medium)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14381" target=3D= "_blank" rel=3D"noopener">CVE-2026-14381</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in ANGLE in Google Chrome pr= ior to 150.0.7871.46 allowed a remote attacker to potentially perform a san= dbox escape via a crafted HTML page. (Chromium security severity: High)</td=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14382" target=3D= "_blank" rel=3D"noopener">CVE-2026-14382</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871= .46 allowed a remote attacker to execute arbitrary code inside a sandbox vi=
a a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14383" target=3D= "_blank" rel=3D"noopener">CVE-2026-14383</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in ANGLE in Google Chrome on Windows prior to 150.0.= 7871.46 allowed a remote attacker to leak cross-origin data via a crafted H= TML page. (Chromium security severity: Medium)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14384" target=3D= "_blank" rel=3D"noopener">CVE-2026-14384</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.78= 71.46 allowed a remote attacker to perform out of bounds memory access via =
a crafted HTML page. (Chromium security severity: High)</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14385" target=3D= "_blank" rel=3D"noopener">CVE-2026-14385</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 all= owed a remote attacker to obtain potentially sensitive information from pro= cess memory via a crafted HTML page. (Chromium security severity: High)</td=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14386" target=3D= "_blank" rel=3D"noopener">CVE-2026-14386</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowe=
d a remote attacker to potentially perform a sandbox escape via a crafted H= TML page. (Chromium security severity: Medium)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14387" target=3D= "_blank" rel=3D"noopener">CVE-2026-14387</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 all= owed a remote attacker to obtain potentially sensitive information from pro= cess memory via a crafted HTML page. (Chromium security severity: Medium)</=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14388" target=3D= "_blank" rel=3D"noopener">CVE-2026-14388</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowe=
d a remote attacker who had compromised the renderer process to potentially=
perform a sandbox escape via a crafted HTML page. (Chromium security sever= ity: Medium)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14389" target=3D= "_blank" rel=3D"noopener">CVE-2026-14389</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed=
a remote attacker to potentially perform a sandbox escape via a crafted HT=
ML page. (Chromium security severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14390" target=3D= "_blank" rel=3D"noopener">CVE-2026-14390</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in ANGLE in Google Chrome on Windows prior to 150.0.78= 71.46 allowed a remote attacker who had compromised the renderer process to=
obtain potentially sensitive information from process memory via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14391" target=3D= "_blank" rel=3D"noopener">CVE-2026-14391</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 all= owed a remote attacker to potentially perform a sandbox escape via a crafte=
d HTML page. (Chromium security severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14392" target=3D= "_blank" rel=3D"noopener">CVE-2026-14392</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a = remote attacker to execute arbitrary code inside a sandbox via a crafted HT=
ML page. (Chromium security severity: Medium)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14393" target=3D= "_blank" rel=3D"noopener">CVE-2026-14393</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a = remote attacker to potentially exploit heap corruption via a crafted HTML p= age. (Chromium security severity: Low)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14394" target=3D= "_blank" rel=3D"noopener">CVE-2026-14394</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds write in V8 in Google Chrome prior to 150.0.7871.46 allow=
ed a remote attacker to execute arbitrary code inside a sandbox via a craft=
ed HTML page. (Chromium security severity: Low)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14395" target=3D= "_blank" rel=3D"noopener">CVE-2026-14395</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 all= owed a remote attacker to leak cross-origin data via a crafted HTML page. (= Chromium security severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14396" target=3D= "_blank" rel=3D"noopener">CVE-2026-14396</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds write in ANGLE in Google Chrome on Mac prior to 150.0.787= 1.46 allowed a remote attacker to potentially perform a sandbox escape via =
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14397" target=3D= "_blank" rel=3D"noopener">CVE-2026-14397</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed=
a remote attacker to potentially perform a sandbox escape via a crafted HT=
ML page. (Chromium security severity: Critical)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14398" target=3D= "_blank" rel=3D"noopener">CVE-2026-14398</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allow=
ed a remote attacker to obtain potentially sensitive information from proce=
ss memory via a crafted HTML page. (Chromium security severity: Medium)</td=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14399" target=3D= "_blank" rel=3D"noopener">CVE-2026-14399</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 al= lowed a remote attacker who had compromised the renderer process to potenti= ally perform a sandbox escape via a crafted HTML page. (Chromium security s= everity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14400" target=3D= "_blank" rel=3D"noopener">CVE-2026-14400</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in ANGLE in Google Chrome on=
Android prior to 150.0.7871.46 allowed a remote attacker who had compromis=
ed the renderer process to potentially perform a sandbox escape via a craft=
ed HTML page. (Chromium security severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14401" target=3D= "_blank" rel=3D"noopener">CVE-2026-14401</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in ANGLE in Google Chrome on Windows prior to 150.0.7= 871.46 allowed a remote attacker to obtain potentially sensitive informatio=
n from process memory via a crafted HTML page. (Chromium security severity:=
High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14402" target=3D= "_blank" rel=3D"noopener">CVE-2026-14402</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a = remote attacker to execute arbitrary code inside a sandbox via a crafted HT=
ML page. (Chromium security severity: Low)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14403" target=3D= "_blank" rel=3D"noopener">CVE-2026-14403</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in PDFium in Google Chrome prior to 150.0.= 7871.46 allowed a remote attacker to perform UI spoofing via a crafted PDF = file. (Chromium security severity: Medium)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14404" target=3D= "_blank" rel=3D"noopener">CVE-2026-14404</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed=
a remote attacker to execute arbitrary code inside a sandbox via a crafted=
HTML page. (Chromium security severity: Low)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14405" target=3D= "_blank" rel=3D"noopener">CVE-2026-14405</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in V8 in Google Chrome prior to 150.0.7871.46 allowe=
d an attacker who convinced a user to install a malicious extension to obta=
in potentially sensitive information from process memory via a crafted Chro=
me Extension. (Chromium security severity: Medium)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14406" target=3D= "_blank" rel=3D"noopener">CVE-2026-14406</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871= .46 allowed a remote attacker to execute arbitrary code inside a sandbox vi=
a a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14407" target=3D= "_blank" rel=3D"noopener">CVE-2026-14407</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allow=
ed a remote attacker to obtain potentially sensitive information from proce=
ss memory via a crafted HTML page. (Chromium security severity: Medium)</td=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14408" target=3D= "_blank" rel=3D"noopener">CVE-2026-14408</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871= .46 allowed a remote attacker who convinced a user to engage in specific UI=
gestures to execute arbitrary code inside a sandbox via a crafted HTML pag=
e. (Chromium security severity: Low)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14409" target=3D= "_blank" rel=3D"noopener">CVE-2026-14409</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Skia in Google Chrome prior to 150.0.78= 71.46 allowed a remote attacker who had compromised the renderer process to=
perform UI spoofing via a crafted HTML page. (Chromium security severity: = Low)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14410" target=3D= "_blank" rel=3D"noopener">CVE-2026-14410</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in ANGLE in Google Chrome pr= ior to 150.0.7871.46 allowed a remote attacker to potentially perform a san= dbox escape via a crafted HTML page. (Chromium security severity: High)</td=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14411" target=3D= "_blank" rel=3D"noopener">CVE-2026-14411</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in ANGLE in Google Chrome pr= ior to 150.0.7871.46 allowed a remote attacker who had compromised the rend= erer process to potentially perform a sandbox escape via a crafted HTML pag=
e. (Chromium security severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14412" target=3D= "_blank" rel=3D"noopener">CVE-2026-14412</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allo= wed a remote attacker who had compromised the renderer process to potential=
ly perform a sandbox escape via a crafted HTML page. (Chromium security sev= erity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14413" target=3D= "_blank" rel=3D"noopener">CVE-2026-14413</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Skia in Google Chrome pri=
or to 150.0.7871.46 allowed a remote attacker who had compromised the rende= rer process to obtain potentially sensitive information from process memory=
via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14414" target=3D= "_blank" rel=3D"noopener">CVE-2026-14414</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871= .46 allowed a remote attacker who convinced a user to engage in specific UI=
gestures to potentially exploit heap corruption via a crafted HTML page. (= Chromium security severity: Low)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14415" target=3D= "_blank" rel=3D"noopener">CVE-2026-14415</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allo= wed a remote attacker to potentially perform a sandbox escape via a crafted=
HTML page. (Chromium security severity: Low)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14416" target=3D= "_blank" rel=3D"noopener">CVE-2026-14416</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Dawn in Google Chrome prior to 150.0.7871.46 allowed =
a remote attacker to potentially perform a sandbox escape via a crafted HTM=
L page. (Chromium security severity: Critical)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14417" target=3D= "_blank" rel=3D"noopener">CVE-2026-14417</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allo= wed a remote attacker to leak cross-origin data via a crafted HTML page. (C= hromium security severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14418" target=3D= "_blank" rel=3D"noopener">CVE-2026-14418</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed =
a remote attacker to potentially perform a sandbox escape via a crafted HTM=
L page. (Chromium security severity: Critical)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14419" target=3D= "_blank" rel=3D"noopener">CVE-2026-14419</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read and write in Dawn in Google Chrome prior to 150.0.78= 71.46 allowed a remote attacker to potentially perform a sandbox escape via=
a crafted HTML page. (Chromium security severity: Critical)</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14420" target=3D= "_blank" rel=3D"noopener">CVE-2026-14420</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Dawn in Google Chrome on ChromeOS prior to 150.0.7= 871.46 allowed a remote attacker to obtain potentially sensitive informatio=
n from process memory via a crafted HTML page. (Chromium security severity:=
Medium)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14421" target=3D= "_blank" rel=3D"noopener">CVE-2026-14421</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read and write in Tint in Google Chrome prior to 150.0.78= 71.46 allowed a remote attacker to potentially perform out of bounds memory=
access via a crafted HTML page. (Chromium security severity: High)</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14422" target=3D= "_blank" rel=3D"noopener">CVE-2026-14422</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed =
a remote attacker to potentially perform a sandbox escape via a crafted HTM=
L page. (Chromium security severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14423" target=3D= "_blank" rel=3D"noopener">CVE-2026-14423</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Dawn in Google Chrome on Mac prior to 150.0.7871.46 a= llowed a remote attacker to potentially perform a sandbox escape via a craf= ted HTML page. (Chromium security severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14424" target=3D= "_blank" rel=3D"noopener">CVE-2026-14424</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed=
a remote attacker to potentially perform a sandbox escape via a crafted HT=
ML page. (Chromium security severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14425" target=3D= "_blank" rel=3D"noopener">CVE-2026-14425</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a = remote attacker who convinced a user to engage in specific UI gestures to e= xecute arbitrary code inside a sandbox via a crafted HTML page. (Chromium s= ecurity severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14426" target=3D= "_blank" rel=3D"noopener">CVE-2026-14426</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Heap buffer overflow in Skia in Google Chrome prior to 150.0.7871.46 al= lowed a remote attacker who had compromised the renderer process to potenti= ally perform a sandbox escape via a crafted HTML page. (Chromium security s= everity: Critical)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14427" target=3D= "_blank" rel=3D"noopener">CVE-2026-14427</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Dawn in Google Chrome on = Android prior to 150.0.7871.46 allowed a remote attacker who had compromise=
d the renderer process to potentially perform a sandbox escape via a crafte=
d HTML page. (Chromium security severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14428" target=3D= "_blank" rel=3D"noopener">CVE-2026-14428</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Skia in Google Chrome pri=
or to 150.0.7871.46 allowed a remote attacker who had compromised the rende= rer process to potentially perform a sandbox escape via a crafted HTML page=
. (Chromium security severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14429" target=3D= "_blank" rel=3D"noopener">CVE-2026-14429</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed =
a remote attacker to execute arbitrary code inside a sandbox via a crafted = HTML page. (Chromium security severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14430" target=3D= "_blank" rel=3D"noopener">CVE-2026-14430</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a = remote attacker to execute arbitrary code inside a sandbox via a crafted HT=
ML page. (Chromium security severity: High)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14431" target=3D= "_blank" rel=3D"noopener">CVE-2026-14431</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a = remote attacker to execute arbitrary code inside a sandbox via a crafted HT=
ML page. (Chromium security severity: Medium)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14432" target=3D= "_blank" rel=3D"noopener">CVE-2026-14432</a></td>
</tr>

<td class=3D"vendor-product">Google--MCP Toolbox for Databases (googleapis/= mcp-toolbox)</td>
<td>A path traversal vulnerability exists in the HTTP tool URL builder of g= oogleapis/mcp-toolbox. When constructing downstream API requests, the URL b= uilder substitutes user-controlled pathParams into the configured tool path=
and parses the resulting string as a relative URL. While it checks that th=
e input does not alter the scheme, host, or user info, it relies on Resolve= Reference for the final URL resolution. Because dot segments (../) are norm= alized during this resolution step, an attacker can supply path parameters = containing directory traversal sequences to escape the operator-configured = path scope. This allows the client to coerce the toolbox into making reques=
ts to unintended endpoints on the same target host while forwarding the too= lbox's configured credentials (e.g., bypassing a restricted path like /api/= v1/users/{{.id}} to reach /admin/secrets).</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11720" target=3D= "_blank" rel=3D"noopener">CVE-2026-11720</a></td>
</tr>

<td class=3D"vendor-product">Gotcha Gotcha Games Inc.--RPG MAKER MV</td> <td>RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS = command injection vulnerability. If a user loads a specially crafted save-f= ile, arbitrary OS command may be executed.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56137" target=3D= "_blank" rel=3D"noopener">CVE-2026-56137</a></td>
</tr>

<td class=3D"vendor-product">GTERMARS--CSS::Minifier::XS</td> <td>CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when=
the entire document is minified away. The minify function has a memory lea=
k when processing a document containing only characters to be removed, such=
as comments and whitespace.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13593" target=3D= "_blank" rel=3D"noopener">CVE-2026-13593</a></td>
</tr>

<td class=3D"vendor-product">GTERMARS--JavaScript::Minifier::XS</td> <td>JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NUL=
L pointer dereference when the first meaningful token of the input is a sla= sh. The regexp versus division disambiguator in JsTokenizeString (XS.xs) in= spects the previous token's last byte to choose between a regexp literal an=
d a division operator. When a slash is the first meaningful token, with the=
start of input or only whitespace and comments before it, there is no vali=
d preceding token: the walk back over whitespace and comment nodes runs off=
the head of the node list to NULL, and the byte lookup reads through a NUL=
L contents pointer at an underflowed length index. The following identifier=
check dereferences the same NULL pointer. The crash is reachable through t=
he public minify() API, so input as small as a single slash byte crashes th=
e calling process. A service that minifies untrusted or third-party JavaScr= ipt can be crashed by a remote request, causing denial of service.</td> <td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56017" target=3D= "_blank" rel=3D"noopener">CVE-2026-56017</a></td>
</tr>

<td class=3D"vendor-product">GTERMARS--JavaScript::Minifier::XS</td> <td>JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on e= very call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs=
) the cleanup frees only the NodeSet structures and never the per-token con= tents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes w= ithout freeing their contents. Each token's contents buffer is therefore le= aked on every call, and the two early returns taken when the node list is e= mpty leak the whole NodeSet. A long-lived process that minifies repeatedly,=
such as an asset pipeline or a server-side minifier endpoint, grows in mem= ory without bound until it exhausts available memory and is killed, causing=
denial of service.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56018" target=3D= "_blank" rel=3D"noopener">CVE-2026-56018</a></td>
</tr>

<td class=3D"vendor-product">hestiacp--hestiacp</td>
<td>HestiaCP panel cronjob feature is affected by a broken access control v= ulnerability. Low privilege users can modify the panel cronjob to execute s= cripts HestiaCP management scripts with passwordless sudo. This could resul=
t in the takeover of administrator users in the application and the underly= ing webserver.</td>
<td>2026-07-04</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12196" target=3D= "_blank" rel=3D"noopener">CVE-2026-12196</a></td>
</tr>

<td class=3D"vendor-product">Hitachi Energy--PROMOD V</td>
<td>PROMOD V is using insecure HTTP communication instead of HTTPS. The vul= nerability is due to the lack of HTTPS support from 3rd party Digipede serv= er.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10763" target=3D= "_blank" rel=3D"noopener">CVE-2026-10763</a></td>
</tr>

<td class=3D"vendor-product">Honeywell Technologies--IQ MultiAccess</td> <td>Honeywell IQ MultiAccess, all versions prior to and including version 2=
8, contain an improper digital signature verification vulnerability. An att= acker could potentially exploit this vulnerability, leading to the replacem= ent of downloaded file with a malicious one. Honeywell also recommends upda= ting to the most recent version of this product, service, or offering [V27 = SP1, V28 SP1]</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13742" target=3D= "_blank" rel=3D"noopener">CVE-2026-13742</a></td>
</tr>

<td class=3D"vendor-product">HP Inc--CCX</td>
<td>The following Poly Voice IP devices, CCX, Trio, and Edge E, might be in= operable if they connect to a malicious SIP server and receive malformed da= ta. HP is releasing updates to mitigate these potential vulnerabilities.</t=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-2891" target=3D"= _blank" rel=3D"noopener">CVE-2026-2891</a></td>
</tr>

<td class=3D"vendor-product">HP Inc.--HP Fan Control App</td>
<td>The HP Fan Control App might allow local escalation of privileges. An u= pdated version of HP Fan Control App has been released to mitigate this pot= ential vulnerability.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8864" target=3D"= _blank" rel=3D"noopener">CVE-2026-8864</a></td>
</tr>

<td class=3D"vendor-product">Intermark IT--WebControl CMS</td>
<td>HTML injection vulnerability in Intermark IT's WebControl CMS v3.5. Thi=
s vulnerability allows an attacker to send an email containing malicious HT=
ML code to a victim via the contact form. To exploit this vulnerability, th=
e attacker must send a request using the 'nombreApellidos', 'direcci=C3=83= =C2=B3n ', and 'comentarios ' parameters to '/processContact.do'.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6953" target=3D"= _blank" rel=3D"noopener">CVE-2026-6953</a></td>
</tr>

<td class=3D"vendor-product">Intermark IT--WebControl CMS</td>
<td>Cross-Site Scripting (XSS) vulnerability in Intermark IT's WebControl C=
MS v3.5. This vulnerability allows an attacker to execute JavaScript code o=
r inject a dynamic iframe into the victim's browser by sending a malicious = URL via the 'urlDestino' parameter in '/portal.do'. This vulnerability can =
be exploited to steal sensitive user data, such as session cookies, display=
phishing interfaces, or perform actions on the user's behalf.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6954" target=3D"= _blank" rel=3D"noopener">CVE-2026-6954</a></td>
</tr>

<td class=3D"vendor-product">joomlack.fr--JoomlaCK.fr Page Builder CK exten= sion for Joomla</td>
<td>The Joomla extension Page Builder CK is vulnerable to an unauthenticate=
d arbitrary file upload that allows uploading executable files and leads to=
full RCE.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56290" target=3D= "_blank" rel=3D"noopener">CVE-2026-56290</a></td>
</tr>

<td class=3D"vendor-product">joomshaper.com--Helix3 extension for Joomla</t=

<td>The Helix3 plugin for Joomla exposes an ajax handler task, that allows = unauthenticated attackers to delete arbitrary files, write arbitrary JSON f= iles and update template parameters.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49049" target=3D= "_blank" rel=3D"noopener">CVE-2026-49049</a></td>
</tr>

<td class=3D"vendor-product">juliangruber--brace-expansion</td> <td>brace-expansion through 5.0.6 is vulnerable to denial of service. The e= xpand() function exhibits exponential-time complexity in the number of cons= ecutive non-expanding '{}' brace groups. An attacker who passes a crafted s= tring to expand(), directly or transitively, can cause significant CPU cons= umption and event-loop blocking. The max option does not mitigate this, as =
it bounds the output size rather than the recursion work.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13149" target=3D= "_blank" rel=3D"noopener">CVE-2026-13149</a></td>
</tr>

<td class=3D"vendor-product">keras-team--keras-team/keras</td>
<td>Keras versions up to and including 3.13.2 are vulnerable to an arbitrar=
y HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerabil= ity resides in the `H5IOStore._verify_dataset()` and `file_editor.py` metho= ds, which fail to check the `dataset.is_virtual` property of HDF5 datasets.=
This allows an attacker to craft a malicious `.keras` model archive or `.h=
5` weights file containing a Virtual Dataset (VDS) that references external=
HDF5 files on the victim's filesystem. When the victim loads the model usi=
ng `keras.models.load_model()` or `keras.saving.load_model()`, the external=
file is transparently read, leading to potential information disclosure. F= ixed in versions 3.12.2 and 3.14.1.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12480" target=3D= "_blank" rel=3D"noopener">CVE-2026-12480</a></td>
</tr>

<td class=3D"vendor-product">keras-team--keras-team/keras</td>
<td>A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary=
code execution due to improper handling of deserialization in the `Lambda`=
layer. Specifically, the `_raise_for_lambda_deserialization()` function fa= ils to enforce the safe-mode guard when `safe_mode` is set to `None`, which=
is the default value when `from_config()` is called outside of a `SafeMode= Scope` context. This logic error conflates `None` (unset/default-deny) with=
`False` (explicitly disabled), bypassing the guard and allowing attacker-c= ontrolled `marshal` bytecode to be deserialized. Affected call sites includ=
e `keras.layers.deserialize(config)`, `keras.models.clone_model(model)`, an=
d any direct invocation of `Lambda.from_config(config)` without an enclosin=
g `SafeModeScope(True)`. This vulnerability can be exploited to achieve arb= itrary OS-level code execution in the context of the server or user process= .</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12481" target=3D= "_blank" rel=3D"noopener">CVE-2026-12481</a></td>
</tr>

<td class=3D"vendor-product">Krajowa Izba Rozliczeniowa--SzafirHost</td> <td>SzafirHost verifies the downloaded native library archive with one JarF= ile parser (reading the Central Directory) but extracts native libraries wi=
th JarInputStream parser (reading sequentially from local file headers).=C2= =A0An attacker who controls the served archive can insert a malicious DLL/S= O/DYLIB as a local-file-header entry between the last legitimate entry and = the Central Directory, without adding it to the Central Directory. The sign= ature verifier never sees the injected entry and accepts the archive as val= idly signed; the extractor reads it sequentially and writes the attacker li= brary to the native temp directory with no hash check), while the archive-s= ize check still passes. This=C2=A0can lead to remote code execution. This i= ssue was fixed in version 1.2.2.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13165" target=3D= "_blank" rel=3D"noopener">CVE-2026-13165</a></td>
</tr>

<td class=3D"vendor-product">KTM System--e-BOK</td>
<td>KTM System e-BOK allows the session identifier to be set by the client = prior to authentication. If a cookie with a valid name is set, its value re= mains unchanged after successful login. This behaviour enables an attacker =
to fix a session ID for a victim and later hijack the authenticated session=
. This issue was fixed in the patch published in June 2026.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-35095" target=3D= "_blank" rel=3D"noopener">CVE-2026-35095</a></td>
</tr>

<td class=3D"vendor-product">KTM System--e-BOK</td>
<td>KTM System e-BOK is vulnerable to Cross-Site Request Forgery (CSRF) in = both the email-change and password-change functionalities. An attacker can = craft a malicious website=C2=A0that, when visited by an authenticated user,=
automatically sends a forged POST request to the application. This allows = the attacker to trigger an unauthorized email or password change on behalf =
of the victim without their knowledge or interaction. This issue was fixed =
in the patch published in June 2026.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-35096" target=3D= "_blank" rel=3D"noopener">CVE-2026-35096</a></td>
</tr>

<td class=3D"vendor-product">KTM System--e-BOK</td>
<td>KTM System e-BOK enforces a maximum password length of six numeric digi=
ts and does not permit the use of any alphabetic, special, or extended char= acters. This issue was fixed in the patch published in June 2026.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-35097" target=3D= "_blank" rel=3D"noopener">CVE-2026-35097</a></td>
</tr>

<td class=3D"vendor-product">KTM System--e-BOK</td>
<td>KTM System e-BOK does not implement any limit or timeout on consecutive=
login attempts, allowing an attacker to perform unlimited authentication r= equests. This lack of rate-limiting enables efficient brute-force attacks a= gainst user accounts. When combined with vulnerability CVE-2026-35097, wher=
e passwords are restricted to a six-digit numeric format, this becomes a cr= itical issue, as such passwords can be brute-forced in a relatively short t= ime. This issue was fixed in the patch published in June 2026.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-35098" target=3D= "_blank" rel=3D"noopener">CVE-2026-35098</a></td>
</tr>

<td class=3D"vendor-product">leandrocp--mdex</td>
<td>Allocation of Resources Without Limits or Throttling vulnerability in l= eandrocp MDEx allows Excessive Allocation. MDEx.parse_document/2 accepts a = {:json, json} source. In lib/mdex.ex, the private json_to_node/1 function p= asses the attacker-controlled node_type value to Module.concat/1, which cal=
ls String.to_atom/1 and interns a brand-new atom for every distinct value. = Atoms are never garbage collected on the BEAM, so a crafted JSON document c= arrying a unique node_type at each (deeply nested) node mints one permanent=
atom per node. A single document can intern hundreds of thousands of atoms=
, and a large enough document exhausts the default atom table (around 1,048= ,576 atoms) and aborts the entire Erlang VM, taking down every process on t=
he node. Any application that passes untrusted input to the {:json, ...} so= urce of MDEx.parse_document is exposed to an unauthenticated denial-of-serv= ice. This issue affects mdex from 0.4.3 before 0.13.2.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53426" target=3D= "_blank" rel=3D"noopener">CVE-2026-53426</a></td>
</tr>

<td class=3D"vendor-product">leandrocp--mdex</td>
<td>Improper Neutralization of Input During Web Page Generation ('Cross-sit=
e Scripting') vulnerability in leandrocp MDEx allows stored or reflected cr= oss-site scripting via attacker-controlled Markdown. When syntax highlighti=
ng and full info-string forwarding (render: [full_info_string: true]) are e= nabled, the Lumis adapter copies the value of a code fence's highlight_line= s_class info-string attribute, unescaped, into the class attribute of every=
rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attri= butes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info strin=
g and stores each key=3Dvalue pair verbatim, highlight_lines_config pulls h= ighlight_lines_class into the per-line class value, and write_highlighted i= nterpolates that value directly into the class attribute of the per-line &l= t;div&gt;. A single-quoted shell token preserves an inner double quote thro= ugh shlex parsing, so a value such as '"&gt;&lt;script&gt;alert(1)&lt;/scri= pt&gt;' terminates the class attribute early and the markup that follows is=
emitted as live HTML. An attacker who can submit Markdown (through comment=
s, posts, wiki pages, documentation, or any user-generated content) can inj= ect arbitrary HTML and JavaScript that runs in the browser of every user wh=
o views the rendered output, enabling session theft, account takeover, and = other client-side attacks. No authentication or special privileges are requ= ired. The vulnerable native code originally shipped inside mdex (in native/= comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate = mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it=
remains unpatched. This issue affects mdex from 0.11.3 before 0.12.3, and = mdex_native from 0.1.0 before 0.2.3.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53427" target=3D= "_blank" rel=3D"noopener">CVE-2026-53427</a></td>
</tr>

<td class=3D"vendor-product">leandrocp--mdex</td>
<td>Memory Allocation with Excessive Size Value vulnerability in leandrocp = mdex allows an unauthenticated attacker to cause a denial of service throug=
h unbounded memory allocation. comrak_nif::lumis_adapter::LumisAdapter::par= se_highlight_lines in native/comrak_nif/src/lumis_adapter.rs eagerly expand=
s a user-controlled inclusive line range from a fenced code block's highlig= ht_lines decorator into a Vec&lt;usize&gt;, pushing one element per integer=
in the range with no upper bound on the range size. An attacker who can su= pply Markdown that an application renders with MDEx.to_html/2 (for example =
a comment, chat message, or wiki page) can embed a code block whose info st= ring is rust highlight_lines=3D"1-100000000", forcing the native adapter to=
allocate roughly 8 bytes per line in the range. A payload that differs by = only a few bytes can therefore allocate hundreds of megabytes, and a suffic= iently large range (for example 1-2000000000) exhausts host memory and abor=
ts the BEAM, denying service to every user of the rendering process. The pe= r-line write loop additionally tests membership with a linear scan over the=
same vector, degrading rendering to a quadratic cost even for ranges that =
do not immediately exhaust memory. The vulnerable native code originally sh= ipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later=
extracted into the separate mdex_native package (native/mdex_native_nif/sr= c/lumis_adapter.rs), where it remains unpatched. This issue affects mdex fr=
om 0.11.0 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.</td> <td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53428" target=3D= "_blank" rel=3D"noopener">CVE-2026-53428</a></td>
</tr>

<td class=3D"vendor-product">leandrocp--mdex</td>
<td>Missing Release of Memory after Effective Lifetime vulnerability in lea= ndrocp mdex and mdex_native allows an attacker who controls a rendered docu= ment to cause a denial of service through unbounded native memory exhaustio=
n. The native rendering code permanently leaks memory when rendering a docu= ment that contains escaped-tag nodes. The conversion of each %MDEx.EscapedT= ag{} node into its native representation (From&lt;ExEscapedTag&gt; for Node= Value in the Rust NIF) calls Box::leak on the caller-supplied literal strin=
g, which surrenders the backing allocation so that it lives for the entire = lifetime of the operating system process and is never freed. Both the byte = length of each literal and the number of escaped-tag nodes in a document ar=
e attacker-controlled, and there is no size cap, rate limit, or string inte= rning on this path. Every render of a document containing escaped-tag nodes=
therefore leaks literal_size x node_count bytes that can never be reclaime=
d, and repeated renders accumulate without bound. Rendering reaches this pa=
th through the public MDEx.to_html/1 entry point and any other API that ren= ders a supplied %MDEx.Document{}. Any application that uses mdex (or mdex_n= ative directly) to render documents derived from user-supplied content is a= ffected. Because the leaked memory is never reclaimed for the life of the B= EAM process, an attacker can drive resident memory upward without limit unt=
il the node exhausts memory and crashes, taking down every process on it. T=
he vulnerable native code originally shipped inside mdex (in native/comrak_= nif/src/types/document.rs) and was later extracted into the separate mdex_n= ative package (native/mdex_native_nif/src/types/document.rs), where it rema= ins unpatched. This issue affects mdex from 0.11.0 before 0.12.3, and mdex_= native from 0.1.0 before 0.2.3.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53429" target=3D= "_blank" rel=3D"noopener">CVE-2026-53429</a></td>
</tr>

<td class=3D"vendor-product">leandrocp--mdex</td>
<td>Uncontrolled Recursion vulnerability in leandrocp mdex allows denial of=
service via deeply nested Markdown input. mdex converts between an Elixir = %MDEx.Document{} struct and Comrak's internal AST using two mutually recurs= ive Rust functions, ex_document_to_comrak_ast and comrak_ast_to_ex_document=
, in the NIF source file document.rs. Neither function enforces a maximum n= esting depth, so the recursion depth is bounded only by the structure of th=
e input. An attacker who can get a Markdown document rendered (for example = through MDEx.parse_document!/1 or MDEx.to_html/1) can supply a document wit=
h thousands of nested block quotes, which drives unbounded recursion across=
the NIF boundary and exhausts the native C stack. Because the resulting st= ack overflow is an uncatchable SIGSEGV raised inside a NIF, it cannot be co= ntained by the Erlang runtime. It terminates the operating system process r= unning the BEAM, killing every Elixir and Erlang process on the node, not j= ust the caller that triggered the render. No authentication or special priv= ileges are required. The vulnerable conversion code was extracted from mdex=
into the separate mdex_native package starting in mdex 0.12.3. This issue = affects mdex from 0.3.0 before 0.12.3 and mdex_native from 0.1.0 before 0.2= .3.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54888" target=3D= "_blank" rel=3D"noopener">CVE-2026-54888</a></td>
</tr>

<td class=3D"vendor-product">leandrocp--mdex</td>
<td>Improper Neutralization of Input During Web Page Generation (XSS) vulne= rability in leandrocp mdex allows cross-site scripting via unsanitized URL = schemes in Quill Delta output. 'Elixir.MDEx':to_delta/2 converts Markdown i= nto a Quill Delta. 'Elixir.MDEx.DeltaConverter':default_convert_node/3 in l= ib/mdex/delta_converter.ex copies the URL of a link, wikilink, or image nod=
e directly from the parsed Markdown into the Delta "link" or "image" attrib= ute without applying a scheme allowlist or any normalization. An attacker w=
ho controls the Markdown text can supply a javascript: URL (for example [cl= ick](javascript:alert(document.cookie))) that survives verbatim into the De= lta attribute. When the Delta is rendered to HTML by a downstream renderer = (such as quill-delta-to-html or the Quill client), the attribute becomes an=
&lt;a href&gt; or &lt;img src&gt;, and the javascript: scheme executes in = the browser of anyone who views the rendered content. The link and wikilink=
cases are the strongest vectors because javascript: in an href executes on=
click; the image case is lower impact because javascript: in &lt;img src&g=
t; generally does not execute in modern browsers. This issue affects mdex: = from 0.8.3 before 0.13.2.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54889" target=3D= "_blank" rel=3D"noopener">CVE-2026-54889</a></td>
</tr>

<td class=3D"vendor-product">lib60870--lib60870</td>
<td>A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMess= ages function of lib60870 v2.3.3 to v2.3.6 allows attackers to cause a Deni=
al of Service (DoS) via a crafted payload.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-51219" target=3D= "_blank" rel=3D"noopener">CVE-2026-51219</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: agp= /amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer de= reference was observed in the AMD64 AGP driver when running in a virtualize=
d environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash=
occurs in amd64_fetch_size() when attempting to dereference the pointer re= turned by node_to_amd_nb(0). The root cause of this crash is broken error p= ropagation in agp_amd64_probe(): When no AMD northbridges are found, cache_= nbs() correctly returns -ENODEV. However, the probe function erroneously ch= ecks the return value against exactly -1, rather than &lt; 0. As a result, = the hardware absence error is masked, allowing the driver to improperly pro= ceed with initialization. It eventually calls agp_add_bridge(), which invok=
es amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0)=
returns NULL, leading to a General Protection Fault (GPF) when accessing i=
ts -&gt;misc member. Fix the issue by correcting the error check in agp_amd= 64_probe() to abort properly when cache_nbs() returns any negative error co= de. This prevents the driver from erroneously proceeding without hardware, = thereby avoiding the subsequent NULL pointer dereference at its source.</td=

<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53325" target=3D= "_blank" rel=3D"noopener">CVE-2026-53325</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: deb= ugobjects: Don't call fill_pool() in early boot hardirq context When bootin=
g a debug PREEMPT_RT kernel on an ARM64 system, a "inconsistent {HARDIRQ-ON= -W} -&gt; {IN-HARDIRQ-W} usage" lockdep warning message was reported to the=
console. During early boot, interrupts are enabled before the scheduler is=
enabled. In this window (before SYSTEM_SCHEDULING is set) interrupts can f= ire and in the hard interrupt context handler attempt to fill the pool This=
can lead to a deadlock when the interrupt occurred when the interrupt hits=
a region which holds a lock that is required to be taken in the allocation=
path. Add a new can_fill_pool() helper and reorder the exception rule and = forbid this scenario by excluding allocations from hard interrupt context.<=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53326" target=3D= "_blank" rel=3D"noopener">CVE-2026-53326</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: deb= ugobjects: Do not fill_pool() if pi_blocked_on On RT enabled kernels, fill_= pool() ends up calling rtlock_lock(), which asserts if current::pi_blocked_=
on is set, because a task can obviously only block on one lock as otherwise=
the priority inheritenace chain gets corrupted. Prevent this by expanding = the conditional to take current::pi_blocked_on into account.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53327" target=3D= "_blank" rel=3D"noopener">CVE-2026-53327</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: sch= ed_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() A WAR=
N fires when systemd's user manager writes "+cpu +memory +pids" to its own = subtree_control while a sched_ext scheduler is loaded: WARNING: at kernel/s= ched/ext.c:3227 scx_cgroup_move_task+0xa8/0xb0 scx_cgroup_move_task+0xa8/0x=
b0 sched_move_task+0x134/0x290 cpu_cgroup_attach+0x39/0x70 cgroup_migrate_e= xecute+0x37d/0x450 cgroup_update_dfl_csses+0x1e3/0x270 cgroup_subtree_contr= ol_write+0x3e7/0x440 scx_cgroup_can_attach() arms cgrp_moving_from only whe=
n a task's cpu cgroup changes. It can still be NULL when scx_cgroup_move_ta= sk() runs, through this sequence: Step Result -----------------------------= ---- ---------------------------------- 1. cpu enabled on cgroup G cpu css = =3D A 2. cpu toggled off then on for G A killed, B created (same cgroup) 3.=
an exiting task keeps A alive migration skips it, A now stale 4. +memory m= igrates G stale A vs current B pulls cpu in 5. cpu attach runs for all task=
s hits a live, cpu-unchanged task 6. scx_cgroup_move_task() on it cgrp_movi= ng_from NULL -&gt; WARN The mismatch is that scx_cgroup_can_attach() keys o=
n cgroup identity while migration drives the move on css identity, so a NUL=
L cgrp_moving_from here is a legitimate css-only migration, not a missing p= rep. The call is already gated on cgrp_moving_from, so just drop the warnin=
g. ops.cgroup_prep_move() and ops.cgroup_move() stay paired.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53328" target=3D= "_blank" rel=3D"noopener">CVE-2026-53328</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: drm= /amd/display: Use krealloc_array() in dal_vector_reserve() [Why &amp; How] = dal_vector_reserve() computes the allocation size as "capacity * vector-&gt= ;struct_size" using uint32_t arithmetic, which can silently wrap to a small=
value on overflow. This would cause krealloc to return a smaller buffer th=
an expected, leading to heap overflows on subsequent vector appends. Replac=
e krealloc() with krealloc_array() which performs an internal overflow chec=
k and returns NULL on wrap, preventing the issue. (cherry picked from commi=
t 37668568641ccc4cc1dbca4923d0a16609dd5707)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53329" target=3D= "_blank" rel=3D"noopener">CVE-2026-53329</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: drm= /amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() [Why &a= mp; How] The aux_rd_interval array in struct dc_lttpr_caps is declared with=
MAX_REPEATER_CNT - 1 (7) elements, indexed 0..6. However, the offset param= eter passed to dp_get_eq_aux_rd_interval() can be as large as MAX_REPEATER_= CNT (8) when a sink reports 8 LTTPR repeaters via DPCD. This leads to an ou= t-of-bounds read of aux_rd_interval[7] when offset is 8. Fix this by growin=
g aux_rd_interval to MAX_REPEATER_CNT elements to accommodate the full rang=
e of valid repeater counts defined by the DP spec. (cherry picked from comm=
it a55a458a8df37a65ffda5cf721d554a8f74f6b04)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53330" target=3D= "_blank" rel=3D"noopener">CVE-2026-53330</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: sli= mbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-&gt;lock During the SSR/PDR=
down notification the tx_lock is taken with the intent to provide synchron= ization with active DMA transfers. But during this period qcom_slim_ngd_dow= n() is invoked, which ends up in slim_report_absent(), which takes the slim= _controller lock. In multiple other codepaths these two locks are taken in = the opposite order (i.e. slim_controller then tx_lock). The result is a loc= kdep splat, and a possible deadlock: rprocctl/449 is trying to acquire lock=
: ffff00009793e620 (&amp;ctrl-&gt;lock){+.+.}-{4:4}, at: slim_report_absent=
(drivers/slimbus/core.c:322) slimbus but task is already holding lock: fff= f00009793fb50 (&amp;ctrl-&gt;tx_lock){+.+.}-{4:4}, at: qcom_slim_ngd_ssr_pd= r_notify (drivers/slimbus/qcom-ngd-ctrl.c:1475) slim_qcom_ngd_ctrl which lo=
ck already depends on the new lock. Possible unsafe locking scenario: CPU0 = CPU1 ---- ---- lock(&amp;ctrl-&gt;tx_lock); lock(&amp;ctrl-&gt;lock); lock(= &amp;ctrl-&gt;tx_lock); lock(&amp;ctrl-&gt;lock); The assumption is that th=
e comment refers to the desire to not call qcom_slim_ngd_exit_dma() while w=
e have an ongoing DMA TX transaction. But any such transaction is initiated=
and completed within a single qcom_slim_ngd_xfer_msg(). Prior to calling q= com_slim_ngd_exit_dma() the slim_controller is torn down, all child devices=
are notified that the slimbus is gone and the child devices are removed. S= top taking the tx_lock in qcom_slim_ngd_ssr_pdr_notify() to avoid the deadl= ock.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53331" target=3D= "_blank" rel=3D"noopener">CVE-2026-53331</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: sli= mbus: qcom-ngd-ctrl: Register callbacks after creating the ngd When the rem= oteproc starts in parallel with the NGD driver being probed, or the remotep= roc is already up when the PDR lookup is being registered, or in the theore= tical event that we get an interrupt from the hardware, these callbacks wil=
l operate on uninitialized data. This result in issues to boot the affected=
boards. One such example can be seen in the following fault, where qcom_sl= im_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work. [ 21.858578=
] ------------[ cut here ]------------ [ 21.858745] WARNING: kernel/workque= ue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116 ... [ 21.8592= 51] Call trace: [ 21.859255] __queue_work+0x5e0/0x790 (P) [ 21.859265] queu= e_work_on+0x6c/0xf0 [ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [= slim_qcom_ngd_ctrl] [ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_q= com_ngd_ctrl] [ 21.859318] notifier_call_chain+0xa4/0x230 [ 21.859329] srcu= _notifier_call_chain+0x64/0xb8 [ 21.859338] ssr_notify_start+0x40/0x78 [qco= m_common] [ 21.859355] rproc_start+0x130/0x230 [ 21.859367] rproc_boot+0x3d= 4/0x518 ... Move the enablement of interrupts, and the registration of SSR = and PDR until after the NGD device has been registered. This could be furth=
er refined by moving initialization to the control driver probe and by remo= ving the platform driver model from the picture.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53332" target=3D= "_blank" rel=3D"noopener">CVE-2026-53332</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: mm/= mincore: handle non-swap entries before !CONFIG_SWAP guard mincore_swap() a= lso fields migration/hwpoison entries (and shmem swapin-error entries), whi=
ch can exist on !CONFIG_SWAP builds when CONFIG_MIGRATION or CONFIG_MEMORY_= FAILURE is enabled. The !IS_ENABLED(CONFIG_SWAP) guard ran before the non-s= wap-entry early return, so mincore_pte_range() can spuriously WARN and repo=
rt these pages nonresident on !CONFIG_SWAP kernels. Move the guard below th=
e non-swap-entry check so only true swap entries trip the WARN, and migrati= on/hwpoison entries take the existing "uptodate / non-shmem" path.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53333" target=3D= "_blank" rel=3D"noopener">CVE-2026-53333</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: mm/= damon/reclaim: handle ctx allocation failure Patch series "mm/damon/{reclai= m,lru_sort}: handle ctx allocation failures". DAMON_RECLAIM and DAMON_LRU_S= ORT could dereference NULL pointers if their damon_ctx object allocations f= ail. The bugs are expected to happen infrequently because the allocations a=
re arguably too small to fail on common setups. But theoretically they are = possible and the consequences are bad. Fix those. The issues were discovere=
d [1] by Sashiko. This patch (of 2): DAMON_RECLAIM allocates the damon_ctx = object for its kdamond in its init function. damon_reclaim_enabled_store() = wrongly assumes the allocation will always succeed once tried. If the damon= _ctx allocation was failed, therefore, code execution reaches to damon_comm= it_ctx() while 'ctx' is NULL. As a result, it dereferences the NULL 'ctx' p= ointer. Avoid the NULL dereference by returning -ENOMEM if 'ctx' is NULL.</=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53334" target=3D= "_blank" rel=3D"noopener">CVE-2026-53334</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: mm/= damon/lru_sort: handle ctx allocation failure DAMON_LRU_SORT allocates the = damon_ctx object for its kdamond in its init function. damon_lru_sort_enabl= ed_store() wrongly assumes the allocation will always succeed once tried. I=
f the damon_ctx allocation was failed, therefore, code execution reaches to=
damon_commit_ctx() while 'ctx' is NULL. As a result, it dereferences the N= ULL 'ctx' pointer. Avoid the NULL dereference by returning -ENOMEM if 'ctx'=
is NULL.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53335" target=3D= "_blank" rel=3D"noopener">CVE-2026-53335</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: nvm= em: layouts: onie-tlv: fix hang on unknown types The EEPROM on my board has=
a vendor specific entry of type 0x41. When stumbling upon that, this drive=
r hangs in an endless loop. Fix it by keep incrementing the offset on unkno=
wn entries, so the loop will eventually stop.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53336" target=3D= "_blank" rel=3D"noopener">CVE-2026-53336</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: net=
: bonding: fix NULL pointer dereference in bond_do_ioctl() In bond_do_ioctl= (), slave_dev is obtained via __dev_get_by_name() which can return NULL if = the requested interface name does not exist. However, the subsequent slave_= dbg() call is placed before the NULL check: slave_dev =3D __dev_get_by_name= (net, ifr-&gt;ifr_slave); slave_dbg(bond_dev, slave_dev, "slave_dev=3D%p:\n=
", slave_dev); //here if (!slave_dev) return -ENODEV; The slave_dbg() macro=
expands to netdev_dbg(bond_dev, "(slave %s): " fmt, (slave_dev)-&gt;name, = ...) which unconditionally dereferences slave_dev-&gt;name before the NULL = check is performed. This results in a NULL pointer dereference kernel oops = when a user calls bonding ioctl (e.g. SIOCBONDENSLAVE, SIOCBONDRELEASE, etc=
.) with a non-existent slave interface name. This is reachable from userspa=
ce via the bonding ioctl interface with CAP_NET_ADMIN capability, making it=
a potential local denial-of-service vector. Fix by moving the slave_dbg() = call after the NULL check.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53337" target=3D= "_blank" rel=3D"noopener">CVE-2026-53337</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: net=
: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_h= fwd_queues() of_reserved_mem_lookup() may return NULL if the reserved memor=
y region referenced by the "memory-region" phandle is not found in the rese= rved memory table (e.g. due to a misconfigured DTS or a removed memory-regi=
on node). The current code dereferences the returned pointer without checki=
ng for NULL, leading to a kernel NULL pointer dereference at the following = lines: dma_addr =3D rmem-&gt;base; // line 1156 num_desc =3D div_u64(rmem-&= gt;size, buf_size); // line 1160 Add a NULL check after of_reserved_mem_loo= kup() and return -ENODEV if the lookup fails, which is consistent with the = existing error handling for of_parse_phandle() failure in the same code blo= ck.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53338" target=3D= "_blank" rel=3D"noopener">CVE-2026-53338</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: i2c=
: qcom-cci: Fix NULL pointer dereference in cci_remove() On all modern plat= forms Qualcomm CCI controller provides two I2C masters, and on particular b= oards only one I2C master may be initialized, and in such cases the device = unbinding or driver removal causes a NULL pointer dereference, because cci_= halt() is called for all two I2C masters, but a completion is initialized o= nly for the single enabled master: % rmmod i2c-qcom-cci Unable to handle ke= rnel NULL pointer dereference at virtual address 0000000000000000 &lt;snip&= gt; Call trace: __wait_for_common+0x194/0x1a8 (P) wait_for_completion_timeo= ut+0x20/0x2c cci_remove+0xc4/0x138 [i2c_qcom_cci] platform_remove+0x20/0x30=
device_remove+0x4c/0x80 device_release_driver_internal+0x1c8/0x224 driver_= detach+0x50/0x98 bus_remove_driver+0x6c/0xbc driver_unregister+0x30/0x60 pl= atform_driver_unregister+0x14/0x20 qcom_cci_driver_exit+0x18/0x1008 [i2c_qc= om_cci] ....</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53339" target=3D= "_blank" rel=3D"noopener">CVE-2026-53339</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: i2c=
: imx: fix clock and pinctrl state inconsistency in runtime PM In i2c_imx_r= untime_suspend(), the clock is disabled before switching the pinctrl state =
to sleep. If pinctrl_pm_select_sleep_state() fails, the runtime suspend is = aborted but the clock remains disabled, causing a system crash when the har= dware is subsequently accessed. Fix this by switching the pinctrl state bef= ore disabling the clock so that a pinctrl failure leaves the clock enabled = and the hardware accessible. In i2c_imx_runtime_resume(), restore the pinct=
rl state back to sleep if clk_enable() fails to keep the consistent.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53340" target=3D= "_blank" rel=3D"noopener">CVE-2026-53340</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: fha= ndle: fix UAF due to unlocked -&gt;mnt_ns read in may_decode_fh() may_decod= e_fh() accesses mount::mnt_ns without holding any locks; that means the mou=
nt can concurrently be unmounted, and the mnt_namespace can concurrently be=
freed after an RCU grace period. This race can happens as follows, assumin=
g that the mount point was created by open_tree(..., OPEN_TREE_CLONE): thre=
ad 1 thread 2 RCU __do_sys_open_by_handle_at do_handle_open handle_to_path = may_decode_fh is_mounted [mount::mnt_ns access] [mount::mnt_ns access] __do= _sys_close fput_close_sync __fput dissolve_on_fput umount_tree class_namesp= ace_excl_destructor namespace_unlock free_mnt_ns mnt_ns_tree_remove call_rc= u(mnt_ns_release_rcu) mnt_ns_release_rcu mnt_ns_release kfree [mnt_namespac= e::user_ns access] **UAF** Fix it by taking rcu_read_lock() around the moun= t::mnt_ns access, like in __prepend_path(). Additionally, document the sema= ntics of mount::mnt_ns, and use WRITE_ONCE() for writers that can race with=
lockless readers. This bug is unreachable unless one of the following is s= et: - CONFIG_PREEMPTION - CONFIG_RCU_STRICT_GRACE_PERIOD because it require=
s an RCU grace period to happen during a syscall without an explicit preemp= tion. This doesn't seem to have interesting security impact; worst-case, it=
could leak the result of an integer comparison to userspace (from the leve=
l check in cap_capable()), cause an endless loop, or crash the kernel by de= referencing an invalid address.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53341" target=3D= "_blank" rel=3D"noopener">CVE-2026-53341</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: arm= 64: mm: call pagetable dtor when freeing hot-removed page tables Since 5e8e= b9aeeda3 ("arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping()") = page-table allocation on ARM64 always calls pagetable_{pte,pmd,pud,p4d}_cto= r(). This sets the page_type to PGTY_table, increments NR_PAGETABLE and pos= sible allocates a PTL. However the matching pagetable_dtor() calls were nev=
er added. With DEBUG_VM enabled on kernel versions prior to v6.17 without 2= dfcd1608f3a9 ("mm/page_alloc: let page freeing clear any set page type") th=
is leads to the following warning when freeing these pages due to page-&gt;= page_type sharing page-&gt;_mapcount: BUG: Bad page state in process ... pf= n:284fbb page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn= :0x284fbb flags: 0x17fffc000000000(node=3D0|zone=3D2|lastcpupid=3D0x1ffff) = page_type: f2(table) page dumped because: nonzero mapcount Call trace: bad_= page+0x13c/0x160 __free_frozen_pages+0x6cc/0x860 ___free_pages+0xf4/0x180 f= ree_pages+0x54/0x80 free_hotplug_page_range.part.0+0x58/0x90 free_empty_tab= les+0x438/0x500 __remove_pgd_mapping.constprop.0+0x60/0xa8 arch_remove_memo= ry+0x48/0x80 try_remove_memory+0x158/0x1d8 offline_and_remove_memory+0x138/= 0x180 It can also lead to leaking the ptl allocation if ALLOC_SPLIT_PTLOCKS=
is defined and incorrect NR_PAGETABLE stats. Fix this by calling pagetable= _dtor() in free_hotplug_pgtable_page() prior to freeing the page to undo th=
e effects of calling pagetable_*_ctor().</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53342" target=3D= "_blank" rel=3D"noopener">CVE-2026-53342</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: ARM=
: 9475/1: entry: use byte load for KASAN VMAP stack shadow Commit 44e9a3bb7= 6e5 ("ARM: 9430/1: entry: Do a dummy read from VMAP shadow") added a dummy = read from the KASAN VMAP stack shadow in __switch_to(). The read uses ldr, = but the KASAN shadow address is byte-granular and is not guaranteed to be w= ord aligned. ARMv5 faults unaligned word loads. With CONFIG_KASAN_VMALLOC a=
nd CONFIG_VMAP_STACK enabled, ARM926/VersatilePB crashes in __switch_to() w= ith an alignment exception before reaching init. Use ldrb for the dummy sha= dow access. The code only needs to fault in the shadow mapping if the stack=
shadow is missing, so a byte load is sufficient and matches the granularit=
y of KASAN shadow memory.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53343" target=3D= "_blank" rel=3D"noopener">CVE-2026-53343</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: pin= ctrl: mcp23s08: Initialize mcp-&gt;dev and mcp-&gt;addr before regmap init = Regmap initialization triggers regcache_maple_populate() which attempts SPI=
read to populate cache. SPI read requires mcp-&gt;dev and mcp-&gt;addr to =
be set, without them, NULL pointer dereference occurs during probe. Move in= itialization before mcp23s08_spi_regmap_init() call.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53344" target=3D= "_blank" rel=3D"noopener">CVE-2026-53344</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: KVM=
: Don't WARN if memory is dirtied without a vCPU when the VM is dying When = marking a page dirty, complain about not having a running/loaded vCPU if an=
d only if the VM is still alive, i.e. its refcount is non-zero. This will a= llow fixing a memory leak for x86 SEV-ES guests without hitting what is eff= ectively a false positive on the WARN. For some SEV-ES VM-Exits, KVM keeps =
a writable mapping of a guest page across an exit to userspace, and typical=
ly unmaps the page on the next KVM_RUN. But if userspace never calls KVM_RU=
N after such an exit, then KVM needs to unmap the page when the vCPU is des= troyed, which in turn triggers the WARN about not having a running vCPU. Al= ternatively, SEV-ES could temporarily load the vCPU to suppress the WARN, a=
s is done in nested_vmx_free_vcpu() (but for completely unrelated reasons; = suppressing WARN from nested_put_vmcs12_pages() is pure happenstance). But = loading a vCPU during destruction is gross (ideally nVMX code would be clea= ned up), risks complicating the SEV-ES code (KVM would need to ensure the t= emporarily load()+put() only runs when the vCPU isn't already loaded), and =
is ultimately pointless. The motivation for the WARN is to guard against KV=
M dirtying guest memory without pushing the corresponding GFN to the active=
vCPU's dirty ring, e.g. to ensure userspace doesn't miss a dirty page. But=
for the VM's refcount to reach zero, there can't be _any_ userspace mappin=
gs to the dirty ring, as mapping the dirty ring requires doing mmap() on th=
e vCPU FD. I.e. if userspace had a valid mapping for the dirty ring, then t=
he vCPU file and thus the owning VM would still be alive. And so since user= space can't possibly reach the dirty ring, whether or not KVM technically "= misses" a push to the dirty ring is irrelevant.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53345" target=3D= "_blank" rel=3D"noopener">CVE-2026-53345</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: rus=
t: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES Due to a ru= stc bug [1] the -Cforce-unwind-tables=3Dy flag only emits the uwtable annot= ation for functions, but not for the module. This means that compiler-gener= ated functions such as 'asan.module_ctor' do not receive the uwtable annota= tion. When CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled, this leads to boot = failures because the dwarf information emitted for the kasan constructors i=
s wrong, which causes the SCS boot patching code to patch the constructor i=
n an illegal manner. Specifically, the paciasp instruction is patched, but = the autiasp instruction is not. This mismatch leads to a crash when the con= structor is called during boot. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D BUG: KASAN: global-out-of-bounds in do_basic_setup+0x4c/0x90 Read of=
size 8 at addr ffffffe3cc7eb488 by task swapper/0/1 Specifically the fault= ing instruction is the (*fn)() to invoke the constructor in do_ctors() of t=
he init/main.c file. Once the fix lands in rustc, this flag can be made con= ditional on the rustc version. Note that passing the flag on a rustc with t=
he fix present has no effect. [ The fix [1] has landed for Rust 1.98.0 (exp= ected release on 2026-08-20). Thus add a version check as discussed. - Migu=
el ] [ Adjusted link and comment. - Miguel ]</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53346" target=3D= "_blank" rel=3D"noopener">CVE-2026-53346</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: drm= /virtio: Fix driver removal with disabled KMS DRM atomic and modesetting ar= en't initialized if virtio-gpu driver built with disabled KMS, leading to a= ccess of uninitialized data on driver removal/unbinding and crashing kernel=
. Fix it by skipping shutting down atomic core with unavailable KMS.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53347" target=3D= "_blank" rel=3D"noopener">CVE-2026-53347</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: ASo=
C: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions sdca= _dev_unregister_functions() iterates over all SDCA function descriptors and=
calls sdca_dev_unregister() on each func_dev without checking for NULL. Wh=
en a function registration has failed partway through, or the device cleanu=
p races with probe deferral, func_dev entries may be NULL, leading to a ker= nel oops: BUG: kernel NULL pointer dereference, address: 0000000000000040 R= IP: 0010:device_del+0x1e/0x3e0 Call Trace: sdca_dev_unregister_functions+0x= 37/0x60 [snd_soc_sdca] release_nodes+0x35/0xb0 devres_release_all+0x90/0x10=
0 device_unbind_cleanup+0xe/0x80 device_release_driver_internal+0x1c1/0x200=
bus_remove_device+0xc6/0x130 device_del+0x161/0x3e0 device_unregister+0x17= /0x60 sdw_delete_slave+0xb6/0xd0 [soundwire_bus] sdw_bus_master_delete+0x1e= /0x50 [soundwire_bus] ... sof_probe_work+0x19/0x30 [snd_sof] This was obser= ved on a Lenovo ThinkPad X1 Carbon G14 (Panther Lake) with the SOF audio dr= iver probe failing due to missing Panther Lake firmware, causing the subseq= uent cleanup of SoundWire devices to trigger the crash. Fix this with three=
changes: 1) Add a NULL guard in sdca_dev_unregister() so that callers do n=
ot need to pre-validate the pointer (defense in depth). 2) In sdca_dev_unre= gister_functions(), skip NULL func_dev entries and clear func_dev to NULL a= fter unregistration, making the function idempotent and safe against double= -invocation. 3) In sdca_dev_register_functions(), roll back all previously = registered functions when a later one fails, so the function array is never=
left in a partially-populated state.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53348" target=3D= "_blank" rel=3D"noopener">CVE-2026-53348</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: net= filter: nf_conntrack: destroy stale expectfn expectations on unregister NAT=
helpers such as nf_nat_h323 store a raw pointer to module text in exp-&gt;= expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister() only=
unlinks the callback descriptor and never walks the expectation table, so =
an expectation pending at module removal survives with a dangling exp-&gt;e= xpectfn into freed module text. When the expected connection arrives, init_= conntrack() invokes exp-&gt;expectfn(), now a stale pointer into the unload=
ed module. Reproduced on a KASAN build by loading the H.323 helpers, creati=
ng a Q.931 expectation, unloading nf_nat_h323, then connecting to the expec= ted port: Oops: int3: 0000 [#1] SMP KASAN NOPTI RIP: 0010:0xffffffffa06102d=
1 init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862) nf_conntra= ck_in (net/netfilter/nf_conntrack_core.c:2049) ipv4_conntrack_local (net/ne= tfilter/nf_conntrack_proto.c:223) nf_hook_slow (net/netfilter/core.c:619) _= _ip_local_out (net/ipv4/ip_output.c:120) __tcp_transmit_skb (net/ipv4/tcp_o= utput.c:1715) tcp_connect (net/ipv4/tcp_output.c:4374) tcp_v4_connect (net/= ipv4/tcp_ipv4.c:345) __sys_connect (net/socket.c:2167) Modules linked in: n= f_conntrack_h323 [last unloaded: nf_nat_h323] Reaching the dangling state r= equires CAP_SYS_MODULE in the initial user namespace to remove a NAT helper=
that still has live expectations, so this is a robustness fix; leaving an = expectation pointing at freed text is wrong regardless. Add nf_ct_helper_ex= pectfn_destroy(), which walks the expectation table and drops every expecta= tion whose -&gt;expectfn matches the descriptor being torn down. Call it fr=
om each NAT helper's exit path after the existing RCU grace period, so no e= xpectation outlives the code it points at and no extra synchronize_rcu() is=
introduced. With the fix, the same reproducer runs to completion without t=
he Oops.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53349" target=3D= "_blank" rel=3D"noopener">CVE-2026-53349</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: ASo=
C: wm_adsp: Fix NULL dereference when removing firmware controls In wm_adsp= _control_remove() check that the priv pointer is not NULL before attempting=
to cleanup what it points to. When cs_dsp creates a control it calls wm_ad= sp_control_add_cb() so that wm_adsp can create its own private control data=
. There are two cases where private data is not created: 1. The control is =
a SYSTEM control, so an ALSA control is not created. 2. The codec driver ha=
s registered a control_add() callback that hides the control, so wm_adsp_co= ntrol_add() is not called. When cs_dsp_remove destroys its control list it = calls wm_adsp_control_remove() for each control. But wm_adsp_control_remove=
() was attempting to cleanup the private data pointed to by cs_ctl-&gt;priv=
without checking the pointer for NULL.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53350" target=3D= "_blank" rel=3D"noopener">CVE-2026-53350</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: ris= cv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI Fixes a warning while d= umping core: [54983.546369][ C7] WARNING: [!note_name] fs/binfmt_elf.c:1771=
at elf_core_dump+0x910/0xf68, CPU#7: abort01/31982</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53351" target=3D= "_blank" rel=3D"noopener">CVE-2026-53351</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: sig= nal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() When a mul= ti-threaded process receives a stop signal (e.g., SIGSTOP), do_signal_stop(=
) sets JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME on all threads and sets = signal-&gt;group_stop_count to the number of threads. If one of the threads=
concurrently calls execve(), de_thread() invokes zap_other_threads() to ki=
ll all other threads. zap_other_threads() aborts the pending group stop by = resetting signal-&gt;group_stop_count to 0 and clears the JOBCTL_PENDING_MA=
SK for all other threads. However, it fails to clear the job control flags = for the calling thread. When execve() completes, the calling thread returns=
to user mode and checks for pending signals. Seeing the stale JOBCTL_STOP_= PENDING flag, it calls do_signal_stop(), which invokes task_participate_gro= up_stop(). Since JOBCTL_STOP_CONSUME is still set, it attempts to decrement=
the already-zero signal-&gt;group_stop_count, triggering a warning: sig-&g= t;group_stop_count =3D=3D 0 WARNING: CPU: 1 PID: 6475 at kernel/signal.c:37=
3 task_participate_group_stop+0x215/0x2d0 Call Trace: &lt;TASK&gt; do_signa= l_stop+0x3be/0x5c0 kernel/signal.c:2619 get_signal+0xa8c/0x1330 kernel/sign= al.c:2884 arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337=
exit_to_user_mode_loop+0x8c/0x4d0 kernel/entry/common.c:98 do_syscall_64+0= x33e/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0= x77/0x7f &lt;/TASK&gt; Fix this race condition by clearing the JOBCTL_PENDI= NG_MASK for the calling thread in zap_other_threads(), ensuring it does not=
retain any stale job control state after the thread group is destroyed. Th=
is aligns with other functions that tear down a thread group and abort grou=
p stops, such as zap_process() and complete_signal(), which correctly clear=
these flags for all threads including the current one.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53352" target=3D= "_blank" rel=3D"noopener">CVE-2026-53352</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: hsr=
: Remove WARN_ONCE() in hsr_addr_is_self(). syzbot reported the warning [0]=
in hsr_addr_is_self(), whose assumption is simply wrong. hsr-&gt;self_node=
is cleared in hsr_del_self_node(), which is called from hsr_dellink(). Sin=
ce dev-&gt;rtnl_link_ops-&gt;dellink() is called before unregister_netdevic= e_many(), there is a window when user can find the device but without hsr-&= gt;self_node. Let's remove WARN_ONCE() in hsr_addr_is_self(). [0]: HSR: No = self node WARNING: net/hsr/hsr_framereg.c:39 at hsr_addr_is_self+0x211/0x3f=
0 net/hsr/hsr_framereg.c:39, CPU#0: syz.4.16848/17220 Modules linked in: CP=
U: 0 UID: 0 PID: 17220 Comm: syz.4.16848 Tainted: G L syzkaller #0 PREEMPT_= {RT,(full)} Tainted: [L]=3DSOFTLOCKUP Hardware name: Google Google Compute = Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:hsr_addr_is_= self+0x211/0x3f0 net/hsr/hsr_framereg.c:39 Code: 33 2f 41 0f b7 dd 89 ee 09=
de 31 ff e8 c8 b4 c6 f6 09 dd 74 54 e8 0f b0 c6 f6 31 ed eb 53 e8 06 b0 c6=
f6 48 8d 3d 2f 50 9c 04 &lt;67&gt; 48 0f b9 3a 31 ed eb 42 e8 c1 13 1f 00 =
89 c5 31 ff 89 c6 e8 96 RSP: 0018:ffffc900041c70e0 EFLAGS: 00010283 RAX: ff= ffffff8afdc6ca RBX: ffffffff8afdc4e6 RCX: 0000000000080000 RDX: ffffc900104= 93000 RSI: 0000000000000948 RDI: ffffffff8f9a1700 RBP: 0000000000000001 R08=
: 0000000000000000 R09: 0000000000000000 R10: ffffc900041c71e8 R11: fffff52= 000838e3f R12: dffffc0000000000 R13: ffff888041f9e3c0 R14: ffff888086ee3802=
R15: 0000000000000000 FS: 00007f6fe985d6c0(0000) GS:ffff888126176000(0000)=
knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR=
2: 00007f80bd437dac CR3: 0000000025096000 CR4: 00000000003526f0 DR0: ffffff= ffffffffff DR1: 00000000000001f8 DR2: 0000000000000002 DR3: ffffffffefffff1=
5 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: &lt;TASK&gt; chec= k_local_dest net/hsr/hsr_forward.c:592 [inline] fill_frame_info net/hsr/hsr= _forward.c:728 [inline] hsr_forward_skb+0xa11/0x2a80 net/hsr/hsr_forward.c:= 739 hsr_dev_xmit+0x253/0x370 net/hsr/hsr_device.c:236 __netdev_start_xmit i= nclude/linux/netdevice.h:5368 [inline] netdev_start_xmit include/linux/netd= evice.h:5377 [inline] xmit_one net/core/dev.c:3888 [inline] dev_hard_start_= xmit+0x2df/0x860 net/core/dev.c:3904 __dev_queue_xmit+0x1428/0x3900 net/cor= e/dev.c:4870 neigh_output include/net/neighbour.h:556 [inline] ip_finish_ou= tput2+0xcec/0x10b0 net/ipv4/ip_output.c:237 ip_send_skb net/ipv4/ip_output.= c:1510 [inline] ip_push_pending_frames+0x8b/0x110 net/ipv4/ip_output.c:1530=
raw_sendmsg+0x1547/0x1a50 net/ipv4/raw.c:659 sock_sendmsg_nosec net/socket= .c:787 [inline] __sock_sendmsg net/socket.c:802 [inline] ____sys_sendmsg+0x= 7da/0x9c0 net/socket.c:2698 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2752 __= sys_sendmsg net/socket.c:2784 [inline] __do_sys_sendmsg net/socket.c:2789 [= inline] __se_sys_sendmsg net/socket.c:2787 [inline] __x64_sys_sendmsg+0x1c3= /0x2a0 net/socket.c:2787 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inl= ine] do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL= _64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6feb62ce59 Code: ff c3 66 2e 0f 1=
f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 8=
9 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 &lt;48&gt; 3d 01 f0 ff ff 73 01 c3 48 c7=
c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6fe985d028 EFLAGS: 000002=
46 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f6feb8a6090 R= CX: 00007f6feb62ce59 RDX: 0000000000000000 RSI: 0000200000000000 RDI: 00000= 00000000004 RBP: 00007f6feb6c2d6f R08: 0000000000000000 R09: 00000000000000=
00 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0= 0007f6feb8a6128 R14: 00007f6feb8a6090 R15: 00007ffcf01cc488 &lt;/TASK&gt;</=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53353" target=3D= "_blank" rel=3D"noopener">CVE-2026-53353</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: arm= 64: errata: Mitigate TLBI errata on various Arm CPUs A number of CPUs devel= oped by Arm suffer from errata whereby a broadcast TLBI;DSB sequence may co= mplete before the global observation of writes which are translated by an a= ffected TLB entry. These errata ONLY affect the completion of memory access=
es which have been translated by an invalidated TLB entry, and these errata=
DO NOT affect the actual invalidation of TLB entries. TLB entries are remo= ved correctly. This issue has been assigned CVE ID CVE-2025-10263. To mitig= ate this issue, Arm recommends that software follows any affected TLBI;DSB = sequence with an additional TLBI;DSB, which will ensure that all memory wri=
te effects affected by the first TLBI have been globally observed. The addi= tional TLBI can use any operation that is broadcast to affected CPUs, and t=
he additional DSB can use any option that is sufficient to complete the add= itional TLBI. The ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to = mitigate the issue. Enable this workaround for affected CPUs, and update th=
e silicon errata documentation accordingly. Note that due to the manner in = which Arm develops IP and tracks errata, some CPUs share a common erratum n= umber.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53354" target=3D= "_blank" rel=3D"noopener">CVE-2026-53354</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: net=
: rds: clear i_sends on setup unwind The RDS IB connection teardown path is=
written so it can run during partial startup and on repeated shutdown atte= mpts. It uses NULL pointers to distinguish resources that are still owned f= rom resources that have already been released. When rds_ib_setup_qp() fails=
after allocating i_sends but before allocating i_recvs, the sends_out path=
frees i_sends without clearing the pointer. A later shutdown pass can stil=
l treat that stale pointer as a live send ring allocation. Clear i_sends af= ter vfree() in the error unwind path so the existing shutdown logic continu=
es to use the correct ownership state.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53355" target=3D= "_blank" rel=3D"noopener">CVE-2026-53355</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: drm= /i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct pa=
ge pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO=
and wrong parts of BO would be accessed if non-zero offset is used. Last i= mpacted platform with overlay or cursor planes using phys mapping was Gen3/= 945G/Lakeport. (cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4e= a3aebe6)</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53356" target=3D= "_blank" rel=3D"noopener">CVE-2026-53356</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: Blu= etooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() bt_accep= t_dequeue() unlinks a not-yet-accepted child from the parent accept queue a=
nd release_sock()s it before returning, so the returned sk has no caller re= ference and is unlocked. l2cap_sock_cleanup_listen() walks these children o=
n listening-socket close. A concurrent HCI disconnect drives hci_rx_work -&= gt; l2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and fr= ees the child sk and its l2cap_chan; cleanup_listen() then uses both: BUG: = KASAN: slab-use-after-free in l2cap_sock_kill l2cap_sock_kill / l2cap_sock_= cleanup_listen / __x64_sys_close Freed by: l2cap_conn_del -&gt; l2cap_sock_= close_cb -&gt; l2cap_sock_kill This is distinct from the two fixes already =
in this area: commit e83f5e24da741 ("Bluetooth: serialize accept_q access")=
serialises the accept_q list/poll and takes temporary refs inside bt_accep= t_dequeue(), and CVE-2025-39860 serialises the userspace close()/accept() r= ace by calling cleanup_listen() under lock_sock() in l2cap_sock_release(). = Neither covers l2cap_conn_del() running from hci_rx_work, so this UAF still=
reproduces on current bluetooth/master. Take the reference at the source: = bt_accept_dequeue() does sock_hold() while sk is still locked, before relea= se_sock(); callers sock_put(). cleanup_listen() pins the chan with l2cap_ch= an_hold_unless_zero() under a brief child sk lock (serialising vs l2cap_soc= k_teardown_cb()), drops it before l2cap_chan_lock(), and skips a duplicate = l2cap_sock_kill() on SOCK_DEAD. conn-&gt;lock is not taken here: cleanup_li= sten() runs under the parent sk lock and that would invert conn-&gt;lock -&= gt; chan-&gt;lock -&gt; sk_lock (lockdep). KASAN/SMP: an unprivileged liste= n/close vs HCI-disconnect race produced 12 use-after-free reports per run b= efore this change; 0, and no lockdep report, over 1600+ raced iterations af= ter it on bluetooth/master.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53357" target=3D= "_blank" rel=3D"noopener">CVE-2026-53357</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: Blu= etooth: L2CAP: use chan timer to close channels in cleanup_listen() l2cap_c= han_close() removes the channel from conn-&gt;chan_l, which must be done un= der conn-&gt;lock. cleanup_listen() runs under the parent sk_lock, so acqui= ring conn-&gt;lock would invert the established conn-&gt;lock -&gt; chan-&g= t;lock -&gt; sk_lock order. Instead of calling l2cap_chan_close() directly,=
schedule l2cap_chan_timeout with delay 0 to close the channel asynchronous= ly. The timeout handler already acquires conn-&gt;lock and chan-&gt;lock in=
the correct order. The timer is only armed when chan-&gt;conn is still set=
: if it is already NULL, l2cap_conn_del() has already processed this channe=
l (l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb), so there=
is nothing left to do. If l2cap_conn_del() races in after the timer is arm= ed, __clear_chan_timer() inside l2cap_chan_del() cancels it; if the timer h=
as already fired, the handler returns harmlessly because chan-&gt;conn was = cleared.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53358" target=3D= "_blank" rel=3D"noopener">CVE-2026-53358</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: KVM=
: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2a= f2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN=
") fixed a shadow paging mismatch between stored and computed GFNs; the bug=
could be triggered by changing a PDE mapping from outside the guest, and t= hen deleting a memslot. The rmap_remove() call would miss entries created a= fter the PDE change because the GFN of the leaf SPTE does not match the GFN=
of the struct kvm_mmu_page. A similar hole however remains if the modified=
PDE points to a non-leaf page. In this case the gfn can be made to match, = but the role does not match: the original large 2MB page creates a kvm_mmu_= page with direct=3D1, while the new 4KB needs a kvm_mmu_page with direct=3D=
0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore=
reuses the page. The next step is installing a leaf (4KB) SPTE on the new = path which records an rmap entry under the gfn resolved by the walk. But wh=
en that child is zapped its parent kvm_mmu_page has direct=3D1 and kvm_mmu_= page_get_gfn() computes the gfn for the 4KB page as sp-&gt;gfn + index inst= ead of using sp-&gt;shadowed_translation[] (or sp-&gt;gfns[] in older kerne= ls). It therefore fails to remove the recorded entry. When the memslot is d= ropped the shadow page is freed but the rmap entry survives, as in the scen= ario that was already fixed. Code that later walks that gfn (dirty logging,=
MMU notifier invalidation, and so on) dereferences an sptep that lies in t=
he freed page, causing the use-after-free.</td>
<td>2026-07-04</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53359" target=3D= "_blank" rel=3D"noopener">CVE-2026-53359</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: KVM=
: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB s= pec, when using GHCB v2+ require the software scratch area to reside in the=
GHCB's shared buffer. Note, things like Page State Change (PSC) requests _= rely_ on this behavior, as the guest can't provide a length when making the=
request, i.e. the size of the guest payload is bounded by the size of the = shared buffer. Failure to force usage of the GHCB, and a slew of other flaw=
s, lets a malicious SNP guest corrupt host kernel heap memory, and leak hos=
t heap layout information. setup_vmgexit_scratch() allocates a buffer via k= vzalloc(exit_info_2), where exit_info_2 is guest-controlled. With exit_info= _2=3D24, this yields a 24-byte allocation in kmalloc-cg-32 (32-byte slab ob= jects). The buffer holds an 8-byte psc_hdr followed by 8-byte psc_entry str= ucts, so only entries[0] and entries[1] are in-bounds. snp_begin_psc() vali= dates end_entry against VMGEXIT_PSC_MAX_COUNT (253) but NOT against the act= ual buffer size: idx_end =3D hdr-&gt;end_entry; if (idx_end &gt;=3D VMGEXIT= _PSC_MAX_COUNT) { // checks 253, not buffer snp_complete_psc(svm, ...); ret= urn 1; } for (idx =3D idx_start; idx &lt;=3D idx_end; idx++) { entry_start = =3D entries[idx]; // OOB when idx &gt;=3D 2 The guest sets end_entry=3D10+,=
causing the host to iterate entries[2+] which are OOB into adjacent slab o= bjects. For each OOB entry: - The host reads 8 bytes (OOB READ / info leak = oracle) - If the data passes PSC validation, __snp_complete_one_psc() write=
s cur_page =3D 1 or 512 into the entry (OOB WRITE, sev.c:3806) - If validat= ion fails, the error response reveals whether adjacent memory is zero vs no= n-zero (information disclosure to guest) The guest controls allocation size=
(exit_info_2), entry range (cur_entry/end_entry), and can fire unlimited V= MGEXITs to repeatedly hit different slab positions. By exploiting the varie=
ty of bugs, a malicious SEV-SNP guest can: - OOB read adjacent kmalloc-cg-3=
2 objects (heap layout disclosure) - OOB write cur_page bits into adjacent = objects (heap corruption) - Trigger use-after-free conditions across VMGEXI=
Ts E.g. with KASAN enabled, a single insmod of the PoC guest module produce=
s 73 KASAN reports: BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0= x890 Read of size 8 at addr ffff888219ffb5e0 by task qemu-system-x86/2199 B= UG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890 Write of size 8 =
at addr ffff888351566648 by task qemu-system-x86/2199 The buggy address bel= ongs to the object at ffff888XXXXXXXXX which belongs to the cache kmalloc-c= g-32 of size 32 The buggy address is located N bytes to the right of alloca= ted 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX) Breakdown: 62 slab-= out-of-bounds (reads + writes past allocation) 7 slab-use-after-free 4 use-= after-free All credit to Stan for the wonderful description and reproducer!=
[sean: write changelog]</td>
<td>2026-07-04</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53360" target=3D= "_blank" rel=3D"noopener">CVE-2026-53360</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: af_= unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that u= nix_gc() could run with gc_in_progress being false if the work is scheduled=
while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_= schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_prog= ress) |- gc_in_progress =3D true | `- queue_work() | unix_gc() &lt;--------= --------/ | | |- gc_in_progress =3D true ... `- queue_work() | | `- gc_in_p= rogress =3D false | | unix_gc() &lt;---------------------------------------= ------' | ... /* gc_in_progress =3D=3D false */ | `- gc_in_progress =3D fal=
se unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. = Let's set gc_in_progress to true in unix_gc().</td>
<td>2026-07-04</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53361" target=3D= "_blank" rel=3D"noopener">CVE-2026-53361</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: ipv=
6: account for fraggap on the paged allocation path In __ip6_append_data(),=
when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large f= raglen), alloclen and pagedlen are computed as alloclen =3D fragheaderlen +=
transhdrlen; pagedlen =3D datalen - transhdrlen; datalen already includes = fraggap (datalen =3D length + fraggap). When fraggap is non-zero, this is n=
ot the first skb and transhdrlen is zero. The fraggap bytes carried over fr=
om the previous skb are copied just past the fragment headers in the new sk= b's linear area. The linear area is therefore undersized by fraggap bytes w= hile pagedlen is overstated by the same amount, and the copy writes past sk= b-&gt;end into the trailing skb_shared_info. An unprivileged user can trigg=
er this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. T=
he bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid parti=
al copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data(= )'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL =
to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in th=
is case, making the corruption triggerable. The non-paged branch sets alloc= len to fraglen, which already accounts for fraggap because datalen does. Br= ing the paged branch in line by adding fraggap to alloclen and subtracting =
it from pagedlen. After this adjustment, copy no longer collapses to -fragg=
ap on the paged path, so remove the stale comment describing that old arith= metic. Since a negative copy is no longer expected for a valid MSG_SPLICE_P= AGES case, remove the MSG_SPLICE_PAGES exception from the negative copy che= ck.</td>
<td>2026-07-04</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53362" target=3D= "_blank" rel=3D"noopener">CVE-2026-53362</a></td>
</tr>

<td class=3D"vendor-product">Little Orbit--GameFirst Anti-Cheat</td>
<td>A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.sys` =
in Little Orbit GFAC allows a local attacker to cause a denial of service v=
ia crafted requests that trigger a system crash.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12166" target=3D= "_blank" rel=3D"noopener">CVE-2026-12166</a></td>
</tr>

<td class=3D"vendor-product">Little Orbit--GameFirst Anti-Cheat</td>
<td>The Minifilter communication port for driver `GFAC_Sys_x64.sys` in Litt=
le Orbit GFAC allows a local attacker to access privileged driver functiona= lity via a communication interface that lacks appropriate access restrictio= ns.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12167" target=3D= "_blank" rel=3D"noopener">CVE-2026-12167</a></td>
</tr>

<td class=3D"vendor-product">Little Orbit--GameFirst Anti-Cheat</td>
<td>An improper validation vulnerability for driver `GFAC_Sys_x64.sys` in L= ittle Orbit GFAC allows a local attacker to escalate privileges to SYSTEM a=
nd execute arbitrary code in kernel mode via crafted messages sent through =
a Minifilter communication port.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12168" target=3D= "_blank" rel=3D"noopener">CVE-2026-12168</a></td>
</tr>

<td class=3D"vendor-product">MARKSTOS--CGI::Session::ID::md5</td> <td>CGI::Session::ID::md5 versions before 4.49 for Perl generate predictabl=
e session ids from low-entropy sources. The generate_id method builds the s= ession id from a MD5 digest of the process id, the epoch time, and the buil= t-in rand() function. All three are predictable, low-entropy sources: the P=
ID is drawn from a small range, the epoch time can be guessed or read from = the HTTP Date header, and Perl's rand() is unsuitable for security purposes=
because it is predictable and reversible. An attacker who predicts a sessi=
on id can impersonate the corresponding session and bypass authentication.<=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56016" target=3D= "_blank" rel=3D"noopener">CVE-2026-56016</a></td>
</tr>

<td class=3D"vendor-product">MediaTek, Inc.--MediaTek chipset</td>
<td>In Modem, there is a possible system crash due to improper input valida= tion. This could lead to remote denial of service, if a UE has connected to=
a rogue base station controlled by the attacker, with no additional execut= ion privileges needed. User interaction is not needed for exploitation. Pat=
ch ID: MOLY01826924; Issue ID: MSV-7301.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20457" target=3D= "_blank" rel=3D"noopener">CVE-2026-20457</a></td>
</tr>

<td class=3D"vendor-product">MediaTek, Inc.--MediaTek chipset</td>
<td>In Modem, there is a possible memory corruption due to a missing bounds=
check. This could lead to remote escalation of privilege, if a UE has conn= ected to a rogue base station controlled by the attacker, with no additiona=
l execution privileges needed. User interaction is not needed for exploitat= ion. Patch ID: MOLY01402160; Issue ID: MSV-7298.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20458" target=3D= "_blank" rel=3D"noopener">CVE-2026-20458</a></td>
</tr>

<td class=3D"vendor-product">MediaTek, Inc.--MediaTek chipset</td>
<td>In Modem, there is a possible system crash due to improper input valida= tion. This could lead to remote denial of service, if a UE has connected to=
a rogue base station controlled by the attacker, with no additional execut= ion privileges needed. User interaction is not needed for exploitation. Pat=
ch ID: MOLY01816800; Issue ID: MSV-6842.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20459" target=3D= "_blank" rel=3D"noopener">CVE-2026-20459</a></td>
</tr>

<td class=3D"vendor-product">MediaTek, Inc.--MediaTek chipset</td>
<td>In Modem, there is a possible information disclosure due to improper in= put validation. This could lead to remote information disclosure, if a UE h=
as connected to a rogue base station controlled by the attacker, with no ad= ditional execution privileges needed. User interaction is not needed for ex= ploitation. Patch ID: MOLY01811421; Issue ID: MSV-6788.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20460" target=3D= "_blank" rel=3D"noopener">CVE-2026-20460</a></td>
</tr>

<td class=3D"vendor-product">MediaTek, Inc.--MediaTek chipset</td>
<td>In Modem, there is a possible out of bounds write due to a missing boun=
ds check. This could lead to remote denial of service, if a UE has connecte=
d to a rogue base station controlled by the attacker, with no additional ex= ecution privileges needed. User interaction is not needed for exploitation.=
Patch ID: MOLY01267281 / MOLY01318201; Issue ID: MSV-6486.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20461" target=3D= "_blank" rel=3D"noopener">CVE-2026-20461</a></td>
</tr>

<td class=3D"vendor-product">MediaTek, Inc.--MediaTek chipset</td>
<td>In Telephony, there is a possible memory corruption due to a heap buffe=
r overflow. This could lead to local escalation of privilege if a malicious=
actor has already obtained the System privilege. User interaction is not n= eeded for exploitation. Patch ID: ALPS11006447; Issue ID: MSV-7871.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20462" target=3D= "_blank" rel=3D"noopener">CVE-2026-20462</a></td>
</tr>

<td class=3D"vendor-product">MediaTek, Inc.--MediaTek chipset</td>
<td>In Modem, there is a possible escalation of privilege due to a permissi= ons bypass. This could lead to local escalation of privilege if a malicious=
actor has already obtained the System privilege. User interaction is not n= eeded for exploitation. Patch ID: MOLY01716533; Issue ID: MSV-6309.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20463" target=3D= "_blank" rel=3D"noopener">CVE-2026-20463</a></td>
</tr>

<td class=3D"vendor-product">MIK--CryptX</td>
<td>CryptX versions before 0.088_001 for Perl compare AEAD authentication t= ags in non-constant time in the streaming decrypt_done path. The decrypt_do= ne($tag) form compares it against the computed tag with memNE (memcmp() !=
=3D 0), which short-circuits on the first differing byte, so its run time d= epends on the number of matching leading bytes. This affects all five AEAD = modes: GCM, CCM, ChaCha20Poly1305, EAX and OCB. The one-shot *_decrypt_veri=
fy helpers are unaffected; they verify the tag inside libtomcrypt with a co= nstant-time comparison. The timing difference is a tag-verification oracle.=
An attacker who can submit many candidate tags for the same nonce, ciphert= ext and associated data while measuring the timing precisely enough may rec= over the expected tag byte by byte and forge a message that verifies.</td> <td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13758" target=3D= "_blank" rel=3D"noopener">CVE-2026-13758</a></td>
</tr>

<td class=3D"vendor-product">mlflow--mlflow/mlflow</td>
<td>In MLflow versions prior to 3.14.0, when running with authentication en= abled, the trace API endpoints lack proper authorization validators. This a= llows any authenticated user to bypass experiment-level authorization contr= ols on all trace operations, including reading, deleting, and modifying tra= ces on experiments they do not have permission to access. The issue arises = from the `_before_request` handler, which does not register authorization v= alidators for trace endpoints, resulting in requests proceeding without val= idation. This vulnerability can expose sensitive data, destroy audit logs, = and allow unauthorized modifications.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8147" target=3D"= _blank" rel=3D"noopener">CVE-2026-8147</a></td>
</tr>

<td class=3D"vendor-product">Mozilla--Firefox</td>
<td>Memory safety bugs present in Firefox 152.0.3. Some of these bugs showe=
d evidence of memory corruption and we presume that with enough effort some=
of these could have been exploited to run arbitrary code. This vulnerabili=
ty was fixed in Firefox 152.0.4.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14241" target=3D= "_blank" rel=3D"noopener">CVE-2026-14241</a></td>
</tr>

<td class=3D"vendor-product">Mozilla--Thunderbird</td>
<td>A malicious LDAP server, which a Thunderbird user is configured to quer=
y for address-book autocomplete, can stash arbitrarily large amounts of att= acker-supplied data into the Thunderbird LDAP client until it crashes due t=
o memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 an=
d Thunderbird 140.12.1.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57962" target=3D= "_blank" rel=3D"noopener">CVE-2026-57962</a></td>
</tr>

<td class=3D"vendor-product">Mozilla--Thunderbird</td>
<td>An attacker who can send HTML chat messages (via Matrix or XMPP) can in= ject arbitrary styled content, phishing links, and CSS that manipulates the=
chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbi=
rd 140.12.1.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57963" target=3D= "_blank" rel=3D"noopener">CVE-2026-57963</a></td>
</tr>

<td class=3D"vendor-product">MyComplianceOffice--MCO</td>
<td>MCO does not properly enforce authorization checks in the /customer/ser= vlet/mco/webapi/profile-sections/group-membership endpoint. An authenticate=
d user can modify their group membership without proper authorization check=
s, allowing privilege escalation. An attacker can add themselves to arbitra=
ry groups by supplying a valid group ID, which can be obtained via other ap= plication functionalities (e.g.=C2=A0/customer/servlet/mco/webapi/group/pic= ker/groups), provided he has necessary permissions, or potentially inferred=
through brute-force techniques. Because vendor contact attempts were unsuc= cessful, the vulnerability has only been confirmed in version 25.3.3.1=C2= =A0but may also affect other versions.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53902" target=3D= "_blank" rel=3D"noopener">CVE-2026-53902</a></td>
</tr>

<td class=3D"vendor-product">MyComplianceOffice--MCO</td>
<td>MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnera= bility in the /customer/servlet/mco/webapi/trading-document/fetchPdfStateme=
nt endpoint. The application does not properly validate whether an authenti= cated user is authorized to access a requested document, allowing direct re= trieval based on a user-supplied identifier. An attacker can access trading=
documents belonging to other users by providing a valid document ID. Altho= ugh exploitation requires guessing the identifier, predictable ID patterns = enable feasible enumeration, leading to unauthorized disclosure of sensitiv=
e information. Because vendor contact attempts were unsuccessful, the vulne= rability has only been confirmed in version 25.3.3.1=C2=A0but may also affe=
ct other versions.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53903" target=3D= "_blank" rel=3D"noopener">CVE-2026-53903</a></td>
</tr>

<td class=3D"vendor-product">MyComplianceOffice--MCO</td>
<td>MCO is vulnerable to Account Denial of Service due to improper implemen= tation of password reset functionality. Each password reset request invalid= ates previously set password as well as previously issued temporary passwor= ds, furthermore, password resets are not limited in any way. An attacker wh=
o provides victim's email and answer to their security question, can succes= sfully initiate the reset process and continuously invalidate credentials, = effectively locking the victim out of their account. Answering security que= stions has a limited number of tries which lowers the risk of this vulnerab= ility. Because vendor contact attempts were unsuccessful, the vulnerability=
has only been confirmed in version 25.3.3.1=C2=A0but may also affect other=
versions.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53904" target=3D= "_blank" rel=3D"noopener">CVE-2026-53904</a></td>
</tr>

<td class=3D"vendor-product">MyComplianceOffice--MCO</td>
<td>MCO does not properly enforce authorization checks in the /customer/ser= vlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An au= thenticated, low-privileged user can retrieve administrator access control = structures without proper authorization checks. This may expose sensitive p= ermission mappings and internal configuration details. Because vendor conta=
ct attempts were unsuccessful, the vulnerability has only been confirmed in=
version 25.3.3.1=C2=A0but may also affect other versions.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53905" target=3D= "_blank" rel=3D"noopener">CVE-2026-53905</a></td>
</tr>

<td class=3D"vendor-product">MyComplianceOffice--MCO</td>
<td>MCO is vulnerable to Path Disclosure and Path Traversal in file handlin=
g functionality related to data export and upload. Improper validation of t=
he filename parameter allows writing files to arbitrary locations as well a=
s indirect disclosure of absolute server paths through error messages. Beca= use vendor contact attempts were unsuccessful, the vulnerability has only b= een confirmed in version 25.3.3.1=C2=A0but may also affect other versions.<=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53906" target=3D= "_blank" rel=3D"noopener">CVE-2026-53906</a></td>
</tr>

<td class=3D"vendor-product">MyComplianceOffice--MCO</td>
<td>MCO is vulnerable to Stored Cross-Site Scripting (XSS) via the applicat= ion logo upload functionality. An attacker with the ability to change the a= pplication logo can upload a crafted SVG file containing malicious JavaScri=
pt code that is executed when the logo is rendered or opened. Because vendo=
r contact attempts were unsuccessful, the vulnerability has only been confi= rmed in version 25.3.3.1=C2=A0but may also affect other versions.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53907" target=3D= "_blank" rel=3D"noopener">CVE-2026-53907</a></td>
</tr>

<td class=3D"vendor-product">MyComplianceOffice--MCO</td>
<td>MCO is vulnerable to User Enumeration through authentication-related fu= nctionalities. The application returns distinguishable responses for valid = and invalid users during username reminder and password reset operations. A=
n attacker can leverage these differences to enumerate valid usernames and = email addresses. Because vendor contact attempts were unsuccessful, the vul= nerability has only been confirmed in version 25.3.3.1=C2=A0but may also af= fect other versions.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53908" target=3D= "_blank" rel=3D"noopener">CVE-2026-53908</a></td>
</tr>

<td class=3D"vendor-product">MyComplianceOffice--MCO</td>
<td>MCO does not correctly validate types of uploaded files. File upload va= lidation functionality relies only on client-side checks, which can be bypa= ssed. An authorized, low-privileged attacker can upload files with arbitrar=
y types to the server. Because vendor contact attempts were unsuccessful, t=
he vulnerability has only been confirmed in version 25.3.3.1=C2=A0but may a= lso affect other versions.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53909" target=3D= "_blank" rel=3D"noopener">CVE-2026-53909</a></td>
</tr>

<td class=3D"vendor-product">myvesta--vesta</td>
<td>myVesta is affected by an authenticated remote code execution vulnerabi= lity. Low privileged users can insert arbitrary commands as a part of the v= _ftp_user parameter when deleting FTP usernames. This could result in the e= xecution of commands as the admin user or takevoer of the admin user in myV= esta.</td>
<td>2026-07-04</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12195" target=3D= "_blank" rel=3D"noopener">CVE-2026-12195</a></td>
</tr>

<td class=3D"vendor-product">NetScaler--ADC</td>
<td>Arbitrary File Read (Unauthenticated) in=C2=A0NetScaler ADC and NetScal=
er Gateway if the access to NSIP, Cluster Management IP or SNIP with manage= ment access is enabled</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10816" target=3D= "_blank" rel=3D"noopener">CVE-2026-10816</a></td>
</tr>

<td class=3D"vendor-product">NetScaler--ADC</td>
<td>Insufficient input validation leading to memory overread in=C2=A0NetSca= ler ADC and NetScaler Gateway if the=C2=A0TCP TimeStamp is enabled in TCP P= rofile and is associated with the virtual server (of type LB, CS, VPN) or t=
he service configured on NetScaler</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10817" target=3D= "_blank" rel=3D"noopener">CVE-2026-10817</a></td>
</tr>

<td class=3D"vendor-product">NetScaler--ADC</td>
<td>Denial of service via malformed HTTP/2 requests in=C2=A0NetScaler ADC a=
nd NetScaler Gateway=C2=A0if=C2=A0HTTP/2 is enabled in HTTP Profile and ass= ociated with the virtual server (of type LB, CS, VPN) or the service config= ured on NetScaler</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13474" target=3D= "_blank" rel=3D"noopener">CVE-2026-13474</a></td>
</tr>

<td class=3D"vendor-product">NetScaler--ADC</td>
<td>Insufficient input validation in=C2=A0NetScaler ADC and NetScaler Gatew= ay=C2=A0leading to memory overread if=C2=A0NetScaler ADC or NetScaler Gatew=
ay is configured as a SAML IDP</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8451" target=3D"= _blank" rel=3D"noopener">CVE-2026-8451</a></td>
</tr>

<td class=3D"vendor-product">NetScaler--ADC</td>
<td>Memory overflow vulnerability=C2=A0NetScaler ADC and NetScaler Gateway= =C2=A0leading to unpredictable or erroneous behavior and Denial of Service =
if the appliance is configured as a=C2=A0Gateway (SSL VPN, ICA Proxy, CVPN,=
RDP Proxy) or AAA virtual server</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8452" target=3D"= _blank" rel=3D"noopener">CVE-2026-8452</a></td>
</tr>

<td class=3D"vendor-product">NetScaler--ADC</td>
<td>Multiple Memory overflow vulnerabilities in=C2=A0NetScaler ADC and NetS= caler Gateway=C2=A0leading to unpredictable or erroneous behavior and Denia=
l of Service if=C2=A0NetScaler ADC is configured as an LB of type Oracle=C2= =A0OR=C2=A0NetScaler ADC is configured as a DNS Proxy=C2=A0OR=C2=A0NetScale=
r ADC is configured as a DNS recursive resolver deployment</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8655" target=3D"= _blank" rel=3D"noopener">CVE-2026-8655</a></td>
</tr>

<td class=3D"vendor-product">nltk--nltk/nltk</td>
<td>NLTK version 3.9.4 is vulnerable to a path traversal attack due to an i= ncomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in=
`nltk/data.py` checks for literal `../` sequences but fails to account for=
percent-encoded traversal sequences such as `..%2f`. The `url2pathname()` = function decodes these sequences after the validation step, allowing an att= acker to bypass the protection. This vulnerability enables an attacker to r= ead arbitrary files accessible to the Python process by controlling the res= ource name parameter passed to `nltk.data.load()` or `nltk.data.find()`. Th=
e issue affects applications that rely on NLTK for resource loading, includ= ing NLP web applications, Jupyter notebooks, and CLI tools. The default `pa= thsec.ENFORCE=3DFalse` setting exacerbates the impact by not blocking the f= ile read at the `open()` stage.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12243" target=3D= "_blank" rel=3D"noopener">CVE-2026-12243</a></td>
</tr>

<td class=3D"vendor-product">nltk--nltk/nltk</td>
<td>In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classe=
s (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependency= Parser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR=
code execution. These classes accept user-controllable JAR paths and execu=
te them via the `java()` function, which invokes `subprocess.Popen()` witho=
ut integrity verification. This vulnerability is identical to CVE-2026-0848=
, which was fixed for StanfordSegmenter by adding SHA256 verification. Howe= ver, the fix was not applied to these additional classes, leaving them susc= eptible to arbitrary code execution when loading untrusted JAR files.</td> <td>2026-07-04</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12252" target=3D= "_blank" rel=3D"noopener">CVE-2026-12252</a></td>
</tr>

<td class=3D"vendor-product">Nokia--MantaRay NM</td>
<td>Nokia MantaRay NM is subject to an unrestricted file upload vulnerabili=
ty due to insufficient file type validation. Successful exploitation could = allow an authenticated attacker to upload malicious files onto the system.<=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-24815" target=3D= "_blank" rel=3D"noopener">CVE-2025-24815</a></td>
</tr>

<td class=3D"vendor-product">Nokia--MantaRay NM</td>
<td>Nokia MantaRay is subject to an Improper Access Control vulnerability d=
ue to insufficient authorization within the API. Successful exploitation co= uld allow an authenticated attacker to retrieve confidential information be= yond their assigned privileges.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-24816" target=3D= "_blank" rel=3D"noopener">CVE-2025-24816</a></td>
</tr>

<td class=3D"vendor-product">Nokia--MantaRay NM</td>
<td>Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerab= ility where a local attacker possessing administrative (local admin) privil= eges can escalate to full root privileges on the host. Successful exploitat= ion results in root-level access to the filesystem and the ability to execu=
te actions as root. The risk can be temporarily mitigated by restricting th=
e set of commands permitted via sudo for the affected accounts.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-7406" target=3D"= _blank" rel=3D"noopener">CVE-2025-7406</a></td>
</tr>

<td class=3D"vendor-product">Notepad3--Notepad3</td>
<td>Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulne= rability in the About-dialog code path in src/Notepad3.c. The application c= alls LoadLibrary(L"MSFTEDIT.DLL") with a bare DLL name, which allows a loca=
l attacker to place a malicious MSFTEDIT.DLL in the application directory o=
r another preferred DLL search location and achieve arbitrary code executio=
n in the context of the user when the About dialog is opened.</td> <td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-38972" target=3D= "_blank" rel=3D"noopener">CVE-2026-38972</a></td>
</tr>

<td class=3D"vendor-product">ntopng--ntopng</td>
<td>ntopng through 6.6 is vulnerable to Predictable Session Identifier whic=
h can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver= .cpp use weak time-seeded pseudo-randomness during session creation. As a r= esult, fresh authenticated logins can receive deterministic or colliding se= ssion cookies under attacker-controlled timing.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-38968" target=3D= "_blank" rel=3D"noopener">CVE-2026-38968</a></td>
</tr>

<td class=3D"vendor-product">ohler55--oj</td>
<td>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as =
a Ruby gem. In versions prior to 3.17.2, Oj.dump is vulnerable to a stack-b= ased buffer overflow when a large :indent value is provided by the develope=
r. fill_indent in dump.h calls memset(indent_str, ' ', (size_t)opts-&gt;ind= ent) without validating the size. When opts-&gt;indent is set to INT_MAX (2= ,147,483,647), the (size_t) cast preserves the large value and memset write=
s 2 GB into the stack-allocated out buffer (4,184 bytes), corrupting the st= ack and crashing the process. This issue has been fixed in version 3.17.2.<=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54502" target=3D= "_blank" rel=3D"noopener">CVE-2026-54502</a></td>
</tr>

<td class=3D"vendor-product">ohler55--oj</td>
<td>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as =
a Ruby gem. In versions prior to 3.17.2, when in object mode, Oj.dump is vu= lnerable to a heap buffer overflow when serializing Exception objects with =
a large :indent value. The serializer allocates a buffer sized for the obje= ct's attributes but does not account for the indent bytes added on each wri= te. With indent: 5000, the accumulation of 5,000-byte indent strings overfl= ows the 13,150-byte heap allocation, corrupting adjacent heap memory. This = issue has been fixed in version 3.17.2.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54896" target=3D= "_blank" rel=3D"noopener">CVE-2026-54896</a></td>
</tr>

<td class=3D"vendor-product">ohler55--oj</td>
<td>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as =
a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, eac= h_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded=
during iteration calls doc.close or d.close, the document's heap memory is=
freed while the C iterator is still running. When control returns from the=
block, the iterator reads from the freed region, producing a use-after-fre=
e accessible from pure Ruby. This issue has been fixed in version 3.17.2.</=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54897" target=3D= "_blank" rel=3D"noopener">CVE-2026-54897</a></td>
</tr>

<td class=3D"vendor-product">ohler55--oj</td>
<td>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as =
a Ruby gem. In versions prior to 3.17.2,Oj::Parser#parse is vulnerable to a=
heap use-after-free when a SAJ/SAJ2 callback mutates the input JSON string=
during parsing. The C engine holds a raw const byte * pointer into the Rub=
y string's internal buffer. If a callback (e.g. hash_start) resizes the str= ing - for example by calling String#replace with a longer value - Ruby real= locates the string buffer and frees the old one. The C parser's pointer is = left dangling; the next character read at parser.c:607 is a use-after-free.=
This issue has been fixed in version 3.17.2.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54898" target=3D= "_blank" rel=3D"noopener">CVE-2026-54898</a></td>
</tr>

<td class=3D"vendor-product">ohler55--oj</td>
<td>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as =
a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::= Parser instance triggers a heap use-after-free. When symbol_keys is toggled=
from true to false, opt_symbol_keys_set frees the internal key cache (cach= e_free) but does not clear the pointer. The next parse call reads from the = freed cache via cache_intern, producing a use-after-free. This issue has be=
en fixed in version 3.17.2.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54899" target=3D= "_blank" rel=3D"noopener">CVE-2026-54899</a></td>
</tr>

<td class=3D"vendor-product">ohler55--oj</td>
<td>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as =
a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id = enabled, Oj::Parser#parse is vulnerable to heap corruption via a negative-s= ize memcpy. When a JSON object key is exactly 65,535 bytes long, an integer=
truncation in form_attr (usual.c:63) converts the length to -1 before pass= ing it to memcpy. This causes memcpy to copy SIZE_MAX bytes (interpreted as=
a huge size_t), corrupting heap memory and crashing the process. The issue=
has been fixed in version 3.17.2.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54900" target=3D= "_blank" rel=3D"noopener">CVE-2026-54900</a></td>
</tr>

<td class=3D"vendor-product">ohler55--oj</td>
<td>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as =
a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not = mark array_class and hash_class references during garbage collection, leadi=
ng to Use-After-Free. If GC runs after the class is assigned but before a p= arse, the class object is reclaimed, leaving the parser holding a dangling = VALUE. The subsequent parse call dereferences the freed object, producing a=
segfault. This issue has been fixed in version 3.17.2.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54901" target=3D= "_blank" rel=3D"noopener">CVE-2026-54901</a></td>
</tr>

<td class=3D"vendor-product">ohler55--oj</td>
<td>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as =
a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when i=
n SAJ mode. The Oj::Parser does not protect cached object keys (=C3=A2=E2= =80=B0=C2=A5 35 bytes) from garbage collection, and a Ruby callback that tr= iggers GC inside hash_end can cause the key string to be reclaimed while th=
e C parser still holds a pointer to it. The subsequent access to the freed = string VALUE results in a segfault, confirmed by an RIP pointing to address=
0x4242 (a canary-style pattern suggesting control over the freed memory's = content). This issue has been fixed in version 3.17.2.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54902" target=3D= "_blank" rel=3D"noopener">CVE-2026-54902</a></td>
</tr>

<td class=3D"vendor-product">ohler55--oj</td>
<td>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as =
a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corr= uption when parsing a JSON string longer than 2 GB. An integer overflow in = buf_append_string (buf.h:61) converts the string length to a large negative=
size_t, causing memcpy to copy an astronomically large amount of data out =
of bounds. This crashes the process and can corrupt adjacent heap memory. T=
he issue has been fixed in version 3.17.2.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54903" target=3D= "_blank" rel=3D"noopener">CVE-2026-54903</a></td>
</tr>

<td class=3D"vendor-product">OpenIDC--liboauth2</td>
<td>liboauth2 is vulnerable to Server-Side Request Forgery in=C2=A0oauth2_j= ose_jwks_aws_alb_resolve() function.=C2=A0The AWS ALB verifier reads both s= igner and kid from the unverified JWT header. If signer matches the configu= red ARN, kid is appended to alb_base_url without URL encoding or path sanit= ization, and the HTTP GET is issued before signature verification. This all= ows an attacker to force the server to send a GET request to an attacker-ch= osen internal path. This issue was fixed in version 2.3.0</td> <td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54430" target=3D= "_blank" rel=3D"noopener">CVE-2026-54430</a></td>
</tr>

<td class=3D"vendor-product">OpenIDC--liboauth2</td>
<td>In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier acce= pts a proof whose JSON Web Key (jwk) header contains private key=C2=A0mater= ial. RFC 9449 section 4.3 step 7 requires the verifier to reject=C2=A0such =
a proof but=C2=A0oauth2_token_verify() function returns success for a malfo= rmed DPoP=C2=A0proof that embeds the private Elliptic Curve (EC) key in the=
header. This issue was fixed in version 2.3.0</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54431" target=3D= "_blank" rel=3D"noopener">CVE-2026-54431</a></td>
</tr>

<td class=3D"vendor-product">pdfcpu--pdfcpu</td>
<td>pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-ser= vice issue in pkg/pdfcpu/model/parse.go. The parser descends recursively th= rough nested PDF objects, including arrays, via ParseObjectContext() and pa= rseArray() without enforcing a maximum nesting depth.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-38970" target=3D= "_blank" rel=3D"noopener">CVE-2026-38970</a></td>
</tr>

<td class=3D"vendor-product">Perforce--Puppet Core</td>
<td>Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2= 023.8.x and 2025.x) does not preserve the sensitive flag on parameters defi= ned via the resource-api, causing values such as passwords to be stored in = cleartext in the agent's local transaction state cache. Affected versions o=
f the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.= 0.0 The issue was fixed in puppet resource_api=C2=A01.9.2 and 2.0.1 release=
d with Puppet Core 8.20.0 and PE 2023.8.10 &amp; PE 2025.11.0.</td> <td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8804" target=3D"= _blank" rel=3D"noopener">CVE-2026-8804</a></td>
</tr>

<td class=3D"vendor-product">phpipam--phpipam</td>
<td>PHPIPAM is affected by an authenticated local file inclusion vulnerabil= ity that allows users with access to the API to execute/include arbitrary P=
HP files on the web server's file system. The API is not enabled by default=
on installations.</td>
<td>2026-07-04</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12194" target=3D= "_blank" rel=3D"noopener">CVE-2026-12194</a></td>
</tr>

<td class=3D"vendor-product">Picklescan--Picklescan</td>
<td>Picklescan before 0.0.25 fails to detect unsafe global functions in the=
Numpy library, allowing attackers to bypass static analysis and execute ar= bitrary code during deserialization. Attackers can craft malicious pickle f= iles using numpy.testing._private.utils.runstring within the reduce method =
to import dangerous libraries like os and execute arbitrary OS commands whe=
n the pickle file is loaded.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71355" target=3D= "_blank" rel=3D"noopener">CVE-2025-71355</a></td>
</tr>

<td class=3D"vendor-product">pion--dtls</td>
<td>Pion DTLS is a Go implementation of Datagram Transport Layer Security. = Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via pani=
c while parsing a crafted ECDHE_PSK ServerKeyExchange message. This issue h=
as been fixed in version 3.1.4.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54908" target=3D= "_blank" rel=3D"noopener">CVE-2026-54908</a></td>
</tr>

<td class=3D"vendor-product">Pivotal --CRM 6.6.4.08</td>
<td>An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-= 502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.z= ip) allows a remote attacker to execute arbitrary code via the Pivotal.Engi= ne.Client.Services.Conversion.dll component. NOTE: this issue exists becaus=
e of an incomplete fix for CVE-2026-39253.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-51947" target=3D= "_blank" rel=3D"noopener">CVE-2026-51947</a></td>
</tr>

<td class=3D"vendor-product">pretix--pretix</td>
<td>We found a chain of combining multiple weaknesses in the product that c= ould allow an attacker to become any user in the backend and access any dat=
a: * The payment integration plugins Stripe (included in the core system), = pretix-mollie, pretix-oppwa, pretix-bitpay, pretix-payone, pretix-secuconne= ct, pretix-sofort, and pretix-saferpay contain a code path that is intended=
for the transport of session parameters from a tab with isolated cookies (= e.g. in the pretix widget) to a new tab. For this purpose, a set of session=
parameters is cryptographically signed and then passed to the new tab as a=
URL parameter. The plugins perform no further validation of the session pa= rameters, other than the cryptographic signature being valid. This is fixed=
with the releases issued today by strictly validating that no session para= meters outside of the scope of the respective plugin may be set. * An unrel= ated feature in the core system is used to generate redirect links that obf= uscate any Referer headers for outgoing links to prevent leakage of secrets=
in URLs. This redirect page also requires cryptographically signed paramet= ers. Unfortunately, it uses the same key and salt for the signature as the = previously mentioned feature in the payment integration plugins. A motivate=
d attacker with access to at least one event in the backend can trick the s= ystem into cryptographically signing arbitrary content using specially craf= ted links. In combination with the previous issue, the attacker could use t= his to set and modify arbitrary parameters on their user session by injecti=
ng the signed parameters into the feature of the payment providers. This is=
fixed with the releases issued today by using different salts for the sign= ature for each plugin and feature. * A third, unrelated feature in the core=
system is used for admin users to act on behalf of another user, mostly fo=
r debugging purposes. With being able to insert arbitrary parameters into a=
session, an attacker can abuse this feature to change their session from t= heir actual user to any user in the system by guessing a valid user ID. Thi=
s is fixed with the release today by requiring unguessable information to b=
e contained in the session of the user to switch to.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13602" target=3D= "_blank" rel=3D"noopener">CVE-2026-13602</a></td>
</tr>

<td class=3D"vendor-product">pretix--pretix-oppwa</td>
<td>The payment integration pretix-oppwa provides support for the payment p= roviders VR Payment, Hobex, and potentially others based on Oppwa's technol= ogy. The integration of Oppwa, following their official documentation, incl= udes a step where the user is redirected from the payment provider back to = our system with a query parameter like ?resourcePath=3D/v1/checkouts/{check= outId}/payment in the URL. Our system is then supposed to fetch the status =
of the transaction from the URL given by baseUrl + resourcePath. Our plugin=
pretix-oppwa did so insecurely by concatenating the parameter form the URL=
to the base domain of the API without further validation and, critically, = without a / at the end of the baseUrl. Therefore, an attacker could inject =
a resourcePath argument in a way that causes pretix to call a different ser= ver instead. Since the request includes the access token (API key) of the O= ppwa account, this would leak the access token, giving access to data conta= ined in the payment provider's system. This is fixed with the release today=
by strictly validating the given API URL. After installing the update, we = recommend asking your payment provider for a new access token and updating =
it in pretix.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13603" target=3D= "_blank" rel=3D"noopener">CVE-2026-13603</a></td>
</tr>

<td class=3D"vendor-product">Progress Software--Flowmon</td>
<td>In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerabili=
ty exists whereby an authenticated low-privileged user may craft a request = during the PDF generation process that results in operations being performe=
d with the privileges of another user, potentially leading to unauthorized = access to sensitive data and unintended modifications to system configurati= on.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8079" target=3D"= _blank" rel=3D"noopener">CVE-2026-8079</a></td>
</tr>

<td class=3D"vendor-product">Progress Software--Flowmon ADS</td>
<td>In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerab= ility exists whereby an adversary who is authenticated as a low-privileged = user in the Anomaly Detection System (ADS) may send specially crafted reque= sts that could result in unauthorized access to application data and its mo= dification.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9272" target=3D"= _blank" rel=3D"noopener">CVE-2026-9272</a></td>
</tr>

<td class=3D"vendor-product">py-pdf--pypdf</td>
<td>pypdf is a free and open-source pure-python PDF library. Prior to 6.13.=
3, a maliciously crafted PDF can cause DoS. An attacker who uses this vulne= rability can craft a PDF which leads to large memory usage, as MAX_DECLARED= _STREAM_LENGTH is sometimes ignored. This requires parsing a content stream=
without a /Length value. This issue has been fixed in version 6.13.3.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57204" target=3D= "_blank" rel=3D"noopener">CVE-2026-57204</a></td>
</tr>

<td class=3D"vendor-product">Python Software Foundation--CPython</td>
<td>In the Tarfile.extract() function, the filter parameter is not passed p= roperly when extracting hardlinks. An affected system that extracts content=
from untrusted tar files could end up writing files with an unexpected uid= /gid despite the user passing filter=3D'data' to the extract() function.</t=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4360" target=3D"= _blank" rel=3D"noopener">CVE-2026-4360</a></td>
</tr>

<td class=3D"vendor-product">Raytha--Raytha</td>
<td>Raytha CMS is vulnerable to SQL Injection within the OData filter parsi=
ng pipeline.=C2=A0 The vulnerability allows a remote, unauthenticated attac= ker to execute arbitrary SQL statements against the underlying PostgreSQL d= atabase, leading to full database compromise, including credential extracti= on. Because vendor contact attempts were unsuccessful, the vulnerability ha=
s only been confirmed in version=C2=A01.5.2 but may also affect other versi= ons.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12076" target=3D= "_blank" rel=3D"noopener">CVE-2026-12076</a></td>
</tr>

<td class=3D"vendor-product">Redeight--Redeight CMS</td>
<td>An SQL Injection vulnerability exists in Redeight CMS version 1.0 via t=
he "userEmail" parameter in the POST "/admin/index.php" login endpoint. The=
application fails to sanitize user input and directly interpolates it into=
SQL queries without using prepared statements, which allows unauthenticate=
d remote attackers to execute arbitrary SQL commands and extract sensitive = database information.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53690" target=3D= "_blank" rel=3D"noopener">CVE-2026-53690</a></td>
</tr>

<td class=3D"vendor-product">Redeight--Redeight CMS</td>
<td>An Unrestricted File Upload vulnerability in Redeight CMS version 1.0 a= llows authenticated attackers to achieve Remote Code Execution via the POST=
"/admin/index.php?module=3Dpages&amp;mode=3DFileAdd" endpoint. The applica= tion fails to validate file extensions and MIME types, permitting the uploa=
d of arbitrary PHP scripts to the publicly accessible "/uploads/files/" dir= ectory where they can be executed directly by the web server.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53691" target=3D= "_blank" rel=3D"noopener">CVE-2026-53691</a></td>
</tr>

<td class=3D"vendor-product">Redeight--Redeight CMS</td>
<td>Redeight CMS version 1.0 uses the MD5 algorithm without a salt to store=
user passwords. Because MD5 is a cryptographically broken algorithm and la= cks salting, attackers who obtain the password hashes can trivially reverse=
them using rainbow tables, leading to the exposure of plaintext credential= s.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53692" target=3D= "_blank" rel=3D"noopener">CVE-2026-53692</a></td>
</tr>

<td class=3D"vendor-product">Ricoh Company, Ltd.--Multiple laser printers a=
nd MFPs which implement Ricoh Web Image Monitor</td>
<td>Multiple laser printers and MFPs (multifunction printers) which impleme=
nt Ricoh Web Image Monitor contain a reflected cross-site scripting vulnera= bility. An arbitrary script may be executed on the web browser of the user = who accesses Web Image Monitor.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56809" target=3D= "_blank" rel=3D"noopener">CVE-2026-56809</a></td>
</tr>

<td class=3D"vendor-product">Roskus--Prospero Flow CRM</td>
<td>Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarD= eleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventCont= roller.php), exposed at GET /calendar/event/delete/{id}, in Prospero Flow C=
RM before 5.5.3 allows a remote, authenticated attacker to delete arbitrary=
calendar events belonging to other users by manipulating the {id} path par= ameter, because the delete handler resolves the record with Calendar::find(= $id)-&gt;delete() and performs no ownership check (no user_id/company_id sc= oping) before deletion. This results in unauthorized destruction of other u= sers' calendar events across the platform.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59234" target=3D= "_blank" rel=3D"noopener">CVE-2026-59234</a></td>
</tr>

<td class=3D"vendor-product">ruby--webrick</td>
<td>ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length int=
o canonical request state, enabling request smuggling.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-38969" target=3D= "_blank" rel=3D"noopener">CVE-2026-38969</a></td>
</tr>

<td class=3D"vendor-product">SamVerschueren--decode-uri-component</td> <td>decode-uri-component through 0.4.1 is vulnerable to denial of service. = The decode() function splits input on '%' producing N tokens and calls deco= deComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens take=
s approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approxim= ately 33s. An attacker can cause significant CPU consumption and event-loop=
blocking via crafted input.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-45822" target=3D= "_blank" rel=3D"noopener">CVE-2026-45822</a></td>
</tr>

<td class=3D"vendor-product">SANKO--Net::BitTorrent</td>
<td>Net::BitTorrent versions through 2.0.1 for Perl write files outside the=
download directory via path traversal in peer-supplied metadata. Net::BitT= orrent validates file path components only on the .torrent-file ingest path=
. The peer and magnet metadata path (_on_metadata_received, reached from th=
e BEP09 ut_metadata extension) passes attacker-supplied file names straight=
to Storage::add_file and Storage::_parse_file_tree, where Path::Tiny's chi= ld() does not collapse "..". A v2 file tree key, a v1 files[].path element,=
or a single-file name containing ".." segments therefore resolves outside = the download directory. Because the peer also controls the piece hashes and=
the served bytes, content verification passes, so a malicious magnet or pe=
er writes attacker-chosen content to an attacker-chosen path on the downloa= ding host.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57079" target=3D= "_blank" rel=3D"noopener">CVE-2026-57079</a></td>
</tr>

<td class=3D"vendor-product">SANKO--Net::BitTorrent</td>
<td>Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exh= austion via an uncapped peer-wire message-length prefix. The peer-wire fram= ing in _process_messages trusts the 4-byte length prefix sent by a connecte=
d peer with no upper bound, while receive_data appends every inbound byte t=
o the input buffer. A peer announces a length prefix of up to about 4 GiB a=
nd then streams bytes; the decoder waits until the buffer holds the full me= ssage before processing it, so the buffer grows without limit. Peer connect= ions are unauthenticated, so any peer in the swarm exhausts the downloading=
process's memory. The largest legitimate message is a 16 KiB piece block, =
so any announced length far above that is anomalous.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57080" target=3D= "_blank" rel=3D"noopener">CVE-2026-57080</a></td>
</tr>

<td class=3D"vendor-product">SANKO--Net::BitTorrent</td>
<td>Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exh= austion via deeply nested bencoded input. bdecode recurses once per nested = list or dictionary level with no depth cap, and each recursive call receive=
s the remaining buffer by value while the list and dictionary branches capt= ure the whole remainder, so every live recursion frame keeps its own copy o=
f the shrinking buffer (O(N^2) bytes for an N-deep input). The decoder runs=
on every untrusted bencode source: .torrent files, BEP09 metadata fetched = from peers, DHT messages, and tracker responses. A bencoded input of roughl=
y 150,000 nested lists (about 150 KB on the wire) drives multi-gigabyte pea=
k memory, so one short message from any peer, or one crafted .torrent file =
or magnet link, terminates the client.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57081" target=3D= "_blank" rel=3D"noopener">CVE-2026-57081</a></td>
</tr>

<td class=3D"vendor-product">SANKO--Net::BitTorrent</td>
<td>Net::BitTorrent versions through 2.0.1 for Perl generate the MSE Diffie= -Hellman private key with a non-cryptographic PRNG. The MSE (Message Stream=
Encryption) handshake derives its 160-bit Diffie-Hellman private key from = Perl's rand(), a non-cryptographic drand48-class generator seeded once per = process, in KeyExchange.pm. The shared secret and the RC4 keys derived from=
it (the SHA-1 of "keyA" or "keyB", the shared secret, and the infohash) th= erefore depend entirely on a predictable PRNG. The same handshake sends, in=
cleartext, random padding drawn from the same rand() sequence in _random_p= ad, immediately after the public key and the private-key draw. A passive ob= server of the handshake recovers the PRNG state from the cleartext padding,=
reconstructs the private key, computes the shared secret from the peer's p= ublic key on the wire, derives the RC4 keys, and decrypts the connection, d= efeating the passive-observation obfuscation MSE provides.</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57082" target=3D= "_blank" rel=3D"noopener">CVE-2026-57082</a></td>
</tr>

<td class=3D"vendor-product">Seiko Solutions Inc.--SkyBridge MB-A100/MB-A11= 0</td>
<td>Improper neutralization of special elements used in an OS command ('OS = Command Injection') issue exists in SkyBridge MB-A100/MB-A110. If this vuln= erability is exploited, an arbitrary OS command may be executed by an attac= ker who can log in to the product with an administrative privilege.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50043" target=3D= "_blank" rel=3D"noopener">CVE-2026-50043</a></td>
</tr>

<td class=3D"vendor-product">Squidex--CMS v.7.21.0</td>
<td>Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.= 21.0 and before allows a remote attacker to escalate privileges via the Ide= ntityServer account profile endpoint</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-31016" target=3D= "_blank" rel=3D"noopener">CVE-2026-31016</a></td>
</tr>

<td class=3D"vendor-product">SUSE--Rancher</td>
<td>Improper privilege handling could be used by users with=C2=A0Project Ow= ner role to escalate privileges, in Rancher versions=C2=A02.14 before 2.14.= 2,=C2=A02.13 before 2.13.6, and=C2=A02.12 before 2.12.10.</td> <td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41052" target=3D= "_blank" rel=3D"noopener">CVE-2026-41052</a></td>
</tr>

<td class=3D"vendor-product">SUSE--Rancher</td>
<td>A SAML authentication replay vulnerability in Rancher's Assertion Consu= mer Service (ACS) handler did not enforce one-time use of SAML assertion, p= otentially allowing person in the middle attacks against Rancher, affecting=
Rancher 2.14.0 before 2.14.3,</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44946" target=3D= "_blank" rel=3D"noopener">CVE-2026-44946</a></td>
</tr>

<td class=3D"vendor-product">SUSE--Rancher</td>
<td>A missing clean-up in the legacy Project Role Template Binding (PRTB) r= econciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 a= llowed users to retain unauthorized Pod Security Admission (PSA) permission=
s after an administrator removes those permissions from a RoleTemplate.</td=

<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44947" target=3D= "_blank" rel=3D"noopener">CVE-2026-44947</a></td>
</tr>

<td class=3D"vendor-product">SUSE--Rancher</td>
<td>A path traversal vulnerability was found in Fleet's ImageScan subsystem=
in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to = 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the int= ended directory, causing a denial of service.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44948" target=3D= "_blank" rel=3D"noopener">CVE-2026-44948</a></td>
</tr>

<td class=3D"vendor-product">SUSE--Rancher</td>
<td>A Rancher FleetWorkspace admission path allowed side effects to occur i=
n the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to = 0.8.7, 0.9.0 up to 0.9.6 and 0.10.0 up to 0.10.7. An unauthenticated attack=
er with network access to the in-cluster rancher-webhook service could subm=
it a crafted admission payload and cause workspace-related Kubernetes objec=
ts to be created with attacker-chosen identity data.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44949" target=3D= "_blank" rel=3D"noopener">CVE-2026-44949</a></td>
</tr>

<td class=3D"vendor-product">swaldman--c3p0</td>
<td>c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0,=
c3p0 in combination with other libraries, can compose to a "sink" for dese= rialization gadgets. The JDBC spec's DataSource.getConnection() and Connect= ionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBea=
n libraries treat them as "properties" assumed safe while they actually cal=
l into JDBC drivers. Attackers can thus craft malicious DataSource objects = whose property lookups invoke vulnerable drivers, then smuggle them in seri= alized form to where an application deserializes and auto-resolves bean pro= perties - triggering the attack. This requires a susceptible DataSource/Con= nectionPoolDataSource and JDBC driver on the CLASSPATH, plus a carrier that=
auto-looks-up JavaBean properties on =3D deserialization, most commonly a = collection paired with an Apache commons-beanutils Comparator that sorts by=
bean properties. c3p0 supplied that susceptible DataSource/ConnectionPoolD= ataSource, which was an essential component of the trigger. This issue has = been fixed in version 0.14.0.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55223" target=3D= "_blank" rel=3D"noopener">CVE-2026-55223</a></td>
</tr>

<td class=3D"vendor-product">Tenda--AC18 v15.03.05.05</td>
<td>An unauthenticated command injection vulnerability in the /goform/fast_= setting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attackers t=
o execute arbitrary commands via a crafted payload injected into the mac pa= rameter.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-38142" target=3D= "_blank" rel=3D"noopener">CVE-2026-38142</a></td>
</tr>

<td class=3D"vendor-product">The Wikimedia Foundation--Mediawiki - Cargo Ex= tension</td>
<td>Improper neutralization of special elements used in an SQL command ('SQ=
L injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo E= xtension allows SQL Injection. This issue affects Mediawiki - Cargo Extensi= on: from * before 1.43.9,1.44.6,1.45.4.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14363" target=3D= "_blank" rel=3D"noopener">CVE-2026-14363</a></td>
</tr>

<td class=3D"vendor-product">The Wikimedia Foundation--Mediawiki - Cargo Ex= tension</td>
<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo E= xtension allows Stored XSS. This issue affects Mediawiki - Cargo Extension:=
from * before 3.9.1.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58519" target=3D= "_blank" rel=3D"noopener">CVE-2026-58519</a></td>
</tr>

<td class=3D"vendor-product">The Wikimedia Foundation--Mediawiki - Cargo Ex= tension</td>
<td>Improper neutralization of special elements used in an SQL command ('SQ=
L injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo E= xtension allows SQL Injection. This issue affects Mediawiki - Cargo Extensi= on: from * before 1.43.9,1.44.6,1.45.4.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58521" target=3D= "_blank" rel=3D"noopener">CVE-2026-58521</a></td>
</tr>

<td class=3D"vendor-product">The Wikimedia Foundation--Mediawiki - Charts E= xtension</td>
<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts = Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki -=
Charts Extension: from * before 1.43.9,1.44.6,1.45.4.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14358" target=3D= "_blank" rel=3D"noopener">CVE-2026-14358</a></td>
</tr>

<td class=3D"vendor-product">The Wikimedia Foundation--Mediawiki - Redirect= Manager Extension</td>
<td>Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Founda= tion Mediawiki - RedirectManager Extension allows Cross Site Request Forger=
y. This issue affects Mediawiki - RedirectManager Extension: from * before = 1.3.3.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58518" target=3D= "_blank" rel=3D"noopener">CVE-2026-58518</a></td>
</tr>

<td class=3D"vendor-product">The Wikimedia Foundation--Mediawiki - UrlShort= ener Extension</td>
<td>URL redirection to untrusted site ('open redirect') vulnerability in Th=
e Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site=
Flashing. This issue affects Mediawiki - UrlShortener Extension: from * be= fore 1.43.9, 1.44.6, 1.45.4.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58520" target=3D= "_blank" rel=3D"noopener">CVE-2026-58520</a></td>
</tr>

<td class=3D"vendor-product">The Wikimedia Foundation--Mediawiki - WikiLamb=
da Extension</td>
<td>Improper neutralization of input terminators vulnerability in The Wikim= edia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypa= ss. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43= .9,1.44.6,1.45.4.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58517" target=3D= "_blank" rel=3D"noopener">CVE-2026-58517</a></td>
</tr>

<td class=3D"vendor-product">TIMLEGGE--Crypt::DSA</td>
<td>Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and=
private key from a biased random generator, leading to private-key recover=
y. "Crypt::DSA::Util::makerandom forces the high bit of every value it retu= rns to obtain an exactly N-bit integer for prime search. The signing nonce = and the private key are drawn from makerandom. Because the high bit is alwa=
ys set, the result is not uniform: its top bit is fixed, producing insecure=
values." An attacker who collects a modest number of signatures under an a= ffected key, together with the public key, can recover the private key with=
a lattice attack. Keys used to sign with an affected version should be con= sidered compromised and new keys should be generated.</td>
<td>2026-07-05</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14570" target=3D= "_blank" rel=3D"noopener">CVE-2026-14570</a></td>
</tr>

<td class=3D"vendor-product">tinacms--tinacms</td>
<td>Tina is a headless content management system. In versions prior to @tin= acms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a r= ich-text URL-sanitization bypass enable stored XSS and session takeover. Th=
e library registers window message listeners - the useTina overlay handler,=
the OAuth authentication popup handler, and the admin=C3=A2=E2=80=A0=E2=80= =9Dpreview iframe GraphQL reducer - that act on event.data without verifyin=
g event.origin or event.source and post messages using non-specific target = origins, while insufficient URL sanitization in rich-text content allows ma= licious URLs to persist and execute. A page the victim visits (or a window =
in an opener/iframe relationship with a Tina admin) can forge messages to d= rive the editor, inject preview content, or observe/forge the OAuth popup c= hannel to take over an authenticated editing session. This issue has been f= ixed in versions @tinacms/app 2.5.6 and tinacms 3.9.3.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55660" target=3D= "_blank" rel=3D"noopener">CVE-2026-55660</a></td>
</tr>

<td class=3D"vendor-product">tinacms--tinacms</td>
<td>Tina is a headless content management system. In versions prior to @tin= acms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/im= age renderers did not sanitize the url field on Slate link/image nodes. Con= tent containing javascript: or data:text/html URLs - including case-variant=
, whitespace-padded, and control-character-obfuscated forms - is rendered i= nto href/src and executes when the content is viewed. Any actor able to aut= hor rich-text content (for example a lower-privileged editor, or imported/e= xternal content) can achieve stored XSS against editors and site viewers. T= his issue is fixed in versions @tinacms/mdx 2.1.7 and tinacms 3.9.3.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55661" target=3D= "_blank" rel=3D"noopener">CVE-2026-55661</a></td>
</tr>

<td class=3D"vendor-product">TP-Link Systems Inc.--Archer AX20 V2.0</td>
<td>An unauthenticated URL redirection vulnerability has been identified in=
Archer AX20 V2 due to improper validation of user-supplied URL input withi=
n the web interface.=C2=A0 An unauthenticated attacker can craft URLs conta= ining URL-encoded path traversal sequences. When processed by the embedded = web server, these inputs may cause the device to respond with HTTP 3xx redi= rects to attacker-controlled external domains. This issue affects Archer AX=
20 V2.0: through 2.1.9 Build 20230829.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10562" target=3D= "_blank" rel=3D"noopener">CVE-2026-10562</a></td>
</tr>

<td class=3D"vendor-product">TP-Link Systems Inc.--Archer C5 v6.8</td>
<td>A stored Cross-Site Scripting (XSS) vulnerability has been identified i=
n the web-based management interface of Archer C5 v6.8 routers, due to insu= fficient server-side validation and lack of proper output encoding of user-= controlled input in a certain field.=C2=A0 An attacker with administrative = privileges can inject crafted HTML or JS payloads into the affected field. = The payload is stored and later executed when the affected page is rendered=
in an administrator's browser.Successful exploitation allows execution of = arbitrary JavaScript in an admin's browser, potentially leading to session = hijacking and unauthorized access to router configuration, possibly resulti=
ng in exposure of sensitive data and modification of device settings. The v= ulnerability affects ISP-managed firmware variants of the product. Remediat= ion is coordinated through service providers.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8699" target=3D"= _blank" rel=3D"noopener">CVE-2026-8699</a></td>
</tr>

<td class=3D"vendor-product">TP-Link Systems Inc.--TL-WR841N v14</td>
<td>An authenticated stack-based buffer overflow vulnerability exists in th=
e web management interface of TP-Link TL-WR841N v14. A remote authenticated=
attacker can send crafted HTTP requests to cause the embedded web server t=
o overflow a stack buffer, resulting in a crash of the affected process. Su= ccessful exploitation results in a denial-of-service condition, causing the=
device to crash and automatically reboot.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9105" target=3D"= _blank" rel=3D"noopener">CVE-2026-9105</a></td>
</tr>

<td class=3D"vendor-product">TPODER--Net::IP::LPM</td>
<td>Net::IP::LPM versions through 1.10 for Perl allow a heap out-of-bounds = read via an unbounded prefix length. add() passes the prefix string to the = trie builder addPrefixToTrie() without checking it against the address widt=
h. addPrefixToTrie() then walks the prefix buffer by prefix_length bits, re= ading prefix[byte] for byte up to prefix_len/8, where prefix is the 4-byte = (IPv4) or 16-byte (IPv6) packed address. A prefix length greater than 32 fo=
r IPv4 or 128 for IPv6, for example add("1.2.3.4/255", $v) or add("2001:db8= ::/255", $v), reads past the end of the packed address. The out-of-bounds r= ead happens during trie construction and is bounded: the prefix length is s= tored as an unsigned char, so the bit walk reads at most 32 bytes from the = start of the packed address, a short distance past the end of the 4-byte or=
16-byte buffer. It is detectable under AddressSanitizer, valgrind, or a ha= rdened allocator, where it can abort the process. Lookups and dump() format=
only the valid address width, so the out-of-bounds bytes are not exposed t= hrough the module's API.</td>
<td>2026-07-03</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56015" target=3D= "_blank" rel=3D"noopener">CVE-2026-56015</a></td>
</tr>

<td class=3D"vendor-product">TS7Worker--TS7Worker</td>
<td>A heap buffer overflow in the TS7Worker::PerformFunctionWrite() functio=
n (/core/s7_server.cpp) of snap7 v1.4.3 allows attackers to cause a Denial =
of Service (DoS) via a crafted packet.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-51218" target=3D= "_blank" rel=3D"noopener">CVE-2026-51218</a></td>
</tr>

<td class=3D"vendor-product">u5CMS--u5CMS</td> <td>u5CMS=C2=A0through=C2=A0v12.8.8 is vulnerable to reflected XSS via the = 'thanks' parameter in multiple form components</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14449" target=3D= "_blank" rel=3D"noopener">CVE-2026-14449</a></td>
</tr>

<td class=3D"vendor-product">Unknown--Adminify</td>
<td>The Adminify WordPress plugin before 4.2.10 does not perform per-user r= ead-capability checks on the results returned by one of its administration = search features, allowing users with a low-privilege role (Contributor) to = disclose non-public content that WordPress would not otherwise expose to th= em, such as other authors' unpublished post titles, pending comment content=
, the site's Adminify WordPress plugin before 4.2.10 inventory, and user ac= count names.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11781" target=3D= "_blank" rel=3D"noopener">CVE-2026-11781</a></td>
</tr>

<td class=3D"vendor-product">Unknown--Advanced Form Integration Connect For=
ms to 200+ Apps</td>
<td>The Advanced Form Integration - Connect Forms to 200+ Apps WordPress pl= ugin before 2.1.1 does not restrict the WordPress role assigned when it cre= ates a user from a public form submission, allowing unauthenticated visitor=
s to create an administrator account when an active integration maps the us=
er role to a public form field. This requires a specific, non-default multi= -Advanced Form Integration - Connect Forms to 200+ Apps WordPress plugin be= fore 2.1.1 configuration.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11794" target=3D= "_blank" rel=3D"noopener">CVE-2026-11794</a></td>
</tr>

<td class=3D"vendor-product">Unknown--APCu Manager</td>
<td>The APCu Manager WordPress plugin before 4.5.0 does not escape APCu obj= ect-cache keys before rendering them in an admin-area page, leading to a St= ored Cross-Site Scripting vulnerability. When a persistent object cache is = enabled, cache keys derived from unsanitised user input (e.g. a transient n= ame created by another APCu Manager WordPress plugin before 4.5.0 from an u= nauthenticated request) are output without escaping and execute arbitrary J= avaScript in the session of an administrator viewing the page.</td> <td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10083" target=3D= "_blank" rel=3D"noopener">CVE-2026-10083</a></td>
</tr>

<td class=3D"vendor-product">Unknown--F4 Post Tree</td>
<td>The F4 Post Tree WordPress plugin before 2.0.5 does not perform capabil= ity checks or CSRF/nonce verification on one of its AJAX actions, allowing = authenticated users with Subscriber-level access and above to modify the pa= rent and menu order of arbitrary posts.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9676" target=3D"= _blank" rel=3D"noopener">CVE-2026-9676</a></td>
</tr>

<td class=3D"vendor-product">Unknown--Fluent Booking</td>
<td>The Fluent Booking WordPress plugin before 2.1.2 does not verify owners= hip of the requested group_id before exporting attendee data via the export=
endpoint, allowing users with at least the Calendar Manager role to retrie=
ve attendees' PII (name, email, phone, address, payment information) from c= alendar groups they do not own.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9576" target=3D"= _blank" rel=3D"noopener">CVE-2026-9576</a></td>
</tr>

<td class=3D"vendor-product">Unknown--Fluent Forms</td>
<td>The Fluent Forms WordPress plugin before 6.2.5 does not properly restri=
ct the deletion of form submission entries to the forms a restricted Manage=
r is authorized to manage, allowing a Manager limited to specific forms to = permanently delete submission entries belonging to other forms. This requir=
es a non-default configuration in which an administrator has created at lea=
st one Manager restricted to specific forms.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11578" target=3D= "_blank" rel=3D"noopener">CVE-2026-11578</a></td>
</tr>

<td class=3D"vendor-product">Unknown--Fluent Forms</td>
<td>The Fluent Forms WordPress plugin before 6.2.1 does not properly verify=
ownership before processing a subscription cancellation request, allowing = authenticated users with a low-privilege account to cancel subscriptions be= longing to other users.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11880" target=3D= "_blank" rel=3D"noopener">CVE-2026-11880</a></td>
</tr>

<td class=3D"vendor-product">Unknown--Kali Forms Contact Form &amp; Drag-an= d-Drop Builder</td>
<td>The Kali Forms - Contact Form &amp; Drag-and-Drop Builder WordPress plu= gin before 2.4.13 does not sanitise a form field's caption before outputtin=
g it as a column header on the administrator form-entries screen, allowing = users with Contributor-level access or above to store JavaScript that execu= tes in an administrator's session. A missing capability check in the Kali F= orms - Contact Form &amp; Drag-and-Drop Builder WordPress plugin before 2.4= .13's post-duplication action additionally lets the Contributor publish the=
malicious form so an administrator renders it.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11581" target=3D= "_blank" rel=3D"noopener">CVE-2026-11581</a></td>
</tr>

<td class=3D"vendor-product">Unknown--Product Configurator for WooCommerce<=

<td>The Product Configurator for WooCommerce WordPress plugin before 1.7.3 = does not perform any authorisation or post-status check before returning Wo= oCommerce product data through a public AJAX action, allowing unauthenticat=
ed users to retrieve the data (title, price, weight, stock status, and conf= igurator option pricing/SKUs) of private and draft, non-public products by = supplying the product ID. WordPress post-visibility controls are bypassed.<=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11568" target=3D= "_blank" rel=3D"noopener">CVE-2026-11568</a></td>
</tr>

<td class=3D"vendor-product">Unknown--Royal MCP</td>
<td>The Royal MCP WordPress plugin before 1.4.26 does not perform capabilit=
y checks on the majority of its MCP tools after token authentication, allow= ing authenticated users with a low-privileged role such as Subscriber to re=
ad private content, enumerate all users and their roles, and create, modify=
, or delete content owned by other users.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10750" target=3D= "_blank" rel=3D"noopener">CVE-2026-10750</a></td>
</tr>

<td class=3D"vendor-product">Unknown--Salon Booking System</td>
<td>The Salon Booking System WordPress plugin before 10.30.20 does not have=
proper authorisation checks on one of its AJAX actions, allowing any authe= nticated user, such as a subscriber, to modify a Salon Booking System WordP= ress plugin before 10.30.20 setting and bypass the manual approval of new b= ookings.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11887" target=3D= "_blank" rel=3D"noopener">CVE-2026-11887</a></td>
</tr>

<td class=3D"vendor-product">Unknown--User Registration &amp; Membership</t=

<td>The User Registration &amp; Membership WordPress plugin before 5.2.0 do=
es not enforce payment completion before activating a paid membership subsc= ription, allowing unauthenticated users (after self-registering an account = through the open registration flow) to obtain an active subscription on any=
paid plan without paying and access the gated content.</td> <td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11965" target=3D= "_blank" rel=3D"noopener">CVE-2026-11965</a></td>
</tr>

<td class=3D"vendor-product">Unknown--User Submitted Posts</td>
<td>The User Submitted Posts WordPress plugin before 20260608 does not esca=
pe a submitted value before outputting it in an admin-configured display te= mplate, leading to a Stored Cross-Site Scripting that can be triggered by u= nauthenticated users when a non-default display option is enabled.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11570" target=3D= "_blank" rel=3D"noopener">CVE-2026-11570</a></td>
</tr>

<td class=3D"vendor-product">Unknown--WebAuthn Provider for Two Factor</td> <td>The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does=
not correctly validate the second-factor authentication response, allowing=
an attacker who already knows a user's password to bypass the two-factor a= uthentication requirement by submitting a malformed request.</td> <td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11883" target=3D= "_blank" rel=3D"noopener">CVE-2026-11883</a></td>
</tr>

<td class=3D"vendor-product">Unknown--WP Support Plus Responsive Ticket Sys= tem</td>
<td>The WP Support Plus Responsive Ticket System WordPress plugin through 9= .1.2 does not properly validate uploaded files, allowing unauthenticated us= ers to upload files containing malicious JavaScript (such as HTML or SVG) t=
o a publicly accessible location, leading to Stored Cross-Site Scripting at= tacks against site users and administrators.</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11589" target=3D= "_blank" rel=3D"noopener">CVE-2026-11589</a></td>
</tr>

<td class=3D"vendor-product">Unknown--WP Support Plus Responsive Ticket Sys= tem</td>
<td>The WP Support Plus Responsive Ticket System WordPress plugin through 9= .1.2 does not sanitize user-supplied array keys before using them in a SQL = statement, allowing unauthenticated users to perform SQL injection attacks.= </td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11590" target=3D= "_blank" rel=3D"noopener">CVE-2026-11590</a></td>
</tr>

<td class=3D"vendor-product">Unknown--WS Form LITE</td>
<td>The WS Form LITE WordPress plugin before 1.11.8 does not have a capabil= ity check on one of its settings-update actions, allowing authenticated use=
rs with subscriber-level access and above to modify the WS Form LITE WordPr= ess plugin before 1.11.8's settings.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11562" target=3D= "_blank" rel=3D"noopener">CVE-2026-11562</a></td>
</tr>

<td class=3D"vendor-product">Unknown--yootheme</td>
<td>The yootheme WordPress theme before 5.0.35 does not prevent its bundled=
front-end framework from treating certain HTML attributes, which are permi= tted by wp_kses_post(), as markup, allowing users with the Author role to p= erform Stored Cross-Site Scripting attacks that execute in the browser of a=
ny user who views the affected post.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10077" target=3D= "_blank" rel=3D"noopener">CVE-2026-10077</a></td>
</tr>

<td class=3D"vendor-product">UTT--nv518G</td>
<td>SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 = allows a remote attacker to execute arbitrary code via the gohead/sub_463bb=
c component</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52186" target=3D= "_blank" rel=3D"noopener">CVE-2026-52186</a></td>
</tr>

<td class=3D"vendor-product">UTT--nv518G</td>
<td>Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-16131=
3 allows a remote attacker to cause a denial of service via the gohead/sub_= 483ba0 component</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52187" target=3D= "_blank" rel=3D"noopener">CVE-2026-52187</a></td>
</tr>

<td class=3D"vendor-product">UTT--nv518G</td>
<td>Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-16131=
3 allows a remote attacker to cause a denial of service via the gohead//sub= _497498 component</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52188" target=3D= "_blank" rel=3D"noopener">CVE-2026-52188</a></td>
</tr>

<td class=3D"vendor-product">UTT--nv518G</td>
<td>Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-16131=
3 allows a remote attacker to cause a denial of service via the gohead/sub_= 487330 component</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52189" target=3D= "_blank" rel=3D"noopener">CVE-2026-52189</a></td>
</tr>

<td class=3D"vendor-product">UTT--nv518G</td>
<td>Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-16131=
3 allows a remote attacker to cause a denial of service via the gohead/sub_= 448384 component</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52190" target=3D= "_blank" rel=3D"noopener">CVE-2026-52190</a></td>
</tr>

<td class=3D"vendor-product">UTT--nv518G</td>
<td>Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-16131=
3 allows a remote attacker to cause a denial of service via the gohead/sub_= 444C8C component</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52191" target=3D= "_blank" rel=3D"noopener">CVE-2026-52191</a></td>
</tr>

<td class=3D"vendor-product">UTT--nv518G</td>
<td>An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote att= acker to cause a denial of service via the gohead/sub_445C5C component</td> <td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52192" target=3D= "_blank" rel=3D"noopener">CVE-2026-52192</a></td>
</tr>

<td class=3D"vendor-product">UTT--nv518G</td>
<td>Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-16131=
3 allows a remote attacker to cause a denial of service via the gohead/sub_= 447CAC component</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52193" target=3D= "_blank" rel=3D"noopener">CVE-2026-52193</a></td>
</tr>

<td class=3D"vendor-product">UTT--nv518G</td>
<td>Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-16131=
3 allows a remote attacker to cause a denial of service via the gohead/sub_= 472f08 component</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52195" target=3D= "_blank" rel=3D"noopener">CVE-2026-52195</a></td>
</tr>

<td class=3D"vendor-product">UTT--nv518G</td>
<td>Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-16131=
3 allows a remote attacker to cause a denial of service via the gohead/sub_= 416f28 component</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52196" target=3D= "_blank" rel=3D"noopener">CVE-2026-52196</a></td>
</tr>

<td class=3D"vendor-product">UTT--nv518G</td>
<td>An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote att= acker to cause a denial of service via the gohead/sub_44af70 component</td> <td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52197" target=3D= "_blank" rel=3D"noopener">CVE-2026-52197</a></td>
</tr>

<td class=3D"vendor-product">UTT--nv518G</td>
<td>Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-16131=
3 allows a remote attacker to cause a denial of service via the gohead/sub_= 425994 component</td>
<td>2026-06-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52198" target=3D= "_blank" rel=3D"noopener">CVE-2026-52198</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd=
process could allow an authenticated privileged user to execute arbitrary = code via a specially crafted requests to the Management Web UI.This vulnera= bility affects Fireware OS 11.8 up to and including=C2=A011.12.4_Update1, 1= 2.0 up to and including 12.12 and 2025.1 up to and including 2026.2.</td> <td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13050" target=3D= "_blank" rel=3D"noopener">CVE-2026-13050</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI co= uld allow an authenticated privileged user to execute arbitrary code via a = specially crafted CLI command. This vulnerability affects Fireware OS 11.0 =
up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 202= 5.1 up to and including 2026.2.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13053" target=3D= "_blank" rel=3D"noopener">CVE-2026-13053</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>A path traversal vulnerability in the WatchGuard Fireware OS Management=
Web UI allows a privileged authenticated attacker to write arbitrary files=
on the Firebox's filesystem. This vulnerability affects Fireware OS 11.0 u=
p to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025=
.1 up to and including 2026.2.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13054" target=3D= "_blank" rel=3D"noopener">CVE-2026-13054</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>A local privilege escalation vulnerability in the WatchGuard Mobile VPN=
with SSL client for Windows allows a local attacker to escalate their priv= ileges to NT AUTHORITY\SYSTEM on the machine where the client is installed.=
This issue affects the Mobile VPN with SSL client for Windows up to and in= cluding 2026.2.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13079" target=3D= "_blank" rel=3D"noopener">CVE-2026-13079</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>A null pointer dereference vulnerability in WatchGuard Fireware OS may = allow a remote unauthenticated attacker to create a denial-of-service (DoS)=
condition by sending specially crafted IKEv2 messages.=C2=A0This vulnerabi= lity affects both the Mobile User VPN with IKEv2 and the Branch Office VPN = using IKEv2 when configured with a dynamic gateway peer. This vulnerability=
affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up t=
o and including 12.12 and 2025.1 up to and including 2026.2</td> <td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13084" target=3D= "_blank" rel=3D"noopener">CVE-2026-13084</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>WatchGuard Fireware OS contains a race condition leading to a use-after= -free vulnerability in LDAP authentication for the Mobile User VPN with IKE= v2. A remote unauthenticated attacker could exploit this vulnerability to e= xecute arbitrary code in the context of the iked process on Fireboxes that = have a Mobile VPN with IKEv2 configured to use an external LDAP authenticat= ion server. This vulnerability affects Fireware OS 11.0 up to and including=
11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and inclu= ding 2026.2.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13368" target=3D= "_blank" rel=3D"noopener">CVE-2026-13368</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>An authenticated administrator can trigger a denial-of-service conditio=
n in the Fireware Management Web UI by sending malformed or crafted data to=
the put_data endpoint, which performs unsafe deserialization of the attack= er-supplied input.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13371" target=3D= "_blank" rel=3D"noopener">CVE-2026-13371</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>Improper Neutralization of Input During Web Page Generation (XSS or 'Cr= oss-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Tech= nology Integration module) allows Stored XSS. This vulnerability is an addi= tional unmitigated attack path for CVE-2025-13936. This issue affects Firew= are OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, an=
d 2025.1 up to and including 2026.2.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13373" target=3D= "_blank" rel=3D"noopener">CVE-2026-13373</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>Improper Neutralization of Input During Web Page Generation (XSS or 'Cr= oss-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise T= echnology Integration module) allows Stored XSS. This vulnerability is an a= dditional unmitigated attack path for CVE-2025-13937. This issue affects Fi= reware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18,=
and 2025.1 up to and including 2026.2.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13374" target=3D= "_blank" rel=3D"noopener">CVE-2026-13374</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>Improper Neutralization of Input During Web Page Generation (XSS or 'Cr= oss-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Tech= nology Integration module) allows Stored XSS. This vulnerability is an addi= tional unmitigated attack path for CVE-2025-13938. This issue affects Firew= are OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, an=
d 2025.1 up to and including 2026.2.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13375" target=3D= "_blank" rel=3D"noopener">CVE-2026-13375</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>Improper Neutralization of Input During Web Page Generation (XSS or 'Cr= oss-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker mo= dule allows Stored XSS. This vulnerability is an additional unmitigated att= ack path for CVE-2025-1071. This issue affects Fireware OS 12.0 up to and i= ncluding 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and incl= uding 2026.2.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13376" target=3D= "_blank" rel=3D"noopener">CVE-2026-13376</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>Improper Neutralization of Input During Web Page Generation (XSS or 'Cr= oss-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy modu=
le allows Stored XSS. This vulnerability is an additional unmitigated attac=
k path for CVE-2025-6947. This issue affects Fireware OS 12.0 up to and inc= luding 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and includ= ing 2026.2.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13377" target=3D= "_blank" rel=3D"noopener">CVE-2026-13377</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd=
process could allow an authenticated privileged user to execute arbitrary = code via a specially crafted requests to the Management Web UI.This vulnera= bility affects Fireware OS 12.1 up to and including 12.12 and 2025.1 up to = and including 2026.2.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13383" target=3D= "_blank" rel=3D"noopener">CVE-2026-13383</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent = process could allow an authenticated privileged user to execute arbitrary c= ode via a specially crafted requests to the Management Web UI.This vulnerab= ility affects Fireware OS 12.1 up to and including 12.12 and 2025.1 up to a=
nd including 2026.2.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13384" target=3D= "_blank" rel=3D"noopener">CVE-2026-13384</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>WatchGuard Fireware OS contains a firmware validation bypass when proce= ssing a backup image via the backup/restore feature. An authenticated admin= istrator can exploit this vulnerability to install a tampered firmware imag= e.This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_U= pdate1, 12.0 up to and including 12.12 and 2025.1 up to and including 2025.= 6.2.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13722" target=3D= "_blank" rel=3D"noopener">CVE-2026-13722</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>In exception circumstances, WatchGuard Fireware OS on a FireCluster may=
use a hard-coded encryption key to encrypt saved credentials for Access Po= rtal resources. This vulnerability affects Fireware OS 12.1 up to and inclu= ding 12.12 and 2025.1 up to and including 2026.2. This vulnerability does n=
ot affect devices that do not support the Access Portal feature or standalo=
ne Fireboxes not deployed in a FireCluster.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13728" target=3D= "_blank" rel=3D"noopener">CVE-2026-13728</a></td>
</tr>

<td class=3D"vendor-product">WatchGuard--Fireware OS</td>
<td>An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allo=
w an unauthenticated attacker on the same local network segment to execute = arbitrary code. This vulnerability affects Fireware OS 11.0 up to and inclu= ding 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and i= ncluding 2026.2.</td>
<td>2026-07-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8247" target=3D"= _blank" rel=3D"noopener">CVE-2026-8247</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--AbuseFilter</td> <td>Exposure of Sensitive Information to an Unauthorized Actor vulnerabilit=
y in Wikimedia Foundation AbuseFilter. This vulnerability is associated wit=
h program files includes/Api/QueryAbuseFilters.Php. This issue affects Abus= eFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58027" target=3D= "_blank" rel=3D"noopener">CVE-2026-58027</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--CheckUser</td>
<td>Improper Neutralization of Input During Web Page Generation (XSS or 'Cr= oss-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This = vulnerability is associated with program files modules/ext.CheckUser.TempAc= counts/components/blockConnectedTempAccountsField.Vue. This issue affects C= heckUser: from 1.46.0-rc.0 before 1.46.0.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58034" target=3D= "_blank" rel=3D"noopener">CVE-2026-58034</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--MediaWiki</td>
<td>Exposure of Sensitive Information to an Unauthorized Actor vulnerabilit=
y in Wikimedia Foundation MediaWiki. This vulnerability is associated with = program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki:=
from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58024" target=3D= "_blank" rel=3D"noopener">CVE-2026-58024</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--MediaWiki</td> <td>Deserialization of untrusted data vulnerability in Wikimedia Foundation=
MediaWiki. This vulnerability is associated with program files includes/Im= port/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/L= ogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4=
, 1.44.6, 1.43.9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58025" target=3D= "_blank" rel=3D"noopener">CVE-2026-58025</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--MediaWiki</td>
<td>Exposure of Sensitive Information to an Unauthorized Actor vulnerabilit=
y in Wikimedia Foundation MediaWiki. This vulnerability is associated with = program files includes/Parser/Parser.Php. This issue affects MediaWiki: fro=
m * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58026" target=3D= "_blank" rel=3D"noopener">CVE-2026-58026</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--MediaWiki</td>
<td>Improper Neutralization of Input During Web Page Generation (XSS or 'Cr= oss-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikim= edia Foundation CentralAuth. This vulnerability is associated with program = files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/Re= sourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php=
, includes/LogFormatter/PermissionChangeLogFormatter.Php. This issue affect=
s MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: fro=
m * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58028" target=3D= "_blank" rel=3D"noopener">CVE-2026-58028</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--MediaWiki</td> <td>Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is = associated with program files includes/Api/ApiChangeAuthenticationData.Php,=
includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.= Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUn= linkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.=
4, 1.44.6, 1.43.9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58029" target=3D= "_blank" rel=3D"noopener">CVE-2026-58029</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--MediaWiki</td>
<td>Improper Neutralization of Input During Web Page Generation (XSS or 'Cr= oss-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This = vulnerability is associated with program files resources/src/mediawiki.Spec= ial.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46= .0-rc.0 before 1.46.0.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58031" target=3D= "_blank" rel=3D"noopener">CVE-2026-58031</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--MediaWiki</td>
<td>Improper Neutralization of Input During Web Page Generation (XSS or 'Cr= oss-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This = vulnerability is associated with program files resources/src/mediawiki.Api/= index.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.=
6, 1.43.9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58032" target=3D= "_blank" rel=3D"noopener">CVE-2026-58032</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--MediaWiki</td>
<td>Exposure of Sensitive Information to an Unauthorized Actor vulnerabilit=
y in Wikimedia Foundation MediaWiki. This vulnerability is associated with = program files includes/Actions/InfoAction.Php. This issue affects MediaWiki=
: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58033" target=3D= "_blank" rel=3D"noopener">CVE-2026-58033</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--MediaWiki</td>
<td>Improper Neutralization of Input During Web Page Generation (XSS or 'Cr= oss-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This = vulnerability is associated with program files resources/src/mediawiki.Spec= ial.Block/SpecialBlock.Vue.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58035" target=3D= "_blank" rel=3D"noopener">CVE-2026-58035</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--MediaWiki</td>
<td>Exposure of Sensitive Information to an Unauthorized Actor vulnerabilit=
y in Wikimedia Foundation MediaWiki. This vulnerability is associated with = program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers= .Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupMa= nager.Php.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58036" target=3D= "_blank" rel=3D"noopener">CVE-2026-58036</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--MediaWiki</td>
<td>Improper Neutralization of Input During Web Page Generation (XSS or 'Cr= oss-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This = vulnerability is associated with program files includes/Language/Language.P= hp, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.P= hp, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLog= Formatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/Spec= ialVersion.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4,=
1.44.6, 1.43.9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58037" target=3D= "_blank" rel=3D"noopener">CVE-2026-58037</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--OAuth</td>
<td>Session fixation vulnerability in Wikimedia Foundation OAuth. This vuln= erability is associated with program files src/Backend/MWOAuthServer.Php. T= his issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.</td=

<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13707" target=3D= "_blank" rel=3D"noopener">CVE-2026-13707</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--SyntaxHighlight_GeSHi</t=

<td>Improper Neutralization of Input During Web Page Generation (XSS or 'Cr= oss-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_= GeSHi. This vulnerability is associated with program files includes/SyntaxH= ighlight.Php. This issue affects SyntaxHighlight_GeSHi: from * before 1.46.=
0, 1.45.4, 1.44.6, 1.43.9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58030" target=3D= "_blank" rel=3D"noopener">CVE-2026-58030</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--timeline</td>
<td>Improper Neutralization of Input During Web Page Generation (XSS or 'Cr= oss-site Scripting') vulnerability in Wikimedia Foundation timeline. This v= ulnerability is associated with program files includes/Timeline.Php, script= s/EasyTimeline.Pl. This issue affects timeline: from * before 1.46.0, 1.45.=
4, 1.44.6, 1.43.9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58038" target=3D= "_blank" rel=3D"noopener">CVE-2026-58038</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--timeline</td>
<td>A vulnerability in Wikimedia Foundation timeline. This vulnerability is=
associated with program files scripts/EasyTimeline.Pl, includes/Timeline.P= hp. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43= .9.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8857" target=3D"= _blank" rel=3D"noopener">CVE-2026-8857</a></td>
</tr>

<td class=3D"vendor-product">Wikimedia Foundation--UrlShortener</td> <td>Improper input validation vulnerability in Wikimedia Foundation UrlShor= tener. This vulnerability is associated with program files includes/UrlShor= tenerUtils.Php.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13706" target=3D= "_blank" rel=3D"noopener">CVE-2026-13706</a></td>
</tr>

<td class=3D"vendor-product">xdan--jodit</td>
<td>Jodit Editor is a WYSIWYG editor with written in pure TypeScript file a=
nd image editing capabilities. In versions prior to 4.12.18, Jodit.configur= e(options) - and the internal ConfigMerge / ConfigProto helpers - merged us= er-supplied options into the editor configuration without filtering prototy= pe-mutating keys, potentially causing a Prototype Pollution vulnerability. =
A payload nested under an existing plain-object option such as controls cou=
ld reach and mutate Object.prototype. Applications that pass user-controlle=
d or partially user-controlled configuration into Jodit.configure() may be = vulnerable. This issue was fixed in version 4.12.18.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54756" target=3D= "_blank" rel=3D"noopener">CVE-2026-54756</a></td>
</tr>

<td class=3D"vendor-product">xdan--jodit</td>
<td>Jodit Editor is a WYSIWYG editor with written in pure TypeScript file a=
nd image editing capabilities. Versions prior to 4.12.26 are vulnerable to = Prototype Pollution through Jodit.modules.Helpers.set(chain, value, obj), w= hich walks the dot-separated chain, creating and following each path segmen=
t without filtering prototype-mutating keys. A chain that begins with (or c= ontains) __proto__, constructor, or prototype lets the final assignment rea=
ch and mutate Object.prototype. Applications that pass a user-controlled or=
partially user-controlled key path into Jodit.modules.Helpers.set() could =
be vulnerable, causing unexpected property injection, logic bypass, denial =
of service, or secondary security issues. This issue has been fixed in vers= ion 4.12.26.</td>
<td>2026-07-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55886" target=3D= "_blank" rel=3D"noopener">CVE-2026-55886</a></td>
</tr>

<td class=3D"vendor-product">xmlsoft--libxml2</td>
<td>libxml2 is vulnerable to multiple stack-based buffer overflows in the x= mlcatalog utility when running in --shell mode. The usershell() function pr= ocesses user input using fixed-size stack buffers without proper bounds che= cking. By supplying an overly long input line, an attacker can overflow int= ernal buffers (command, arg, and argv) during input parsing. This results i=
n memory corruption within the stack frame. Successful exploitation may cau=
se a crash or potentially allow arbitrary code execution in the context of = the xmlcatalog process. This issue has been fixed in the commit c2e233fc. N= OTE: The maintainers of this project did not agree that this issue is a vul= nerability and considered it a bug.</td>
<td>2026-06-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11979" target=3D= "_blank" rel=3D"noopener">CVE-2026-11979</a></td>
</tr>
</tbody>
</table>
<p><a href=3D"#top">Back to top</a></p>
</div>
</div>
</div>
<style>body {
font-size: 1em; font-family: Arial, Verdana, sans-serif; font-weight: norma=
l; font-style: normal; color: #333333;
}
</style>
=20


<div id=3D"mail_footer">
<p style=3D"text-align: center;"><span style=3D"font-size: 10.0pt; colo=
r: #757575;">Having trouble viewing this message?=C2=A0</span><a href=3D"ht= tps://content.govdelivery.com/accounts/USDHSCISA/bulletins/41f3c56" target= =3D"_blank" rel=3D"noopener">View it as a webpage</a>.=C2=A0<a href=3D"http= s://content.govdelivery.com/accounts/USDHS/bulletins/292141e" target=3D"_bl= ank" rel=3D"noopener"></a><span style=3D"font-size: 10.0pt; color: #757575;= "></span></p>
<p style=3D"text-align: center;"><span style=3D"font-size: 10.0pt; color: #= 757575;">You are subscribed to updates from the </span><a href=3D"https://w= ww.cisa.gov"><span style=3D"font-size: 10.0pt;">Cybersecurity and Infrastru= cture Security Agency</span></a><span style=3D"font-size: 10.0pt; color: #7= 57575;"> (CISA)<br></span><a href=3D"https://public.govdelivery.com/account= s/USDHSCISA/subscriber/edit?preferences=3Dtrue#tab1" target=3D"_blank" rel= =3D"noopener"><span style=3D"font-size: 10.0pt; color: #00568c;">Manage Sub= scriptions</span></a>=C2=A0=C2=A0<span style=3D"font-size: 10.0pt; color: #= 757575;">|=C2=A0=C2=A0</span><a href=3D"https://www.cisa.gov/privacy-policy=
" target=3D"_blank" rel=3D"noopener"><span style=3D"font-size: 10.0pt; colo=
r: #00568c;">Privacy Policy</span></a><span style=3D"font-size: 10.0pt; col= or: #757575;">=C2=A0=C2=A0|=C2=A0 <a href=3D"https://subscriberhelp.granicu= s.com/s/article/Subscriber-Help-Center" target=3D"_blank" rel=3D"noopener">= Help</a><a href=3D"https://insights.govdelivery.com/Communications/Subscrib= er_Help_Center" target=3D"_blank" rel=3D"noopener"></a></span><span style= =3D"font-size: 10.0pt; color: #757575;"></span></p>
<p style=3D"text-align: center;"><span style=3D"font-size: 10.0pt; color: #= 757575;">Connect with CISA: <br></span><a href=3D"https://www.facebook.com/= CISA" target=3D"_blank" rel=3D"noopener"><span style=3D"font-size: 10.0pt; = color: #00568c;">Facebook</span></a><span style=3D"font-size: 10.0pt; color=
: #757575;">=C2=A0 |=C2=A0 </span><a href=3D"https://twitter.com/CISAgov" t= arget=3D"_blank" rel=3D"noopener"><span style=3D"font-size: 10.0pt; color: = #00568c;">Twitter</span></a><span style=3D"font-size: 10.0pt; color: #75757= 5;">=C2=A0 |=C2=A0 </span><a href=3D"https://Instagram.com/cisagov" target= =3D"_blank" rel=3D"noopener"><span style=3D"font-size: 10.0pt; color: #0056= 8c;">Instagram</span></a><span style=3D"font-size: 10.0pt; color: #757575;"= >=C2=A0 |=C2=A0 </span><a href=3D"https://www.linkedin.com/company/cybersec= urity-and-infrastructure-security-agency" target=3D"_blank" rel=3D"noopener= "><span style=3D"font-size: 10.0pt; color: #00568c;">LinkedIn</span></a><sp=
an style=3D"font-size: 10.0pt; color: #757575;">=C2=A0 |=C2=A0=C2=A0 </span= ><a href=3D"https://www.youtube.com/channel/UCxyq9roe-npgzrVwbpoAy0A" targe= t=3D"_self"><span style=3D"font-size: 10.0pt; color: #00568c;">YouTube</spa= n></a><span style=3D"font-size: 10.0pt; color: #757575;"></span></p>

</div>
<div id=3D"tagline">
<hr>
<table style=3D"width: 100%;" border=3D"0" cellspacing=3D"0" cellpadding=3D=

<tbody>

<td style=3D"color: #757575; font-size: 10px; font-family: Arial;" width=3D= "89%">This email was sent to cisa@toolazy.synchro.net using Granicus Commun= ications Cloud, on behalf of: Cybersecurity and Infrastructure Security Age= ncy =C2=B7 707 17th St, Suite 4000 =C2=B7 Denver, CO 80202</td>
<td align=3D"right" width=3D"11%"><a href=3D"https://subscriberhelp.granicu= s.com/" target=3D"_blank" rel=3D"noopener"><img src=3D"https://content.govd= elivery.com/images/govd-logo-dark.png" border=3D"0" alt=3D"GovDelivery logo=
" width=3D"115"></a></td>
</tr>
</tbody>
</table>
<style type=3D"text/css">body .abe-column-block { min-height: 5px; } table.= gd_combo_table img {margin-left:10px; margin-right:10px;} table.gd_combo_ta= ble div.govd_image_display img, table.gd_combo_table td.gd_combo_image_cell=
img {margin-left:0px; margin-right:0px;}</style>

</div>
</td>
</tr>
</table>

<img alt=3D"" src=3D"https://links-2.govdelivery.com/CI0/0101019f38030735-d= 97ddd0a-b8bf-498f-8f95-529500f07811-000000/Qji0dN72Gaua1kgM4zKV3LTj-gPjEpgK= Vv8csXydGuQ=3D452" style=3D"display: none; width: 1px; height: 1px;">
</body>
</html>

--===============7983194463610718321==--

--===============1635925356315796311==--